last executing test programs: 7.479019479s ago: executing program 3 (id=114): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) syz_usb_connect(0x0, 0x24, 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000000)={0x58, 0x0, &(0x7f0000000200)=[@exit_looper, @release, @transaction={0x40406300, {0x3, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs], 0x0, 0x0, 0x0}) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r0, &(0x7f0000000000), 0x6) 6.943041212s ago: executing program 3 (id=120): r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000400)=ANY=[@ANYBLOB="30000000240005050000000000000000000000000100000000000100ffffffff"], 0x30}], 0x1, 0x0, 0x0, 0x8081}, 0x4080) 6.923881512s ago: executing program 3 (id=121): r0 = getpid() r1 = syz_pidfd_open(r0, 0x0) setns(r1, 0x8020000) r2 = syz_clone(0xb21e0000, 0x0, 0x0, 0x0, 0x0, 0x0) r3 = syz_pidfd_open(r2, 0x0) setns(r3, 0x24020000) ppoll(0x0, 0x0, 0x0, 0x0, 0x0) open_tree(0xffffffffffffff9c, &(0x7f0000000100)='\x00', 0x89901) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, 0x0) 5.581190234s ago: executing program 3 (id=123): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000c73d8a0870272091776c0102ef010902120001000000000904"], 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000740)={0x1c, &(0x7f0000000600)={0x40, 0xd}, 0x0, 0x0}) 4.902235322s ago: executing program 4 (id=127): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmmsg$inet(0xffffffffffffffff, &(0x7f00000007c0)=[{{0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f0000000440)="ff", 0x1}], 0x1}}], 0x1, 0x50) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000200000a20000000000a01040000000000000000020000000900010073797a300000000058000000120a01040000000000000000020000000900010073797a30000000000900020073797a30000000000800030000000004240004800c00010000000000000000010c0002"], 0xa0}}, 0x0) 4.902123062s ago: executing program 4 (id=128): syz_usb_connect(0x3, 0x3d, &(0x7f0000000240)=ANY=[@ANYBLOB="12010000bdce4208110f80106afc0000000109022b00010000000009043700022ee5cd0009058010ff037f790209050e0320000980070705ab0b78"], 0x0) r0 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) writev(r0, &(0x7f0000000500)=[{&(0x7f0000000980)="7d30b49391e881577a73d28638c07c266cc4014e1ab090df74679458676663a6d601894750bcdff43a2b1eec6b7705fcc13fc6b1345745cb41331217e32c04ad0f3fa6208283a6e22127c11817fab0c5accc30621bc71ff7ac8a0685133763129482f2551d2c5e16358c21b41f203579e8a1478f6b602bd55237c57881a20fb73b9caccfcef5d6f3e293e95a36872b7c972ead1850e51ff0640b2acef740d441b4bf772ea843eb5364411b7cae3afcbb9a3784d97bb62c7b439ea1d225a6118c703ff5d803567e3357c130238e007b836d46328531cb439f20b2b14b4253d43833b1f35e3f631e495ea46d4a37323e810864f099550a66e1d0d42f61b60e464c6b26dbb87f3159ba3be331bd74af78a0b4506d900d3e8da55df718b766d9681455003a5b519f633e512539d98bbdcf2efa0bc87b7ddf0651f2a5c23b5d7e97bfa7d696", 0x143}], 0x1) 4.499471121s ago: executing program 0 (id=131): r0 = socket$netlink(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETSETELEM(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB="2c0000000d0a010300000000000000000a0000010900020073797a3100000000090001"], 0x2c}, 0x1, 0x0, 0x0, 0x24000801}, 0x8000) sendmmsg(r0, &(0x7f00000002c0), 0x40000000000009f, 0x0) 4.499239941s ago: executing program 0 (id=132): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0xa, 0x8000000000002}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0xb, 0x6, 0xff}, 0x3a, [0x1, 0xc95a, 0xf, 0x8, 0x80, 0x8, 0x3, 0x10007e, 0x20000006, 0x53, 0x6, 0x10000, 0x80005, 0x3, 0xffff2d34, 0xffffff01, 0x6, 0x4, 0x10003, 0x5, 0x4, 0x2, 0x7, 0x3c5b, 0x80000001, 0x26, 0xd, 0x1, 0x6, 0x7, 0xe661, 0x7, 0x7, 0x6, 0x0, 0x4c74, 0x80000000, 0x0, 0x3, 0xe, 0x8, 0x800080ee, 0xa, 0x17, 0x1, 0x9, 0x200, 0x3e, 0x8c, 0x6, 0xca9, 0x0, 0x5, 0x4, 0x8, 0x400, 0x80, 0x10001, 0x5, 0x6, 0x6, 0x5, 0x1, 0x40], [0x10000007, 0xc, 0x80000130, 0x8004, 0x5, 0xfffffff3, 0x2, 0xc8, 0xf9, 0xe, 0xb, 0x6c7, 0x9, 0xfffffffc, 0x1000, 0x0, 0x0, 0x205, 0x442f, 0xe, 0x6, 0x78, 0x1, 0x0, 0x2, 0x7, 0x7fff, 0x6, 0x4402, 0x401, 0x6, 0x1, 0xfc, 0x6, 0x1000005, 0x5f31, 0xd, 0x40000101, 0x7, 0x4, 0xffff80f1, 0x8, 0x6, 0x8, 0x9, 0x6, 0x47, 0x8020, 0x1, 0xfe000000, 0xffff, 0xfffffe01, 0x4, 0x9, 0x3, 0x3, 0x9, 0x1, 0x3, 0x3, 0xbc45, 0x48c93694, 0x43, 0x9], [0x7, 0x9, 0x0, 0x5, 0xfffffffe, 0x100, 0x8d2, 0xb42a, 0x5, 0x7fff, 0x80000000, 0x5, 0xf, 0x4, 0x6, 0x805, 0x5, 0x8, 0x5, 0xffffffff, 0x86, 0x3, 0x303c, 0xbe7, 0xb, 0x1ff, 0x2, 0x2, 0x2, 0x20000008, 0x2, 0x6d03, 0x6, 0xd, 0x800006, 0x200, 0x1006a, 0x40000001, 0x4, 0x2950bfaf, 0x2, 0xa2, 0x7, 0xa9, 0x20000005, 0x6, 0xac8, 0xc2, 0x2, 0x3, 0x7ff, 0x12b, 0x4, 0x1, 0x6, 0x0, 0x2, 0x21c, 0x120000, 0x3, 0x0, 0x80aaed, 0x4, 0x24], [0x9, 0x40bb33, 0x9db, 0xb, 0x5, 0x93a, 0x9, 0x1000006, 0x100, 0xb9, 0xce7, 0x1ff, 0x2, 0x57, 0x4, 0x3, 0x101, 0x7ff, 0x7fff, 0x7fff, 0x1000, 0x7f, 0x2, 0x5, 0x1, 0x2, 0x14c, 0x60a7, 0x6, 0x96, 0xffffffff, 0x80000001, 0x7, 0x4, 0xc8, 0xfffffffd, 0xfffff000, 0x0, 0x3, 0x7e, 0x100, 0x1000, 0x7, 0x9, 0x8, 0x6, 0x226, 0x5, 0x5, 0x1, 0x30b1d69b, 0xa1f, 0xf40, 0x7, 0x1, 0x6c1b, 0x0, 0x4, 0x928, 0xb1e, 0xc7, 0x200, 0xffff2441, 0xfff]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000300)) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001040)={0x4c, 0x0, &(0x7f0000000ec0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x1000}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x4c, 0x0, &(0x7f0000000740)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40}], 0x0, 0x0, 0x0}) 4.498896891s ago: executing program 0 (id=133): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) setresuid(0x0, 0xee01, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) 4.435901753s ago: executing program 0 (id=134): r0 = socket$packet(0x11, 0x3, 0x300) socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000040)=0x14) bind$packet(r0, &(0x7f0000000000)={0x11, 0x0, r2, 0x1, 0x0, 0x6, @link_local}, 0x14) 4.435764253s ago: executing program 0 (id=135): r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) 3.237581051s ago: executing program 4 (id=140): mkdirat(0xffffffffffffff9c, 0x0, 0x140) r0 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) r2 = dup(r1) write$UHID_INPUT(r2, &(0x7f0000002080)={0xf, {"a2e3ad21ed0d09791b3d090987f70e06d038e7ff7fc6e5539b0d650e8b089b3f3b3168090890e0878f0e1ac6e7049b336d959b669a240d5b67f3988f7ef319520100ffe8d178708c523c921b1b5b31070d074a0936cd3b78130daa61d8e80400000c5802b77f07227227b7ba67e0e78657a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae193973735b36d5b1b63dd1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000000000075271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1f416e56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617669314e2fbe70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d546a40b9f6ff14ac488ec130fb3850a27ffff1243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9963ac4f4bb3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce7cd9f465e41e610c20d80421d653a5520000008213b704c7fb082ff27590678ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc946813591ad8deff4b05f60cea0da7710ac0000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4fb8a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f912ff01000021ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d4ac01b75d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2aed9e53803ed0ca4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4350aeae9ca1207e78283cd0b20ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034ef655b253ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f423500c7872c827467cfa5c4e72730d56bd068ed211cf847535edecb7bd50978b095b68441a34cb51682a8ae4d24ad0465f3927f889b813076038e79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdcce04579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93aec92a5de203717aa49c2d284acfabe262fccfcbb2b75a2183c46eb65ca8104e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43eaeb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e94265c803b35ee5f83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369dde50e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aae501b20f7694a00f16e2d0174035a2c22656dc29880acebdbe8ddbd75c2f998d8ac2dfad2ba3a504767b6b45a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40427db6fe29068c0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf46366e7205dd8d6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7c5419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e04454cf2e6864ae090d81eaee5ee6cf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3144345f48843dd015ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6d594f88a4facfd4c735a20307c737afa2d60399473296b831dbd933d93994ba3062479b10ea0c5833f41f157ea2302993dbe433b1aa3a3766d5439020484f4113c4c859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefdc01000094d02daee67918e5d6787463183b4b87c1050000002f7809959bc048850613d17ca51055f2f416a44fe180d2d50c312cca7cb14a2bdc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb42913777c06376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebc82d7f96093530e76692839d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7340002000000000000f288a4510de03dab19d26285eda89156d50dd385a60333ba5bbf5d77cd7007ad1519ad5470de3dd6d6a97406bb6b68a1f0c4549820a73c880f475f732ae00398e8bd1f4108b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf652f406c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6528341b648cdd56fed7cdcbb1575912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae033a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a3cd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08758897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb784ed7148b6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d3f458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b8081c128ad2706f48261f75a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9cc8036cbd65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c971d90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36d7d3e5db21b094b8b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1162dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1dfb1c68cc164b0a4780d971a96ea2c4d4ca0398c2235980a9307b3d5bd3b01faffd0a5dbed2881a9700af5617ea94c9493260fad0000f96f06817fb903729a7db6ff957697c9ede7885d94ffb00600e0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c148cd2f9c55f4901203a9a8a2c3e90f3943dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d0fc5a752f90000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400", 0x1000}}, 0x1006) mount$fuse(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$FIGETBSZ(r0, 0x2, 0x0) 3.237470442s ago: executing program 4 (id=141): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) setxattr$trusted_overlay_upper(0x0, 0x0, &(0x7f0000000200)={0x0, 0xfb, 0x32, 0x7, 0x10, "f9bc21eb66a70781c7d54d8c7137384c", "a2930dfa803a6a1295bd1d16de09bc21b35d29210aec55894c54f515f1"}, 0x32, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x2, 0x6, 0xfffa}, 0x3a, [0x8000, 0xc95a, 0x8, 0x8, 0x80, 0x2, 0x3, 0x7f, 0x20000006, 0x4d, 0x6, 0x5f, 0x9, 0x5, 0xffff2d37, 0xffffff01, 0x6, 0xff, 0x0, 0x5, 0x4, 0x0, 0x7, 0x3c5b, 0x1, 0x24, 0xd, 0x1, 0x4, 0x8, 0xe661, 0x4, 0x7, 0x3, 0x8, 0x4c74, 0x80000000, 0x242, 0x3, 0xe, 0x0, 0x80008071, 0x7, 0x17, 0x1, 0x7, 0x5, 0x41, 0x8f, 0x6, 0xbee8, 0x0, 0x5, 0x4, 0x8, 0x3ff, 0x80, 0x0, 0x5, 0x3, 0x8, 0x4, 0x1, 0x40], [0x10000007, 0x9, 0x8000012f, 0x8004, 0x5, 0xfffffff3, 0x129432e6, 0xc8, 0xf9, 0xe, 0x2bb, 0x6d7, 0x9, 0xfffffffc, 0x3, 0x0, 0x0, 0x5, 0x2f, 0xe, 0x312, 0x78, 0xea4, 0x0, 0x4, 0x7, 0x7fff, 0x6, 0x400, 0x401, 0x6, 0x1, 0xff, 0x5, 0x1000005, 0x5f31, 0xd, 0x4e0, 0x2, 0x4, 0xb, 0x4, 0x9, 0x8, 0x9, 0x6, 0x47, 0x8000, 0x100001, 0xfe000000, 0x8, 0x2, 0x4, 0x9, 0x3, 0x3, 0x9, 0x1, 0x3, 0x3, 0xbc45, 0x48c93690, 0x42, 0x3], [0x7, 0x408, 0x0, 0x5, 0xfffffffe, 0x100, 0x8d2, 0x9, 0x5, 0x7fff, 0x0, 0x5, 0xb, 0x4, 0x5, 0x5, 0x0, 0x1ef, 0x5, 0x8, 0x86, 0x3, 0x3038, 0x3e7, 0xb, 0x5, 0x4, 0x2, 0x3, 0x20000008, 0x4, 0x6d01, 0x6, 0x38, 0x800003, 0x200, 0x80, 0x3, 0x4, 0x2950bfaf, 0x1000, 0xa2, 0x7, 0xa9, 0x5, 0x6, 0xac8, 0xbf, 0x2, 0x3, 0x7ff, 0x12b, 0x4, 0x1, 0xa, 0x0, 0x5, 0x1c, 0x120000, 0x3, 0x2006, 0x80a2ed, 0x4, 0x25], [0x8, 0xbb33, 0x7, 0xb, 0x5, 0x938, 0x6, 0x6, 0x0, 0xb9, 0xce7, 0x1ff, 0x2, 0x3ff, 0x5, 0x3, 0x101, 0x10000, 0x4, 0x7fff, 0x5, 0xa620, 0x1, 0x5, 0x1, 0xb4, 0x14c, 0x81, 0x6, 0x16, 0xffffffff, 0x80000000, 0x5, 0x4, 0xc8, 0x7ff, 0xfffff000, 0x10000, 0x3, 0x7e, 0x100, 0x9602, 0x7, 0xaf, 0x8, 0x6, 0x226, 0x5, 0x5, 0x8, 0x30b1d693, 0xa1f, 0xf40, 0x7, 0x1, 0x6c1b, 0x0, 0x4, 0x5, 0xb1e, 0xd7, 0x200, 0xffff3441, 0xfff]}, 0x45c) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4400ae8f, &(0x7f0000000140)=@x86={0x40, 0x1, 0xc, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x80, 0x9, 0x0, 0x0, 0x0, 0xfffffff8, 0x0, 0xff, 0xff}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 3.168599553s ago: executing program 4 (id=143): mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='sys_mnt\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='sys_mnt\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='sys_mnt/block/zram0/disksize\x00', 0x1, 0x0) write(r0, &(0x7f0000000400)='1', 0x1) 3.168447543s ago: executing program 4 (id=144): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921000000012201000905810308"], 0x0) syz_usb_disconnect(r0) r1 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120110010000004058040350"], 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_connect$cdc_ncm(0x2, 0x112, &(0x7f0000000180)={{0x12, 0x1, 0x310, 0x2, 0x0, 0x0, 0x8, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x100, 0x2, 0x1, 0x6, 0x80, 0x7f, "", {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5, 0x24, 0x0, 0x1}, {0xd, 0x24, 0xf, 0x1, 0x9, 0x10, 0x6, 0xff}, {0x6, 0x24, 0x1a, 0x7f}, [@dmm={0x7, 0x24, 0x14, 0x1, 0x8}, @dmm={0x7, 0x24, 0x14, 0x7ff, 0x1}, @mdlm_detail={0x96, 0x24, 0x13, 0x4, "627807919cdc16f1a9caea8e1b13e8ca264f0969317d1b396560ef0be8b55e64514cba7acb1637d9bee6ba5217a96ff05d56e5db7fe024eb453c88d671a4f01286204d692f6e73cf29a3db222e52ad71b3522c4bab4a5c557ecf6b7fe70fb91669308630c79cc3593556c38734688273ec4556f200e0b6670a014d384cd3d80b2e86b6757ea1ffe2e8a98c19a23258d7c08d"}]}, {{0x9, 0x5, 0x81, 0x3, 0x200, 0x2, 0x8, 0x81}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200, 0x6d, 0xf, 0x6}}, {{0x9, 0x5, 0x3, 0x2, 0x40, 0x77, 0x8, 0x7}}}}}}}]}}, 0x0) syz_usb_ep_write(r0, 0x81, 0xffffffffffffff6d, &(0x7f0000000100)="019a18370cfb661ba08c228ce6ca19b6a99a071ca34c72c891f8a260fa00000080977dae8d64a30e92cd51117c4a71e26518e804c00058e6c7c0c363027251668bb650d90000000000") 3.075952965s ago: executing program 1 (id=149): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./gadget/ep1in-bulk\x00', 0x2, 0x24) write(r1, &(0x7f00000005c0)="010000000705810240000007058102000200", 0x12) 3.075877485s ago: executing program 1 (id=150): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_PRE_FAULT_MEMORY(r2, 0xc040aed5, &(0x7f0000000240)={0x0, 0x100000}) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) close_range(r3, 0xffffffffffffffff, 0x0) 3.075795665s ago: executing program 1 (id=151): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/pci/drivers/i801_smbus/new_id\x00', 0x1, 0x0) write(r0, &(0x7f0000000380)='ffffffff ff', 0xb) 3.069965935s ago: executing program 1 (id=152): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000280)=ANY=[@ANYBLOB="12010000d3750820c80a2103be6f000000010902120001000000000904"], 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000540)={0x1c, &(0x7f0000000380)=ANY=[], 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) 2.87575839s ago: executing program 2 (id=156): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)={0x54, 0x9, 0x6, 0x3, 0x0, 0x0, {0x5}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x2c, 0x7, 0x0, 0x1, [@IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x4e20}, @IPSET_ATTR_PROTO={0x5, 0x7, 0xff}, @IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @rand_addr=0x64010102}}, @IPSET_ATTR_IP2={0xc, 0x14, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @broadcast}}]}]}, 0x54}, 0x1, 0x0, 0x0, 0x10004893}, 0x80) 2.87257111s ago: executing program 2 (id=157): r0 = syz_open_procfs(0x0, &(0x7f0000000240)='cgroup\x00') pread64(r0, &(0x7f0000000300)=""/4092, 0xffc, 0x4) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_usb_connect(0x0, 0x3f, 0x0, 0x0) 2.566809438s ago: executing program 3 (id=158): sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000000a00)={0x0, 0x0, &(0x7f00000009c0)={&(0x7f0000000500)=ANY=[@ANYBLOB="9c020000", @ANYRES16=0x0, @ANYBLOB="00022dbd7000fcdbdf253b00000008000300", @ANYRES32=0x0, @ANYBLOB="78023300808c02000802110000000802110000005050505050505cc410000341d6f7050000000000640040100015f8d9c3537204b0b478308bf7aa17d3cb35af8f0b1a010303810303019d04060806c60e0400060203003c040100060871070001000002f320dd6bccff396922e15cae25aef7da02fcbfdfdcbfdb1ff313dae170d604445f1a"], 0x29c}, 0x1, 0x0, 0x0, 0x20000081}, 0x80) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000480)=ANY=[@ANYBLOB="3c0000003f000701", @ANYBLOB], 0x3c}, 0x1, 0x0, 0x0, 0xc000}, 0x4040) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000000)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r1, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r2, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}}, 0x0) 2.547693578s ago: executing program 3 (id=159): r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000240)=ANY=[@ANYBLOB="12010000772904202404019957c2010203010902240001000010000904430002317d5500090502020002020000090582020002"], 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$uac3(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000400)={0x34, &(0x7f0000000340)=ANY=[@ANYBLOB="0014af"], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000cc0)={0x44, &(0x7f0000000a80)=ANY=[@ANYBLOB="401504"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000d40)={0x84, &(0x7f0000000740)={0x20, 0x15, 0x4, "8b27be98"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac3(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f00000006c0)={0x2c, &(0x7f0000000440)={0x20, 0xc98dfa9b6969f6bb, 0x4, "0e3b45ca"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) 2.312050224s ago: executing program 2 (id=160): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={0x0}}, 0x20050800) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) sendmsg$NL80211_CMD_SET_WIPHY_NETNS(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4008880}, 0x20000084) sendmsg$OSF_MSG_ADD(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x1508}}, 0x10) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="640000000001010400000000141a000002000000240001801400018008000100e000000108"], 0x64}}, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)={0x14, 0x0, 0x1, 0x401, 0x0, 0x0, {0x2}}, 0x14}, 0x1, 0x0, 0x0, 0x8014}, 0x40c0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_CAP_DISABLE_QUIRKS(0xffffffffffffffff, 0x4068aea3, &(0x7f00000000c0)={0x74, 0x0, 0x34}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000140)=[@text32={0x20, &(0x7f0000000180)="66b80e010f00d0b0060f21a20f01c40f009b2700000066b80c008ee00f3235008000000f30b80e0000000f23d80f21f835800000a00f23f8c9b9490300000f60b932c00a00b9730200000f32328fe858b660002fb90d090000b800680000ba000000000f30", 0x65}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 1.505649303s ago: executing program 2 (id=161): sendmsg$DEVLINK_CMD_RATE_GET(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000440)=ANY=[@ANYBLOB="000425bd7000ffdbdf254a0000000f00a8007365636f6e646e616d6500000880030001"], 0x48}, 0x1, 0x0, 0x0, 0x4500}, 0x240001d0) write(0xffffffffffffffff, &(0x7f0000000240)="aefc00001a0025f00385bc04fef7681d020b49ff708800008003280008021000ac0a1410bc71176a36ede498534108e58342fa94a235a2a441f9", 0xfcae) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) 1.495376524s ago: executing program 2 (id=162): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='sys_mnt\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='sys_mnt\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='sys_mnt/block/zram0/comp_algorithm\x00', 0x1, 0x0) write(r0, &(0x7f00000003c0)="87be630db34e3ac3aa9fa9abc32c266a25cbb8cb10441dce1797593f54dd49fe896bc7ea5c6a079f21ecb62ca8c45bb4d6cb96293f0efacaa0c8489d7d43a7b980b7d8d4be6451e722db70861cd1892b9c716d1cc9ff978738a5dfd45a17f15d6abc3f8301cf4f7f4a4a602ed0ae22871c98e6b364eb26df2d758fd27bdaf090", 0x80) 1.444132015s ago: executing program 2 (id=163): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x8001, 0x0) r0 = syz_usb_connect(0x0, 0x55, &(0x7f0000000180)=ANY=[@ANYBLOB="12010002020000402505a7a400010000000109024300020100c001090400000102020100052400100104240202052401000105240600010705810308000a09040100020a00000007058202000200070503020002"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/ttyACM0\x00', 0x2, 0x1) syz_usb_control_io(r0, 0x0, 0x0) ioctl$KVM_CAP_VM_DISABLE_NX_HUGE_PAGES(r1, 0x5411, 0x0) 1.436315625s ago: executing program 0 (id=164): r0 = syz_usb_connect$uac3(0x0, 0xa0, &(0x7f00000000c0)=ANY=[@ANYBLOB="12011003000000403512100040000102030109028e000301002040080b0201012130c60904000000010130000a2401042a00ff0f0000132403050001020602028000000700100002000f240902020000000001"], &(0x7f0000000780)={0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac3(r0, 0x0, &(0x7f00000005c0)={0x44, &(0x7f0000000440)={0x0, 0x17, 0x21, "e971e87b"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000b40)={0x84, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000940)={0x44, &(0x7f0000000640)={0x20, 0xf}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000a40)={0x84, &(0x7f00000003c0)={0x0, 0x1}, &(0x7f0000000480)={0x0, 0xa, 0x1, 0xcb}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 53.781899ms ago: executing program 1 (id=165): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000740)={{0x14, 0x10, 0x1, 0x0, 0x0, {0xd4ad1185e214d3bd}}, [@NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}]}, @NFT_MSG_DELCHAIN={0x2c, 0x5, 0xa, 0x201, 0x0, 0x0, {0x1, 0x0, 0x2000}, [@NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x1}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}]}], {0x14}}, 0x80}}, 0x0) 0s ago: executing program 1 (id=166): syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x7, 0x1, 0x6, 0xfffa}, 0x1d, [0x6, 0xc95a, 0xfffffff3, 0x9, 0x7f, 0x2, 0x1, 0x7f, 0x4, 0xfffffff9, 0xfffffff2, 0x5f, 0xa, 0x3, 0xffff2d37, 0x1dd2, 0x6, 0x7, 0x10, 0x80000001, 0x4, 0x7, 0x3, 0x3c5b, 0x1, 0x24, 0xffffffff, 0x2, 0x1f461e2c, 0x2, 0xe661, 0x4, 0x9, 0x3, 0x7fff, 0x4c74, 0x8f00, 0x642, 0x3, 0xa, 0x0, 0x71, 0x7, 0x7, 0x103, 0x0, 0x5, 0x3c, 0x91, 0x6, 0xfffffffd, 0x5, 0x5, 0x4, 0x8, 0x8ed2, 0x80, 0x0, 0x5, 0x6, 0x8, 0x4, 0x1, 0x40], [0x10000007, 0x8, 0x12f, 0x8000, 0x10, 0x8, 0x129432e2, 0xcb, 0xf9, 0xd, 0x2bf, 0x6c9, 0x9, 0xfffffffe, 0x4, 0x0, 0x7, 0x5, 0x2f, 0xe, 0x312, 0x78, 0xea4, 0xa, 0x4, 0x4000, 0x8000, 0x9, 0x400, 0x1, 0x6, 0x9, 0xff, 0x1005, 0x7ff, 0x5f32, 0xffff1ef5, 0x0, 0x9, 0x2, 0x9, 0x4, 0x7f, 0x8, 0x9, 0x6, 0x5, 0x0, 0x1, 0x7ffc, 0xffff, 0x2, 0x7f, 0x6, 0x5, 0x10003, 0x4, 0x1, 0x7, 0xb, 0x9, 0x48c93690, 0x3, 0xff], [0x7, 0x4, 0x0, 0x64e, 0x8000, 0x7fffffff, 0x8d2, 0x9, 0x1, 0x7fff, 0x0, 0x5, 0xb, 0x4, 0x1, 0x5, 0x0, 0x1ef, 0x5, 0x8, 0x86, 0x3, 0x10000009, 0x3e7, 0xb, 0x5, 0x2, 0x2, 0xf, 0x8, 0x4, 0x6d01, 0x5, 0x3b, 0x3, 0x200, 0x80, 0x3, 0x4, 0x2, 0x0, 0xa2, 0x7, 0x53cf697b, 0x5, 0x6, 0x54fe12d6, 0xbf, 0x200, 0x3, 0x400002, 0xfffffff9, 0x0, 0x6, 0x5, 0x0, 0x6, 0xfffffffb, 0x120000, 0x3, 0x80, 0x9, 0x4, 0x3], [0x9, 0xbb2f, 0x3, 0x7, 0x5, 0x938, 0x6, 0x6, 0x0, 0x5, 0xce7, 0x1ff, 0x6, 0x8ad, 0x5, 0x3, 0x101, 0x10000, 0x6, 0x7fff, 0x8ffff, 0xa620, 0x2, 0x5, 0x1, 0x2, 0x14c, 0x60a7, 0x6, 0x1, 0xffffffff, 0x7ffffffe, 0x5, 0x8, 0xc8, 0x3, 0x2, 0x10002, 0x3, 0x9, 0x80000001, 0x9602, 0xa, 0x8, 0x4, 0x0, 0x1, 0x10000, 0x5, 0x8, 0x2b91, 0xa1f, 0x8, 0x9, 0x1, 0x6c1b, 0x0, 0x4, 0x5, 0xb1c, 0x1, 0x200, 0xffff3441, 0xfff]}, 0x45c) mount$overlay(0x0, 0x0, 0x0, 0x8, &(0x7f0000000040)={[{@upperdir={'upperdir', 0x3d, './file0'}}]}) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000000)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r1, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r2, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}}, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.30' (ED25519) to the list of known hosts. [ 22.206723][ T24] audit: type=1400 audit(1786307382.220:64): avc: denied { mounton } for pid=271 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 22.209423][ T271] cgroup: Unknown subsys name 'net' [ 22.229539][ T24] audit: type=1400 audit(1786307382.220:65): avc: denied { mount } for pid=271 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.256725][ T24] audit: type=1400 audit(1786307382.260:66): avc: denied { unmount } for pid=271 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.276559][ T271] cgroup: Unknown subsys name 'devices' [ 22.431286][ T271] cgroup: Unknown subsys name 'hugetlb' [ 22.436884][ T271] cgroup: Unknown subsys name 'rlimit' [ 22.576370][ T24] audit: type=1400 audit(1786307382.590:67): avc: denied { setattr } for pid=271 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=253 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 22.599901][ T24] audit: type=1400 audit(1786307382.590:68): avc: denied { mounton } for pid=271 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 22.624722][ T24] audit: type=1400 audit(1786307382.590:69): avc: denied { mount } for pid=271 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 22.636901][ T273] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 22.656674][ T24] audit: type=1400 audit(1786307382.670:70): avc: denied { relabelto } for pid=273 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.682077][ T24] audit: type=1400 audit(1786307382.670:71): avc: denied { write } for pid=273 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.707753][ T271] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 22.707879][ T24] audit: type=1400 audit(1786307382.700:72): avc: denied { read } for pid=271 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.742009][ T24] audit: type=1400 audit(1786307382.700:73): avc: denied { open } for pid=271 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.227806][ T279] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.235032][ T279] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.242511][ T279] device bridge_slave_0 entered promiscuous mode [ 23.261009][ T279] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.268078][ T279] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.275426][ T279] device bridge_slave_1 entered promiscuous mode [ 23.354254][ T283] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.361318][ T283] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.368619][ T283] device bridge_slave_0 entered promiscuous mode [ 23.375296][ T280] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.382391][ T280] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.389627][ T280] device bridge_slave_0 entered promiscuous mode [ 23.403855][ T280] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.410911][ T280] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.418205][ T280] device bridge_slave_1 entered promiscuous mode [ 23.424862][ T283] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.431947][ T283] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.439179][ T283] device bridge_slave_1 entered promiscuous mode [ 23.465786][ T281] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.472857][ T281] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.480191][ T281] device bridge_slave_0 entered promiscuous mode [ 23.486900][ T281] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.493979][ T281] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.501407][ T281] device bridge_slave_1 entered promiscuous mode [ 23.526489][ T282] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.533614][ T282] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.540949][ T282] device bridge_slave_0 entered promiscuous mode [ 23.547850][ T282] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.555005][ T282] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.562412][ T282] device bridge_slave_1 entered promiscuous mode [ 23.599653][ T279] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.606718][ T279] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.614000][ T279] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.621056][ T279] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.712254][ T280] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.719398][ T280] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.726669][ T280] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.733731][ T280] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.747266][ T283] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.754408][ T283] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.761676][ T283] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.768702][ T283] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.789808][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.798288][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.806987][ T7] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.814446][ T7] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.821929][ T7] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.829036][ T7] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.836836][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 23.844401][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.864617][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.872439][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.880663][ T7] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.887688][ T7] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.895167][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.904117][ T7] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.911182][ T7] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.923391][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.942895][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.950936][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 23.958780][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.967206][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 23.985496][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.993081][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.001337][ T7] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.008364][ T7] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.016717][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.025372][ T7] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.032414][ T7] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.049425][ T283] device veth0_vlan entered promiscuous mode [ 24.060166][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.068631][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.077373][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.085067][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.092708][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.100834][ T7] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.107841][ T7] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.115243][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.123317][ T7] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.130351][ T7] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.137631][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.145523][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.153432][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 24.181189][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.189068][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.197063][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.207873][ T283] device veth1_macvtap entered promiscuous mode [ 24.224063][ T279] device veth0_vlan entered promiscuous mode [ 24.231839][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.240170][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.248399][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.256839][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.265136][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.273006][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.281121][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.288548][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.302359][ T281] device veth0_vlan entered promiscuous mode [ 24.309288][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.317602][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.325969][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.334551][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.343403][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.351418][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.359317][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.367631][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.376071][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.383583][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.403770][ T283] request_module fs-gadgetfs succeeded, but still no fs? [ 24.406805][ T280] device veth0_vlan entered promiscuous mode [ 24.421354][ T283] cgroup: cgroup: disabling cgroup2 socket matching due to net_prio or net_cls activation [ 24.421388][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 24.439447][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.446987][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 24.455967][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.468404][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.475462][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.483375][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.492805][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.500918][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 24.509083][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.517404][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 24.525122][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.532567][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.542680][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 24.551230][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.559367][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.566418][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.574783][ T281] device veth1_macvtap entered promiscuous mode [ 24.585425][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 24.593177][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.601509][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.612889][ T279] device veth1_macvtap entered promiscuous mode [ 24.622635][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 24.630735][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.638742][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 24.646316][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 24.654872][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.662926][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.671357][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.680071][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 24.688047][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.701628][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.709893][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.718087][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.726477][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.737363][ T280] device veth1_macvtap entered promiscuous mode [ 24.750068][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 24.758262][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.766473][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 24.792399][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.801300][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.809686][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.818363][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.839838][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.848184][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.857737][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.870131][ T311] FAT-fs (loop0): Directory bread(block 64) failed [ 24.876720][ T311] FAT-fs (loop0): Directory bread(block 65) failed [ 24.883648][ T311] FAT-fs (loop0): Directory bread(block 66) failed [ 24.892213][ T311] FAT-fs (loop0): Directory bread(block 67) failed [ 24.898846][ T311] FAT-fs (loop0): Directory bread(block 68) failed [ 24.905722][ T311] FAT-fs (loop0): Directory bread(block 69) failed [ 24.912471][ T311] FAT-fs (loop0): Directory bread(block 70) failed [ 24.912535][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.919150][ T311] FAT-fs (loop0): Directory bread(block 71) failed [ 24.933519][ T311] FAT-fs (loop0): Directory bread(block 72) failed [ 24.940270][ T311] FAT-fs (loop0): Directory bread(block 73) failed [ 24.951482][ T282] device veth0_vlan entered promiscuous mode [ 24.959428][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.967002][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.981856][ T282] device veth1_macvtap entered promiscuous mode [ 24.988450][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 24.997254][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.005590][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 25.030572][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.076654][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.097088][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.105488][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.458499][ T347] cgroup: syz.1.17 (347) created nested cgroup for controller "memory" which has incomplete hierarchy support. Nested cgroups may change behavior in the future. [ 25.476540][ T347] cgroup: "memory" requires setting use_hierarchy to 1 on the root [ 25.530561][ T20] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 25.563833][ T363] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 25.579870][ T5] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 25.779874][ T20] usb 4-1: Using ep0 maxpacket: 8 [ 25.819744][ T5] usb 3-1: Using ep0 maxpacket: 16 [ 25.828100][ T383] tipc: Started in network mode [ 25.833273][ T383] tipc: Own node identity 4, cluster identity 4711 [ 25.840320][ T383] tipc: 32-bit node address hash set to 4 [ 25.899797][ T20] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 13 [ 25.969800][ T5] usb 3-1: config 0 interface 0 altsetting 5 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 25.980885][ T5] usb 3-1: config 0 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 25.994238][ T5] usb 3-1: config 0 interface 0 has no altsetting 0 [ 26.000948][ T307] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 26.008502][ T5] usb 3-1: New USB device found, idVendor=11c0, idProduct=5506, bcdDevice= 0.00 [ 26.017615][ T5] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 26.027330][ T5] usb 3-1: config 0 descriptor?? [ 26.059829][ T20] usb 4-1: New USB device found, idVendor=046d, idProduct=08ae, bcdDevice=11.58 [ 26.069028][ T20] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 26.077115][ T20] usb 4-1: Product: syz [ 26.081434][ T20] usb 4-1: Manufacturer: syz [ 26.086027][ T20] usb 4-1: SerialNumber: syz [ 26.091794][ T20] usb 4-1: config 0 descriptor?? [ 26.109858][ T53] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 26.239857][ T307] usb 2-1: Using ep0 maxpacket: 16 [ 26.360015][ T307] usb 2-1: config 0 has an invalid interface number: 41 but max is 0 [ 26.368227][ T307] usb 2-1: config 0 has no interface number 0 [ 26.374366][ T307] usb 2-1: config 0 interface 41 altsetting 2 bulk endpoint 0x4 has invalid maxpacket 16 [ 26.384189][ T307] usb 2-1: config 0 interface 41 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 64 [ 26.394122][ T307] usb 2-1: config 0 interface 41 has no altsetting 0 [ 26.499840][ T53] usb 1-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 26.509001][ T53] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 26.517834][ T53] usb 1-1: config 0 descriptor?? [ 26.531458][ T5] input: HID 11c0:5506 as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/0003:11C0:5506.0001/input/input4 [ 26.543837][ T5] betop 0003:11C0:5506.0001: input,hidraw0: USB HID v0.00 Joystick [HID 11c0:5506] on usb-dummy_hcd.2-1/input0 [ 26.555629][ T5] betop 0003:11C0:5506.0001: no output reports found [ 26.562397][ T307] usb 2-1: New USB device found, idVendor=0fe6, idProduct=9700, bcdDevice=d1.9a [ 26.571736][ T307] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 26.580708][ T307] usb 2-1: Product: syz [ 26.584939][ T307] usb 2-1: Manufacturer: syz [ 26.589576][ T307] usb 2-1: SerialNumber: syz [ 26.595235][ T307] usb 2-1: config 0 descriptor?? [ 26.620106][ T373] raw-gadget.2 gadget: fail, usb_ep_enable returned -22 [ 26.627155][ T373] raw-gadget.2 gadget: fail, usb_ep_enable returned -22 [ 26.737649][ T5] usb 3-1: USB disconnect, device number 2 [ 26.841303][ T373] raw-gadget.2 gadget: fail, usb_ep_enable returned -22 [ 26.848336][ T373] raw-gadget.2 gadget: fail, usb_ep_enable returned -22 [ 27.019784][ T287] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 27.539786][ T20] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 27.539880][ T287] usb 5-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 27.556363][ T287] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 27.564439][ T287] usb 5-1: Product: syz [ 27.568598][ T287] usb 5-1: Manufacturer: syz [ 27.573300][ T287] usb 5-1: SerialNumber: syz [ 27.701254][ T307] sr9700 2-1:0.41 eth1: register 'sr9700' at usb-dummy_hcd.1-1, CoreChip SR9700 USB Ethernet, ac:ec:0e:85:d1:f1 [ 27.717587][ T307] usb 2-1: USB disconnect, device number 2 [ 27.724009][ T307] sr9700 2-1:0.41 eth1: unregister 'sr9700' usb-dummy_hcd.1-1, CoreChip SR9700 USB Ethernet [ 27.909796][ T20] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 27.919953][ T20] usb 3-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 27.928959][ T20] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 27.937671][ T20] usb 3-1: config 0 descriptor?? [ 27.950780][ T24] kauditd_printk_skb: 65 callbacks suppressed [ 27.950790][ T24] audit: type=1400 audit(1786307387.970:139): avc: denied { read } for pid=134 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=1 [ 28.049300][ T24] audit: type=1400 audit(1786307388.060:140): avc: denied { read write } for pid=415 comm="syz.1.43" name="binder0" dev="binder" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 28.052878][ T416] binder: 415:416 ioctl c0306201 2000000001c0 returned -14 [ 28.072808][ T24] audit: type=1400 audit(1786307388.060:141): avc: denied { open } for pid=415 comm="syz.1.43" path="/dev/binderfs/binder0" dev="binder" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 28.104294][ T24] audit: type=1400 audit(1786307388.060:142): avc: denied { ioctl } for pid=415 comm="syz.1.43" path="/dev/binderfs/binder0" dev="binder" ino=13 ioctlcmd=0x6201 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 28.139324][ T287] usb 4-1: USB disconnect, device number 2 [ 28.160741][ T24] audit: type=1400 audit(1786307388.180:143): avc: denied { set_context_mgr } for pid=422 comm="syz.3.46" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 28.180613][ T24] audit: type=1400 audit(1786307388.180:144): avc: denied { map } for pid=422 comm="syz.3.46" path="/dev/binderfs/binder0" dev="binder" ino=10 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 28.204435][ T24] audit: type=1400 audit(1786307388.180:145): avc: denied { call } for pid=422 comm="syz.3.46" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 28.208709][ T395] usb 3-1: USB disconnect, device number 3 [ 28.230279][ T24] audit: type=1400 audit(1786307388.180:146): avc: denied { transfer } for pid=422 comm="syz.3.46" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 28.399804][ T307] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 28.619825][ T287] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 28.639794][ T307] usb 2-1: Using ep0 maxpacket: 8 [ 28.779800][ T395] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 28.855835][ T15] usb 1-1: USB disconnect, device number 2 [ 28.868937][ T24] audit: type=1400 audit(1786307388.880:147): avc: denied { write } for pid=428 comm="syz.0.48" name="ptype" dev="proc" ino=4026532478 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_net_t tclass=file permissive=1 [ 28.869929][ T287] usb 4-1: Using ep0 maxpacket: 32 [ 28.929983][ T307] usb 2-1: New USB device found, idVendor=046d, idProduct=08dd, bcdDevice=ff.f4 [ 28.939304][ T307] usb 2-1: New USB device strings: Mfr=8, Product=2, SerialNumber=3 [ 28.947564][ T307] usb 2-1: Product: syz [ 28.951943][ T307] usb 2-1: Manufacturer: syz [ 28.956556][ T307] usb 2-1: SerialNumber: syz [ 28.961736][ T307] usb 2-1: config 0 descriptor?? [ 29.139857][ T395] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 29.153788][ T395] usb 3-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 29.163310][ T395] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 29.171433][ T287] usb 4-1: New USB device found, idVendor=1d50, idProduct=60a1, bcdDevice=a1.4f [ 29.181507][ T395] usb 3-1: config 0 descriptor?? [ 29.186645][ T287] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 29.194824][ T287] usb 4-1: Product: syz [ 29.199016][ T287] usb 4-1: Manufacturer: syz [ 29.203836][ T287] usb 4-1: SerialNumber: syz [ 29.209075][ T287] usb 4-1: config 0 descriptor?? [ 29.479788][ T15] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 29.719793][ T15] usb 1-1: Using ep0 maxpacket: 16 [ 29.766699][ T287] usb 5-1: USB disconnect, device number 2 [ 29.778147][ T24] audit: type=1400 audit(1786307389.790:148): avc: denied { read } for pid=453 comm="syz.4.57" dev="nsfs" ino=4026532472 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 29.817041][ T457] kvm: apic: phys broadcast and lowest prio [ 29.889890][ T15] usb 1-1: unable to get BOS descriptor or descriptor too short [ 29.969834][ T15] usb 1-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 152, changing to 7 [ 29.980972][ T15] usb 1-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 66, changing to 7 [ 30.149809][ T15] usb 1-1: New USB device found, idVendor=041e, idProduct=3042, bcdDevice= 0.40 [ 30.159228][ T15] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 30.167275][ T15] usb 1-1: Product: syz [ 30.171748][ T15] usb 1-1: Manufacturer: syz [ 30.176333][ T15] usb 1-1: SerialNumber: syz [ 30.427629][ T20] usb 3-1: USB disconnect, device number 4 [ 30.520960][ T287] usb 4-1: USB disconnect, device number 3 [ 30.539898][ T15] usb 1-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 30.559843][ T15] usb 1-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 30.582688][ T15] usb 1-1: USB disconnect, device number 3 [ 30.790295][ T471] udevd[471]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 30.899768][ T20] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 30.969769][ T287] usb 4-1: new low-speed USB device number 4 using dummy_hcd [ 31.139758][ T20] usb 3-1: Using ep0 maxpacket: 16 [ 31.155946][ T395] usb 2-1: USB disconnect, device number 3 [ 31.199748][ T15] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 31.239816][ T355] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 31.259813][ T20] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 31.270007][ T20] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 31.281168][ T20] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 31.290949][ T20] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 31.301189][ T20] usb 3-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 31.339809][ T287] usb 4-1: config 168 descriptor has 1 excess byte, ignoring [ 31.347312][ T287] usb 4-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 31.358262][ T287] usb 4-1: config 168 interface 0 altsetting 0 has an invalid endpoint with address 0xFF, skipping [ 31.389853][ T20] usb 3-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 31.399020][ T20] usb 3-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 31.411245][ T20] usb 3-1: Manufacturer: syz [ 31.418750][ T20] usb 3-1: config 0 descriptor?? [ 31.449807][ T287] usb 4-1: config 168 descriptor has 1 excess byte, ignoring [ 31.457387][ T287] usb 4-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 31.468244][ T15] usb 1-1: Using ep0 maxpacket: 8 [ 31.473461][ T287] usb 4-1: config 168 interface 0 altsetting 0 has an invalid endpoint with address 0xFF, skipping [ 31.479838][ T355] usb 5-1: Using ep0 maxpacket: 32 [ 31.560159][ T287] usb 4-1: config 168 descriptor has 1 excess byte, ignoring [ 31.567810][ T287] usb 4-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 31.578666][ T287] usb 4-1: config 168 interface 0 altsetting 0 has an invalid endpoint with address 0xFF, skipping [ 31.589823][ T15] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 31.601047][ T15] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 31.609920][ T355] usb 5-1: config 155 has an invalid descriptor of length 0, skipping remainder of the config [ 31.621450][ T15] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 31.622207][ T355] usb 5-1: config 155 interface 0 altsetting 0 has an invalid endpoint with address 0xE2, skipping [ 31.642336][ T15] usb 1-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 31.642632][ T355] usb 5-1: config 155 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 11 [ 31.668425][ T15] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 31.677523][ T15] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 31.819926][ T355] usb 5-1: New USB device found, idVendor=15c2, idProduct=ffdc, bcdDevice=bd.30 [ 31.829273][ T355] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 31.837379][ T355] usb 5-1: Product: syz [ 31.841646][ T355] usb 5-1: Manufacturer: syz [ 31.846374][ T355] usb 5-1: SerialNumber: syz [ 31.859863][ T287] usb 4-1: string descriptor 0 read error: -22 [ 31.866276][ T287] usb 4-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 31.877866][ T287] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 32.147653][ T287] usb 4-1: USB disconnect, device number 4 [ 32.509768][ T532] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 32.869805][ T532] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 128, changing to 11 [ 32.881227][ T532] usb 2-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 64 [ 32.949800][ T355] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 33.049907][ T532] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 33.058994][ T532] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 33.066999][ T532] usb 2-1: Product: syz [ 33.071293][ T532] usb 2-1: Manufacturer: syz [ 33.075875][ T532] usb 2-1: SerialNumber: syz [ 33.309790][ T355] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 33.319994][ T355] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 33.322679][ T542] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 33.330478][ T355] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x83 has invalid maxpacket 0 [ 33.346484][ T355] usb 4-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 4 [ 33.359440][ T355] usb 4-1: New USB device found, idVendor=0424, idProduct=012c, bcdDevice= 0.00 [ 33.368585][ T355] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 33.502150][ T355] usb 3-1: USB disconnect, device number 5 [ 33.612552][ T287] usb 4-1: USB disconnect, device number 5 [ 33.936725][ T25] usb 1-1: USB disconnect, device number 4 [ 33.980084][ T542] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 33.988290][ T20] usb 5-1: USB disconnect, device number 3 [ 34.059819][ T355] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 34.146649][ T24] kauditd_printk_skb: 28 callbacks suppressed [ 34.146659][ T24] audit: type=1400 audit(1786307394.160:177): avc: denied { create } for pid=590 comm="syz.3.113" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 34.182141][ T24] audit: type=1400 audit(1786307394.200:178): avc: denied { bind } for pid=593 comm="syz.3.114" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 34.220663][ T532] cdc_ncm 2-1:1.0: MAC-Address: 42:42:42:42:42:42 [ 34.227121][ T532] cdc_ncm 2-1:1.0: setting rx_max = 16384 [ 34.379826][ T25] usb 1-1: new full-speed USB device number 5 using dummy_hcd [ 34.419816][ T355] usb 3-1: config 1 has an invalid interface number: 7 but max is 0 [ 34.427858][ T355] usb 3-1: config 1 has no interface number 0 [ 34.434034][ T532] cdc_ncm 2-1:1.0: setting tx_max = 16384 [ 34.441353][ T532] cdc_ncm 2-1:1.0 usb0: register 'cdc_ncm' at usb-dummy_hcd.1-1, CDC NCM, 42:42:42:42:42:42 [ 34.451579][ T355] usb 3-1: config 1 interface 7 altsetting 0 has an invalid endpoint with address 0xDB, skipping [ 34.462777][ T355] usb 3-1: config 1 interface 7 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 34.474709][ T532] usb 2-1: USB disconnect, device number 4 [ 34.480847][ T532] cdc_ncm 2-1:1.0 usb0: unregister 'cdc_ncm' usb-dummy_hcd.1-1, CDC NCM [ 34.503621][ T24] audit: type=1400 audit(1786307394.520:179): avc: denied { ioctl } for pid=603 comm="syz.4.118" path="socket:[16925]" dev="sockfs" ino=16925 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 34.529029][ T24] audit: type=1400 audit(1786307394.520:180): avc: denied { write } for pid=603 comm="syz.4.118" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 34.551079][ T24] audit: type=1400 audit(1786307394.520:181): avc: denied { nlmsg_write } for pid=603 comm="syz.4.118" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 34.649844][ T355] usb 3-1: New USB device found, idVendor=1199, idProduct=68a3, bcdDevice= 0.00 [ 34.658954][ T355] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 34.666965][ T355] usb 3-1: Product: syz [ 34.671215][ T355] usb 3-1: Manufacturer: syz [ 34.675794][ T355] usb 3-1: SerialNumber: syz [ 34.699796][ T560] raw-gadget.1 gadget: fail, usb_ep_enable returned -22 [ 34.715836][ T611] netlink: 12 bytes leftover after parsing attributes in process `syz.3.120'. [ 34.789792][ T25] usb 1-1: config 0 has an invalid interface number: 41 but max is 0 [ 34.798008][ T25] usb 1-1: config 0 has no interface number 0 [ 34.804379][ T25] usb 1-1: config 0 interface 41 has no altsetting 0 [ 34.819790][ T395] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 34.969967][ T25] usb 1-1: New USB device found, idVendor=0fe6, idProduct=9800, bcdDevice=d1.9a [ 34.979062][ T25] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 34.987109][ T25] usb 1-1: Product: syz [ 34.991294][ T25] usb 1-1: Manufacturer: syz [ 34.995880][ T25] usb 1-1: SerialNumber: syz [ 35.001061][ T25] usb 1-1: config 0 descriptor?? [ 35.069773][ T395] usb 5-1: Using ep0 maxpacket: 8 [ 35.189808][ T395] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 13 [ 35.210292][ T355] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 35.349800][ T395] usb 5-1: New USB device found, idVendor=046d, idProduct=08ae, bcdDevice=11.58 [ 35.359081][ T395] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 35.367164][ T395] usb 5-1: Product: syz [ 35.371344][ T395] usb 5-1: Manufacturer: syz [ 35.375918][ T395] usb 5-1: SerialNumber: syz [ 35.381020][ T395] usb 5-1: config 0 descriptor?? [ 35.449796][ T355] usb 2-1: Using ep0 maxpacket: 32 [ 35.569808][ T355] usb 2-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 35.578929][ T355] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 35.587507][ T355] usb 2-1: config 0 descriptor?? [ 35.919806][ T25] CoreChips 1-1:0.41 (unnamed net_device) (uninitialized): sr_get_phy_addr : Error reading PHYID register:ffffffe0 [ 36.339891][ T395] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 36.579785][ T395] usb 4-1: Using ep0 maxpacket: 8 [ 36.683877][ T355] usb 5-1: USB disconnect, device number 4 [ 36.695940][ T287] usb 3-1: USB disconnect, device number 6 [ 36.717084][ T628] uffd: Set unprivileged_userfaultfd sysctl knob to 1 if kernel faults must be handled without obtaining CAP_SYS_PTRACE capability [ 36.869802][ T395] usb 4-1: New USB device found, idVendor=2770, idProduct=9120, bcdDevice=6c.77 [ 36.878940][ T395] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=239 [ 36.891913][ T395] usb 4-1: Product: syz [ 36.896090][ T395] usb 4-1: Manufacturer: syz [ 36.900720][ T395] usb 4-1: SerialNumber: syz [ 36.905788][ T395] usb 4-1: config 0 descriptor?? [ 37.049799][ T25] CoreChips 1-1:0.41 (unnamed net_device) (uninitialized): Failed to send software reset:ffffffb9 [ 37.060471][ T25] CoreChips 1-1:0.41 (unnamed net_device) (uninitialized): Failed to power up PHY: -71 [ 37.070335][ T25] CoreChips: probe of 1-1:0.41 failed with error -71 [ 37.078045][ T25] usb 1-1: USB disconnect, device number 5 [ 37.109795][ T287] usb 3-1: new low-speed USB device number 7 using dummy_hcd [ 37.126119][ T641] Zero length message leads to an empty skb [ 37.140584][ T355] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 37.175344][ T24] audit: type=1400 audit(1786307397.190:182): avc: denied { bind } for pid=647 comm="syz.0.134" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 37.389782][ T355] usb 5-1: Using ep0 maxpacket: 8 [ 37.489783][ T287] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 37.497833][ T287] usb 3-1: config 0 has no interface number 0 [ 37.504170][ T287] usb 3-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 37.509948][ T355] usb 5-1: config 0 has an invalid interface number: 55 but max is 0 [ 37.515624][ T287] usb 3-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid maxpacket 159, setting to 8 [ 37.523652][ T355] usb 5-1: config 0 has no interface number 0 [ 37.534228][ T287] usb 3-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 37.540114][ T355] usb 5-1: config 0 interface 55 altsetting 0 has an invalid endpoint with address 0x80, skipping [ 37.549345][ T287] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 37.559814][ T355] usb 5-1: config 0 interface 55 altsetting 0 has an invalid endpoint with address 0xAB, skipping [ 37.569466][ T287] usb 3-1: config 0 descriptor?? [ 37.583289][ T355] usb 5-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 37.596303][ T25] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 37.604188][ T355] usb 5-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 37.613667][ T638] raw-gadget.1 gadget: fail, usb_ep_enable returned -22 [ 37.620675][ T355] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 37.629282][ T355] usb 5-1: config 0 descriptor?? [ 37.837207][ T395] usb 3-1: USB disconnect, device number 7 [ 37.872928][ T355] usb 5-1: USB disconnect, device number 5 [ 37.946241][ T20] usb 2-1: USB disconnect, device number 5 [ 37.963073][ T24] audit: type=1400 audit(1786307397.980:183): avc: denied { mount } for pid=654 comm="syz.1.136" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 37.985167][ T25] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x4 has invalid wMaxPacketSize 0 [ 37.994956][ T25] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 0 [ 38.004666][ T25] usb 1-1: New USB device found, idVendor=0424, idProduct=012c, bcdDevice= 0.00 [ 38.013691][ T25] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 38.349897][ T657] netlink: 'syz.2.137': attribute type 4 has an invalid length. [ 38.357777][ T657] netlink: 17 bytes leftover after parsing attributes in process `syz.2.137'. [ 38.437691][ T24] audit: type=1400 audit(1786307398.450:184): avc: denied { read } for pid=669 comm="syz.2.142" name="usbmon0" dev="devtmpfs" ino=154 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 38.460842][ T24] audit: type=1400 audit(1786307398.460:185): avc: denied { open } for pid=669 comm="syz.2.142" path="/dev/usbmon0" dev="devtmpfs" ino=154 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 38.511255][ T678] tipc: Started in network mode [ 38.516229][ T678] tipc: Own node identity 785634120000000021436587, cluster identity 4711 [ 38.525276][ T678] tipc: Enabled bearer , priority 10 [ 38.759761][ T287] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 38.849798][ T355] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 39.084714][ T20] usb 4-1: USB disconnect, device number 6 [ 39.091656][ T355] usb 2-1: Using ep0 maxpacket: 32 [ 39.139782][ T287] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 39.150780][ T287] usb 5-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 39.159854][ T287] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 39.168263][ T287] usb 5-1: config 0 descriptor?? [ 39.209877][ T355] usb 2-1: New USB device found, idVendor=0ac8, idProduct=0321, bcdDevice=6f.be [ 39.218995][ T355] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 39.227531][ T355] usb 2-1: config 0 descriptor?? [ 39.489763][ T20] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 39.499902][ T287] usbhid 5-1:0.0: can't add hid device: -71 [ 39.506007][ T287] usbhid: probe of 5-1:0.0 failed with error -71 [ 39.513601][ T287] usb 5-1: USB disconnect, device number 6 [ 39.639762][ T25] tipc: 32-bit node address hash set to 95511559 [ 39.729767][ T20] usb 4-1: Using ep0 maxpacket: 32 [ 39.849783][ T20] usb 4-1: config 0 has an invalid interface number: 67 but max is 0 [ 39.857906][ T20] usb 4-1: config 0 has no interface number 0 [ 39.999789][ T287] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 40.019949][ T20] usb 4-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 40.029135][ T20] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 40.037368][ T20] usb 4-1: Product: syz [ 40.041756][ T20] usb 4-1: Manufacturer: syz [ 40.046411][ T20] usb 4-1: SerialNumber: syz [ 40.060041][ T20] usb 4-1: config 0 descriptor?? [ 40.110215][ T20] smsc95xx v2.0.0 [ 40.174458][ T24] audit: type=1400 audit(1786307400.190:186): avc: denied { mount } for pid=717 comm="syz.2.163" name="/" dev="devtmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 40.210741][ T395] usb 1-1: USB disconnect, device number 6 [ 40.379788][ T287] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 40.390718][ T287] usb 5-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.40 [ 40.399789][ T287] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 40.408391][ T287] usb 5-1: config 0 descriptor?? [ 40.439921][ T15] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 40.549807][ T20] smsc95xx 4-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -32 [ 40.560605][ T20] smsc95xx 4-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 40.569855][ T395] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 40.799863][ T15] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a7, bcdDevice= 1.00 [ 40.809091][ T15] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 40.969975][ T395] usb 1-1: unable to get BOS descriptor or descriptor too short [ 41.050638][ T395] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 41.060785][ T395] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 41.070340][ T15] cdc_acm 3-1:1.0: ttyACM0: USB ACM device [ 41.220004][ T395] usb 1-1: New USB device found, idVendor=1235, idProduct=0010, bcdDevice= 0.40 [ 41.229236][ T395] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 41.237255][ T395] usb 1-1: Product: syz [ 41.239943][ T20] smsc95xx 4-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000020: -32 [ 41.241505][ T395] usb 1-1: Manufacturer: syz [ 41.252936][ T20] smsc95xx: probe of 4-1:0.67 failed with error -32 [ 41.256756][ T395] usb 1-1: SerialNumber: syz [ 41.269212][ T317] udevd[317]: setting mode of /dev/bus/usb/004/007 to 020664 failed: Read-only file system [ 41.279407][ T317] udevd[317]: setting owner of /dev/bus/usb/004/007 to uid=0, gid=0 failed: Read-only file system [ 41.293015][ T317] udevd[317]: symlink '../bus/usb/004/007' '/dev/char/189:390.tmp-c189:390' failed: Read-only file system [ 41.310505][ T395] usb 1-1: selecting invalid altsetting 1 [ 41.316418][ T395] usb 1-1: unit 6 not found! [ 41.329951][ T672] udc-core: couldn't find an available UDC or it's busy [ 41.336938][ T672] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 41.349799][ T287] aiptek 5-1:0.0: Aiptek using 400 ms programming speed [ 41.357365][ T287] input: Aiptek as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/input/input5 [ 41.593507][ T15] usb 2-1: USB disconnect, device number 6 [ 41.759757][ C0] ================================================================================ [ 41.769041][ C0] UBSAN: array-index-out-of-bounds in drivers/input/tablet/aiptek.c:741:31 [ 41.777606][ C0] index 32639 is out of range for type 'const int[34]' [ 41.784439][ C0] CPU: 0 PID: 0 Comm: swapper/0 Not tainted syzkaller #0 [ 41.791441][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 41.801491][ C0] Call Trace: [ 41.804761][ C0] [ 41.807624][ C0] __dump_stack+0x21/0x24 [ 41.811969][ C0] dump_stack_lvl+0x1a7/0x208 [ 41.816647][ C0] ? show_regs_print_info+0x18/0x18 [ 41.821840][ C0] dump_stack+0x15/0x1c [ 41.825987][ C0] ubsan_epilogue+0xe/0x40 [ 41.830391][ C0] __ubsan_handle_out_of_bounds+0xdf/0xf0 [ 41.836100][ C0] aiptek_irq+0x1fa2/0x2860 [ 41.840592][ C0] __usb_hcd_giveback_urb+0x32f/0x4f0 [ 41.845950][ C0] usb_hcd_giveback_urb+0x11d/0x3f0 [ 41.851161][ C0] ? _raw_spin_unlock+0x4d/0x70 [ 41.856005][ C0] ? usb_hcd_unlink_urb_from_ep+0x10e/0x120 [ 41.861884][ C0] dummy_timer+0xa34/0x31d0 [ 41.866415][ C0] ? dummy_free_streams+0x5c0/0x5c0 [ 41.871603][ C0] ? __kasan_check_write+0x14/0x20 [ 41.876706][ C0] ? _raw_spin_lock_irq+0x95/0xf0 [ 41.881720][ C0] ? _raw_spin_lock_irqsave+0x130/0x130 [ 41.887267][ C0] ? dummy_free_streams+0x5c0/0x5c0 [ 41.892449][ C0] call_timer_fn+0x38/0x290 [ 41.896950][ C0] ? dummy_free_streams+0x5c0/0x5c0 [ 41.902136][ C0] __run_timers+0x637/0x9a0 [ 41.906638][ C0] ? calc_index+0x200/0x200 [ 41.911221][ C0] ? sched_clock_cpu+0x1b/0x3d0 [ 41.916058][ C0] run_timer_softirq+0x6a/0xf0 [ 41.920802][ C0] __do_softirq+0x255/0x563 [ 41.925288][ C0] ? __this_cpu_preempt_check+0x13/0x20 [ 41.930813][ C0] asm_call_irq_on_stack+0xf/0x20 [ 41.935828][ C0] [ 41.938756][ C0] do_softirq_own_stack+0x60/0x80 [ 41.943768][ C0] __irq_exit_rcu+0x128/0x150 [ 41.948432][ C0] irq_exit_rcu+0x9/0x10 [ 41.952657][ C0] sysvec_apic_timer_interrupt+0xbf/0xe0 [ 41.958306][ C0] asm_sysvec_apic_timer_interrupt+0x12/0x20 [ 41.964268][ C0] RIP: 0010:default_idle+0x12/0x20 [ 41.969364][ C0] Code: 49 bd 00 00 00 00 00 fc ff df e9 68 ff ff ff e8 74 f8 fa ff 00 00 cc cc 55 48 89 e5 0f 1f 44 00 00 0f 00 2d 60 40 63 00 fb f4 <5d> c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 55 48 89 e5 41 57 41 56 [ 41.989040][ C0] RSP: 0018:ffffffff86407d78 EFLAGS: 00000242 [ 41.995091][ C0] RAX: ffff8881f7000000 RBX: ffffffff8641c100 RCX: 000000000003221a [ 42.003061][ C0] RDX: 0000000000000001 RSI: ffffffff85406480 RDI: ffffffff85406440 [ 42.011060][ C0] RBP: ffffffff86407d78 R08: ffff8881f70573d3 R09: 1ffff1103ee0ae7a [ 42.019046][ C0] R10: dffffc0000000000 R11: ffffed103ee0ae7b R12: 0000000000000000 [ 42.027001][ C0] R13: 1ffffffff0c83820 R14: dffffc0000000000 R15: dffffc0000000000 [ 42.034965][ C0] arch_cpu_idle+0xa/0x10 [ 42.039280][ C0] default_idle_call+0x71/0x1d0 [ 42.044129][ C0] do_idle+0x368/0x620 [ 42.048182][ C0] ? idle_inject_timer_fn+0x60/0x60 [ 42.053363][ C0] cpu_startup_entry+0x18/0x20 [ 42.058135][ C0] rest_init+0xe8/0xf0 [ 42.062217][ C0] ? time_init+0x38/0x38 [ 42.066464][ C0] arch_call_rest_init+0xe/0x10 [ 42.071320][ C0] start_kernel+0x431/0x49f [ 42.075826][ C0] x86_64_start_reservations+0x2a/0x2c [ 42.081288][ C0] x86_64_start_kernel+0x60/0x63 [ 42.086213][ C0] secondary_startup_64_no_verify+0xad/0xbb [ 42.092089][ C0] ================================================================================ [ 42.101448][ C0] ================================================================== [ 42.109512][ C0] BUG: KASAN: global-out-of-bounds in aiptek_irq+0x1fc0/0x2860 [ 42.117048][ C0] Read of size 4 at addr ffffffff855cda7c by task swapper/0/0 [ 42.124479][ C0] [ 42.126804][ C0] CPU: 0 PID: 0 Comm: swapper/0 Not tainted syzkaller #0 [ 42.133800][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 42.143919][ C0] Call Trace: [ 42.147185][ C0] [ 42.150034][ C0] __dump_stack+0x21/0x24 [ 42.154356][ C0] dump_stack_lvl+0x1a7/0x208 [ 42.159019][ C0] ? show_regs_print_info+0x18/0x18 [ 42.164207][ C0] ? thaw_kernel_threads+0x220/0x220 [ 42.169472][ C0] print_address_description+0x7f/0x2c0 [ 42.175000][ C0] ? aiptek_irq+0x1fc0/0x2860 [ 42.179823][ C0] kasan_report+0x100/0x140 [ 42.184318][ C0] ? aiptek_irq+0x1fc0/0x2860 [ 42.188979][ C0] __asan_report_load4_noabort+0x14/0x20 [ 42.194599][ C0] aiptek_irq+0x1fc0/0x2860 [ 42.199086][ C0] __usb_hcd_giveback_urb+0x32f/0x4f0 [ 42.204444][ C0] usb_hcd_giveback_urb+0x11d/0x3f0 [ 42.209632][ C0] ? _raw_spin_unlock+0x4d/0x70 [ 42.214482][ C0] ? usb_hcd_unlink_urb_from_ep+0x10e/0x120 [ 42.220360][ C0] dummy_timer+0xa34/0x31d0 [ 42.224853][ C0] ? dummy_free_streams+0x5c0/0x5c0 [ 42.230033][ C0] ? __kasan_check_write+0x14/0x20 [ 42.235128][ C0] ? _raw_spin_lock_irq+0x95/0xf0 [ 42.240140][ C0] ? _raw_spin_lock_irqsave+0x130/0x130 [ 42.245672][ C0] ? dummy_free_streams+0x5c0/0x5c0 [ 42.250941][ C0] call_timer_fn+0x38/0x290 [ 42.255426][ C0] ? dummy_free_streams+0x5c0/0x5c0 [ 42.260607][ C0] __run_timers+0x637/0x9a0 [ 42.265183][ C0] ? calc_index+0x200/0x200 [ 42.269677][ C0] ? sched_clock_cpu+0x1b/0x3d0 [ 42.274531][ C0] run_timer_softirq+0x6a/0xf0 [ 42.279276][ C0] __do_softirq+0x255/0x563 [ 42.283773][ C0] ? __this_cpu_preempt_check+0x13/0x20 [ 42.289319][ C0] asm_call_irq_on_stack+0xf/0x20 [ 42.294336][ C0] [ 42.297401][ C0] do_softirq_own_stack+0x60/0x80 [ 42.302428][ C0] __irq_exit_rcu+0x128/0x150 [ 42.307105][ C0] irq_exit_rcu+0x9/0x10 [ 42.311378][ C0] sysvec_apic_timer_interrupt+0xbf/0xe0 [ 42.317026][ C0] asm_sysvec_apic_timer_interrupt+0x12/0x20 [ 42.322748][ T20] usb 4-1: USB disconnect, device number 7 [ 42.323050][ C0] RIP: 0010:default_idle+0x12/0x20 [ 42.333912][ C0] Code: 49 bd 00 00 00 00 00 fc ff df e9 68 ff ff ff e8 74 f8 fa ff 00 00 cc cc 55 48 89 e5 0f 1f 44 00 00 0f 00 2d 60 40 63 00 fb f4 <5d> c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 55 48 89 e5 41 57 41 56 [ 42.353520][ C0] RSP: 0018:ffffffff86407d78 EFLAGS: 00000242 [ 42.359598][ C0] RAX: ffff8881f7000000 RBX: ffffffff8641c100 RCX: 000000000003221a [ 42.367579][ C0] RDX: 0000000000000001 RSI: ffffffff85406480 RDI: ffffffff85406440 [ 42.373879][ T318] udevd[318]: symlink '../bus/usb/004/007' '/dev/char/189:390.tmp-c189:390' failed: Read-only file system [ 42.375554][ C0] RBP: ffffffff86407d78 R08: ffff8881f70573d3 R09: 1ffff1103ee0ae7a [ 42.375582][ C0] R10: dffffc0000000000 R11: ffffed103ee0ae7b R12: 0000000000000000 [ 42.402742][ C0] R13: 1ffffffff0c83820 R14: dffffc0000000000 R15: dffffc0000000000 [ 42.410726][ C0] arch_cpu_idle+0xa/0x10 [ 42.415042][ C0] default_idle_call+0x71/0x1d0 [ 42.419902][ C0] do_idle+0x368/0x620 [ 42.423962][ C0] ? idle_inject_timer_fn+0x60/0x60 [ 42.429162][ C0] cpu_startup_entry+0x18/0x20 [ 42.433910][ C0] rest_init+0xe8/0xf0 [ 42.437960][ C0] ? time_init+0x38/0x38 [ 42.442192][ C0] arch_call_rest_init+0xe/0x10 [ 42.447029][ C0] start_kernel+0x431/0x49f [ 42.451518][ C0] x86_64_start_reservations+0x2a/0x2c [ 42.456965][ C0] x86_64_start_kernel+0x60/0x63 [ 42.461892][ C0] secondary_startup_64_no_verify+0xad/0xbb [ 42.467777][ C0] [ 42.470103][ C0] The buggy address belongs to the variable: [ 42.476068][ C0] .str.185+0x1c/0x20 [ 42.480032][ C0] [ 42.482352][ C0] Memory state around the buggy address: [ 42.488066][ C0] ffffffff855cd900: 06 f9 f9 f9 06 f9 f9 f9 07 f9 f9 f9 04 f9 f9 f9 [ 42.496112][ C0] ffffffff855cd980: 04 f9 f9 f9 04 f9 f9 f9 00 05 f9 f9 00 00 00 00 [ 42.504254][ C0] >ffffffff855cda00: 00 00 00 f9 f9 f9 f9 f9 00 05 f9 f9 07 f9 f9 f9 [ 42.512431][ C0] ^ [ 42.520392][ C0] ffffffff855cda80: 04 f9 f9 f9 00 05 f9 f9 00 03 f9 f9 00 01 f9 f9 [ 42.528475][ C0] ffffffff855cdb00: 00 00 00 00 00 00 00 00 f9 f9 f9 f9 00 00 03 f9 [ 42.536528][ C0] ================================================================== [ 42.544577][ C0] Disabling lock debugging due to kernel taint [ 42.550724][ C0] ================================================================================ [ 42.559994][ C0] UBSAN: array-index-out-of-bounds in drivers/input/tablet/aiptek.c:763:30 [ 42.568572][ C0] index 32640 is out of range for type 'const int[34]' [ 42.575443][ C0] CPU: 0 PID: 0 Comm: swapper/0 Tainted: G B syzkaller #0 [ 42.583834][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 42.593871][ C0] Call Trace: [ 42.597153][ C0] [ 42.600007][ C0] __dump_stack+0x21/0x24 [ 42.604341][ C0] dump_stack_lvl+0x1a7/0x208 [ 42.609000][ C0] ? show_regs_print_info+0x18/0x18 [ 42.614180][ C0] ? __kasan_check_read+0x11/0x20 [ 42.620318][ C0] dump_stack+0x15/0x1c [ 42.624459][ C0] ubsan_epilogue+0xe/0x40 [ 42.628863][ C0] __ubsan_handle_out_of_bounds+0xdf/0xf0 [ 42.634576][ C0] aiptek_irq+0x1e71/0x2860 [ 42.639067][ C0] __usb_hcd_giveback_urb+0x32f/0x4f0 [ 42.644426][ C0] usb_hcd_giveback_urb+0x11d/0x3f0 [ 42.649616][ C0] ? _raw_spin_unlock+0x4d/0x70 [ 42.654450][ C0] ? usb_hcd_unlink_urb_from_ep+0x10e/0x120 [ 42.660361][ C0] dummy_timer+0xa34/0x31d0 [ 42.664868][ C0] ? dummy_free_streams+0x5c0/0x5c0 [ 42.670070][ C0] ? __kasan_check_write+0x14/0x20 [ 42.675168][ C0] ? _raw_spin_lock_irq+0x95/0xf0 [ 42.680183][ C0] ? _raw_spin_lock_irqsave+0x130/0x130 [ 42.685734][ C0] ? dummy_free_streams+0x5c0/0x5c0 [ 42.690920][ C0] call_timer_fn+0x38/0x290 [ 42.695412][ C0] ? dummy_free_streams+0x5c0/0x5c0 [ 42.700608][ C0] __run_timers+0x637/0x9a0 [ 42.705102][ C0] ? calc_index+0x200/0x200 [ 42.709633][ C0] ? sched_clock_cpu+0x1b/0x3d0 [ 42.714493][ C0] run_timer_softirq+0x6a/0xf0 [ 42.719252][ C0] __do_softirq+0x255/0x563 [ 42.723766][ C0] ? __this_cpu_preempt_check+0x13/0x20 [ 42.729295][ C0] asm_call_irq_on_stack+0xf/0x20 [ 42.734299][ C0] [ 42.737250][ C0] do_softirq_own_stack+0x60/0x80 [ 42.742289][ C0] __irq_exit_rcu+0x128/0x150 [ 42.746967][ C0] irq_exit_rcu+0x9/0x10 [ 42.751200][ C0] sysvec_apic_timer_interrupt+0xbf/0xe0 [ 42.756838][ C0] asm_sysvec_apic_timer_interrupt+0x12/0x20 [ 42.759847][ T20] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 42.762812][ C0] RIP: 0010:default_idle+0x12/0x20 [ 42.762822][ C0] Code: 49 bd 00 00 00 00 00 fc ff df e9 68 ff ff ff e8 74 f8 fa ff 00 00 cc cc 55 48 89 e5 0f 1f 44 00 00 0f 00 2d 60 40 63 00 fb f4 <5d> c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 55 48 89 e5 41 57 41 56 [ 42.762849][ C0] RSP: 0018:ffffffff86407d78 EFLAGS: 00000242 [ 42.801089][ C0] RAX: ffff8881f7000000 RBX: ffffffff8641c100 RCX: 000000000003221a [ 42.809062][ C0] RDX: 0000000000000001 RSI: ffffffff85406480 RDI: ffffffff85406440 [ 42.817021][ C0] RBP: ffffffff86407d78 R08: ffff8881f70573d3 R09: 1ffff1103ee0ae7a [ 42.824978][ C0] R10: dffffc0000000000 R11: ffffed103ee0ae7b R12: 0000000000000000 [ 42.832935][ C0] R13: 1ffffffff0c83820 R14: dffffc0000000000 R15: dffffc0000000000 [ 42.840902][ C0] arch_cpu_idle+0xa/0x10 [ 42.845221][ C0] default_idle_call+0x71/0x1d0 [ 42.850068][ C0] do_idle+0x368/0x620 [ 42.854124][ C0] ? idle_inject_timer_fn+0x60/0x60 [ 42.859306][ C0] cpu_startup_entry+0x18/0x20 [ 42.864059][ C0] rest_init+0xe8/0xf0 [ 42.868115][ C0] ? time_init+0x38/0x38 [ 42.872350][ C0] arch_call_rest_init+0xe/0x10 [ 42.877204][ C0] start_kernel+0x431/0x49f [ 42.881727][ C0] x86_64_start_reservations+0x2a/0x2c [ 42.887191][ C0] x86_64_start_kernel+0x60/0x63 [ 42.892137][ C0] secondary_startup_64_no_verify+0xad/0xbb [ 42.898013][ C0] ================================================================================ [ 42.909675][ T395] usb 1-1: cannot get ctl value: req = 0x84, wValue = 0x100, wIndex = 0x200, type = 3 [ 42.920661][ T355] usb 5-1: USB disconnect, device number 7 [ 42.990198][ T395] snd-usb-audio: probe of 1-1:1.0 failed with error -22 [ 43.183057][ T355] usb 3-1: USB disconnect, device number 8 [ 43.189840][ T20] usb 4-1: config 0 has an invalid interface number: 117 but max is 0 [ 43.196484][ T24] audit: type=1400 audit(1786307403.210:187): avc: denied { unmount } for pid=282 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 43.206245][ T20] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 43.218846][ T15] usb 1-1: USB disconnect, device number 7 [ 43.240857][ T20] usb 4-1: config 0 has no interface number 0 [ 43.249377][ T20] usb 4-1: config 0 interface 117 altsetting 0 endpoint 0x88 has an invalid bInterval 0, changing to 7 [ 43.260887][ T20] usb 4-1: config 0 interface 117 altsetting 0 endpoint 0x88 has invalid wMaxPacketSize 0 [ 43.270832][ T20] usb 4-1: config 0 interface 117 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 43.440056][ T20] usb 4-1: New USB device found, idVendor=0afa, idProduct=03e8, bcdDevice=99.d0 [ 43.450062][ T20] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 43.458946][ T20] usb 4-1: Product: syz [ 43.463129][ T20] usb 4-1: Manufacturer: syz [ 43.467719][ T20] usb 4-1: SerialNumber: syz [ 43.473287][ T20] usb 4-1: config 0 descriptor?? [ 45.373155][ T15] usb 4-1: USB disconnect, device number 8