last executing test programs: 7.628975776s ago: executing program 0 (id=514): socket$packet(0x11, 0x3, 0x300) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) syz_usb_connect(0x0, 0x107, &(0x7f0000000200)=ANY=[@ANYBLOB="12010000b2111d40c71b10905336000000010902f50001000000000904"], 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = dup(r1) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000080)=[@text64={0x40, &(0x7f00000000c0)="0f20c035000000200f22c0b9b1030000b8f0ffffffbaffffff7f0f3066baf80cb8bb0e708bef66bafc0cb044ee440f20c03507000000440f22c0410f185e4666b86a008ed8440f0748b80d180000000000000f23c00f21f835010002000f23f8c4217d29d9a20068000000000000", 0x6e}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CAP_X86_USER_SPACE_MSR(r2, 0x4068aea3, &(0x7f0000000180)={0xbc, 0x0, 0x2}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000500)={'syzkaller1\x00', 0x5001}) ioctl$TUNSETVNETHDRSZ(r4, 0x400454d8, &(0x7f0000000540)=0xc) r5 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r5, 0x11, 0x66, &(0x7f0000000580)=0x1, 0x4) bind$inet6(r5, &(0x7f00000005c0)={0xa, 0x20e6, 0x0, @empty}, 0x1c) setsockopt$inet6_udp_int(r5, 0x11, 0x68, &(0x7f0000000600)=0x80000000, 0x4) write$tun(r4, &(0x7f0000000680)=ANY=[@ANYBLOB="010530000a0028000600000060000000003011402001000000000000"], 0x64) ioctl$KVM_RUN(r3, 0xae80, 0x0) 6.30787513s ago: executing program 0 (id=525): r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x0) sendmsg$key(r0, &(0x7f00000001c0)={0x500, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=ANY=[@ANYBLOB="020100030e000000fcffffff04000000050006"], 0x70}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x400008a, 0x0) 6.20917629s ago: executing program 0 (id=527): r0 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)=@newqdisc={0x24, 0x24, 0xd0f, 0x170bd2b, 0x25dfdbff, {0x60, 0x0, 0x0, r2, {}, {0xe, 0xa}, {0xf, 0x1}}}, 0x24}, 0x1, 0x0, 0x0, 0x48045}, 0x0) 6.20890434s ago: executing program 0 (id=528): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000b40)=ANY=[@ANYBLOB="9f01000083667d1040206402d14e0102030109021b000100000000090400000190f19c000905f3ed"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$uac2(r0, 0x0, &(0x7f00000006c0)={0x44, &(0x7f00000004c0)={0x20, 0x18, 0x2, "f88d"}, 0x0, 0x0, &(0x7f0000000580)={0x20, 0x81, 0x1, "a2"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000440)={0x44, &(0x7f0000000180)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac3(r0, 0x0, 0x0) syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f0000001000)={0x1c, &(0x7f0000000200)=ANY=[], 0x0, 0x0}) 5.864032305s ago: executing program 2 (id=533): mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) getuid() r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r2, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x7}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_JOIN_MESH(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x28, r2, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_MESH_ID={0xa}]}, 0x28}}, 0x0) sendmsg$NL80211_CMD_NEW_STATION(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x3c, r2, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_STA_AID={0x6, 0x10, 0x1}, @NL80211_ATTR_STA_LISTEN_INTERVAL={0x6, 0x12, 0x1}, @NL80211_ATTR_STA_SUPPORTED_RATES={0x4}]}, 0x3c}}, 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000001500)={0x0, 0x0, &(0x7f0000001540)={&(0x7f0000001580)=@newsa={0x104, 0x10, 0x1, 0x0, 0x0, {{@in=@private=0xa010101, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0xa}, {@in6=@remote, 0x0, 0x2b}, @in6=@empty, {}, {}, {}, 0x0, 0x0, 0xa, 0x2}, [@coaddr={0x14, 0xe, @in6=@remote}]}, 0x104}}, 0x0) r5 = socket$inet6(0xa, 0x2, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000001800), 0x0, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000001840)={'syzkaller0\x00', 0x7101}) r7 = socket(0x400000000010, 0x3, 0x0) r8 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000001880)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f00000018c0)={0x0, 0x0, &(0x7f0000001900)={&(0x7f0000001940)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r9, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x0, 0x3}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000001980)={0x0, 0x0, &(0x7f00000019c0)={&(0x7f0000001a00)=@newtfilter={0x84, 0x2c, 0xd27, 0x70bd28, 0x25dfdc00, {0x0, 0x0, 0x0, r9, {0x9, 0xfff3}, {}, {0xfff1, 0x4}}, [@filter_kind_options=@f_matchall={{0xd}, {0x50, 0x2, [@TCA_MATCHALL_ACT={0x4c, 0x2, [@m_gact={0x48, 0x1, 0x0, 0x0, {{0x9}, {0x1c, 0x2, 0x0, 0x1, [@TCA_GACT_PARMS={0x18, 0x2, {0x2, 0x8ba4, 0x3, 0x100000a, 0x8}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x2, 0x3}}}}]}]}}]}, 0x84}, 0x1, 0x0, 0x0, 0x10}, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r5, 0x29, 0x23, &(0x7f00000016c0)={{{@in=@multicast1, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@remote, 0x0, 0x3c}, 0xa, @in=@broadcast, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1}}, 0xe8) sendto$inet6(r5, 0x0, 0x0, 0x0, &(0x7f00000017c0)={0xa, 0x1234, 0x0, @remote}, 0x1c) sendmsg$NL80211_CMD_DEL_INTERFACE(r1, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000003c0)={0x1c, r2, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$NL80211_CMD_SET_WOWLAN(r0, &(0x7f00000014c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000001480)={0x0}, 0x1, 0x0, 0x0, 0x4c041}, 0x20004001) 5.817236929s ago: executing program 2 (id=534): sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=ANY=[@ANYBLOB="100029bd7000ffdbdf250e000000340041090800080006000000060002004e200000080007"], 0x48}, 0x1, 0x0, 0x0, 0x40081c4}, 0x44000) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=ANY=[@ANYBLOB="480000001000010400000000", @ANYBLOB='\x00\x00\x00\x00\x00\x00'], 0x48}}, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0x8, 0x0, 0x8, 0x9b99}, 0x25, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x6, 0x2dcd, 0x1, 0xb4, 0x8, 0xa2b9, 0x6, 0x7, 0xe1, 0x6, 0x9, 0x403, 0xbbf, 0x3, 0xfffffffd, 0xfffffff7, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x8002, 0x8a, 0x79, 0x2, 0x10080, 0x3c, 0x91, 0x129, 0x4, 0x16, 0x5, 0x5, 0x401, 0x1, 0x3, 0xa7, 0x81, 0x709, 0xf9a2, 0xa9, 0xff, 0xffffffff, 0x2, 0x2, 0x2, 0x7, 0x5, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x8, 0x4], [0x401, 0x3, 0x6, 0x9, 0x6, 0x8000c66, 0xa8a9, 0x2000006f, 0x8e, 0xd50, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0xfa8, 0x200b398, 0x8001, 0xfffffffe, 0x4, 0x1c, 0x0, 0x1, 0xfffffffe, 0x9, 0x8, 0xffffff7f, 0x6, 0x6, 0x9, 0x40000004, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x7, 0xeb00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3fe, 0x1ff, 0x1, 0x8001, 0x67b2, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0x10, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x5, 0x494, 0x7, 0x200026, 0x7f, 0x400, 0x102, 0x1, 0x41, 0x6, 0x2ee4b, 0x2000004, 0x1, 0xc, 0x5, 0x9, 0x5, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x10000a, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x40, 0x800003, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x2, 0x7ffe, 0x28, 0x5, 0xd500, 0x1, 0x77, 0x5, 0x6, 0x10000, 0x8, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7f7, 0xff, 0x1005, 0x10000001, 0x4, 0x21, 0x8, 0x81, 0x7, 0x9d87, 0x8, 0x8, 0x4, 0x140f1, 0x5396, 0x3, 0x4, 0x80008001, 0xbbd6, 0x1, 0x2, 0x100, 0x200d8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0xbe, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x8, 0x274, 0x6, 0xfffffff9, 0x7, 0x9, 0x9, 0x4, 0x463f, 0xf, 0xdab, 0x5, 0x8, 0x13fff, 0x8, 0xab6b]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) signalfd(0xffffffffffffffff, &(0x7f0000000340)={[0x4]}, 0x8) syz_genetlink_get_family_id$tipc2(&(0x7f0000000380), 0xffffffffffffffff) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_MEMORY_ATTRIBUTES(r2, 0x4020aed2, &(0x7f00000001c0)={0x60000, 0x18000, 0x9fef19c9430e26b8}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0x8], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="2800000012000100"/20, @ANYRES32=0x0, @ANYBLOB="000000000000000408001d00ff03"], 0x28}, 0x1, 0x0, 0x0, 0x2000}, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = dup(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text64={0x40, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) 4.806604512s ago: executing program 2 (id=535): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = dup(r1) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000080)=[@text64={0x40, &(0x7f00000000c0)="0f20c035000000200f22c0b9b1030000b8f0ffffffbaffffff7f0f3066baf80cb8bb0e708bef66bafc0cb044ee440f20c03507000000440f22c0410f185e4666b86a008ed8440f0748b80d180000000000000f23c00f21f835010002000f23f8c4217d29d9a20068000000000000", 0x6e}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CAP_X86_USER_SPACE_MSR(r2, 0x4068aea3, &(0x7f0000000180)={0xbc, 0x0, 0x2}) ioctl$KVM_RUN(r3, 0xae80, 0x0) 4.738736929s ago: executing program 2 (id=536): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)=ANY=[@ANYBLOB="8800000000010104000000000000000002000000240001801400018008000100ac1e000108000200e00000d60c0002800500010000000000240002800c000280050001000000000014000180080001000000000008000200e00000020800074000000000080039774de300001c001880"], 0x88}}, 0x0) 4.689057594s ago: executing program 2 (id=537): r0 = socket$packet(0x11, 0x2, 0x300) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000780)={'batadv_slave_1\x00', 0x0}) setsockopt$packet_add_memb(r0, 0x107, 0x1, &(0x7f00000007c0)={r1, 0x1, 0x6, @multicast}, 0x10) setsockopt$packet_add_memb(r0, 0x107, 0x1, &(0x7f0000000800)={r1, 0x1, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x34}}, 0x10) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x4) r4 = syz_usb_connect(0x0, 0x2b, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000408106050000010000000109021900010100803209040000010a00000007058102"], 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x10000) r5 = dup(r2) ioctl$F2FS_IOC_SET_COMPRESS_OPTION(r5, 0x4002f516, &(0x7f0000000040)={0x5, 0x2a}) syz_usb_control_io$printer(r4, 0x0, 0x0) sendmsg$IPVS_CMD_SET_INFO(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000005c0)={0x0, 0x14}}, 0x0) getsockname$packet(r3, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000640)=0x14) sendmsg$nl_route(r2, &(0x7f0000000680)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000700)=@newlink={0x50, 0x10, 0xffffff1f, 0x0, 0x80, {0x0, 0x0, 0x0, 0x0, 0x300, 0x17e05}, [@IFLA_MASTER={0x8, 0xa, r6}, @IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @veth={{0x9}, {0x18, 0x2, 0x0, 0x1, @val=@VETH_INFO_PEER={0x14, 0x1, {{0x0, 0x0, 0x0, 0x0, 0x4000, 0x640}}}}}}]}, 0x50}, 0x1, 0x0, 0x0, 0x2000c0c1}, 0x0) 4.316010632s ago: executing program 3 (id=539): sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=ANY=[@ANYBLOB="100029bd7000ffdbdf250e00000034004109080008000600000006"], 0x48}, 0x1, 0x0, 0x0, 0x40081c4}, 0x44000) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=ANY=[@ANYBLOB="480000001000010400000000", @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00('], 0x48}}, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0x8, 0x0, 0x8, 0x9b99}, 0x25, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x6, 0x2dcd, 0x1, 0xb4, 0x8, 0xa2b9, 0x6, 0x7, 0xe1, 0x6, 0x9, 0x403, 0xbbf, 0x3, 0xfffffffd, 0xfffffff7, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x8002, 0x8a, 0x79, 0x2, 0x10080, 0x3c, 0x91, 0x129, 0x4, 0x16, 0x5, 0x5, 0x401, 0x1, 0x3, 0xa7, 0x81, 0x709, 0xf9a2, 0xa9, 0xff, 0xffffffff, 0x2, 0x2, 0x2, 0x7, 0x5, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x8, 0x4], [0x401, 0x3, 0x6, 0x9, 0x6, 0x8000c66, 0xa8a9, 0x2000006f, 0x8e, 0xd50, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0xfa8, 0x200b398, 0x8001, 0xfffffffe, 0x4, 0x1c, 0x0, 0x1, 0xfffffffe, 0x9, 0x8, 0xffffff7f, 0x6, 0x6, 0x9, 0x40000004, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x7, 0xeb00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3fe, 0x1ff, 0x1, 0x8001, 0x67b2, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0x10, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x5, 0x494, 0x7, 0x200026, 0x7f, 0x400, 0x102, 0x1, 0x41, 0x6, 0x2ee4b, 0x2000004, 0x1, 0xc, 0x5, 0x9, 0x5, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x10000a, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x40, 0x800003, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x2, 0x7ffe, 0x28, 0x5, 0xd500, 0x1, 0x77, 0x5, 0x6, 0x10000, 0x8, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7f7, 0xff, 0x1005, 0x10000001, 0x4, 0x21, 0x8, 0x81, 0x7, 0x9d87, 0x8, 0x8, 0x4, 0x140f1, 0x5396, 0x3, 0x4, 0x80008001, 0xbbd6, 0x1, 0x2, 0x100, 0x200d8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0xbe, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x8, 0x274, 0x6, 0xfffffff9, 0x7, 0x9, 0x9, 0x4, 0x463f, 0xf, 0xdab, 0x5, 0x8, 0x13fff, 0x8, 0xab6b]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) signalfd(0xffffffffffffffff, &(0x7f0000000340)={[0x4]}, 0x8) syz_genetlink_get_family_id$tipc2(&(0x7f0000000380), 0xffffffffffffffff) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_MEMORY_ATTRIBUTES(r2, 0x4020aed2, &(0x7f00000001c0)={0x60000, 0x18000, 0x9fef19c9430e26b8}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0x8], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="2800000012000100"/20, @ANYRES32=0x0, @ANYBLOB="000000000000000408001d00ff03"], 0x28}, 0x1, 0x0, 0x0, 0x2000}, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = dup(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) 4.188493135s ago: executing program 3 (id=540): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='hugetlb.1GB.rsvd.usage_in_bytes\x00', 0x275a, 0x0) write$UHID_INPUT(r0, &(0x7f00000007c0)={0x8, {"85f080a4933d55266e07e799aa0cc421388242df2a3c6b631b65b1c061edd2aa108c3528fe9b0bb3a53ab1200f5d01a68a4acdec8fee09648222f908c1fedc3000342e6139de28366c13509306d00ebcc67497181ac916db98af9d366b76e427d9ab5bb68095f0fb246df32b8af0783653136f8a04c03690312125c7ded6a24fda8685340c575ead69519e3583f89d467ec232d6a1ffd0463ba4ea3cbae5dae6654b5547b5458f02ac307729e57b09e134f68be44f88d72517b230b066f6315b5fb80206397bbff8cbc2a36e01c2e7b3aadb32bd3dd5288a69a991d9c674717e3abba7167280b2db3b1b8502afa4f3f296c532510c9d2dd79bb5eeb25adb5edddbdd069c09d14d15c2e7e1e2bd6c108fab3591bb22e97d6992236d2273c8bb95536f7118d007965008b125c7daac2814e6bbe1adbfa3572ad0b7ad5c26c8014118d8374ca9f285779dfee7715a403908146a74de61b3853914c89f444c12e7a38bdd46c4ed36eb806ea598f44d1dec9eff9e2476f43802211f0762b66673b45d236b2391ce322e30fb9c69fe0d514dc1f8b6e3979c1205fd5224b07d18a44fec4f6f1a6f65158bb6adcc295bf2dd7dea107f59d7e03c61fe5822292e45968956b931bdc4d6445ff1631e0b98e4b4448774dd4b9cd53a45896fdb3f03702778741ae2b45a25bf9a23fc02fb97a630f132bf9def6c6d4a7baeb62972f1a814f6f2377bcfc78e2e86368c138510a04cedf7175af8c2034fae7413e3ace8c71ab9a0af1ca7042011a6ed028e205648535dabf3b2f85196ae18d36b839e3cd54ae4933ad529888fdac7bb8a70c72bc0fc81ba06506f2d5bc7686e219bbe5283959cbef9950e071cb6d9f341fc624a5110341f26cebd7100599a06e61f66fae120c7fc2b34c6221200eba75bd1277114671a3fa8f058b27fd897b052f4a52afcea814df526181c75c4497210a2b8b74e26601561e78735387cf123654b0295d1d60556956b36d96dd038866c4b4db31ebdcddd4829bbc2850cd4901389e6ea6e86041e0efa1158f334e7afda0e11c2fb0e6df6364cb95659f506d5c7e63fb67c8116577d15e4a4b1fc4c27de2e52586cb1f52be9c3601f5066549de8bdc3ec07d1a84caf1961323ec2487a37b751aeabafcd647ce2dae5d9499c0f969467e6cabad198669ac96bd1488954eff0854ee0c83d7b596d273625bdb16270782321071fda5d980ded78ffa9dc2b56037d7cbf942547f48a5131f1991f6c17ae1ed5120ca6878f98e68e7997a9a2b70be640a70a34adb80de286c6692abb5f092e4e3a15a83217e03d02a4054f34af3a65ff6b36f395b76a0579cffafd5d3bb0e704c935caecf3a7ab756c23fd60c9fe3f4fb2be7504f5bae22b116ff1588dcf02b327d31bf0488dba8af5b33ccf2d7d87f43bbc48fcd4f191ad6af9313ad38b8b29674bfabd6651bc1f6ce5abb4a2f1413194f96b26d7d6edc4e013fba549075c97eef508af5ca7873664b058b7bcf455a8a04b591d29fab6366c844bb75576bac2d52323e747303d00a5736c9812922b0e17bcec9135550736b54cf6407d61e22e62d7bb75f62935b665acf33e75f688c36ef416f1b890d0f0c8ad1df00e02ec45967834d5649c8e7143978622fa3704672970b7993a87e97d3d926a14265647bc8b8c9e6f83e29572608d24b42c2635ef4abbd0af83860e99c90d7471cf6e8ce99507f5ec2bc572212fa9ee3f5a9dfa3815fe55f0bbb119acce062ae37f2ff921707abba139bccdf42bfd174d29b540161b4113c4e1a13f3a628c638ec4d3a884dfbc093e23ec0d0671b46b41dc8b42d950c8615ba5ee87f49b5d0910ffa4871207995001920db05a95199967f097ba7b55bbd271d818690c4238406b40a3dfc42fa56a67173b53a96b543326c56738b6d043195934018696f5ab49347e5148a78f2d1369a71afab8330273d46ecfba4ee05802a5385649851db949dbfb39e290941641c50b1ac20fb3102754a760b097f464ddb0b83f8168badfa71db6621dcf22fb081e3403f3bac5c7e65905aca52885c807f8ddab18bb2f12ef952c50483c0e251968bc70ff0d42a638ca744dea4c7ebb4fea777cf663bb4f1505ed79730c45bc86e488a13f924377a8e2ee6670a02ca52874ae1c42a35d55b9765757047b2cc3742aa51fa3e43fb2c113c92ad213bad252c1a82966dd016f12a7f1c3900c0f1ab455035163f31899bdd30f3ff43ad17d9e45bb7438c1c986712736f24be14f71ab1bfe92a25ec07f086ee8c7971b8077a13e58a8e8bea39c8e06b251909f02cb0080abf020f27ca160eb26c082dda1fa54ea4094dfdbcb2fa7bddccb67a844e8075f4cc08dad35757006d051e183dced336bc0c2502f93ffc87dca622286ba174c24e1f53f27dc2777baafe170348b0e8d3e743b3aa906bc0764bbe7da08ff403efe2212627d672250658bb513b7312517d1f88c61c7ba5f9647cd619281c5b390b48606ee39fb4171103df2e09d7cfd56c06c721f7c24ad8cce383623fc2dcb15ac56438ea331820ae59c8c474e36fc73f7b1b3b86df1b42490815513681aafbf7e871b4b9686efae6c45ecfca60a640a6f071dfd31f9437c3d03086164b48c1ed802986864bfe0d49bdd7709662262368dbc3ecc05eb240ecc41904c76d78ab5c52b66af5a720fdd6a92f52be0676427a56e32e5bc5085b25f90add28a76f2fce6f8f0ef74f4659698549646bd63175adf77b5cdcfe676e1b1a9af15102946554ba6136cbc83c6268ee40318f3c9d4718025688b35d2265bf60bf889ff629f7834586ef46eab7a9176337536bb6001e676546b987f36b1fe4b9f6e46a8ce73eb22ebbb9c14d8e2b43ea77ef887e5a26448f4086fa819a25e27725ac10298851c8bc45f2ce4430b07917ade5ea8c434c3f2576effbeb521173736e5c9557450643068b0c0fb132a7e99de6ca292246a9937fa7d7e06e59cf59ce5b9f842629049931146af40a8a1256ba373a88d09dc00cdf4453cc6ba78572bf3e1f2352a978cdbad60220cb8ac37d7f614a306492a4b5eee9244b0ca84b6cf2e23013bfb1cb92bf6d126fe550e58c19f84e7a4081437b75b31b2b9fb658dcd8ba077962e0f3359721a148d4fefe5c97941ca9688cb85adf38fd10f5811cdd8e074a21bbfc9541c71465b08d7321281b68ed52bfab789b9c83849c09d52376d419b1e7ba367603236e119cdf4a7b7cf9d81f2229601deace53cea2f14a05f7fa0ca04b39e31c6453e332f4bd0915c0e09e28f4d1125c390c6ff0833a04b6fc37855e65de90333e505b9eb66e00686a3ed499cfb7b8b215dbdc9787b5baa724cfa71ee6745b41e203de8b7794757ac328ec5567540b951b50530c3d4ee34705ea1c66fd6591e88561083e86d48c45ef3b83a3029319d8f3d8e65ce14c1dc3cb92d0a7dbeb609a8d2793928caa079f0fbbb2bc90b9f058cc048f4032041d14c5bca00e99b3027ec3a50c4957199cf016a4594069af8659df0973f20ffb15dbc265ac5b8a2203e90b114a3e9441e357c60ce0b550a7fe66fc34f5702ac8e8992a22e89194c1df69e81a9b7ad3d2634ea8c0388588192fd47d8e803b10044d558617fb2921b69eb4d85c051f86ef63a2f4382b9becd870fb2ecadca6902712b88680792e2f2ec89591cfebb6db3ad31c2a339af10465fcf7988519d382218df52261234f26a6f66ad0d1859de505d0fe819caf2f8d30aa9fd1228ac91d11ca67f1f8d50c8eefa5c441514321507dff6c6ea3cff6f340a1c11e0c40f419e8e60fc94d8828fa47a96cdf7ee4f61e23f40751b25cf9ca1295041a350f83f0e679515d6b4b46e2c9ce8999e07f835abc1663cefcf728df37831f4e17f8c8a4feaf1fbf44c38c9313284404a50ba4cd8abe835b33bfecb02cd6c9d7f435853b4c8d505ab83cf46512739116694765658bae64b3127152d216055aef9b25c70a8a3b302752d7b1e8791c657b9f3fc9001ef299fd1a349491ae6ee9940149160507fc4130fb825d47d97dc2c243209d2403583ac3ef6ddbedcaa76432255487c0a06e59e043e572ab3aec002af6a6b6a2dc9cfaeefa70557886c4d12924a0388f2f1bc8e89e4cfa69705d1ef3c4658f8616278b588011d9dd914beec0b151d65b6524fba3e3f235d58373e021699b07622a51504eade747e0b2f9cf38bc167cabc8cb18c708d1337e25648707e8c0872876514c7a49c0b2aaee5ed9e9ecfcbcc23e032c4deb63e48e7120188056468fad31448e4b42e7d62fbcfc1c2cfb01fcf0db5e8a162bdb9bd820c763f17b96c23f32db9d1c1d74ddbe657b4f9595a9796982a0742153111b15e484d8ffebe47ce0a78a41e470a341616ec2eb6eef813fb415fab50fa965bec6a5977a0ade4fed67f86fc24e11b0e2f5364079f7c7c35b560cac726dbc80f29dbd248f7ecda0286a23ef172a28c96d9bdb1f598eab31c6baf0321312da23920c074b9d2d2e442717f2c21001142a39c2da6b8bd9d06b05a6a8deae1bd1be4108a636ddbebc682d113e715f2f3ee506abc28b1c654b3d2d28e02f73b171ed0deed71dda90ce4a0b728cc75cb576385e7418b545b992b1dd98e2ee53355f464f9250a2a03b3d1e4d2ac1aa71d01de2573530324e14d15a507883411ddbd37be21dc929db9b11f11010e4d2a04c7325a5ae6d24d19900ff97a8a89438f8676457a78cff05201528f4358fe67f61288bf042a8f3c2e0f8b4997b8fb74996b80d465489b2d7807a945eba72a945e8cf8625dbad6f6f6e30537b29e558ca8a8b0625f578c766d34f2d28d704715f94df1f6318a308042aa494baa295640679f1eab1e6a8308af8ce6441d5ad8a2f3d477eb5307af0dfae6644493f1434030b8361621340ad3dcefa6d8f090ed3929d89ad9c0ba01a6903033428dd8f98619304b1803187d2a6130bf1e009b5eb0e7e21c75594b3b8470f3106c92a9e55bfeb026091ced127a90a1f1247f3c07e36d3572923e0de3f73518d0369a25fcd4e65d243b7eab91063a7bfd8bc8ac9e39fbbb32b5c9517886287a18eacd8dbfda9b91db693cb12e42cba5988280e09e51e72b91a0f360656d8f21cc1eb3248ac345ad51d1a6172b18419277851dab01e028c7e8e2cf34095efd28267852a08fccf61c45b5e46930160daf50282be058274e7ff58c48b60b86d0c8cc886ab8778a2a2b5fa2557ad7bf7f01f2175523ce758871d334c20a9839f7a89fe2867c06289c8a2f6456ac7e4fbadee53ac41aee68214bc76669853baa4f58255b39ba581414f2e8c4b49303f8936a33bae5cbc96b29a5c724d5b50e1614144c2acd03bd90de891c3d36ce040d57543682ecbfcae66c4153c337c3a5d01896524c8e0c27e9a08919821ca27bbfe3fc9ba24a823aeec8d4ad8ef8a65c585bee4dcf1acaa3da501a8c11a23b2e22920c1ad0129a038b31fe16c2abc80589dbf7c37211afc5d1a6db908bc5fe8a692060069fcbcdcba7c523d3c424aa3b0c6556387e0e51bcde9e5f850abf62d2c2101c3a2786a0cb94932877a09cb6b64aa61da8cab3b423e7adc4c4700418a65e87225710e1691f6d9cb2eb63cce5b605ce0a4a89cf519767e00845397c5e381141a0ed8a89b01064b495ec8d1e2da37433bf1597d919a69610d2ad26bdf6fca8de422bb2cb80d0516206e8194ee51445a3dcb5dee33c0c310b4751e68e58bebda2fb586985a5a5b06456756f44e6dbfef4bb99ca732f00fb9ea35775f7419681bfbe6f43dc7c4650c13b63d93c1d490bf0173f287a4309531f13ecb1a775d0bd881a", 0x1000}}, 0x1006) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r0, 0x0) keyctl$search(0xa, 0x0, &(0x7f0000000180)='keyring\x00', 0x0, 0x0) 4.13722728s ago: executing program 3 (id=541): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000007780), 0x200, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, 0x0) 4.118729542s ago: executing program 3 (id=542): r0 = syz_usb_connect(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000f2303920422c021240850102030109022400010000100009040c0202c17f0c00090502020002020000090582020002"], 0x0) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000000100)={0x34, &(0x7f0000000140)={0x0, 0x12, 0x1, "84"}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000280)={0x84, &(0x7f0000000340)={0x0, 0xe, 0x1, "04"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) 3.25481619s ago: executing program 1 (id=545): unshare(0x2c020400) r0 = socket$netlink(0x10, 0x3, 0x0) setsockopt$sock_int(r0, 0x1, 0x3, &(0x7f0000000000)=0x7, 0x4) 3.25456575s ago: executing program 1 (id=546): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = dup(r1) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000080)=[@text64={0x40, &(0x7f00000000c0)="0f20c035000000200f22c0b9b1030000b8f0ffffffbaffffff7f0f3066baf80cb8bb0e708bef66bafc0cb044ee440f20c03507000000440f22c0410f185e4666b86a008ed8440f0748b80d180000000000000f23c00f21f835010002000f23f8c4217d29d9a20068000000000000", 0x6e}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) 3.185167756s ago: executing program 0 (id=547): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f00000001c0)=0x100000001, 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000200)=0x1, 0x4) connect$inet6(r0, &(0x7f0000000240)={0xa, 0x4e22, 0x2000000, @ipv4={'\x00', '\xff\xff', @empty}}, 0x1c) sendto$inet6(r0, &(0x7f0000000280)="a6e2976b5c4383036d32dadd2e144d8645ca8d1b230e105614396838da83c754887e7bea2f35d4ea667817d90d532af065f2e398dd9081ea16f8b371a202a6f9e505bbc964a0d3880bf0104a0a0a2f0d311efee1637e85a0125b38f961918f99bf9c2c146e42327f178dc2b3d4936e7f7f0a79f74ba464d83ab41742d1186776dc1779b5c50ac82d0fa8f9e42074b5b6079207fb21e718080907964669be539791e3e98687ee059853", 0xfffffffffffffcc1, 0x840, 0x0, 0x56) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000001680)={&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0, &(0x7f00000022c0)=""/4080, 0xfffffffffffffdcc, 0x0, 0x0, 0xffffffffffffffa5}, &(0x7f00000032c0)=0x24) 3.184974387s ago: executing program 0 (id=548): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921000000012201000905810308"], 0x0) syz_usb_disconnect(r0) r1 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120110010000004058040350"], 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_connect$hid(0x4, 0x0, 0x0, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x0, 0x6, [{0x4, &(0x7f0000000180)=@lang_id={0x4, 0x3, 0x444}}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}]}) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0xffffffffffffff6d, &(0x7f0000000100)="019a18370cfb661ba08c228ce6ca19b6a99a071ca34c72c891f8a260fa00000080977dae8d64a30e92cd51117c4a71e26518e804c00058e6c7c0c363027251668bb650d90000000000") 3.158590619s ago: executing program 1 (id=549): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000600), 0xffffffffffffffff) sendmsg$WG_CMD_SET_DEVICE(r0, &(0x7f0000001000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000008c0)={0xc4, r1, 0x1, 0x0, 0x0, {}, [@WGDEVICE_A_PEERS={0x9c, 0x8, 0x0, 0x1, [{0x28, 0x0, 0x0, 0x1, [@WGPEER_A_PUBLIC_KEY={0x24}]}, {0x70, 0x0, 0x0, 0x1, [@WGPEER_A_PUBLIC_KEY={0x24}, @WGPEER_A_ALLOWEDIPS={0x48, 0x9, 0x0, 0x1, [{0x1c, 0x0, 0x0, 0x1, [@ipv4={{0x6}, {0x8, 0x2, @rand_addr=0x64010102}, {0x5, 0x3, 0x1}}]}, {0x28, 0x0, 0x0, 0x1, [@ipv6={{0x6}, {0x14, 0x2, @empty}, {0x5, 0x3, 0x3}}]}]}]}]}, @WGDEVICE_A_IFNAME={0x14, 0x2, 'wg2\x00'}]}, 0xc4}, 0x1, 0x0, 0x0, 0x4084}, 0x20008040) 3.15002177s ago: executing program 1 (id=550): sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=ANY=[@ANYBLOB="100029bd7000ffdbdf250e00000034004109080008000600000006"], 0x48}, 0x1, 0x0, 0x0, 0x40081c4}, 0x44000) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=ANY=[@ANYBLOB="480000001000010400000000", @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00('], 0x48}}, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0x8, 0x0, 0x8, 0x9b99}, 0x25, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x6, 0x2dcd, 0x1, 0xb4, 0x8, 0xa2b9, 0x6, 0x7, 0xe1, 0x6, 0x9, 0x403, 0xbbf, 0x3, 0xfffffffd, 0xfffffff7, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x8002, 0x8a, 0x79, 0x2, 0x10080, 0x3c, 0x91, 0x129, 0x4, 0x16, 0x5, 0x5, 0x401, 0x1, 0x3, 0xa7, 0x81, 0x709, 0xf9a2, 0xa9, 0xff, 0xffffffff, 0x2, 0x2, 0x2, 0x7, 0x5, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x8, 0x4], [0x401, 0x3, 0x6, 0x9, 0x6, 0x8000c66, 0xa8a9, 0x2000006f, 0x8e, 0xd50, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0xfa8, 0x200b398, 0x8001, 0xfffffffe, 0x4, 0x1c, 0x0, 0x1, 0xfffffffe, 0x9, 0x8, 0xffffff7f, 0x6, 0x6, 0x9, 0x40000004, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x7, 0xeb00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3fe, 0x1ff, 0x1, 0x8001, 0x67b2, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0x10, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x5, 0x494, 0x7, 0x200026, 0x7f, 0x400, 0x102, 0x1, 0x41, 0x6, 0x2ee4b, 0x2000004, 0x1, 0xc, 0x5, 0x9, 0x5, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x10000a, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x40, 0x800003, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x2, 0x7ffe, 0x28, 0x5, 0xd500, 0x1, 0x77, 0x5, 0x6, 0x10000, 0x8, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7f7, 0xff, 0x1005, 0x10000001, 0x4, 0x21, 0x8, 0x81, 0x7, 0x9d87, 0x8, 0x8, 0x4, 0x140f1, 0x5396, 0x3, 0x4, 0x80008001, 0xbbd6, 0x1, 0x2, 0x100, 0x200d8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0xbe, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x8, 0x274, 0x6, 0xfffffff9, 0x7, 0x9, 0x9, 0x4, 0x463f, 0xf, 0xdab, 0x5, 0x8, 0x13fff, 0x8, 0xab6b]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) signalfd(0xffffffffffffffff, &(0x7f0000000340)={[0x4]}, 0x8) syz_genetlink_get_family_id$tipc2(&(0x7f0000000380), 0xffffffffffffffff) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_MEMORY_ATTRIBUTES(r2, 0x4020aed2, &(0x7f00000001c0)={0x60000, 0x18000, 0x9fef19c9430e26b8}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0x8], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="2800000012000100"/20, @ANYRES32=0x0, @ANYBLOB="000000000000000408001d00ff03"], 0x28}, 0x1, 0x0, 0x0, 0x2000}, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = dup(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) 3.092839836s ago: executing program 4 (id=552): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x1a1740, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f0000000100)={0x0, &(0x7f0000000140)=[@wrmsr={0x65, 0x20, {0x40000000, 0x3}}, @wrmsr={0x65, 0x20, {0x40000001, 0x3f}}], 0x40}) ioctl$KVM_SET_CPUID2(r3, 0x4008ae90, &(0x7f0000000300)={0x1, 0x0, [{0x40000001, 0x4, 0x3, 0x31237648, 0x6, 0x2, 0x7}]}) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000340)={[0x9, 0x7cffdffffffffffc, 0x10013, 0x0, 0x9, 0x4, 0x8, 0x800000, 0x1, 0x7ffffffffffffffc, 0x1, 0x0, 0x5, 0x5, 0xfffffffffffffffd, 0x8], 0x0, 0x1019c4}) ioctl$KVM_RUN(r3, 0xae80, 0x0) 3.028245923s ago: executing program 4 (id=553): syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x1) ioctl$KVM_SET_ONE_REG(r3, 0x4048aecb, &(0x7f0000000100)=@arm64_ccsidr={0x6020000000110009, &(0x7f0000000140)=0xd8}) syz_usb_connect$printer(0x0, 0x0, 0x0, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, 0x0) syz_usb_connect(0x0, 0x0, 0x0, 0x0) readv(0xffffffffffffffff, 0x0, 0x0) r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000001c0)={0x1, &(0x7f0000000200)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) close_range(r4, 0xffffffffffffffff, 0x0) 3.009075605s ago: executing program 1 (id=554): socket(0x10, 0x3, 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000040)='\x00', 0x81101) syz_usb_connect$uac1(0x0, 0xa4, &(0x7f0000000380)=ANY=[@ANYBLOB="2a01000020000040b708000000000000030109029200030172e5000904000000010100000a24010000000201020c0d2407000005000000000000000c240000e9fffff5ffffffff092403f3ff000005024524", @ANYRES8=r0, @ANYBLOB="05", @ANYRESHEX=r0], 0x0) 2.46332681s ago: executing program 4 (id=555): write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x402, 0x6, 0xfffa}, 0x3a, [0x8000, 0x401, 0xf, 0x8, 0x86, 0x2, 0x3, 0x7f, 0xa6, 0x4d, 0x6, 0x5f, 0x9, 0x15, 0xffff2d37, 0xff7fff01, 0x6, 0x5, 0x7, 0x5, 0xdb, 0x0, 0x7, 0x3c5b, 0x1, 0x24, 0x10, 0x5, 0x0, 0xffffffff, 0x10, 0x80, 0x207, 0x20003, 0x8, 0x4c76, 0x10000, 0x242, 0x3, 0xe, 0x4, 0x80008071, 0x7fc, 0x17, 0x0, 0x7, 0x5, 0x3e, 0x18e, 0x200006, 0x6, 0x454f, 0x6, 0x80004, 0x8, 0x3ff, 0x80, 0x0, 0x0, 0x0, 0x8, 0x8000, 0x1, 0x40], [0x10000004, 0x9, 0x8000012f, 0x8004, 0x8, 0xffffbff3, 0x129432f6, 0xc8, 0xc9, 0xe, 0x2bf, 0x6c7, 0x1, 0xfffffffc, 0x5, 0x0, 0x0, 0x9, 0x2f, 0xe, 0x1, 0x66abcbd2, 0xea4, 0x8, 0x4, 0x7, 0x7ffb, 0x6, 0x500, 0x401, 0x10001, 0x1, 0xff, 0x5, 0xfffff572, 0x5f31, 0xd, 0x4e0, 0x381, 0x4, 0xb, 0x4, 0x9, 0x8, 0x5, 0xd, 0xfffff256, 0x2, 0x1, 0xfdfffffd, 0x8, 0x2, 0x4, 0x9, 0x3, 0x3, 0x4000009, 0x6, 0x0, 0x3, 0xfffffffc, 0x48c93690, 0xe79, 0x3], [0x7, 0x408, 0x4, 0x5, 0xfffffffd, 0xff, 0x4, 0xb, 0x6, 0x7fff, 0x0, 0x5, 0xb, 0x4, 0x5, 0x5, 0xfffffffd, 0x1ef, 0x5, 0x8, 0x86, 0x3, 0x3039, 0xfffffffa, 0xb, 0x5, 0xffffffff, 0x2, 0x400003, 0x6, 0x4, 0x6d01, 0x6, 0x34, 0x800003, 0x200, 0x83, 0x3, 0x5, 0x2950bfaf, 0x1000, 0xa2, 0x4, 0x1000, 0x5, 0xb1, 0xac8, 0xbf, 0x50, 0x3, 0x7ff, 0x12b, 0x8a6, 0x1, 0xa, 0xffffffff, 0x5, 0x1c, 0x120000, 0x2008077f, 0x2006, 0x7, 0x4, 0x25], [0x9, 0xbb33, 0x7, 0xb, 0x5, 0x2000004, 0xffff, 0x6, 0x80000000, 0xb9, 0xce4, 0x10001fc, 0x10002, 0x4184, 0x5, 0x3, 0x0, 0x10000, 0x4, 0x7fff, 0xfffe, 0xa620, 0x1, 0x5, 0x1, 0x6, 0x14c, 0x60a7, 0x6, 0xa, 0xffffffff, 0x80000000, 0x5, 0x5, 0xc8, 0x1, 0xfffff000, 0xffff, 0x0, 0x7e, 0x100, 0x1622, 0x7, 0x200af, 0x20000008, 0x5, 0x226, 0x3, 0x5, 0x0, 0x30b1d693, 0xfffff4f0, 0x4, 0x7, 0x7, 0x6c1b, 0x0, 0x4, 0x5, 0x803, 0xd7, 0x200, 0x30, 0xfff]}, 0x45c) unshare(0x28000600) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000080)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000940)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000980), 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f00000009c0)=0x1, 0x4) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f0000000a00)=@ccm_128={{0x303}, "0e57b3d487e2db32", "a9df7ccffde8899f914d4f2c3e263509", "3c36a51c", "6775c975b6b15e11"}, 0x28) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000a40)=@ccm_128={{0x303}, "f64e40992f79ecf0", "53c272d8b763f690b35605dff8a4a8d2", "021000", "72392a24199b5903"}, 0x28) writev(r0, &(0x7f0000000a80)=[{&(0x7f0000000ac0)="c800b6", 0x3}], 0x1) readv(r0, &(0x7f0000003b00)=[{&(0x7f0000003b40)=""/4099, 0x1003}], 0x1) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) 2.417170054s ago: executing program 4 (id=556): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$IPSET_CMD_ADD(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000003c0)={0x54, 0x9, 0x6, 0x201, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x2c, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @broadcast}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x5000}, @IPSET_ATTR_PROTO={0x5, 0x7, 0x6}, @IPSET_ATTR_IP2={0xc, 0x14, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}}}]}]}, 0x54}}, 0x0) 2.416982464s ago: executing program 4 (id=557): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x22020600) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e22, 0x200, @mcast1, 0x7}, 0x1c) 2.416771514s ago: executing program 4 (id=558): r0 = syz_usb_connect$cdc_ncm(0x0, 0x8f, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000020000402505a1a440000102030109027d0002010080000904000001020d0000052406000105240000000d240f0103000000fd0000000406241aff072908241c0101090000142413099f33760bf14377323063f9c8a04d113905241510000905810300020800040904010000020d00000904010102020d0000090582020002e1ad00090503020002"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000000)={0x44, 0x0, 0x0, 0x0, &(0x7f0000000540)={0x20, 0x80, 0x1c, {0x8, 0x70, 0xab8, 0xfffc, 0x4, 0x8000, 0x0, 0x10, 0x8, 0x1000, 0x1000, 0xfb}}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) recvfrom$inet(0xffffffffffffffff, 0x0, 0x0, 0x720, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_FRAME(r1, 0x0, 0x28008004) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(0xffffffffffffffff, 0x6, 0x16, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000000080)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) sendmsg$nl_route_sched(r2, 0x0, 0x20040084) sendmsg$nl_route_sched(r2, 0x0, 0x20000010) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000640)={0x44, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000005c0)={0x20, 0x87, 0x2, 0x5}, 0x0}) 1.709984066s ago: executing program 2 (id=559): r0 = syz_usb_connect$hid(0x5, 0x36, &(0x7f00000000c0)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x20, 0x44e, 0x120b, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0xba4e7a40265e5c6b, 0x2c, "", [{{0x9, 0x4, 0x0, 0x5, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x8000, 0x9, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x10, 0xfc, 0x8}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150825ff0904a1010901a1007508950109308102c0c0"], 0x0}, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, 0x0) io_submit(0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000740)={0x4, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x40f00, 0x1, '\x00', 0x0, @fallback=0x1c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffe}, 0x94) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) ptrace(0x10, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000600)={0x2c, 0x0, 0x0, 0x0, 0x0, 0x0}) socket$nl_route(0x10, 0x3, 0x0) 1.08056265s ago: executing program 3 (id=560): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000b00)=[@text16={0x10, 0x0}], 0x1, 0x14, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000b40)=[@text64={0x40, &(0x7f0000000b80)="67400f00d9440f381c730866baf80cb838b97a83ef66bafc0c66b8000066ef430f005f000f01f865400f01c5c7442400bdc70000c7442402f7670000c7442406000000000f011c24c744240004000000c744240200580000ff1c2466baf80cb8ec337087ef66bafc0c66edb9260b00000f32", 0x72}], 0x1, 0x55, 0x0, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4400ae8f, &(0x7f0000000c00)=@x86={0x60, 0x4, 0x9, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x7f, 0x9, 0x1, 0x0, 0x0, 0x8, 0x0, 0xff, 0xff, 0x7, '\x00', 0x0, 0x1}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f0000000c40)={0x2, 0x0, @ioapic={0x8000000, 0xe, 0x10001, 0xfffffffe, 0x0, [{0x2, 0x4, 0x87, '\x00', 0x8}, {0x9, 0x8, 0x40, '\x00', 0xb}, {0xff, 0x7f, 0x9, '\x00', 0x6}, {0x0, 0x5, 0xd4, '\x00', 0xf9}, {0x7, 0x9, 0xc, '\x00', 0xfb}, {0x0, 0x4, 0xd4, '\x00', 0xdf}, {0x71, 0xd7, 0xf1, '\x00', 0x7b}, {0x3, 0x4, 0xc}, {0x7f, 0xd, 0xb, '\x00', 0xb}, {0xd7, 0xd, 0x8, '\x00', 0x6}, {0x0, 0x28, 0x80, '\x00', 0xdc}, {0xff, 0x1, 0xfe, '\x00', 0x1}, {0xfe, 0x7, 0x26}, {0xcf, 0x3, 0x0, '\x00', 0x6}, {0xb, 0xee, 0x7, '\x00', 0x3}, {0x39, 0x2, 0xff, '\x00', 0xb}, {0x9, 0x6, 0x2, '\x00', 0x8}, {0x5, 0x9, 0x5, '\x00', 0xc}, {0x7, 0xe1, 0x7, '\x00', 0xc2}, {0x0, 0x80, 0xe, '\x00', 0x7f}, {0x1, 0xc, 0x80, '\x00', 0x7f}, {0x10, 0x6, 0x3, '\x00', 0x8}, {0x1, 0x23, 0xf3, '\x00', 0x4}, {0x7, 0x6, 0x44}]}}) 917.189437ms ago: executing program 3 (id=561): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000080)=ANY=[@ANYBLOB="1201000041436120410e5150e8d5000000010902f98a5c01000000090401001186eee2000905821704"], 0x0) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f00000000c0)=@raw={'raw\x00', 0x3c1, 0x3, 0x2b0, 0x0, 0xc8, 0x8, 0x0, 0x5803, 0x240, 0x2e8, 0x2e8, 0x240, 0x2e8, 0x3, 0x0, {[{{@ipv6={@mcast2, @rand_addr=' \x01\x00', [0xffffffff, 0xff, 0xff, 0xffffffff], [0xff, 0xff, 0x0, 0xff000000], 'veth1_to_hsr\x00', 'syzkaller1\x00', {}, {0xff}, 0x32, 0x3, 0x0, 0x4}, 0x0, 0xa8, 0xd0, 0x0, {0x0, 0x2000000000000}}, @common=@unspec=@MARK={0x28, 'MARK\x00', 0x2, {0x69, 0x5}}}, {{@ipv6={@mcast2, @rand_addr=' \x01\x00', [0xff000000, 0xffffff00, 0x0, 0xffffff00], [], 'veth0_to_team\x00', 'pimreg1\x00', {0xcf0f066856f06171}, {0xff}, 0x1d, 0x5, 0x2, 0x40}, 0x0, 0xa8, 0x110}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x10, 0x4a3, 0xd, 0x3, '\x00', 'syz1\x00', {0x2}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x310) syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0xfffffffffffffddf, &(0x7f0000000200)=ANY=[]) 0s ago: executing program 1 (id=562): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000040)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @multicast1}, 0x2}}, 0x2e) ioctl$PPPIOCGL2TPSTATS(r0, 0x80487436, &(0x7f0000000480)="f89748") kernel console output (not intermixed with test programs): T1053] erofs: (device loop0): z_erofs_readahead: readahead error at page 4 @ nid 89 [ 67.663697][ T28] audit: type=1326 audit(1794037124.169:1296): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1043 comm="syz.0.178" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd27fb9fb19 code=0x7ffc0000 [ 67.689725][ T1053] erofs: (device loop0): z_erofs_readahead: readahead error at page 3 @ nid 89 [ 67.698893][ T28] audit: type=1326 audit(1794037124.229:1297): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1043 comm="syz.0.178" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=273 compat=0 ip=0x7fd27fb5bf6c code=0x7ffc0000 [ 67.726674][ T1053] syz.0.178: attempt to access beyond end of device [ 67.726674][ T1053] loop0: rw=524288, sector=34359738360, nr_sectors = 8 limit=16 [ 67.745043][ T1053] syz.0.178: attempt to access beyond end of device [ 67.745043][ T1053] loop0: rw=524288, sector=8, nr_sectors = 16 limit=16 [ 68.104271][ T1059] loop1: detected capacity change from 0 to 40427 [ 68.118361][ T290] EXT4-fs (loop4): unmounting filesystem. [ 68.139983][ T1059] F2FS-fs (loop1): invalid crc value [ 68.154010][ T1059] F2FS-fs (loop1): Found nat_bits in checkpoint [ 68.188644][ T1059] F2FS-fs (loop1): Start checkpoint disabled! [ 68.195483][ T1059] F2FS-fs (loop1): f2fs_disable_checkpoint() finish, err:0 [ 68.202930][ T1059] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e6 [ 68.216514][ T1075] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 68.272539][ T10] Bluetooth: hci0: Frame reassembly failed (-84) [ 68.792739][ T358] Bluetooth: hci1: Frame reassembly failed (-84) [ 69.057024][ T1090] xt_TCPMSS: Only works on TCP SYN packets [ 69.519995][ T1090] loop4: detected capacity change from 0 to 131072 [ 69.540124][ T1090] F2FS-fs (loop4): Invalid segment/section count (458783, 24 x 150994945) [ 69.548668][ T1090] F2FS-fs (loop4): Can't find valid F2FS filesystem in 1th superblock [ 69.564033][ T1090] F2FS-fs (loop4): invalid crc value [ 69.570883][ T1090] F2FS-fs (loop4): Found nat_bits in checkpoint [ 69.582412][ T1099] loop1: detected capacity change from 0 to 512 [ 69.608956][ T1090] F2FS-fs (loop4): Try to recover 1th superblock, ret: 0 [ 69.616117][ T1090] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e4 [ 69.622309][ T1099] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 69.632627][ T1099] ext4 filesystem being mounted at /26/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 69.708289][ T1105] xt_CT: You must specify a L4 protocol and not use inversions on it [ 69.774721][ T1099] EXT4-fs error (device loop1): ext4_lookup:1858: inode #12: comm syz.1.189: iget: bad i_size value: 2533274857506816 [ 69.798866][ T1104] EXT4-fs error (device loop1): ext4_find_dest_de:2115: inode #2: block 3: comm syz.1.189: bad entry in directory: directory entry overrun - offset=76, inode=16, rec_len=65296, size=2048 fake=0 [ 70.352355][ T1112] device vlan2 entered promiscuous mode [ 70.403298][ T655] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 70.900012][ T400] Bluetooth: hci1: Opcode 0x1003 failed: -110 [ 71.026206][ T287] EXT4-fs (loop1): unmounting filesystem. [ 71.250989][ T1119] loop2: detected capacity change from 0 to 40427 [ 71.289993][ T1119] F2FS-fs (loop2): Invalid log_blocksize (268), supports only 12 [ 71.298183][ T1119] F2FS-fs (loop2): Can't find valid F2FS filesystem in 1th superblock [ 71.318264][ T1119] F2FS-fs (loop2): invalid crc value [ 71.343436][ T1119] F2FS-fs (loop2): Mismatch valid blocks 5 vs. 7 [ 71.352010][ T1119] F2FS-fs (loop2): Failed to initialize F2FS segment manager (-117) [ 71.578722][ T1137] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 71.626087][ T1122] loop4: detected capacity change from 0 to 131072 [ 71.638734][ T1122] F2FS-fs (loop4): Invalid segment/section count (458783, 24 x 150994945) [ 71.651331][ T1122] F2FS-fs (loop4): Can't find valid F2FS filesystem in 1th superblock [ 71.660764][ T1122] F2FS-fs (loop4): invalid crc value [ 71.690641][ T1122] F2FS-fs (loop4): Found nat_bits in checkpoint [ 71.740072][ T1143] loop2: detected capacity change from 0 to 256 [ 71.746621][ T1122] F2FS-fs (loop4): Try to recover 1th superblock, ret: 0 [ 71.763372][ T1122] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e4 [ 71.778756][ T1115] loop3: detected capacity change from 0 to 131072 [ 71.790619][ T1115] F2FS-fs (loop3): Invalid segment/section count (458783, 24 x 150994945) [ 71.804038][ T1115] F2FS-fs (loop3): Can't find valid F2FS filesystem in 1th superblock [ 71.827094][ T1115] F2FS-fs (loop3): invalid crc value [ 71.849285][ T1115] F2FS-fs (loop3): Found nat_bits in checkpoint [ 71.944764][ T1115] F2FS-fs (loop3): Try to recover 1th superblock, ret: 0 [ 71.958453][ T1115] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e4 [ 72.270521][ T1155] device vlan2 entered promiscuous mode [ 72.388500][ T1161] loop3: detected capacity change from 0 to 256 [ 72.417423][ T1161] FAT-fs (loop3): Unrecognized mount option "xœìÝ»‹cU" or missing value [ 72.454002][ T1161] loop3: detected capacity change from 0 to 256 [ 72.478849][ T1163] binder_alloc: 1158: binder_alloc_buf size 16496 failed, no address space [ 72.487588][ T1163] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) [ 72.487774][ T1161] FAT-fs (loop3): Unrecognized mount option "utf8=1(uni_xlate=1" or missing value [ 72.756756][ T8] Bluetooth: hci0: Frame reassembly failed (-84) [ 72.774842][ T1149] loop1: detected capacity change from 0 to 131072 [ 72.799640][ T1149] F2FS-fs (loop1): Invalid segment/section count (458783, 24 x 150994945) [ 72.828550][ T1149] F2FS-fs (loop1): Can't find valid F2FS filesystem in 1th superblock [ 72.846087][ T1149] F2FS-fs (loop1): invalid crc value [ 72.868614][ T1149] F2FS-fs (loop1): Found nat_bits in checkpoint [ 72.951616][ T1149] F2FS-fs (loop1): Try to recover 1th superblock, ret: 0 [ 72.958674][ T1149] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e4 [ 72.976417][ T1149] FAULT_INJECTION: forcing a failure. [ 72.976417][ T1149] name fail_page_alloc, interval 1, probability 0, space 0, times 1 [ 72.991432][ T1149] CPU: 0 PID: 1149 Comm: syz.1.198 Not tainted syzkaller #0 [ 72.999342][ T1149] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 73.010802][ T1149] Call Trace: [ 73.014090][ T1149] [ 73.017027][ T1149] __dump_stack+0x21/0x24 [ 73.021366][ T1149] dump_stack_lvl+0x110/0x170 [ 73.026049][ T1149] ? __cfi_dump_stack_lvl+0x8/0x8 [ 73.031080][ T1149] ? ____kasan_slab_free+0x13d/0x180 [ 73.036388][ T1149] dump_stack+0x15/0x24 [ 73.040678][ T1149] should_fail_ex+0x3bf/0x510 [ 73.045627][ T1149] should_fail_alloc_page+0x61/0x90 [ 73.050838][ T1149] prepare_alloc_pages+0x131/0x570 [ 73.055963][ T1149] ? __alloc_pages_bulk+0x9d0/0x9d0 [ 73.061443][ T1149] __alloc_pages+0x15b/0x610 [ 73.066219][ T1149] ? __cfi___alloc_pages+0x10/0x10 [ 73.071346][ T1149] ? _raw_spin_lock_irqsave+0xc2/0x130 [ 73.076811][ T1149] ? avc_has_perm+0x163/0x250 [ 73.081503][ T1149] ? xas_start+0x324/0x3e0 [ 73.086125][ T1149] ? xas_load+0x394/0x3c0 [ 73.090467][ T1149] __folio_alloc+0x12/0x40 [ 73.094942][ T1149] __filemap_get_folio+0x6fe/0xa70 [ 73.100074][ T1149] ? __dquot_initialize+0x236/0xc80 [ 73.105474][ T1149] ? __cfi___filemap_get_folio+0x10/0x10 [ 73.111116][ T1149] ? _raw_spin_lock+0x94/0xf0 [ 73.115802][ T1149] ? wb_io_lists_depopulated+0x60/0x180 [ 73.121368][ T1149] pagecache_get_page+0x2b/0x110 [ 73.126315][ T1149] f2fs_convert_inline_inode+0x6b2/0x8b0 [ 73.131964][ T1149] ? __file_update_time+0x250/0x270 [ 73.137352][ T1149] ? __cfi_f2fs_convert_inline_inode+0x10/0x10 [ 73.143519][ T1149] ? fault_in_readable+0x11a/0x150 [ 73.148645][ T1149] f2fs_file_write_iter+0x12e9/0x27c0 [ 73.154024][ T1149] ? _parse_integer+0x2a/0x40 [ 73.158978][ T1149] ? __cfi_kstrtouint_from_user+0x10/0x10 [ 73.164713][ T1149] ? __cfi_f2fs_file_write_iter+0x10/0x10 [ 73.170454][ T1149] ? avc_policy_seqno+0x1b/0x70 [ 73.175372][ T1149] ? fsnotify_perm+0x67/0x5b0 [ 73.180064][ T1149] ? security_file_permission+0x8a/0xb0 [ 73.185672][ T1149] vfs_write+0x5ef/0xd00 [ 73.189939][ T1149] ? __cfi_vfs_write+0x10/0x10 [ 73.194710][ T1149] ? __fget_files+0x2d1/0x330 [ 73.199400][ T1149] ? __fdget+0x19c/0x220 [ 73.203665][ T1149] ? __x64_sys_pwrite64+0xf3/0x220 [ 73.208875][ T1149] __x64_sys_pwrite64+0x194/0x220 [ 73.213908][ T1149] ? __cfi___x64_sys_pwrite64+0x10/0x10 [ 73.219560][ T1149] ? fpregs_assert_state_consistent+0xb1/0xe0 [ 73.225651][ T1149] x64_sys_call+0x36/0x9a0 [ 73.230086][ T1149] do_syscall_64+0x4c/0xa0 [ 73.234513][ T1149] ? clear_bhb_loop+0x30/0x80 [ 73.239214][ T1149] ? clear_bhb_loop+0x30/0x80 [ 73.244263][ T1149] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 73.250195][ T1149] RIP: 0033:0x7f34bd19fb19 [ 73.254814][ T1149] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 73.274683][ T1149] RSP: 002b:00007f34be0fe028 EFLAGS: 00000246 ORIG_RAX: 0000000000000012 [ 73.283112][ T1149] RAX: ffffffffffffffda RBX: 00007f34bd425fa0 RCX: 00007f34bd19fb19 [ 73.291100][ T1149] RDX: 0000000000000001 RSI: 0000200000010d00 RDI: 0000000000000004 [ 73.299090][ T1149] RBP: 00007f34be0fe090 R08: 0000000000000000 R09: 0000000000000000 [ 73.307071][ T1149] R10: 000000000000fecc R11: 0000000000000246 R12: 0000000000000001 [ 73.315067][ T1149] R13: 00007f34bd426038 R14: 00007f34bd425fa0 R15: 00007fff131afd48 [ 73.323138][ T1149] [ 74.255771][ T1179] loop0: detected capacity change from 0 to 131072 [ 74.267714][ T1179] F2FS-fs (loop0): Invalid segment/section count (458783, 24 x 150994945) [ 74.282108][ T1179] F2FS-fs (loop0): Can't find valid F2FS filesystem in 1th superblock [ 74.302759][ T1179] F2FS-fs (loop0): invalid crc value [ 74.309608][ T1179] F2FS-fs (loop0): Found nat_bits in checkpoint [ 74.362864][ T1179] F2FS-fs (loop0): Try to recover 1th superblock, ret: 0 [ 74.370068][ T1179] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e4 [ 74.378963][ T1179] FAULT_INJECTION: forcing a failure. [ 74.378963][ T1179] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 74.393400][ T1179] CPU: 1 PID: 1179 Comm: syz.0.205 Not tainted syzkaller #0 [ 74.400720][ T1179] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 74.410769][ T1179] Call Trace: [ 74.414064][ T1179] [ 74.416984][ T1179] __dump_stack+0x21/0x24 [ 74.421315][ T1179] dump_stack_lvl+0x110/0x170 [ 74.425985][ T1179] ? __cfi_dump_stack_lvl+0x8/0x8 [ 74.430998][ T1179] ? __kasan_check_write+0x14/0x20 [ 74.436285][ T1179] dump_stack+0x15/0x24 [ 74.440457][ T1179] should_fail_ex+0x3bf/0x510 [ 74.445151][ T1179] should_fail+0xb/0x10 [ 74.449305][ T1179] should_fail_usercopy+0x1a/0x20 [ 74.454366][ T1179] strncpy_from_user+0x24/0x2c0 [ 74.459310][ T1179] ? kmem_cache_alloc+0x166/0x320 [ 74.464375][ T1179] ? getname_flags+0xba/0x510 [ 74.467144][ T1212] loop4: detected capacity change from 0 to 1024 [ 74.469065][ T1179] getname_flags+0xf5/0x510 [ 74.479872][ T1179] getname+0x19/0x20 [ 74.483865][ T1179] do_sys_openat2+0xeb/0x820 [ 74.488482][ T1179] ? __kasan_check_write+0x14/0x20 [ 74.493613][ T1179] ? do_sys_open+0xe0/0xe0 [ 74.498064][ T1179] ? ksys_write+0x1fa/0x260 [ 74.502063][ T1212] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: writeback. [ 74.502780][ T1179] ? __cfi_ksys_write+0x10/0x10 [ 74.516544][ T1179] __x64_sys_openat+0x136/0x160 [ 74.521452][ T1179] x64_sys_call+0x783/0x9a0 [ 74.525969][ T1179] do_syscall_64+0x4c/0xa0 [ 74.530403][ T1179] ? clear_bhb_loop+0x30/0x80 [ 74.535094][ T1179] ? clear_bhb_loop+0x30/0x80 [ 74.539791][ T1179] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 74.545706][ T1179] RIP: 0033:0x7fd27fb9fb19 [ 74.550120][ T1179] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 74.569713][ T1179] RSP: 002b:00007fd280b17028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 74.578130][ T1179] RAX: ffffffffffffffda RBX: 00007fd27fe25fa0 RCX: 00007fd27fb9fb19 [ 74.586086][ T1179] RDX: 0000000000040042 RSI: 0000200000000280 RDI: ffffffffffffff9c [ 74.594062][ T1179] RBP: 00007fd280b17090 R08: 0000000000000000 R09: 0000000000000000 [ 74.602020][ T1179] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000001 [ 74.609981][ T1179] R13: 00007fd27fe26038 R14: 00007fd27fe25fa0 R15: 00007ffe77bf8ca8 [ 74.617973][ T1179] [ 74.759959][ T655] Bluetooth: hci0: command 0x1003 tx timeout [ 74.759969][ T45] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 74.784699][ T1222] loop3: detected capacity change from 0 to 256 [ 74.793862][ T1222] FAT-fs (loop3): Unrecognized mount option "xœìÝ»‹cU" or missing value [ 74.824817][ T1222] FAT-fs (loop3): Unrecognized mount option "utf8=1(uni_xlate=1" or missing value [ 74.835917][ T1224] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 74.852603][ T28] kauditd_printk_skb: 214 callbacks suppressed [ 74.852618][ T28] audit: type=1326 audit(1794037131.809:1512): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1225 comm="syz.3.213" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f135979fb19 code=0x7ffc0000 [ 74.884110][ T28] audit: type=1326 audit(1794037131.809:1514): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1225 comm="syz.3.213" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f135979fb19 code=0x7ffc0000 [ 74.909096][ T40] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 74.916654][ T28] audit: type=1326 audit(1794037131.809:1515): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1225 comm="syz.3.213" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f135979fb19 code=0x7ffc0000 [ 74.941982][ T28] audit: type=1326 audit(1794037131.809:1513): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1225 comm="syz.3.213" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f135979fb19 code=0x7ffc0000 [ 74.966897][ T28] audit: type=1326 audit(1794037131.809:1516): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1225 comm="syz.3.213" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=186 compat=0 ip=0x7f135979fb19 code=0x7ffc0000 [ 74.992031][ T28] audit: type=1326 audit(1794037131.809:1517): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1225 comm="syz.3.213" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f135979fb19 code=0x7ffc0000 [ 75.016912][ T28] audit: type=1326 audit(1794037131.809:1518): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1225 comm="syz.3.213" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f135979fb19 code=0x7ffc0000 [ 75.041805][ T28] audit: type=1326 audit(1794037131.809:1519): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1225 comm="syz.3.213" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f135979fb19 code=0x7ffc0000 [ 75.066837][ T28] audit: type=1326 audit(1794037131.809:1520): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1225 comm="syz.3.213" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f135979fb19 code=0x7ffc0000 [ 75.091058][ T40] usb 2-1: config 0 interface 0 altsetting 8 endpoint 0x81 has invalid wMaxPacketSize 0 [ 75.092110][ T28] audit: type=1326 audit(1794037131.809:1521): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1225 comm="syz.3.213" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f13597a1387 code=0x7ffc0000 [ 75.101504][ T40] usb 2-1: config 0 interface 0 altsetting 8 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 75.171350][ T40] usb 2-1: config 0 interface 0 has no altsetting 0 [ 75.178366][ T40] usb 2-1: New USB device found, idVendor=1b1c, idProduct=0a55, bcdDevice= 0.00 [ 75.187798][ T40] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 75.204426][ T1229] erofs: (device loop3): mounted with root inode @ nid 36. [ 75.251605][ T1229] erofs: (device loop3): z_erofs_readahead: readahead error at page 4 @ nid 89 [ 75.261009][ T1229] erofs: (device loop3): z_erofs_readahead: readahead error at page 3 @ nid 89 [ 75.270416][ T1229] syz.3.213: attempt to access beyond end of device [ 75.270416][ T1229] loop3: rw=524288, sector=34359738360, nr_sectors = 8 limit=16 [ 75.284692][ T1229] syz.3.213: attempt to access beyond end of device [ 75.284692][ T1229] loop3: rw=524288, sector=8, nr_sectors = 16 limit=16 [ 75.431144][ T290] EXT4-fs (loop4): unmounting filesystem. [ 75.512752][ T40] usb 2-1: config 0 descriptor?? [ 76.056496][ T40] usbhid 2-1:0.0: can't add hid device: -71 [ 76.064489][ T40] usbhid: probe of 2-1:0.0 failed with error -71 [ 76.075474][ T40] usb 2-1: USB disconnect, device number 4 [ 76.668041][ T1237] device vlan2 entered promiscuous mode [ 76.684447][ T400] Bluetooth: hci1: Opcode 0x1003 failed: -110 [ 77.384865][ T1257] set_capacity_and_notify: 2 callbacks suppressed [ 77.384880][ T1257] loop3: detected capacity change from 0 to 16 [ 77.400628][ T1257] erofs: (device loop3): mounted with root inode @ nid 36. [ 77.413190][ T1257] erofs: (device loop3): z_erofs_readahead: readahead error at page 4 @ nid 89 [ 77.422209][ T1257] erofs: (device loop3): z_erofs_readahead: readahead error at page 3 @ nid 89 [ 77.431725][ T1257] syz.3.220: attempt to access beyond end of device [ 77.431725][ T1257] loop3: rw=524288, sector=34359738360, nr_sectors = 8 limit=16 [ 77.445866][ T1257] syz.3.220: attempt to access beyond end of device [ 77.445866][ T1257] loop3: rw=524288, sector=8, nr_sectors = 16 limit=16 [ 77.599118][ T1256] device vlan2 entered promiscuous mode [ 77.798559][ T524] Bluetooth: hci0: Frame reassembly failed (-84) [ 77.997588][ T1231] loop0: detected capacity change from 0 to 131072 [ 78.009965][ T1231] F2FS-fs (loop0): Invalid segment/section count (458783, 24 x 150994945) [ 78.018545][ T1231] F2FS-fs (loop0): Can't find valid F2FS filesystem in 1th superblock [ 78.025478][ T1271] binder: 1267:1271 ioctl c0306201 0 returned -14 [ 78.034218][ T1231] F2FS-fs (loop0): invalid crc value [ 78.090750][ T1231] F2FS-fs (loop0): Found nat_bits in checkpoint [ 78.145206][ T1231] F2FS-fs (loop0): Try to recover 1th superblock, ret: 0 [ 78.159974][ T1231] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e4 [ 78.296207][ T1278] loop3: detected capacity change from 0 to 512 [ 79.114433][ T1282] loop2: detected capacity change from 0 to 512 [ 79.436404][ T1282] EXT4-fs: Ignoring removed nobh option [ 79.449157][ T1282] EXT4-fs error (device loop2): ext4_mb_generate_buddy:1126: group 0, block bitmap and bg descriptor inconsistent: 219 vs 220 free clusters [ 79.520185][ T1282] EXT4-fs (loop2): Remounting filesystem read-only [ 79.527419][ T1282] EXT4-fs error (device loop2): ext4_free_branches:1030: inode #11: comm syz.2.226: invalid indirect mapped block 4278190080 (level 0) [ 79.610287][ T1282] EXT4-fs (loop2): Remounting filesystem read-only [ 79.703563][ T1289] loop3: detected capacity change from 0 to 1024 [ 79.750317][ T1282] EXT4-fs error (device loop2): ext4_free_branches:1030: inode #11: comm syz.2.226: invalid indirect mapped block 1 (level 1) [ 79.800028][ T400] Bluetooth: hci0: command 0x1003 tx timeout [ 79.800053][ T45] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 79.925662][ T1282] EXT4-fs (loop2): Remounting filesystem read-only [ 79.963582][ T1289] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: writeback. [ 80.455040][ T1294] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 80.560612][ T1282] EXT4-fs (loop2): 1 truncate cleaned up [ 80.575632][ T1282] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 80.623335][ T288] EXT4-fs (loop3): unmounting filesystem. [ 80.632694][ T291] EXT4-fs (loop2): unmounting filesystem. [ 80.919978][ T24] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 81.142838][ T24] usb 4-1: config 0 interface 0 altsetting 8 endpoint 0x81 has invalid wMaxPacketSize 0 [ 81.153183][ T24] usb 4-1: config 0 interface 0 altsetting 8 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 81.166434][ T24] usb 4-1: config 0 interface 0 has no altsetting 0 [ 81.173262][ T24] usb 4-1: New USB device found, idVendor=1b1c, idProduct=0a55, bcdDevice= 0.00 [ 81.182758][ T24] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 81.194518][ T24] usb 4-1: config 0 descriptor?? [ 81.262990][ T1320] FAULT_INJECTION: forcing a failure. [ 81.262990][ T1320] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 81.290070][ T1320] CPU: 1 PID: 1320 Comm: syz.1.234 Not tainted syzkaller #0 [ 81.297396][ T1320] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 81.307465][ T1320] Call Trace: [ 81.310753][ T1320] [ 81.313686][ T1320] __dump_stack+0x21/0x24 [ 81.318029][ T1320] dump_stack_lvl+0x110/0x170 [ 81.322713][ T1320] ? __cfi_dump_stack_lvl+0x8/0x8 [ 81.327751][ T1320] dump_stack+0x15/0x24 [ 81.331914][ T1320] should_fail_ex+0x3bf/0x510 [ 81.336713][ T1320] should_fail+0xb/0x10 [ 81.340877][ T1320] should_fail_usercopy+0x1a/0x20 [ 81.345107][ T1303] loop4: detected capacity change from 0 to 131072 [ 81.345907][ T1320] _copy_from_user+0x1e/0xc0 [ 81.345928][ T1320] iovec_from_user+0x1aa/0x2e0 [ 81.353215][ T1303] F2FS-fs (loop4): Invalid segment/section count (458783, 24 x 150994945) [ 81.357074][ T1320] __import_iovec+0x6d/0x460 [ 81.357105][ T1320] ? kstrtoull+0x137/0x1d0 [ 81.362658][ T1303] F2FS-fs (loop4): Can't find valid F2FS filesystem in 1th superblock [ 81.370328][ T1320] import_iovec+0x7c/0xb0 [ 81.370357][ T1320] ___sys_sendmsg+0x252/0x360 [ 81.370372][ T1320] ? __sys_sendmsg+0x290/0x290 [ 81.375875][ T1303] F2FS-fs (loop4): invalid crc value [ 81.379347][ T1320] ? __kasan_check_write+0x14/0x20 [ 81.379373][ T1320] ? proc_fail_nth_write+0x180/0x200 [ 81.416803][ T1320] ? vfs_write+0xa51/0xd00 [ 81.421210][ T1320] ? __fdget+0x19c/0x220 [ 81.425441][ T1320] __x64_sys_sendmsg+0x20d/0x2e0 [ 81.430372][ T1320] ? __cfi___x64_sys_sendmsg+0x10/0x10 [ 81.437147][ T1320] ? fpregs_assert_state_consistent+0xb1/0xe0 [ 81.443313][ T1320] x64_sys_call+0x171/0x9a0 [ 81.448075][ T1320] do_syscall_64+0x4c/0xa0 [ 81.453089][ T1320] ? clear_bhb_loop+0x30/0x80 [ 81.457757][ T1320] ? clear_bhb_loop+0x30/0x80 [ 81.462419][ T1320] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 81.468384][ T1320] RIP: 0033:0x7f34bd19fb19 [ 81.472791][ T1320] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 81.492471][ T1320] RSP: 002b:00007f34be0bc028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 81.500868][ T1320] RAX: ffffffffffffffda RBX: 00007f34bd426180 RCX: 00007f34bd19fb19 [ 81.508917][ T1320] RDX: ea5bc50b6199d77e RSI: 0000200000000240 RDI: 0000000000000006 [ 81.516873][ T1320] RBP: 00007f34be0bc090 R08: 0000000000000000 R09: 0000000000000000 [ 81.524828][ T1320] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 81.532795][ T1320] R13: 00007f34bd426218 R14: 00007f34bd426180 R15: 00007fff131afd48 [ 81.540755][ T1320] [ 81.545394][ T1303] F2FS-fs (loop4): Found nat_bits in checkpoint [ 81.550484][ T24] usbhid 4-1:0.0: can't add hid device: -71 [ 81.560703][ T24] usbhid: probe of 4-1:0.0 failed with error -71 [ 81.577794][ T24] usb 4-1: USB disconnect, device number 3 [ 81.608651][ T1303] F2FS-fs (loop4): Try to recover 1th superblock, ret: 0 [ 81.615887][ T1303] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e4 [ 81.673030][ T1303] F2FS-fs (loop4): sanity_check_inode: inode (ino=4, mode=16877) should not have inline_data, run fsck to fix [ 81.685183][ T28] kauditd_printk_skb: 1117 callbacks suppressed [ 81.685198][ T28] audit: type=1326 audit(1794037138.639:2639): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1325 comm="syz.2.235" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2b78d9fb19 code=0x7ffc0000 [ 81.687243][ T1303] F2FS-fs (loop4): sanity_check_inode: inode (ino=4, mode=16877) should not have inline_data, run fsck to fix [ 81.694840][ T28] audit: type=1326 audit(1794037138.639:2640): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1325 comm="syz.2.235" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2b78d9fb19 code=0x7ffc0000 [ 81.752879][ T28] audit: type=1326 audit(1794037138.649:2641): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1325 comm="syz.2.235" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2b78d9fb19 code=0x7ffc0000 [ 81.778409][ T28] audit: type=1326 audit(1794037138.649:2642): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1325 comm="syz.2.235" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2b78d9fb19 code=0x7ffc0000 [ 81.805615][ T28] audit: type=1326 audit(1794037138.679:2643): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1325 comm="syz.2.235" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=186 compat=0 ip=0x7f2b78d9fb19 code=0x7ffc0000 [ 81.830757][ T28] audit: type=1326 audit(1794037138.679:2644): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1325 comm="syz.2.235" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2b78d9fb19 code=0x7ffc0000 [ 81.856929][ T28] audit: type=1326 audit(1794037138.679:2645): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1325 comm="syz.2.235" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2b78d9fb19 code=0x7ffc0000 [ 81.883004][ T28] audit: type=1326 audit(1794037138.689:2646): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1325 comm="syz.2.235" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2b78d9fb19 code=0x7ffc0000 [ 81.907839][ T28] audit: type=1326 audit(1794037138.689:2647): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1325 comm="syz.2.235" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2b78d9fb19 code=0x7ffc0000 [ 81.932660][ T28] audit: type=1326 audit(1794037138.689:2648): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1325 comm="syz.2.235" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f2b78d9fb19 code=0x7ffc0000 [ 82.040810][ T1330] loop2: detected capacity change from 0 to 16 [ 82.552336][ T1330] erofs: (device loop2): mounted with root inode @ nid 36. [ 82.661855][ T1327] erofs: (device loop2): z_erofs_readahead: readahead error at page 4 @ nid 89 [ 82.670914][ T1327] erofs: (device loop2): z_erofs_readahead: readahead error at page 3 @ nid 89 [ 82.680450][ T1327] syz.2.235: attempt to access beyond end of device [ 82.680450][ T1327] loop2: rw=524288, sector=34359738360, nr_sectors = 8 limit=16 [ 82.694848][ T1327] syz.2.235: attempt to access beyond end of device [ 82.694848][ T1327] loop2: rw=524288, sector=8, nr_sectors = 16 limit=16 [ 82.880047][ T400] Bluetooth: hci0: command 0x1003 tx timeout [ 82.886124][ T45] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 83.378161][ T1340] loop0: detected capacity change from 0 to 1024 [ 84.536657][ T1340] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. [ 84.677830][ T10] Bluetooth: hci0: Frame reassembly failed (-84) [ 84.714751][ T1353] loop2: detected capacity change from 0 to 256 [ 84.754659][ T1353] FAT-fs (loop2): Unrecognized mount option "xœìÝ»‹cU" or missing value [ 84.787234][ T1356] loop3: detected capacity change from 0 to 512 [ 84.831843][ T1356] EXT4-fs: Ignoring removed nobh option [ 84.839339][ T289] EXT4-fs (loop0): unmounting filesystem. [ 84.847376][ T1353] loop2: detected capacity change from 0 to 256 [ 84.868096][ T1353] FAT-fs (loop2): Unrecognized mount option "utf8=1(uni_xlate=1" or missing value [ 84.889606][ T1336] loop1: detected capacity change from 0 to 40427 [ 84.901150][ T1336] F2FS-fs (loop1): invalid crc value [ 84.919144][ T1356] EXT4-fs error (device loop3): ext4_mb_generate_buddy:1126: group 0, block bitmap and bg descriptor inconsistent: 219 vs 220 free clusters [ 84.982202][ T1336] F2FS-fs (loop1): Found nat_bits in checkpoint [ 85.060788][ T1356] EXT4-fs (loop3): Remounting filesystem read-only [ 85.067549][ T1356] EXT4-fs error (device loop3): ext4_free_branches:1030: inode #11: comm syz.3.242: invalid indirect mapped block 4278190080 (level 0) [ 85.096891][ T1336] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e5 [ 85.104849][ T1356] EXT4-fs (loop3): Remounting filesystem read-only [ 85.114895][ T1356] EXT4-fs error (device loop3): ext4_free_branches:1030: inode #11: comm syz.3.242: invalid indirect mapped block 1 (level 1) [ 85.134203][ T1356] EXT4-fs (loop3): Remounting filesystem read-only [ 85.146796][ T1356] EXT4-fs (loop3): 1 truncate cleaned up [ 85.152605][ T1356] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 85.191184][ T288] EXT4-fs (loop3): unmounting filesystem. [ 85.220955][ T1376] syz.3.246 uses obsolete (PF_INET,SOCK_PACKET) [ 85.231301][ T1376] loop3: detected capacity change from 0 to 256 [ 85.247758][ T1376] FAT-fs (loop3): Directory bread(block 1285) failed [ 85.259777][ T1376] FAT-fs (loop3): Directory bread(block 1286) failed [ 85.266694][ T1376] FAT-fs (loop3): Directory bread(block 1287) failed [ 85.276778][ T1376] FAT-fs (loop3): Directory bread(block 1288) failed [ 85.287833][ T1376] FAT-fs (loop3): Directory bread(block 1285) failed [ 85.294615][ T1376] FAT-fs (loop3): Directory bread(block 1286) failed [ 85.309966][ T1376] FAT-fs (loop3): Directory bread(block 1287) failed [ 85.317294][ T1376] FAT-fs (loop3): Directory bread(block 1288) failed [ 85.327580][ T1376] FAT-fs (loop3): FAT read failed (blocknr 1281) [ 85.338068][ T1370] netlink: 20 bytes leftover after parsing attributes in process `syz.2.244'. [ 85.376479][ T1373] loop0: detected capacity change from 0 to 40427 [ 85.393460][ T1373] F2FS-fs (loop0): Invalid log_blocksize (268), supports only 12 [ 85.406063][ T1373] F2FS-fs (loop0): Can't find valid F2FS filesystem in 1th superblock [ 85.419608][ T1373] F2FS-fs (loop0): invalid crc value [ 85.426519][ T1373] F2FS-fs (loop0): Found nat_bits in checkpoint [ 85.444888][ T287] syz-executor: attempt to access beyond end of device [ 85.444888][ T287] loop1: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 85.462007][ T10] Bluetooth: hci1: Frame reassembly failed (-84) [ 85.462998][ T1373] F2FS-fs (loop0): Try to recover 1th superblock, ret: 0 [ 85.480481][ T1373] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e5 [ 85.528256][ T1373] overlayfs: invalid origin (0000) [ 85.771160][ T342] F2FS-fs (loop0): f2fs_check_nid_range: out-of-range nid=1, run fsck to fix. [ 85.780595][ T342] F2FS-fs (loop0): f2fs_check_nid_range: out-of-range nid=2, run fsck to fix. [ 85.850101][ T24] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 85.924754][ T1404] loop2: detected capacity change from 0 to 16 [ 85.932643][ T1404] erofs: (device loop2): mounted with root inode @ nid 36. [ 85.949039][ T1404] erofs: (device loop2): z_erofs_readahead: readahead error at page 4 @ nid 89 [ 85.958343][ T1404] erofs: (device loop2): z_erofs_readahead: readahead error at page 3 @ nid 89 [ 85.967766][ T1404] syz.2.252: attempt to access beyond end of device [ 85.967766][ T1404] loop2: rw=524288, sector=34359738360, nr_sectors = 8 limit=16 [ 85.982289][ T1404] syz.2.252: attempt to access beyond end of device [ 85.982289][ T1404] loop2: rw=524288, sector=8, nr_sectors = 16 limit=16 [ 86.031002][ T24] usb 2-1: config 0 interface 0 altsetting 8 endpoint 0x81 has invalid wMaxPacketSize 0 [ 86.041026][ T24] usb 2-1: config 0 interface 0 altsetting 8 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 86.054346][ T24] usb 2-1: config 0 interface 0 has no altsetting 0 [ 86.061364][ T24] usb 2-1: New USB device found, idVendor=1b1c, idProduct=0a55, bcdDevice= 0.00 [ 86.070923][ T24] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 86.080986][ T24] usb 2-1: config 0 descriptor?? [ 86.129945][ T6] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 86.291102][ T24] usbhid 2-1:0.0: can't add hid device: -71 [ 86.297151][ T24] usbhid: probe of 2-1:0.0 failed with error -71 [ 86.304913][ T24] usb 2-1: USB disconnect, device number 5 [ 86.322462][ T6] usb 1-1: New USB device found, idVendor=0bda, idProduct=8150, bcdDevice= 0.00 [ 86.331614][ T6] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 86.339611][ T6] usb 1-1: Product: syz [ 86.344155][ T6] usb 1-1: Manufacturer: syz [ 86.348930][ T6] usb 1-1: SerialNumber: syz [ 86.680039][ T655] Bluetooth: hci0: command 0x1003 tx timeout [ 86.680058][ T45] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 86.728710][ T1408] loop4: detected capacity change from 0 to 256 [ 86.737779][ T1408] FAT-fs (loop4): Unrecognized mount option "xœìÝ»‹cU" or missing value [ 86.748674][ T1408] loop4: detected capacity change from 0 to 256 [ 86.755792][ T1408] FAT-fs (loop4): Unrecognized mount option "utf8=1(uni_xlate=1" or missing value [ 86.769286][ T28] kauditd_printk_skb: 852 callbacks suppressed [ 86.769301][ T28] audit: type=1400 audit(1794037143.719:3501): avc: denied { mount } for pid=1401 comm="syz.0.251" name="/" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=filesystem permissive=1 [ 86.785293][ T6] rtl8150 1-1:1.0: couldn't reset the device [ 86.833159][ T1414] process 'syz.4.256' launched './file2' with NULL argv: empty string added [ 86.839889][ T6] rtl8150: probe of 1-1:1.0 failed with error -5 [ 86.856275][ T6] usb 1-1: USB disconnect, device number 3 [ 87.157088][ T1432] FAULT_INJECTION: forcing a failure. [ 87.157088][ T1432] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 87.170471][ T1432] CPU: 1 PID: 1432 Comm: syz.1.259 Not tainted syzkaller #0 [ 87.177948][ T1432] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 87.188019][ T1432] Call Trace: [ 87.191319][ T1432] [ 87.194242][ T1432] __dump_stack+0x21/0x24 [ 87.198759][ T1432] dump_stack_lvl+0x110/0x170 [ 87.203458][ T1432] ? __cfi_dump_stack_lvl+0x8/0x8 [ 87.208559][ T1432] ? __kasan_check_write+0x14/0x20 [ 87.213684][ T1432] dump_stack+0x15/0x24 [ 87.217881][ T1432] should_fail_ex+0x3bf/0x510 [ 87.222559][ T1432] should_fail+0xb/0x10 [ 87.226802][ T1432] should_fail_usercopy+0x1a/0x20 [ 87.231912][ T1432] strncpy_from_user+0x24/0x2c0 [ 87.236957][ T1432] ? kmem_cache_alloc+0x166/0x320 [ 87.242509][ T1432] ? getname_flags+0xba/0x510 [ 87.247195][ T1432] getname_flags+0xf5/0x510 [ 87.251689][ T1432] getname+0x19/0x20 [ 87.256025][ T1432] do_sys_openat2+0xeb/0x820 [ 87.260626][ T1432] ? __kasan_check_write+0x14/0x20 [ 87.265728][ T1432] ? do_sys_open+0xe0/0xe0 [ 87.270164][ T1432] ? ksys_write+0x1fa/0x260 [ 87.274657][ T1432] ? __cfi_ksys_write+0x10/0x10 [ 87.279496][ T1432] __x64_sys_openat+0x136/0x160 [ 87.284342][ T1432] x64_sys_call+0x783/0x9a0 [ 87.289375][ T1432] do_syscall_64+0x4c/0xa0 [ 87.293786][ T1432] ? clear_bhb_loop+0x30/0x80 [ 87.298472][ T1432] ? clear_bhb_loop+0x30/0x80 [ 87.303165][ T1432] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 87.309067][ T1432] RIP: 0033:0x7f34bd19fb19 [ 87.313470][ T1432] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 87.333153][ T1432] RSP: 002b:00007f34be0fe028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 87.341653][ T1432] RAX: ffffffffffffffda RBX: 00007f34bd425fa0 RCX: 00007f34bd19fb19 [ 87.349626][ T1432] RDX: 000000000000275a RSI: 0000200000000100 RDI: ffffffffffffff9c [ 87.357584][ T1432] RBP: 00007f34be0fe090 R08: 0000000000000000 R09: 0000000000000000 [ 87.365547][ T1432] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 87.373505][ T1432] R13: 00007f34bd426038 R14: 00007f34bd425fa0 R15: 00007fff131afd48 [ 87.381495][ T1432] [ 87.419955][ T1435] FAULT_INJECTION: forcing a failure. [ 87.419955][ T1435] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 87.434305][ T1435] CPU: 0 PID: 1435 Comm: syz.1.260 Not tainted syzkaller #0 [ 87.441614][ T1435] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 87.451665][ T1435] Call Trace: [ 87.455007][ T1435] [ 87.458292][ T1435] __dump_stack+0x21/0x24 [ 87.462628][ T1435] dump_stack_lvl+0x110/0x170 [ 87.467306][ T1435] ? __cfi_dump_stack_lvl+0x8/0x8 [ 87.472582][ T1435] dump_stack+0x15/0x24 [ 87.476724][ T1435] should_fail_ex+0x3bf/0x510 [ 87.479964][ T45] Bluetooth: hci1: command 0x1003 tx timeout [ 87.481387][ T1435] should_fail+0xb/0x10 [ 87.481406][ T1435] should_fail_usercopy+0x1a/0x20 [ 87.487415][ T400] Bluetooth: hci1: Opcode 0x1003 failed: -110 [ 87.491498][ T1435] _copy_from_user+0x1e/0xc0 [ 87.491517][ T1435] memdup_user+0x63/0xc0 [ 87.491531][ T1435] kvm_arch_vcpu_ioctl+0xd15/0x2390 [ 87.491550][ T1435] ? __cfi_avc_has_perm+0x10/0x10 [ 87.524062][ T1435] ? __cfi_kvm_arch_vcpu_ioctl+0x10/0x10 [ 87.531124][ T1435] ? is_bpf_text_address+0x177/0x190 [ 87.536885][ T1435] ? kernel_text_address+0xa0/0xd0 [ 87.542026][ T1435] ? __kernel_text_address+0xd/0x30 [ 87.547239][ T1435] ? unwind_get_return_address+0x4d/0x90 [ 87.553471][ T1435] ? __cfi_stack_trace_consume_entry+0x10/0x10 [ 87.561112][ T1435] ? arch_stack_walk+0xfc/0x150 [ 87.565991][ T1435] ? stack_trace_save+0xa6/0xf0 [ 87.570846][ T1435] ? __stack_depot_save+0x36/0x490 [ 87.575955][ T1435] ? _parse_integer_limit+0x18e/0x1d0 [ 87.581422][ T1435] ? __asan_set_shadow_00+0xe/0x10 [ 87.586736][ T1435] ? do_vfs_ioctl+0x1b68/0x1cd0 [ 87.591592][ T1435] ? __ia32_compat_sys_ioctl+0x860/0x860 [ 87.597223][ T1435] ? kstrtouint+0x74/0xe0 [ 87.601552][ T1435] ? kstrtouint_from_user+0x113/0x170 [ 87.606935][ T1435] ? __cfi_kstrtouint_from_user+0x10/0x10 [ 87.612654][ T1435] ? ioctl_has_perm+0x1b8/0x4f0 [ 87.617498][ T1435] ? memcpy+0x56/0x70 [ 87.621482][ T1435] ? __kasan_check_write+0x14/0x20 [ 87.626589][ T1435] ? mutex_lock_killable+0x93/0x1b0 [ 87.631777][ T1435] ? __cfi_mutex_lock_killable+0x10/0x10 [ 87.637404][ T1435] kvm_vcpu_ioctl+0x6fb/0xc00 [ 87.642114][ T1435] ? __cfi_kvm_vcpu_ioctl+0x10/0x10 [ 87.647335][ T1435] ? selinux_file_ioctl+0x3ad/0x4c0 [ 87.652531][ T1435] ? __cfi_selinux_file_ioctl+0x10/0x10 [ 87.658112][ T1435] ? mutex_unlock+0x8f/0x230 [ 87.662722][ T1435] ? __cfi_mutex_unlock+0x10/0x10 [ 87.667759][ T1435] ? __fget_files+0x2d1/0x330 [ 87.672599][ T1435] ? security_file_ioctl+0x95/0xc0 [ 87.677815][ T1435] ? __cfi_kvm_vcpu_ioctl+0x10/0x10 [ 87.683108][ T1435] __se_sys_ioctl+0x12f/0x1b0 [ 87.688321][ T1435] __x64_sys_ioctl+0x7b/0x90 [ 87.692924][ T1435] x64_sys_call+0x58b/0x9a0 [ 87.697443][ T1435] do_syscall_64+0x4c/0xa0 [ 87.701874][ T1435] ? clear_bhb_loop+0x30/0x80 [ 87.706822][ T1435] ? clear_bhb_loop+0x30/0x80 [ 87.711502][ T1435] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 87.717408][ T1435] RIP: 0033:0x7f34bd19fb19 [ 87.721943][ T1435] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 87.741987][ T1435] RSP: 002b:00007f34be0fe028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 87.750484][ T1435] RAX: ffffffffffffffda RBX: 00007f34bd425fa0 RCX: 00007f34bd19fb19 [ 87.758533][ T1435] RDX: 00002000000010c0 RSI: 000000004400ae8f RDI: 0000000000000005 [ 87.766767][ T1435] RBP: 00007f34be0fe090 R08: 0000000000000000 R09: 0000000000000000 [ 87.774749][ T1435] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 87.782713][ T1435] R13: 00007f34bd426038 R14: 00007f34bd425fa0 R15: 00007fff131afd48 [ 87.790678][ T1435] [ 87.830598][ T1442] EXT4-fs (loop2): ext4_check_descriptors: Checksum for group 0 failed (38034!=20869) [ 87.847618][ T1441] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 87.848835][ T1442] EXT4-fs (loop2): barriers disabled [ 87.864103][ T1442] JBD2: no valid journal superblock found [ 87.865242][ T28] audit: type=1400 audit(1794037144.819:3502): avc: denied { create } for pid=1438 comm="syz.3.261" name="file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=lnk_file permissive=1 [ 87.871218][ T1442] EXT4-fs (loop2): error loading journal [ 87.921972][ T288] EXT4-fs (loop3): unmounting filesystem. [ 88.028556][ T1449] device dummy0 entered promiscuous mode [ 88.035133][ T1449] device vlan2 entered promiscuous mode [ 88.046125][ T358] Bluetooth: hci0: Frame reassembly failed (-84) [ 88.277274][ T1465] device vlan2 entered promiscuous mode [ 88.507803][ T28] audit: type=1400 audit(1794037145.459:3503): avc: denied { unmount } for pid=289 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=filesystem permissive=1 [ 88.661853][ T1470] set_capacity_and_notify: 3 callbacks suppressed [ 88.661899][ T1470] loop0: detected capacity change from 0 to 256 [ 88.880272][ T1470] FAT-fs (loop0): Unrecognized mount option "xœìÝ»‹cU" or missing value [ 88.913881][ T28] audit: type=1326 audit(1794037145.869:3504): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1471 comm="syz.2.269" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2b78d9fb19 code=0x7ffc0000 [ 88.942560][ T28] audit: type=1326 audit(1794037145.899:3505): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1471 comm="syz.2.269" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2b78d9fb19 code=0x7ffc0000 [ 88.971217][ T28] audit: type=1326 audit(1794037145.919:3506): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1471 comm="syz.2.269" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2b78d9fb19 code=0x7ffc0000 [ 88.979025][ T1476] FAULT_INJECTION: forcing a failure. [ 88.979025][ T1476] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 88.996767][ T28] audit: type=1326 audit(1794037145.919:3507): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1471 comm="syz.2.269" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2b78d9fb19 code=0x7ffc0000 [ 89.034001][ T28] audit: type=1326 audit(1794037145.919:3508): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1471 comm="syz.2.269" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f2b78d9fb19 code=0x7ffc0000 [ 89.041564][ T1476] CPU: 1 PID: 1476 Comm: syz.1.270 Not tainted syzkaller #0 [ 89.059304][ T28] audit: type=1326 audit(1794037145.919:3509): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1471 comm="syz.2.269" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2b78d9fb19 code=0x7ffc0000 [ 89.065833][ T1476] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 89.065847][ T1476] Call Trace: [ 89.065852][ T1476] [ 89.065858][ T1476] __dump_stack+0x21/0x24 [ 89.065883][ T1476] dump_stack_lvl+0x110/0x170 [ 89.091417][ T28] audit: type=1326 audit(1794037145.919:3510): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1471 comm="syz.2.269" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2b78d9fb19 code=0x7ffc0000 [ 89.100544][ T1476] ? __cfi_dump_stack_lvl+0x8/0x8 [ 89.100566][ T1476] ? getname_flags+0xba/0x510 [ 89.122376][ T1470] loop0: detected capacity change from 0 to 256 [ 89.140355][ T1476] dump_stack+0x15/0x24 [ 89.140382][ T1476] should_fail_ex+0x3bf/0x510 [ 89.140407][ T1476] should_fail+0xb/0x10 [ 89.169439][ T1476] should_fail_usercopy+0x1a/0x20 [ 89.170146][ T1470] FAT-fs (loop0): Unrecognized mount option "utf8=1(uni_xlate=1" or missing value [ 89.174482][ T1476] strncpy_from_user+0x24/0x2c0 [ 89.188509][ T1476] ? kmem_cache_alloc+0x166/0x320 [ 89.193552][ T1476] ? getname_flags+0xba/0x510 [ 89.198218][ T1476] getname_flags+0xf5/0x510 [ 89.202707][ T1476] __x64_sys_renameat2+0xb4/0xf0 [ 89.207646][ T1476] x64_sys_call+0x6b8/0x9a0 [ 89.212158][ T1476] do_syscall_64+0x4c/0xa0 [ 89.216571][ T1476] ? clear_bhb_loop+0x30/0x80 [ 89.221237][ T1476] ? clear_bhb_loop+0x30/0x80 [ 89.225921][ T1476] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 89.231897][ T1476] RIP: 0033:0x7f34bd19fb19 [ 89.236309][ T1476] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 89.255904][ T1476] RSP: 002b:00007f34be0fe028 EFLAGS: 00000246 ORIG_RAX: 000000000000013c [ 89.264336][ T1476] RAX: ffffffffffffffda RBX: 00007f34bd425fa0 RCX: 00007f34bd19fb19 [ 89.272301][ T1476] RDX: ffffffffffffff9c RSI: 000020000000a6c0 RDI: ffffffffffffff9c [ 89.280275][ T1476] RBP: 00007f34be0fe090 R08: 0000000000000000 R09: 0000000000000000 [ 89.288331][ T1476] R10: 000020000000a700 R11: 0000000000000246 R12: 0000000000000001 [ 89.296671][ T1476] R13: 00007f34bd426038 R14: 00007f34bd425fa0 R15: 00007fff131afd48 [ 89.304640][ T1476] [ 89.363660][ T1478] loop2: detected capacity change from 0 to 16 [ 89.401309][ T1478] erofs: (device loop2): mounted with root inode @ nid 36. [ 89.435793][ T1478] erofs: (device loop2): z_erofs_readahead: readahead error at page 4 @ nid 89 [ 89.444844][ T1478] erofs: (device loop2): z_erofs_readahead: readahead error at page 3 @ nid 89 [ 89.454326][ T1478] syz.2.269: attempt to access beyond end of device [ 89.454326][ T1478] loop2: rw=524288, sector=34359738360, nr_sectors = 8 limit=16 [ 89.469513][ T1478] syz.2.269: attempt to access beyond end of device [ 89.469513][ T1478] loop2: rw=524288, sector=8, nr_sectors = 16 limit=16 [ 89.580073][ T327] I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 90.119995][ T45] Bluetooth: hci0: command 0x1003 tx timeout [ 90.120022][ T655] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 90.453244][ T1501] FAULT_INJECTION: forcing a failure. [ 90.453244][ T1501] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 90.513303][ T1501] CPU: 1 PID: 1501 Comm: syz.0.274 Not tainted syzkaller #0 [ 90.520638][ T1501] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 90.530781][ T1501] Call Trace: [ 90.534061][ T1501] [ 90.537164][ T1501] __dump_stack+0x21/0x24 [ 90.541493][ T1501] dump_stack_lvl+0x110/0x170 [ 90.546167][ T1501] ? __cfi_dump_stack_lvl+0x8/0x8 [ 90.551179][ T1501] ? walk_page_range+0x6d2/0x760 [ 90.556103][ T1501] dump_stack+0x15/0x24 [ 90.560241][ T1501] should_fail_ex+0x3bf/0x510 [ 90.564907][ T1501] should_fail+0xb/0x10 [ 90.569047][ T1501] should_fail_usercopy+0x1a/0x20 [ 90.574077][ T1501] _copy_to_user+0x1e/0x90 [ 90.578476][ T1501] pagemap_read+0x42e/0x600 [ 90.582966][ T1501] ? __cfi_pagemap_read+0x10/0x10 [ 90.587977][ T1501] ? fsnotify_perm+0x269/0x5b0 [ 90.592728][ T1501] ? security_file_permission+0x94/0xb0 [ 90.598274][ T1501] ? __cfi_pagemap_read+0x10/0x10 [ 90.603284][ T1501] vfs_read+0x286/0x930 [ 90.607426][ T1501] ? __cfi_vfs_read+0x10/0x10 [ 90.612083][ T1501] ? __fget_files+0x2d1/0x330 [ 90.616752][ T1501] ? __fdget+0x19c/0x220 [ 90.620982][ T1501] ? __x64_sys_pread64+0xf3/0x220 [ 90.625996][ T1501] __x64_sys_pread64+0x194/0x220 [ 90.630919][ T1501] ? __cfi___x64_sys_pread64+0x10/0x10 [ 90.636384][ T1501] ? fpregs_restore_userregs+0x128/0x260 [ 90.642089][ T1501] ? switch_fpu_return+0xe/0x10 [ 90.646925][ T1501] x64_sys_call+0x4c7/0x9a0 [ 90.651414][ T1501] do_syscall_64+0x4c/0xa0 [ 90.655818][ T1501] ? clear_bhb_loop+0x30/0x80 [ 90.660524][ T1501] ? clear_bhb_loop+0x30/0x80 [ 90.665191][ T1501] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 90.671073][ T1501] RIP: 0033:0x7fd27fb9fb19 [ 90.675561][ T1501] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 90.695426][ T1501] RSP: 002b:00007fd280ad5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000011 [ 90.703829][ T1501] RAX: ffffffffffffffda RBX: 00007fd27fe26180 RCX: 00007fd27fb9fb19 [ 90.711790][ T1501] RDX: 0000000000019000 RSI: 0000200000000a40 RDI: 0000000000000009 [ 90.719745][ T1501] RBP: 00007fd280ad5090 R08: 0000000000000000 R09: 0000000000000000 [ 90.727698][ T1501] R10: 0000001000000000 R11: 0000000000000246 R12: 0000000000000001 [ 90.735658][ T1501] R13: 00007fd27fe26218 R14: 00007fd27fe26180 R15: 00007ffe77bf8ca8 [ 90.743716][ T1501] [ 90.758529][ T1505] capability: warning: `syz.1.276' uses 32-bit capabilities (legacy support in use) [ 90.982885][ T1522] loop1: detected capacity change from 0 to 1024 [ 91.236886][ T1526] FAULT_INJECTION: forcing a failure. [ 91.236886][ T1526] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 91.250199][ T1526] CPU: 1 PID: 1526 Comm: syz.3.281 Not tainted syzkaller #0 [ 91.257492][ T1526] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 91.267545][ T1526] Call Trace: [ 91.270828][ T1526] [ 91.273752][ T1526] __dump_stack+0x21/0x24 [ 91.278080][ T1526] dump_stack_lvl+0x110/0x170 [ 91.282752][ T1526] ? __cfi_dump_stack_lvl+0x8/0x8 [ 91.287787][ T1526] dump_stack+0x15/0x24 [ 91.291955][ T1526] should_fail_ex+0x3bf/0x510 [ 91.296632][ T1526] should_fail+0xb/0x10 [ 91.300791][ T1526] should_fail_usercopy+0x1a/0x20 [ 91.305818][ T1526] _copy_from_user+0x1e/0xc0 [ 91.310401][ T1526] do_ip6t_set_ctl+0x69b/0xe00 [ 91.315172][ T1526] ? finish_task_switch+0x16b/0x7c0 [ 91.320401][ T1526] ? switch_mm_irqs_off+0x724/0x960 [ 91.325595][ T1526] ? __cfi_do_ip6t_set_ctl+0x10/0x10 [ 91.330878][ T1526] ? __schedule+0xcbb/0x1700 [ 91.335475][ T1526] ? __cfi_avc_has_perm+0x10/0x10 [ 91.340755][ T1526] ? __kasan_check_write+0x14/0x20 [ 91.345869][ T1526] ? mutex_unlock+0x8f/0x230 [ 91.350478][ T1526] ? __cfi_mutex_unlock+0x10/0x10 [ 91.355501][ T1526] nf_setsockopt+0x284/0x2b0 [ 91.360091][ T1526] ipv6_setsockopt+0x170/0x1a0 [ 91.364853][ T1526] tcp_setsockopt+0xeb/0x100 [ 91.369438][ T1526] sock_common_setsockopt+0xb1/0xc0 [ 91.374632][ T1526] ? __cfi_sock_common_setsockopt+0x10/0x10 [ 91.380524][ T1526] __sys_setsockopt+0x2ff/0x4e0 [ 91.385415][ T1526] ? __cfi___sys_setsockopt+0x10/0x10 [ 91.390791][ T1526] ? __kasan_check_write+0x14/0x20 [ 91.396159][ T1526] ? fpregs_restore_userregs+0x128/0x260 [ 91.401791][ T1526] __x64_sys_setsockopt+0xbf/0xd0 [ 91.406823][ T1526] x64_sys_call+0x124/0x9a0 [ 91.411325][ T1526] do_syscall_64+0x4c/0xa0 [ 91.415830][ T1526] ? clear_bhb_loop+0x30/0x80 [ 91.420773][ T1526] ? clear_bhb_loop+0x30/0x80 [ 91.425557][ T1526] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 91.431630][ T1526] RIP: 0033:0x7f135979fb19 [ 91.436055][ T1526] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 91.455673][ T1526] RSP: 002b:00007f135a580028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 91.464362][ T1526] RAX: ffffffffffffffda RBX: 00007f1359a26180 RCX: 00007f135979fb19 [ 91.474772][ T1526] RDX: 0000000000000040 RSI: 0000000000000029 RDI: 0000000000000009 [ 91.482746][ T1526] RBP: 00007f135a580090 R08: 00000000000004c0 R09: 0000000000000000 [ 91.490729][ T1526] R10: 00002000000003c0 R11: 0000000000000246 R12: 0000000000000001 [ 91.498708][ T1526] R13: 00007f1359a26218 R14: 00007f1359a26180 R15: 00007ffef226d6f8 [ 91.506690][ T1526] [ 91.512989][ T1522] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 91.740827][ T287] EXT4-fs (loop1): unmounting filesystem. [ 91.758873][ T1534] loop1: detected capacity change from 0 to 256 [ 91.783417][ T1534] FAT-fs (loop1): Unrecognized mount option "xœìÝ»‹cU" or missing value [ 92.047140][ T1534] loop1: detected capacity change from 0 to 256 [ 92.069262][ T1534] FAT-fs (loop1): Unrecognized mount option "utf8=1(uni_xlate=1" or missing value [ 92.231771][ T1544] loop0: detected capacity change from 0 to 512 [ 92.242833][ T1544] EXT4-fs: Ignoring removed nobh option [ 92.252472][ T1544] EXT4-fs error (device loop0): ext4_mb_generate_buddy:1126: group 0, block bitmap and bg descriptor inconsistent: 219 vs 220 free clusters [ 92.268215][ T1544] EXT4-fs (loop0): Remounting filesystem read-only [ 92.283879][ T1544] EXT4-fs error (device loop0): ext4_free_branches:1030: inode #11: comm syz.0.287: invalid indirect mapped block 4278190080 (level 0) [ 92.298376][ T1544] EXT4-fs (loop0): Remounting filesystem read-only [ 92.305316][ T1544] EXT4-fs error (device loop0): ext4_free_branches:1030: inode #11: comm syz.0.287: invalid indirect mapped block 1 (level 1) [ 92.319061][ T1544] EXT4-fs (loop0): Remounting filesystem read-only [ 92.326152][ T1544] EXT4-fs (loop0): 1 truncate cleaned up [ 92.332183][ T1544] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 92.350699][ T289] EXT4-fs (loop0): unmounting filesystem. [ 92.393324][ T1556] loop0: detected capacity change from 0 to 256 [ 92.402499][ T1556] exFAT-fs (loop0): failed to load upcase table (idx : 0x00010895, chksum : 0x816c887a, utbl_chksum : 0xe619d30d) [ 92.791740][ T28] kauditd_printk_skb: 326 callbacks suppressed [ 92.791780][ T28] audit: type=1400 audit(1794037149.749:3837): avc: denied { read } for pid=1565 comm="syz.4.292" path="socket:[18969]" dev="sockfs" ino=18969 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 92.869138][ T1569] binder: 1567:1569 ioctl c0306201 0 returned -14 [ 92.983687][ T1573] netlink: 24 bytes leftover after parsing attributes in process `syz.3.295'. [ 92.993027][ T1573] netlink: 16 bytes leftover after parsing attributes in process `syz.3.295'. [ 93.002015][ T1573] netlink: 8 bytes leftover after parsing attributes in process `syz.3.295'. [ 93.011279][ T1573] netlink: 8 bytes leftover after parsing attributes in process `syz.3.295'. [ 93.021728][ T1573] loop3: detected capacity change from 0 to 16 [ 93.031747][ T1573] erofs: (device loop3): mounted with root inode @ nid 36. [ 93.044264][ T1573] erofs: (device loop3): z_erofs_extent_lookback: invalid lookback distance 0 @ nid 89 [ 93.054275][ T1573] erofs: (device loop3): z_erofs_readahead: readahead error at page 17 @ nid 89 [ 93.063630][ T1573] erofs: (device loop3): z_erofs_extent_lookback: invalid lookback distance 0 @ nid 89 [ 93.073912][ T1573] erofs: (device loop3): z_erofs_readahead: readahead error at page 16 @ nid 89 [ 93.083208][ T1573] erofs: (device loop3): z_erofs_readahead: readahead error at page 4 @ nid 89 [ 93.092575][ T1573] erofs: (device loop3): z_erofs_readahead: readahead error at page 3 @ nid 89 [ 93.102269][ T1573] syz.3.295: attempt to access beyond end of device [ 93.102269][ T1573] loop3: rw=524288, sector=34359738360, nr_sectors = 8 limit=16 [ 93.116800][ T1573] syz.3.295: attempt to access beyond end of device [ 93.116800][ T1573] loop3: rw=524288, sector=96, nr_sectors = 40 limit=16 [ 93.130593][ T1573] syz.3.295: attempt to access beyond end of device [ 93.130593][ T1573] loop3: rw=524288, sector=8, nr_sectors = 80 limit=16 [ 93.149988][ T6] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 93.169519][ T1576] loop3: detected capacity change from 0 to 256 [ 93.176421][ T1576] FAT-fs (loop3): Unrecognized mount option "xœìÝ»‹cU" or missing value [ 93.219353][ T28] audit: type=1400 audit(1794037150.169:3838): avc: denied { setopt } for pid=1577 comm="syz.3.297" lport=6 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 93.249122][ T1578] EXT4-fs: Project quota feature not enabled. Cannot enable project quota enforcement. [ 93.305723][ T1578] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 93.341211][ T6] usb 5-1: config 0 interface 0 altsetting 8 endpoint 0x81 has invalid wMaxPacketSize 0 [ 93.346569][ T1578] EXT4-fs error (device loop3): ext4_free_branches:1030: inode #16: comm syz.3.297: invalid indirect mapped block 32768 (level 2) [ 93.353515][ T6] usb 5-1: config 0 interface 0 altsetting 8 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 93.365554][ T1578] EXT4-fs (loop3): 1 orphan inode deleted [ 93.378927][ T6] usb 5-1: config 0 interface 0 has no altsetting 0 [ 93.390028][ T6] usb 5-1: New USB device found, idVendor=1b1c, idProduct=0a55, bcdDevice= 0.00 [ 93.399840][ T6] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 93.400960][ T1578] EXT4-fs (loop3): 1 truncate cleaned up [ 93.409408][ T6] usb 5-1: config 0 descriptor?? [ 93.419575][ T1578] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 93.445922][ T288] EXT4-fs (loop3): unmounting filesystem. [ 93.527280][ T358] Bluetooth: hci1: Frame reassembly failed (-84) [ 93.749995][ T19] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 93.821939][ T6] usbhid 5-1:0.0: can't add hid device: -71 [ 93.828245][ T6] usbhid: probe of 5-1:0.0 failed with error -71 [ 93.837225][ T6] usb 5-1: USB disconnect, device number 4 [ 93.939948][ T19] usb 4-1: Using ep0 maxpacket: 32 [ 93.946441][ T19] usb 4-1: config 1 interface 0 altsetting 129 endpoint 0x81 has an invalid bInterval 247, changing to 11 [ 93.958139][ T19] usb 4-1: config 1 interface 0 has no altsetting 0 [ 93.966223][ T19] usb 4-1: New USB device found, idVendor=1e71, idProduct=200d, bcdDevice= 0.40 [ 93.975570][ T19] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 93.983694][ T19] usb 4-1: Product: ည [ 93.987976][ T19] usb 4-1: Manufacturer: 㟈⟥䟢쬖㊇ë»ÄŸã¦…éŠé¿Šâ¬¢ã‹ªî­ë¯ˆï¶¹Í»à¹‘ᒸ鸩蜈쌌译닦â´å…¤ [ 93.999318][ T19] usb 4-1: SerialNumber: syz [ 94.207933][ T28] audit: type=1400 audit(1794037151.159:3839): avc: denied { connect } for pid=1589 comm="syz.3.301" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 94.239817][ T19] usbhid 4-1:1.0: can't add hid device: -71 [ 94.250074][ T19] usbhid: probe of 4-1:1.0 failed with error -71 [ 94.264215][ T19] usb 4-1: USB disconnect, device number 4 [ 94.277530][ T28] audit: type=1400 audit(1794037151.159:3840): avc: denied { write } for pid=1589 comm="syz.3.301" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 94.296794][ T400] Bluetooth: hci0: command 0x1003 tx timeout [ 94.302923][ T655] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 94.325903][ T1598] set_capacity_and_notify: 2 callbacks suppressed [ 94.325915][ T1598] loop1: detected capacity change from 0 to 512 [ 94.384290][ T1598] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 94.393391][ T1598] ext4 filesystem being mounted at /47/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 94.514768][ T287] EXT4-fs (loop1): unmounting filesystem. [ 94.528128][ T1611] loop1: detected capacity change from 0 to 256 [ 94.535880][ T1611] FAT-fs (loop1): Unrecognized mount option "xœìÝ»‹cU" or missing value [ 94.618797][ T1616] loop2: detected capacity change from 0 to 16 [ 94.627599][ T1616] erofs: (device loop2): mounted with root inode @ nid 36. [ 94.643719][ T1616] erofs: (device loop2): z_erofs_readahead: readahead error at page 4 @ nid 89 [ 94.652980][ T1616] erofs: (device loop2): z_erofs_readahead: readahead error at page 3 @ nid 89 [ 94.662222][ T1616] syz.2.306: attempt to access beyond end of device [ 94.662222][ T1616] loop2: rw=524288, sector=34359738360, nr_sectors = 8 limit=16 [ 94.676696][ T1616] syz.2.306: attempt to access beyond end of device [ 94.676696][ T1616] loop2: rw=524288, sector=8, nr_sectors = 16 limit=16 [ 95.530906][ T1623] loop3: detected capacity change from 0 to 16 [ 95.539889][ T1623] erofs: (device loop3): mounted with root inode @ nid 36. [ 95.549267][ T1623] erofs: (device loop3): z_erofs_extent_lookback: invalid lookback distance 0 @ nid 89 [ 95.559164][ T1623] erofs: (device loop3): z_erofs_readahead: readahead error at page 17 @ nid 89 [ 95.560008][ T655] Bluetooth: hci1: command 0x1003 tx timeout [ 95.575284][ T1623] erofs: (device loop3): z_erofs_extent_lookback: invalid lookback distance 0 @ nid 89 [ 95.604012][ T45] Bluetooth: hci1: Opcode 0x1003 failed: -110 [ 95.627193][ T1623] erofs: (device loop3): z_erofs_readahead: readahead error at page 16 @ nid 89 [ 95.682104][ T1621] binder_alloc: 1613: binder_alloc_buf size 16496 failed, no address space [ 95.690772][ T1621] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) [ 95.727332][ T1623] erofs: (device loop3): z_erofs_readahead: readahead error at page 4 @ nid 89 [ 95.742742][ T1623] erofs: (device loop3): z_erofs_readahead: readahead error at page 3 @ nid 89 [ 95.752376][ T1623] syz.3.310: attempt to access beyond end of device [ 95.752376][ T1623] loop3: rw=524288, sector=34359738360, nr_sectors = 8 limit=16 [ 95.777473][ T1623] syz.3.310: attempt to access beyond end of device [ 95.777473][ T1623] loop3: rw=524288, sector=96, nr_sectors = 40 limit=16 [ 95.800785][ T1623] syz.3.310: attempt to access beyond end of device [ 95.800785][ T1623] loop3: rw=524288, sector=16, nr_sectors = 80 limit=16 [ 95.816895][ T342] Bluetooth: hci0: Frame reassembly failed (-84) [ 95.831120][ T1637] binder: 1628:1637 ioctl c0306201 0 returned -14 [ 95.838468][ T1623] syz.3.310: attempt to access beyond end of device [ 95.838468][ T1623] loop3: rw=0, sector=34359738360, nr_sectors = 8 limit=16 [ 95.868124][ T1614] syz.4.309 (1614) used greatest stack depth: 20800 bytes left [ 95.883501][ T1623] syz.3.310: attempt to access beyond end of device [ 95.883501][ T1623] loop3: rw=0, sector=34359738360, nr_sectors = 8 limit=16 [ 95.930933][ T1643] loop3: detected capacity change from 0 to 512 [ 96.513458][ T1646] loop4: detected capacity change from 0 to 1024 [ 97.060719][ T1646] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: writeback. [ 97.233899][ T290] EXT4-fs (loop4): unmounting filesystem. [ 97.439864][ T1658] loop3: detected capacity change from 0 to 256 [ 97.440217][ T1658] FAT-fs (loop3): Unrecognized mount option "xœìÝ»‹cU" or missing value [ 97.451752][ T1660] loop4: detected capacity change from 0 to 512 [ 97.468178][ T569] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 97.472099][ T1657] loop2: detected capacity change from 0 to 512 [ 97.486653][ T1658] loop3: detected capacity change from 0 to 256 [ 97.507383][ T1658] FAT-fs (loop3): Unrecognized mount option "utf8=1(uni_xlate=1" or missing value [ 98.521173][ T655] Bluetooth: hci0: command 0x1003 tx timeout [ 98.540080][ T45] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 98.542656][ T1657] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback. [ 98.555399][ T1657] ext4 filesystem being mounted at /67/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 99.526521][ T1679] erofs: (device loop0): mounted with root inode @ nid 36. [ 100.358170][ T1678] erofs: (device loop0): z_erofs_readahead: readahead error at page 4 @ nid 89 [ 100.367270][ T1678] erofs: (device loop0): z_erofs_readahead: readahead error at page 3 @ nid 89 [ 100.376369][ T1678] syz.0.322: attempt to access beyond end of device [ 100.376369][ T1678] loop0: rw=524288, sector=34359738360, nr_sectors = 8 limit=16 [ 100.390528][ T1678] syz.0.322: attempt to access beyond end of device [ 100.390528][ T1678] loop0: rw=524288, sector=8, nr_sectors = 16 limit=16 [ 100.448180][ T28] audit: type=1400 audit(1794037157.399:3841): avc: denied { read write } for pid=1684 comm="syz.1.325" name="uinput" dev="devtmpfs" ino=262 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 100.473046][ T1687] input: syz0 as /devices/virtual/input/input4 [ 100.481057][ T291] EXT4-fs (loop2): unmounting filesystem. [ 100.498508][ T28] audit: type=1400 audit(1794037157.399:3842): avc: denied { open } for pid=1684 comm="syz.1.325" path="/dev/uinput" dev="devtmpfs" ino=262 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 100.514261][ T1687] input: failed to attach handler leds to device input4, error: -6 [ 100.523320][ T28] audit: type=1400 audit(1794037157.429:3843): avc: denied { ioctl } for pid=1684 comm="syz.1.325" path="/dev/uinput" dev="devtmpfs" ino=262 ioctlcmd=0x5564 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 100.565233][ T1692] binder_alloc: 1685: binder_alloc_buf size 16496 failed, no address space [ 100.573891][ T1692] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) [ 100.646621][ T1698] binder: 1690:1698 ioctl c0306201 0 returned -14 [ 100.892958][ T1706] set_capacity_and_notify: 1 callbacks suppressed [ 100.892984][ T1706] loop1: detected capacity change from 0 to 1024 [ 101.127048][ T1706] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 101.592571][ T1713] loop3: detected capacity change from 0 to 256 [ 101.632208][ T1713] FAT-fs (loop3): Unrecognized mount option "xœìÝ»‹cU" or missing value [ 101.675301][ T287] EXT4-fs (loop1): unmounting filesystem. [ 101.713954][ T1713] loop3: detected capacity change from 0 to 256 [ 101.731172][ T1719] binder: BINDER_SET_CONTEXT_MGR already set [ 101.736295][ T1713] FAT-fs (loop3): Unrecognized mount option "utf8=1(uni_xlate=1" or missing value [ 101.747353][ T1719] binder: 1712:1719 ioctl 4018620d 2000000005c0 returned -16 [ 101.908613][ T1715] binder: 1712:1715 ioctl c0306201 0 returned -14 [ 102.210329][ T342] Bluetooth: hci1: Frame reassembly failed (-84) [ 102.290075][ T40] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 102.360060][ T45] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 102.460205][ T1735] loop2: detected capacity change from 0 to 2048 [ 102.469948][ T40] usb 4-1: Using ep0 maxpacket: 32 [ 102.476302][ T40] usb 4-1: config 1 interface 0 altsetting 129 endpoint 0x81 has an invalid bInterval 247, changing to 11 [ 102.487846][ T40] usb 4-1: config 1 interface 0 has no altsetting 0 [ 102.489212][ T1735] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 102.496048][ T40] usb 4-1: New USB device found, idVendor=1e71, idProduct=200d, bcdDevice= 0.40 [ 102.503736][ T1735] ext4 filesystem being mounted at /70/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 102.512290][ T40] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 102.689817][ T40] usb 4-1: Product: ည [ 102.694284][ T40] usb 4-1: Manufacturer: 㟈⟥䟢쬖㊇ë»ÄŸã¦…éŠé¿Šâ¬¢ã‹ªî­ë¯ˆï¶¹Í»à¹‘ᒸ鸩蜈쌌译닦â´å…¤ [ 102.728229][ T40] usb 4-1: SerialNumber: syz [ 102.738815][ T1735] fs-verity: sha512 using implementation "sha512-avx2" [ 102.786537][ T1735] FAULT_INJECTION: forcing a failure. [ 102.786537][ T1735] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 102.884766][ T1735] CPU: 1 PID: 1735 Comm: syz.2.337 Not tainted syzkaller #0 [ 102.892181][ T1735] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 102.902236][ T1735] Call Trace: [ 102.905517][ T1735] [ 102.908441][ T1735] __dump_stack+0x21/0x24 [ 102.912769][ T1735] dump_stack_lvl+0x110/0x170 [ 102.917447][ T1735] ? __cfi_dump_stack_lvl+0x8/0x8 [ 102.922474][ T1735] dump_stack+0x15/0x24 [ 102.926629][ T1735] should_fail_ex+0x3bf/0x510 [ 102.931303][ T1735] should_fail+0xb/0x10 [ 102.935547][ T1735] should_fail_usercopy+0x1a/0x20 [ 102.940569][ T1735] _copy_to_user+0x1e/0x90 [ 102.945066][ T1735] fsverity_read_merkle_tree+0x251/0x7c0 [ 102.950725][ T1735] fsverity_ioctl_read_metadata+0x263/0x280 [ 102.956628][ T1735] ? __cfi_fsverity_ioctl_read_metadata+0x10/0x10 [ 102.963048][ T1735] ? ext4_ioctl+0x1a6c/0x3ec0 [ 102.967725][ T1735] ext4_ioctl+0x1a79/0x3ec0 [ 102.972232][ T1735] ? memcpy+0x56/0x70 [ 102.976212][ T1735] ? __cfi_ext4_ioctl+0x10/0x10 [ 102.981057][ T1735] ? __cfi____update_load_sum+0x10/0x10 [ 102.986603][ T1735] ? __cfi_avc_has_extended_perms+0x10/0x10 [ 102.992504][ T1735] ? __update_load_avg_cfs_rq+0xb1/0x2e0 [ 102.998138][ T1735] ? __kasan_check_write+0x14/0x20 [ 103.003247][ T1735] ? __switch_to+0x56f/0x1070 [ 103.008192][ T1735] ? plist_check_list+0x255/0x270 [ 103.013244][ T1735] ? __cfi___switch_to+0x10/0x10 [ 103.018277][ T1735] ? _raw_spin_unlock+0x4c/0x70 [ 103.023126][ T1735] ? finish_task_switch+0x16b/0x7c0 [ 103.028330][ T1735] ? switch_mm_irqs_off+0x724/0x960 [ 103.033525][ T1735] ? __schedule+0xcbb/0x1700 [ 103.038117][ T1735] ? release_firmware_map_entry+0x190/0x190 [ 103.044021][ T1735] ? raw_irqentry_exit_cond_resched+0x29/0x30 [ 103.050275][ T1735] ? __kasan_check_read+0x11/0x20 [ 103.055513][ T1735] ? preempt_schedule_irq+0xca/0x120 [ 103.060823][ T1735] ? __cfi_preempt_schedule_irq+0x10/0x10 [ 103.066557][ T1735] ? __cfi_selinux_file_ioctl+0x10/0x10 [ 103.072288][ T1735] ? raw_irqentry_exit_cond_resched+0x29/0x30 [ 103.078397][ T1735] ? irqentry_exit+0x37/0x40 [ 103.083171][ T1735] ? sysvec_reschedule_ipi+0x78/0x80 [ 103.088465][ T1735] ? asm_sysvec_reschedule_ipi+0x1b/0x20 [ 103.094195][ T1735] ? __cfi_ext4_ioctl+0x10/0x10 [ 103.099398][ T1735] ? __cfi_ext4_ioctl+0x10/0x10 [ 103.104425][ T1735] __se_sys_ioctl+0x12f/0x1b0 [ 103.109114][ T1735] __x64_sys_ioctl+0x7b/0x90 [ 103.113792][ T1735] x64_sys_call+0x58b/0x9a0 [ 103.118298][ T1735] do_syscall_64+0x4c/0xa0 [ 103.122713][ T1735] ? clear_bhb_loop+0x30/0x80 [ 103.127392][ T1735] ? clear_bhb_loop+0x30/0x80 [ 103.132244][ T1735] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 103.138153][ T1735] RIP: 0033:0x7f2b78d9fb19 [ 103.139166][ T28] audit: type=1326 audit(1794037160.089:3844): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1743 comm="syz.1.339" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f34bd19fb19 code=0x7ffc0000 [ 103.142568][ T1735] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 103.142583][ T1735] RSP: 002b:00007f2b79bdd028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 103.142606][ T1735] RAX: ffffffffffffffda RBX: 00007f2b79025fa0 RCX: 00007f2b78d9fb19 [ 103.142617][ T1735] RDX: 0000200000000f40 RSI: 00000000c0286687 RDI: 0000000000000004 [ 103.142628][ T1735] RBP: 00007f2b79bdd090 R08: 0000000000000000 R09: 0000000000000000 [ 103.171329][ T28] audit: type=1326 audit(1794037160.089:3845): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1743 comm="syz.1.339" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f34bd19fb19 code=0x7ffc0000 [ 103.186843][ T1735] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 103.186859][ T1735] R13: 00007f2b79026038 R14: 00007f2b79025fa0 R15: 00007fffe2562a68 [ 103.186873][ T1735] [ 103.281037][ T291] EXT4-fs (loop2): unmounting filesystem. [ 103.289635][ T28] audit: type=1326 audit(1794037160.089:3846): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1743 comm="syz.1.339" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f34bd19fb19 code=0x7ffc0000 [ 103.315389][ T40] usbhid 4-1:1.0: can't add hid device: -71 [ 103.321973][ T40] usbhid: probe of 4-1:1.0 failed with error -71 [ 103.330839][ T28] audit: type=1326 audit(1794037160.089:3847): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1743 comm="syz.1.339" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f34bd19fb19 code=0x7ffc0000 [ 103.338897][ T40] usb 4-1: USB disconnect, device number 5 [ 103.372196][ T28] audit: type=1326 audit(1794037160.089:3848): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1743 comm="syz.1.339" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f34bd19fb19 code=0x7ffc0000 [ 103.410541][ T28] audit: type=1326 audit(1794037160.089:3849): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1743 comm="syz.1.339" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f34bd19fb19 code=0x7ffc0000 [ 103.436946][ T1751] binder_alloc: 1747: binder_alloc_buf size 16496 failed, no address space [ 103.439988][ T28] audit: type=1326 audit(1794037160.089:3850): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1743 comm="syz.1.339" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f34bd19fb19 code=0x7ffc0000 [ 103.446096][ T1751] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) [ 103.480771][ T1752] binder: 1746:1752 ioctl c0306201 0 returned -14 [ 103.543293][ T1753] loop1: detected capacity change from 0 to 16 [ 103.553791][ T1753] erofs: (device loop1): mounted with root inode @ nid 36. [ 103.603762][ T1753] erofs: (device loop1): z_erofs_readahead: readahead error at page 4 @ nid 89 [ 103.612895][ T1753] erofs: (device loop1): z_erofs_readahead: readahead error at page 3 @ nid 89 [ 103.622308][ T1753] syz.1.339: attempt to access beyond end of device [ 103.622308][ T1753] loop1: rw=524288, sector=34359738360, nr_sectors = 8 limit=16 [ 103.636723][ T1753] syz.1.339: attempt to access beyond end of device [ 103.636723][ T1753] loop1: rw=524288, sector=8, nr_sectors = 16 limit=16 [ 104.290408][ T655] Bluetooth: hci1: Opcode 0x1003 failed: -110 [ 104.480206][ T1764] loop0: detected capacity change from 0 to 16 [ 104.506640][ T1764] erofs: (device loop0): mounted with root inode @ nid 36. [ 104.577872][ T1764] erofs: (device loop0): z_erofs_readahead: readahead error at page 4 @ nid 89 [ 104.605500][ T1764] erofs: (device loop0): z_erofs_readahead: readahead error at page 3 @ nid 89 [ 104.678406][ T1764] syz.0.342: attempt to access beyond end of device [ 104.678406][ T1764] loop0: rw=524288, sector=34359738360, nr_sectors = 8 limit=16 [ 104.851391][ T1764] syz.0.342: attempt to access beyond end of device [ 104.851391][ T1764] loop0: rw=524288, sector=8, nr_sectors = 16 limit=16 [ 104.969932][ T60] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 105.161012][ T60] usb 2-1: config 0 interface 0 altsetting 8 endpoint 0x81 has invalid wMaxPacketSize 0 [ 105.174022][ T60] usb 2-1: config 0 interface 0 altsetting 8 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 105.194119][ T60] usb 2-1: config 0 interface 0 has no altsetting 0 [ 105.203940][ T60] usb 2-1: New USB device found, idVendor=1b1c, idProduct=0a55, bcdDevice= 0.00 [ 105.217277][ T60] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 105.238601][ T60] usb 2-1: config 0 descriptor?? [ 105.410074][ T19] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 105.599926][ T19] usb 3-1: Using ep0 maxpacket: 32 [ 105.606293][ T19] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 105.622996][ T19] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 105.643938][ T19] usb 3-1: config 0 has no interface number 0 [ 105.652484][ T60] usbhid 2-1:0.0: can't add hid device: -71 [ 105.658507][ T60] usbhid: probe of 2-1:0.0 failed with error -71 [ 105.671381][ T19] usb 3-1: config 0 interface 1 altsetting 9 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 105.687453][ T60] usb 2-1: USB disconnect, device number 6 [ 105.694777][ T19] usb 3-1: config 0 interface 1 has no altsetting 0 [ 105.709531][ T1813] netlink: 4 bytes leftover after parsing attributes in process `syz.4.364'. [ 105.728063][ T19] usb 3-1: New USB device found, idVendor=0572, idProduct=58a5, bcdDevice=27.0a [ 105.737529][ T19] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 105.745909][ T19] usb 3-1: Product: syz [ 105.750226][ T19] usb 3-1: Manufacturer: syz [ 105.760047][ T19] usb 3-1: SerialNumber: syz [ 105.767471][ T19] usb 3-1: config 0 descriptor?? [ 105.816070][ T1818] mmap: syz.4.366 (1818) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 105.898934][ T1825] netlink: 8 bytes leftover after parsing attributes in process `syz.4.370'. [ 105.920825][ T28] kauditd_printk_skb: 662 callbacks suppressed [ 105.920840][ T28] audit: type=1400 audit(1794037162.879:4513): avc: denied { mount } for pid=1826 comm="syz.4.371" name="/" dev="ramfs" ino=19283 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ramfs_t tclass=filesystem permissive=1 [ 105.977702][ T19] usb 3-1: USB disconnect, device number 3 [ 105.987326][ T1831] xt_hashlimit: size too large, truncated to 1048576 [ 106.089932][ T40] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 106.174015][ T1834] netlink: 'syz.1.373': attribute type 9 has an invalid length. [ 106.204207][ T1836] tun0: tun_chr_ioctl cmd 1074030121 [ 106.210600][ T1836] tun0: tun_chr_ioctl cmd 1074812118 [ 106.210917][ T1838] input: syz1 as /devices/virtual/input/input5 [ 106.230707][ T28] audit: type=1400 audit(1794037163.179:4514): avc: denied { read } for pid=88 comm="acpid" name="event3" dev="devtmpfs" ino=914 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 106.259701][ T28] audit: type=1400 audit(1794037163.179:4515): avc: denied { open } for pid=88 comm="acpid" path="/dev/input/event3" dev="devtmpfs" ino=914 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 106.280983][ T40] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 106.303497][ T28] audit: type=1400 audit(1794037163.179:4516): avc: denied { ioctl } for pid=88 comm="acpid" path="/dev/input/event3" dev="devtmpfs" ino=914 ioctlcmd=0x4520 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 106.314037][ T40] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 106.341151][ T40] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 106.351703][ T40] usb 1-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 106.366472][ T40] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 106.375795][ T40] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 106.384431][ T40] usb 1-1: Product: syz [ 106.389108][ T40] usb 1-1: Manufacturer: syz [ 106.394134][ T28] audit: type=1400 audit(1794037163.349:4517): avc: denied { create } for pid=1839 comm="syz.1.376" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 106.399624][ T40] cdc_wdm: probe of 1-1:1.0 failed with error -22 [ 106.625168][ T40] usb 1-1: USB disconnect, device number 4 [ 106.633203][ T24] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 106.649979][ T19] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 106.821036][ T24] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 106.831255][ T24] usb 4-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 106.839931][ T19] usb 3-1: Using ep0 maxpacket: 32 [ 106.841331][ T24] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 106.846536][ T19] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 106.857789][ T24] usb 4-1: config 0 descriptor?? [ 106.862303][ T19] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 106.877252][ T19] usb 3-1: config 0 has no interface number 0 [ 106.883460][ T19] usb 3-1: config 0 interface 1 altsetting 9 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 106.896466][ T19] usb 3-1: config 0 interface 1 has no altsetting 0 [ 106.904585][ T19] usb 3-1: New USB device found, idVendor=0572, idProduct=58a5, bcdDevice=27.0a [ 106.913765][ T19] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 106.921780][ T19] usb 3-1: Product: syz [ 106.926088][ T19] usb 3-1: Manufacturer: syz [ 106.930721][ T19] usb 3-1: SerialNumber: syz [ 106.936747][ T19] usb 3-1: config 0 descriptor?? [ 107.160044][ T28] audit: type=1400 audit(1794037164.119:4518): avc: denied { write } for pid=1857 comm="syz.0.383" name="ppp" dev="devtmpfs" ino=158 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 107.182910][ T28] audit: type=1400 audit(1794037164.119:4519): avc: denied { open } for pid=1857 comm="syz.0.383" path="/dev/ppp" dev="devtmpfs" ino=158 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 107.206661][ T28] audit: type=1400 audit(1794037164.119:4520): avc: denied { ioctl } for pid=1857 comm="syz.0.383" path="/dev/ppp" dev="devtmpfs" ino=158 ioctlcmd=0x7438 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 107.347319][ T19] usb 3-1: USB disconnect, device number 4 [ 107.402026][ T1876] pit: kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 107.502577][ T28] audit: type=1400 audit(1794037164.459:4521): avc: denied { ioctl } for pid=1888 comm="syz.0.395" path="socket:[21474]" dev="sockfs" ino=21474 ioctlcmd=0x8983 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 107.513359][ T1891] netlink: 12 bytes leftover after parsing attributes in process `syz.0.396'. [ 107.576038][ T28] audit: type=1400 audit(1794037164.529:4522): avc: denied { read } for pid=1894 comm="syz.0.398" name="snapshot" dev="devtmpfs" ino=91 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 107.709996][ T60] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 107.900697][ T60] usb 5-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice= 0.00 [ 107.915714][ T60] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 107.999951][ T40] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 108.189954][ T24] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 108.201192][ T40] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 108.211522][ T40] usb 1-1: config 1 interface 0 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0 [ 108.221417][ T40] usb 1-1: config 1 interface 0 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 4 [ 108.240174][ T40] usb 1-1: config 1 interface 0 has no altsetting 0 [ 108.251067][ T40] usb 1-1: New USB device found, idVendor=174c, idProduct=55aa, bcdDevice= 1.00 [ 108.260888][ T40] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 108.268901][ T40] usb 1-1: Product: syz [ 108.273851][ T40] usb 1-1: Manufacturer: syz [ 108.278806][ T40] usb 1-1: SerialNumber: syz [ 108.294906][ T40] usb-storage 1-1:1.0: USB Mass Storage device detected [ 108.310710][ T40] usb-storage 1-1:1.0: Quirks match for vid 174c pid 55aa: 400000 [ 108.369954][ T24] usb 3-1: Using ep0 maxpacket: 32 [ 108.376476][ T24] usb 3-1: config 0 has an invalid interface number: 12 but max is 0 [ 108.384660][ T24] usb 3-1: config 0 has no interface number 0 [ 108.390861][ T24] usb 3-1: config 0 interface 12 has no altsetting 0 [ 108.398959][ T24] usb 3-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 108.408557][ T24] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 108.416609][ T24] usb 3-1: Product: syz [ 108.420895][ T24] usb 3-1: Manufacturer: syz [ 108.425617][ T24] usb 3-1: SerialNumber: syz [ 108.433544][ T24] usb 3-1: config 0 descriptor?? [ 108.496810][ T24] usb 1-1: USB disconnect, device number 5 [ 108.710011][ T60] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 108.890061][ T60] usb 2-1: Using ep0 maxpacket: 32 [ 108.896473][ T60] usb 2-1: config index 0 descriptor too short (expected 35577, got 27) [ 108.904936][ T60] usb 2-1: config 1 has too many interfaces: 92, using maximum allowed: 32 [ 108.913596][ T60] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 92 [ 108.922567][ T60] usb 2-1: config 1 has no interface number 0 [ 108.928652][ T60] usb 2-1: config 1 interface 1 altsetting 0 has an invalid endpoint with address 0x0, skipping [ 108.939314][ T60] usb 2-1: config 1 interface 1 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 17 [ 108.952430][ T60] usb 2-1: New USB device found, idVendor=0e41, idProduct=5051, bcdDevice=d5.e8 [ 108.961510][ T60] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 109.319743][ T24] usb 4-1: USB disconnect, device number 6 [ 109.379981][ T60] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 109.561282][ T60] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 109.569965][ T60] usb 1-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 109.580303][ T60] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 109.589265][ T60] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 109.600253][ T60] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 109.612557][ T60] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 109.621640][ T60] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 109.629622][ T60] usb 1-1: Product: syz [ 109.633810][ T60] usb 1-1: Manufacturer: syz [ 109.640089][ T60] cdc_wdm 1-1:1.0: skipping garbage [ 109.645337][ T60] cdc_wdm 1-1:1.0: skipping garbage [ 109.652173][ T60] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 109.669983][ T24] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 109.861049][ T24] usb 4-1: New USB device found, idVendor=0813, idProduct=0001, bcdDevice=3a.08 [ 109.870196][ T24] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 109.879466][ T24] usb 4-1: config 0 descriptor?? [ 110.042450][ T60] usb 1-1: USB disconnect, device number 6 [ 110.459549][ T24] usb 5-1: USB disconnect, device number 5 [ 110.550404][ T1950] Disabled LAPIC found during irq injection [ 110.830005][ T60] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 110.933769][ T19] usb 3-1: USB disconnect, device number 5 [ 111.009963][ T24] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 111.011062][ T60] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 111.027664][ T60] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 111.037435][ T60] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 111.047512][ T60] usb 1-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 111.060376][ T60] usb 1-1: New USB device found, idVendor=1d50, idProduct=614d, bcdDevice= 1.00 [ 111.069771][ T60] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 111.199949][ T24] usb 5-1: Using ep0 maxpacket: 32 [ 111.206449][ T24] usb 5-1: config 0 has an invalid interface number: 12 but max is 0 [ 111.214640][ T24] usb 5-1: config 0 has no interface number 0 [ 111.220745][ T24] usb 5-1: config 0 interface 12 has no altsetting 0 [ 111.228682][ T24] usb 5-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 111.237744][ T24] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 111.245741][ T24] usb 5-1: Product: syz [ 111.249884][ T24] usb 5-1: Manufacturer: syz [ 111.254510][ T24] usb 5-1: SerialNumber: syz [ 111.259521][ T24] usb 5-1: config 0 descriptor?? [ 111.409964][ T19] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 111.449659][ T24] usb 2-1: USB disconnect, device number 7 [ 111.590010][ T19] usb 3-1: Using ep0 maxpacket: 32 [ 111.596359][ T19] usb 3-1: config 0 has an invalid interface number: 12 but max is 0 [ 111.604482][ T19] usb 3-1: config 0 has no interface number 0 [ 111.610638][ T19] usb 3-1: config 0 interface 12 altsetting 2 endpoint 0x82 has invalid wMaxPacketSize 0 [ 111.620483][ T19] usb 3-1: config 0 interface 12 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 0 [ 111.630337][ T19] usb 3-1: config 0 interface 12 has no altsetting 0 [ 111.638462][ T19] usb 3-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 111.647647][ T19] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 111.655699][ T19] usb 3-1: Product: syz [ 111.659843][ T19] usb 3-1: Manufacturer: syz [ 111.664455][ T19] usb 3-1: SerialNumber: syz [ 111.669822][ T19] usb 3-1: config 0 descriptor?? [ 111.877962][ T19] usb 3-1: USB disconnect, device number 6 [ 111.910040][ T24] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 112.089957][ T24] usb 2-1: Using ep0 maxpacket: 16 [ 112.096510][ T24] usb 2-1: unable to get BOS descriptor or descriptor too short [ 112.105360][ T24] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 112.115520][ T24] usb 2-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 112.127971][ T24] usb 2-1: New USB device found, idVendor=103d, idProduct=0100, bcdDevice= 0.40 [ 112.137063][ T24] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 112.145087][ T24] usb 2-1: Product: syz [ 112.149239][ T24] usb 2-1: Manufacturer: syz [ 112.153851][ T24] usb 2-1: SerialNumber: syz [ 112.341411][ T19] usb 4-1: USB disconnect, device number 7 [ 112.362491][ T24] usb 2-1: Audio class v2/v3 interfaces need an interface association [ 112.371922][ T24] snd-usb-audio: probe of 2-1:1.0 failed with error -22 [ 112.562220][ T24] usb 2-1: 2:1 : can't get High Capability descriptor [ 112.749951][ T19] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 112.771270][ T24] usb 2-1: USB disconnect, device number 8 [ 112.929962][ T19] usb 4-1: Using ep0 maxpacket: 16 [ 112.936456][ T19] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 112.947499][ T19] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 112.957274][ T19] usb 4-1: New USB device found, idVendor=05ac, idProduct=024b, bcdDevice= 0.00 [ 112.966348][ T19] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 112.974909][ T19] usb 4-1: config 0 descriptor?? [ 113.288876][ T1996] device syzkaller0 entered promiscuous mode [ 113.382944][ T19] apple 0003:05AC:024B.0002: unknown main item tag 0x0 [ 113.390233][ T19] apple 0003:05AC:024B.0002: unknown main item tag 0x0 [ 113.397180][ T19] apple 0003:05AC:024B.0002: unknown main item tag 0x0 [ 113.404445][ T19] apple 0003:05AC:024B.0002: unknown main item tag 0x0 [ 113.411428][ T19] apple 0003:05AC:024B.0002: unknown main item tag 0x0 [ 113.418406][ T19] apple 0003:05AC:024B.0002: unknown main item tag 0x0 [ 113.426537][ T19] apple 0003:05AC:024B.0002: unknown main item tag 0x0 [ 113.433501][ T19] apple 0003:05AC:024B.0002: unknown main item tag 0x0 [ 113.440436][ T19] apple 0003:05AC:024B.0002: unknown main item tag 0x0 [ 113.447300][ T19] apple 0003:05AC:024B.0002: unknown main item tag 0x0 [ 113.454190][ T19] apple 0003:05AC:024B.0002: unknown main item tag 0x0 [ 113.461104][ T19] apple 0003:05AC:024B.0002: unknown main item tag 0x0 [ 113.467955][ T19] apple 0003:05AC:024B.0002: unknown main item tag 0x0 [ 113.474867][ T19] apple 0003:05AC:024B.0002: unknown main item tag 0x0 [ 113.481817][ T19] apple 0003:05AC:024B.0002: unknown main item tag 0x0 [ 113.488683][ T19] apple 0003:05AC:024B.0002: unknown main item tag 0x0 [ 113.495595][ T19] apple 0003:05AC:024B.0002: unknown main item tag 0x0 [ 113.502491][ T19] apple 0003:05AC:024B.0002: unknown main item tag 0x0 [ 113.509344][ T19] apple 0003:05AC:024B.0002: unknown main item tag 0x0 [ 113.509931][ T24] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 113.516503][ T19] apple 0003:05AC:024B.0002: unknown main item tag 0x0 [ 113.530957][ T19] apple 0003:05AC:024B.0002: unknown main item tag 0x0 [ 113.537824][ T19] apple 0003:05AC:024B.0002: unknown main item tag 0x0 [ 113.544706][ T19] apple 0003:05AC:024B.0002: unknown main item tag 0x0 [ 113.551593][ T19] apple 0003:05AC:024B.0002: unknown main item tag 0x0 [ 113.558444][ T19] apple 0003:05AC:024B.0002: unknown main item tag 0x0 [ 113.565421][ T19] apple 0003:05AC:024B.0002: unknown main item tag 0x0 [ 113.572370][ T19] apple 0003:05AC:024B.0002: unknown main item tag 0x0 [ 113.579256][ T19] apple 0003:05AC:024B.0002: unknown main item tag 0x0 [ 113.586486][ T19] apple 0003:05AC:024B.0002: unknown main item tag 0x0 [ 113.590537][ T318] usb 1-1: USB disconnect, device number 7 [ 113.599736][ T19] apple 0003:05AC:024B.0002: unknown main item tag 0x0 [ 113.606672][ T19] apple 0003:05AC:024B.0002: unknown main item tag 0x0 [ 113.614498][ T19] apple 0003:05AC:024B.0002: unknown main item tag 0x0 [ 113.623812][ T19] apple 0003:05AC:024B.0002: unknown main item tag 0x0 [ 113.630756][ T19] apple 0003:05AC:024B.0002: unknown main item tag 0x0 [ 113.633823][ T442] usb 5-1: USB disconnect, device number 6 [ 113.638423][ T19] apple 0003:05AC:024B.0002: unknown main item tag 0x0 [ 113.650917][ T19] apple 0003:05AC:024B.0002: unknown main item tag 0x0 [ 113.657804][ T19] apple 0003:05AC:024B.0002: unknown main item tag 0x0 [ 113.664972][ T19] apple 0003:05AC:024B.0002: unknown main item tag 0x0 [ 113.672022][ T19] apple 0003:05AC:024B.0002: unknown main item tag 0x0 [ 113.678941][ T19] apple 0003:05AC:024B.0002: unknown main item tag 0x0 [ 113.680771][ T40] usb 2-1: new full-speed USB device number 9 using dummy_hcd [ 113.694522][ T19] apple 0003:05AC:024B.0002: unknown main item tag 0x0 [ 113.701618][ T19] apple 0003:05AC:024B.0002: unknown main item tag 0x0 [ 113.708548][ T19] apple 0003:05AC:024B.0002: unknown main item tag 0x0 [ 113.716181][ T19] apple 0003:05AC:024B.0002: unknown main item tag 0x0 [ 113.723116][ T19] apple 0003:05AC:024B.0002: unknown main item tag 0x0 [ 113.729926][ T24] usb 3-1: Using ep0 maxpacket: 8 [ 113.735611][ T19] apple 0003:05AC:024B.0002: unknown main item tag 0x0 [ 113.736168][ T24] usb 3-1: config 0 interface 0 altsetting 7 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 113.752677][ T19] apple 0003:05AC:024B.0002: unknown main item tag 0x0 [ 113.753861][ T24] usb 3-1: config 0 interface 0 altsetting 7 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 113.770272][ T19] apple 0003:05AC:024B.0002: unknown main item tag 0x0 [ 113.773688][ T24] usb 3-1: config 0 interface 0 has no altsetting 0 [ 113.781821][ T19] apple 0003:05AC:024B.0002: unknown main item tag 0x0 [ 113.787002][ T24] usb 3-1: New USB device found, idVendor=0810, idProduct=0002, bcdDevice= 0.00 [ 113.803644][ T24] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 113.803674][ T19] apple 0003:05AC:024B.0002: unknown main item tag 0x0 [ 113.803696][ T19] apple 0003:05AC:024B.0002: unknown main item tag 0x0 [ 113.816178][ T24] usb 3-1: config 0 descriptor?? [ 113.818628][ T19] apple 0003:05AC:024B.0002: unknown main item tag 0x0 [ 113.838548][ T19] apple 0003:05AC:024B.0002: unknown main item tag 0x0 [ 113.845566][ T19] apple 0003:05AC:024B.0002: unknown main item tag 0x0 [ 113.852990][ T19] apple 0003:05AC:024B.0002: unknown main item tag 0x0 [ 113.859939][ T19] apple 0003:05AC:024B.0002: unknown main item tag 0x0 [ 113.867147][ T19] apple 0003:05AC:024B.0002: unknown main item tag 0x0 [ 113.874388][ T19] apple 0003:05AC:024B.0002: unknown main item tag 0x0 [ 113.881003][ T40] usb 2-1: config 0 interface 0 altsetting 8 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 113.889995][ T19] apple 0003:05AC:024B.0002: unknown main item tag 0x0 [ 113.895460][ T40] usb 2-1: config 0 interface 0 has no altsetting 0 [ 113.901776][ T19] apple 0003:05AC:024B.0002: unknown main item tag 0x0 [ 113.911010][ T40] usb 2-1: New USB device found, idVendor=054c, idProduct=0374, bcdDevice= 0.00 [ 113.915124][ T19] apple 0003:05AC:024B.0002: unknown main item tag 0x0 [ 113.926682][ T40] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 113.940681][ T19] apple 0003:05AC:024B.0002: unknown main item tag 0x0 [ 113.942000][ T40] usb 2-1: config 0 descriptor?? [ 113.947770][ T19] apple 0003:05AC:024B.0002: unknown main item tag 0x0 [ 113.947794][ T19] apple 0003:05AC:024B.0002: unknown main item tag 0x0 [ 113.947812][ T19] apple 0003:05AC:024B.0002: unknown main item tag 0x0 [ 113.947830][ T19] apple 0003:05AC:024B.0002: unknown main item tag 0x0 [ 113.947848][ T19] apple 0003:05AC:024B.0002: unknown main item tag 0x0 [ 113.987351][ T19] apple 0003:05AC:024B.0002: unknown main item tag 0x0 [ 113.994352][ T19] apple 0003:05AC:024B.0002: unknown main item tag 0x0 [ 114.003419][ T19] apple 0003:05AC:024B.0002: hidraw0: USB HID v0.00 Device [HID 05ac:024b] on usb-dummy_hcd.3-1/input0 [ 114.017676][ T19] usb 4-1: USB disconnect, device number 8 [ 114.030036][ T318] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 114.052407][ T2023] fido_id[2023]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.3/usb4/report_descriptor': No such file or directory [ 114.229690][ T24] pantherlord 0003:0810:0002.0003: unknown main item tag 0x2 [ 114.237201][ T318] usb 1-1: Using ep0 maxpacket: 16 [ 114.243105][ T24] pantherlord 0003:0810:0002.0003: unknown main item tag 0x0 [ 114.250994][ T24] pantherlord 0003:0810:0002.0003: unknown main item tag 0x0 [ 114.259224][ T318] usb 1-1: config 0 interface 0 altsetting 0 has an invalid endpoint with address 0xF3, skipping [ 114.271068][ T24] input: HID 0810:0002 as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/0003:0810:0002.0003/input/input6 [ 114.284145][ T318] usb 1-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 114.293652][ T318] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 114.301796][ T318] usb 1-1: Product: syz [ 114.306032][ T318] usb 1-1: Manufacturer: syz [ 114.311078][ T318] usb 1-1: SerialNumber: syz [ 114.317209][ T318] usb 1-1: config 0 descriptor?? [ 114.356457][ T40] sony 0003:054C:0374.0004: ignoring exceeding usage max [ 114.367786][ T24] pantherlord 0003:0810:0002.0003: input,hidraw0: USB HID v0.00 Keyboard [HID 0810:0002] on usb-dummy_hcd.2-1/input0 [ 114.387080][ T40] sony 0003:054C:0374.0004: No inputs registered, leaving [ 114.394478][ T24] pantherlord 0003:0810:0002.0003: Force feedback for PantherLord/GreenAsia devices by Anssi Hannula [ 114.412241][ T40] sony 0003:054C:0374.0004: hiddev96,hidraw1: USB HID v0.10 Joystick [HID 054c:0374] on usb-dummy_hcd.1-1/input0 [ 114.432290][ T40] sony 0003:054C:0374.0004: failed to claim input [ 114.532952][ T40] usb 3-1: USB disconnect, device number 7 [ 114.575283][ T60] usb 2-1: USB disconnect, device number 9 [ 114.581230][ T19] usb 4-1: new high-speed USB device number 9 using dummy_hcd [ 114.581560][ T2046] usb usb7: usbfs: process 2046 (syz.4.451) did not claim interface 0 before use [ 114.613712][ T28] kauditd_printk_skb: 1 callbacks suppressed [ 114.613726][ T28] audit: type=1400 audit(1794037171.569:4524): avc: denied { create } for pid=2049 comm="syz.4.453" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 114.640708][ T28] audit: type=1400 audit(1794037171.599:4525): avc: denied { create } for pid=2053 comm="syz.4.455" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 114.660616][ T28] audit: type=1400 audit(1794037171.599:4526): avc: denied { connect } for pid=2053 comm="syz.4.455" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 114.771113][ T19] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x86 has an invalid bInterval 0, changing to 7 [ 114.782056][ T19] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x86 has invalid wMaxPacketSize 0 [ 114.792277][ T19] usb 4-1: New USB device found, idVendor=2040, idProduct=5530, bcdDevice=a8.82 [ 114.801353][ T19] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 114.810267][ T19] usb 4-1: config 0 descriptor?? [ 115.017974][ T19] usb 4-1: USB disconnect, device number 9 [ 115.369961][ T60] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 115.549929][ T60] usb 2-1: Using ep0 maxpacket: 32 [ 115.556503][ T60] usb 2-1: unable to get BOS descriptor or descriptor too short [ 115.570683][ T60] usb 2-1: config 1 interface 0 altsetting 254 bulk endpoint 0x82 has invalid maxpacket 16 [ 115.581252][ T60] usb 2-1: config 1 interface 0 altsetting 254 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 115.594821][ T60] usb 2-1: config 1 interface 0 has no altsetting 0 [ 115.618167][ T60] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 115.637494][ T60] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 115.645928][ T60] usb 2-1: Product: syz [ 115.650289][ T2076] fuse: root generation should be zero [ 115.662607][ T60] usb 2-1: Manufacturer: syz [ 115.667246][ T60] usb 2-1: SerialNumber: syz [ 115.682585][ T2066] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 115.694945][ T2066] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 115.911591][ T60] cdc_ether: probe of 2-1:1.0 failed with error -22 [ 115.923052][ T60] usb 2-1: USB disconnect, device number 10 [ 115.959945][ T19] usb 4-1: new high-speed USB device number 10 using dummy_hcd [ 116.050067][ T40] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 116.118300][ T28] audit: type=1400 audit(1794037173.069:4527): avc: denied { append } for pid=2092 comm="syz.2.467" name="001" dev="devtmpfs" ino=167 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 116.132784][ T2093] usb usb2: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 116.149728][ T19] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 116.159977][ T19] usb 4-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 116.160563][ T2093] usb usb2: Process 2093 (syz.2.467) called USBDEVFS_RESETEP for active endpoint 0x81 [ 116.169085][ T19] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 116.190365][ T19] usb 4-1: config 0 descriptor?? [ 116.190806][ T2093] netlink: 28 bytes leftover after parsing attributes in process `syz.2.467'. [ 116.204387][ T2093] netlink: 28 bytes leftover after parsing attributes in process `syz.2.467'. [ 116.251099][ T40] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 116.255576][ T2100] ------------[ cut here ]------------ [ 116.262177][ T40] usb 5-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 116.267548][ T2100] WARNING: CPU: 0 PID: 2100 at crypto/rsa-pkcs1pad.c:540 pkcs1pad_verify+0x4b8/0x600 [ 116.277303][ T40] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 116.286275][ T2100] Modules linked in: [ 116.298374][ T2100] CPU: 0 PID: 2100 Comm: syz.2.470 Not tainted syzkaller #0 [ 116.305792][ T2100] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 116.316036][ T2100] RIP: 0010:pkcs1pad_verify+0x4b8/0x600 [ 116.319574][ T40] usb 5-1: config 0 descriptor?? [ 116.321740][ T2100] Code: 44 89 f6 e8 4a 0f 00 00 48 83 c4 20 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 56 1b 2c ff 0f 0b b8 ea ff ff ff eb e3 e8 48 1b 2c ff <0f> 0b b8 ea ff ff ff eb d5 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 85 [ 116.346460][ T2100] RSP: 0018:ffffc90001117728 EFLAGS: 00010283 [ 116.352555][ T2100] RAX: ffffffff824556d8 RBX: ffff8881421fd600 RCX: 0000000000080000 [ 116.360560][ T2100] RDX: ffffc90002a6f000 RSI: 0000000000000907 RDI: 0000000000000908 [ 116.368562][ T2100] RBP: ffffc90001117770 R08: ffffc900011178af R09: ffffc90001117898 [ 116.376597][ T2100] R10: 0000000000000000 R11: ffffffff82455220 R12: 0000000000000000 [ 116.384593][ T2100] R13: ffff88813c428580 R14: dffffc0000000000 R15: ffff8881421fd638 [ 116.392610][ T2100] FS: 00007f2b79bdd6c0(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 116.401576][ T2100] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 116.408169][ T2100] CR2: 0000001b2ee1fff8 CR3: 00000001423ac000 CR4: 00000000003506b0 [ 116.416199][ T2100] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 116.424239][ T2100] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 116.432266][ T2100] Call Trace: [ 116.435559][ T2100] [ 116.438512][ T2100] ? sg_init_one+0x93/0x140 [ 116.443201][ T2100] public_key_verify_signature+0x90f/0xd80 [ 116.449062][ T2100] ? __cfi_public_key_verify_signature+0x10/0x10 [ 116.455456][ T2100] ? __kmalloc_node_track_caller+0xb1/0x1e0 [ 116.461386][ T2100] ? memdup_user+0x2a/0xc0 [ 116.465990][ T2100] ? keyctl_pkey_verify+0x3a4/0x460 [ 116.471255][ T2100] ? __se_sys_keyctl+0x817/0xe10 [ 116.476215][ T2100] ? __x64_sys_keyctl+0xbf/0xd0 [ 116.481129][ T2100] ? __cfi_public_key_verify_signature_2+0x10/0x10 [ 116.487645][ T2100] public_key_verify_signature_2+0x43/0x50 [ 116.493500][ T2100] verify_signature+0xe4/0x110 [ 116.498279][ T2100] asymmetric_key_verify_signature+0x177/0x220 [ 116.504478][ T2100] ? __cfi_asymmetric_key_verify_signature+0x10/0x10 [ 116.511186][ T2100] ? __kasan_check_write+0x14/0x20 [ 116.516305][ T2100] keyctl_pkey_verify+0x434/0x460 [ 116.521373][ T2100] ? __cfi_keyctl_pkey_verify+0x10/0x10 [ 116.526959][ T2100] __se_sys_keyctl+0x817/0xe10 [ 116.531779][ T2100] ? __x64_sys_keyctl+0xd0/0xd0 [ 116.532327][ T40] usbhid 5-1:0.0: can't add hid device: -71 [ 116.536648][ T2100] ? do_futex+0x2bf/0x430 [ 116.536674][ T2100] ? __cfi_do_futex+0x10/0x10 [ 116.543367][ T40] usbhid: probe of 5-1:0.0 failed with error -71 [ 116.546903][ T2100] ? __se_sys_futex+0x136/0x310 [ 116.546930][ T2100] ? __this_cpu_preempt_check+0x13/0x20 [ 116.560753][ T40] usb 5-1: USB disconnect, device number 7 [ 116.563338][ T2100] ? xfd_validate_state+0x70/0x150 [ 116.579845][ T2100] ? __kasan_check_write+0x14/0x20 [ 116.585064][ T2100] ? fpregs_restore_userregs+0x128/0x260 [ 116.590735][ T2100] __x64_sys_keyctl+0xbf/0xd0 [ 116.595415][ T2100] x64_sys_call+0x71a/0x9a0 [ 116.599951][ T2100] do_syscall_64+0x4c/0xa0 [ 116.604456][ T2100] ? clear_bhb_loop+0x30/0x80 [ 116.609234][ T2100] ? clear_bhb_loop+0x30/0x80 [ 116.613934][ T2100] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 116.619833][ T2100] RIP: 0033:0x7f2b78d9fb19 [ 116.624277][ T2100] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 116.644003][ T2100] RSP: 002b:00007f2b79bdd028 EFLAGS: 00000246 ORIG_RAX: 00000000000000fa [ 116.652464][ T2100] RAX: ffffffffffffffda RBX: 00007f2b79025fa0 RCX: 00007f2b78d9fb19 [ 116.660455][ T2100] RDX: 0000200000000c80 RSI: 0000200000000c40 RDI: 000000000000001c [ 116.668416][ T2100] RBP: 00007f2b78e37b70 R08: 0000200000000cc0 R09: 0000000000000000 [ 116.675971][ T24] usb 1-1: USB disconnect, device number 8 [ 116.676456][ T2100] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 116.690391][ T2100] R13: 00007f2b79026038 R14: 00007f2b79025fa0 R15: 00007fffe2562a68 [ 116.698378][ T2100] [ 116.701440][ T2100] ---[ end trace 0000000000000000 ]--- [ 117.030029][ T19] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 117.100000][ T60] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 117.209987][ T24] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 117.211111][ T19] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 117.228422][ T19] usb 5-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.40 [ 117.237533][ T19] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 117.246048][ T19] usb 5-1: config 0 descriptor?? [ 117.279937][ T60] usb 3-1: Using ep0 maxpacket: 16 [ 117.286504][ T60] usb 3-1: unable to get BOS descriptor or descriptor too short [ 117.294923][ T60] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 117.305070][ T60] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 117.313989][ T60] usb 3-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 117.327217][ T60] usb 3-1: string descriptor 0 read error: -22 [ 117.333459][ T60] usb 3-1: New USB device found, idVendor=0525, idProduct=a4ad, bcdDevice= 0.39 [ 117.342523][ T60] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 117.352651][ T60] cdc_ncm 3-1:1.0: CDC Union missing and no IAD found [ 117.359599][ T60] cdc_ncm 3-1:1.0: bind() failure [ 117.401011][ T24] usb 1-1: config 0 has an invalid interface number: 16 but max is 0 [ 117.409184][ T24] usb 1-1: config 0 has no interface number 0 [ 117.415477][ T24] usb 1-1: config 0 interface 16 altsetting 5 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 117.426512][ T24] usb 1-1: config 0 interface 16 altsetting 5 endpoint 0x81 has invalid wMaxPacketSize 0 [ 117.436411][ T24] usb 1-1: config 0 interface 16 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 117.449302][ T24] usb 1-1: config 0 interface 16 has no altsetting 0 [ 117.456130][ T24] usb 1-1: New USB device found, idVendor=06a3, idProduct=0cd0, bcdDevice= 0.4b [ 117.465223][ T24] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 117.473927][ T24] usb 1-1: config 0 descriptor?? [ 117.554773][ T60] usb 3-1: USB disconnect, device number 8 [ 117.881520][ T24] saitek 0003:06A3:0CD0.0005: unknown main item tag 0x0 [ 117.888599][ T24] saitek 0003:06A3:0CD0.0005: unknown main item tag 0x0 [ 117.895655][ T24] saitek 0003:06A3:0CD0.0005: unknown main item tag 0x0 [ 117.902670][ T24] saitek 0003:06A3:0CD0.0005: unknown main item tag 0x0 [ 117.909614][ T24] saitek 0003:06A3:0CD0.0005: unknown main item tag 0x0 [ 117.916646][ T24] saitek 0003:06A3:0CD0.0005: unknown main item tag 0x0 [ 117.923644][ T24] saitek 0003:06A3:0CD0.0005: unknown main item tag 0x0 [ 117.930655][ T24] saitek 0003:06A3:0CD0.0005: unknown main item tag 0x0 [ 117.937610][ T24] saitek 0003:06A3:0CD0.0005: unknown main item tag 0x0 [ 117.944608][ T24] saitek 0003:06A3:0CD0.0005: unknown main item tag 0x0 [ 117.951603][ T24] saitek 0003:06A3:0CD0.0005: unknown main item tag 0x0 [ 117.958685][ T24] saitek 0003:06A3:0CD0.0005: unknown main item tag 0x0 [ 117.965672][ T24] saitek 0003:06A3:0CD0.0005: unknown main item tag 0x0 [ 117.972665][ T24] saitek 0003:06A3:0CD0.0005: unknown main item tag 0x0 [ 117.979694][ T24] saitek 0003:06A3:0CD0.0005: unbalanced collection at end of report description [ 117.988994][ T24] saitek 0003:06A3:0CD0.0005: parse failed [ 117.994849][ T24] saitek: probe of 0003:06A3:0CD0.0005 failed with error -22 [ 118.070379][ T19] aiptek 5-1:0.0: Aiptek using 400 ms programming speed [ 118.077783][ T19] input: Aiptek as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/input/input8 [ 118.086732][ T40] usb 1-1: USB disconnect, device number 9 [ 118.329946][ T24] usb 3-1: new high-speed USB device number 9 using dummy_hcd [ 118.383397][ T19] usb 5-1: USB disconnect, device number 8 [ 118.389284][ C0] aiptek 5-1:0.0: aiptek_irq - usb_submit_urb failed with result -19 [ 118.511136][ T24] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 118.521398][ T24] usb 3-1: New USB device found, idVendor=1bc7, idProduct=9010, bcdDevice=36.53 [ 118.530735][ T24] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 118.539468][ T24] usb 3-1: config 0 descriptor?? [ 118.688477][ T40] usb 4-1: USB disconnect, device number 10 [ 118.696878][ T2152] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 118.726868][ T28] audit: type=1400 audit(1794037175.679:4528): avc: denied { setopt } for pid=2155 comm="syz.3.496" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 118.870895][ T19] usb 3-1: USB disconnect, device number 9 [ 118.899975][ T24] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 119.090008][ T24] usb 1-1: Using ep0 maxpacket: 16 [ 119.096502][ T24] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 119.106695][ T24] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 119.116314][ T24] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= f.89 [ 119.125400][ T24] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 119.133418][ T24] usb 1-1: SerialNumber: syz [ 119.139666][ T24] usb 1-1: 0:2 : does not exist [ 119.149968][ T40] usb 4-1: new low-speed USB device number 11 using dummy_hcd [ 119.331064][ T40] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 119.342226][ T40] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 64, setting to 8 [ 119.342381][ T19] usb 1-1: USB disconnect, device number 10 [ 119.353038][ T40] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 119.371792][ T40] usb 4-1: New USB device found, idVendor=1b1c, idProduct=1c1f, bcdDevice= 0.00 [ 119.380892][ T40] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 119.391396][ T28] audit: type=1400 audit(1794037176.349:4529): avc: denied { getopt } for pid=2172 comm="syz.2.503" lport=255 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 119.412154][ T40] usb 4-1: config 0 descriptor?? [ 119.417390][ T2163] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 119.709943][ T60] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 119.827452][ T40] hid (null): unknown global tag 0xe [ 119.832901][ T40] hid (null): unknown global tag 0xe [ 119.838862][ T40] hid-generic 0003:1B1C:1C1F.0006: unknown main item tag 0x3 [ 119.846320][ T40] hid-generic 0003:1B1C:1C1F.0006: unknown global tag 0xe [ 119.853445][ T40] hid-generic 0003:1B1C:1C1F.0006: item 0 1 1 14 parsing failed [ 119.861290][ T40] hid-generic: probe of 0003:1B1C:1C1F.0006 failed with error -22 [ 119.899972][ T60] usb 3-1: Using ep0 maxpacket: 32 [ 119.906227][ T60] usb 3-1: config 0 has an invalid interface number: 51 but max is 0 [ 119.914530][ T60] usb 3-1: config 0 has no interface number 0 [ 119.927933][ T60] usb 3-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 119.937238][ T60] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 119.945399][ T60] usb 3-1: Product: syz [ 119.949656][ T60] usb 3-1: Manufacturer: syz [ 119.954318][ T60] usb 3-1: SerialNumber: syz [ 119.959567][ T60] usb 3-1: config 0 descriptor?? [ 120.040626][ T40] usb 4-1: USB disconnect, device number 11 [ 120.829980][ T40] usb 4-1: new high-speed USB device number 12 using dummy_hcd [ 121.009942][ T40] usb 4-1: Using ep0 maxpacket: 16 [ 121.016358][ T40] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 121.026992][ T40] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 121.037290][ T40] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= f.89 [ 121.046618][ T40] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 121.055086][ T40] usb 4-1: SerialNumber: syz [ 121.071117][ T40] usb 4-1: 0:2 : does not exist [ 121.275103][ T40] usb 4-1: 5:0: failed to get current value for ch 0 (-22) [ 121.287094][ T40] usb 4-1: 5:0: cannot get min/max values for control 2 (id 5) [ 121.297343][ T40] usb 4-1: 5:0: cannot get min/max values for control 3 (id 5) [ 121.307463][ T40] usb 4-1: 5:0: cannot get min/max values for control 4 (id 5) [ 121.317614][ T40] usb 4-1: 5:0: cannot get min/max values for control 5 (id 5) [ 121.329707][ T40] usb 4-1: 5:0: failed to get current value for ch 0 (-22) [ 121.342302][ T40] usb 4-1: 5:0: cannot get min/max values for control 8 (id 5) [ 121.369705][ T40] usb 4-1: USB disconnect, device number 12 [ 121.800161][ T2202] xt_hashlimit: size too large, truncated to 1048576 [ 121.929990][ T60] usb 1-1: new high-speed USB device number 11 using dummy_hcd [ 122.111151][ T60] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 122.121563][ T60] usb 1-1: New USB device found, idVendor=1bc7, idProduct=9010, bcdDevice=36.53 [ 122.130704][ T60] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 122.143616][ T60] usb 1-1: config 0 descriptor?? [ 122.199971][ T40] usb 4-1: new high-speed USB device number 13 using dummy_hcd [ 122.379938][ T40] usb 4-1: Using ep0 maxpacket: 16 [ 122.387517][ T40] usb 4-1: config 0 interface 0 altsetting 0 has an invalid endpoint with address 0xF3, skipping [ 122.399790][ T40] usb 4-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 122.409067][ T40] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 122.417271][ T40] usb 4-1: Product: syz [ 122.421605][ T40] usb 4-1: Manufacturer: syz [ 122.426353][ T40] usb 4-1: SerialNumber: syz [ 122.448087][ T40] usb 4-1: config 0 descriptor?? [ 122.453422][ T60] usb 3-1: USB disconnect, device number 10 [ 122.474829][ T19] usb 1-1: USB disconnect, device number 11 [ 122.486426][ T28] audit: type=1400 audit(1794037179.439:4530): avc: denied { create } for pid=2215 comm="syz.2.520" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 122.954595][ T28] audit: type=1400 audit(1794037179.909:4531): avc: denied { link } for pid=2222 comm="syz.1.523" name="file0" dev="fuse" ino=4503599627370496 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=blk_file permissive=1 [ 122.992113][ T28] audit: type=1400 audit(1794037179.949:4532): avc: denied { create } for pid=2227 comm="syz.0.525" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 123.011639][ T28] audit: type=1400 audit(1794037179.949:4533): avc: denied { write } for pid=2227 comm="syz.0.525" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 123.319968][ T19] usb 1-1: new high-speed USB device number 12 using dummy_hcd [ 123.499942][ T19] usb 1-1: Using ep0 maxpacket: 16 [ 123.506338][ T19] usb 1-1: config 0 interface 0 altsetting 0 has an invalid endpoint with address 0xF3, skipping [ 123.518906][ T19] usb 1-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 123.528461][ T19] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 123.536729][ T19] usb 1-1: Product: syz [ 123.541137][ T19] usb 1-1: Manufacturer: syz [ 123.545747][ T19] usb 1-1: SerialNumber: syz [ 123.554763][ T19] usb 1-1: config 0 descriptor?? [ 124.563451][ T2264] device batadv_slave_1 entered promiscuous mode [ 124.840044][ T40] usb 3-1: new high-speed USB device number 11 using dummy_hcd [ 124.933799][ T19] usb 4-1: USB disconnect, device number 13 [ 125.021348][ T40] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 125.031239][ T40] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 0 [ 125.043386][ T40] usb 3-1: New USB device found, idVendor=0681, idProduct=0005, bcdDevice= 1.00 [ 125.052744][ T40] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 125.449954][ T19] usb 4-1: new high-speed USB device number 14 using dummy_hcd [ 125.629990][ T19] usb 4-1: Using ep0 maxpacket: 32 [ 125.636283][ T19] usb 4-1: config 0 has an invalid interface number: 12 but max is 0 [ 125.644486][ T19] usb 4-1: config 0 has no interface number 0 [ 125.650667][ T19] usb 4-1: config 0 interface 12 has no altsetting 0 [ 125.658778][ T19] usb 4-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 125.667911][ T19] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 125.675921][ T19] usb 4-1: Product: syz [ 125.680372][ T19] usb 4-1: Manufacturer: syz [ 125.684974][ T19] usb 4-1: SerialNumber: syz [ 125.690329][ T19] usb 4-1: config 0 descriptor?? [ 126.057150][ T40] usb 1-1: USB disconnect, device number 12 [ 126.469973][ T40] usb 1-1: new high-speed USB device number 13 using dummy_hcd [ 126.651229][ T40] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 126.662316][ T40] usb 1-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 126.671452][ T40] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 126.681090][ T40] usb 1-1: config 0 descriptor?? [ 126.889486][ T40] usbhid 1-1:0.0: can't add hid device: -71 [ 126.895530][ T40] usbhid: probe of 1-1:0.0 failed with error -71 [ 126.902959][ T40] usb 1-1: USB disconnect, device number 13 [ 127.469954][ T40] usb 1-1: new high-speed USB device number 14 using dummy_hcd [ 127.569618][ T24] usb 3-1: USB disconnect, device number 11 [ 127.571584][ T2263] device batadv_slave_1 left promiscuous mode [ 127.661076][ T40] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 127.672124][ T40] usb 1-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.40 [ 127.681270][ T40] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 127.689766][ T40] usb 1-1: config 0 descriptor?? [ 127.979989][ T24] usb 3-1: new high-speed USB device number 12 using dummy_hcd [ 128.159991][ T24] usb 3-1: Using ep0 maxpacket: 32 [ 128.166317][ T24] usb 3-1: config 0 interface 0 altsetting 5 endpoint 0x81 has an invalid bInterval 252, changing to 11 [ 128.177545][ T24] usb 3-1: config 0 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 128.185714][ T19] usb 4-1: USB disconnect, device number 14 [ 128.190454][ T24] usb 3-1: config 0 interface 0 has no altsetting 0 [ 128.203080][ T24] usb 3-1: New USB device found, idVendor=044e, idProduct=120b, bcdDevice= 0.00 [ 128.212378][ T24] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 128.221316][ T24] usb 3-1: config 0 descriptor?? [ 128.510428][ T40] aiptek 1-1:0.0: Aiptek using 400 ms programming speed [ 128.517823][ T40] input: Aiptek as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/input/input9 [ 128.629558][ T24] input: HID 044e:120b as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/0003:044E:120B.0007/input/input10 [ 128.642108][ T24] hid-generic 0003:044E:120B.0007: input,hidraw0: USB HID v80.00 Joystick [HID 044e:120b] on usb-dummy_hcd.2-1/input0 [ 128.709972][ T19] usb 4-1: new high-speed USB device number 15 using dummy_hcd [ 128.810775][ T24] usb 1-1: USB disconnect, device number 14 [ 128.816713][ C1] aiptek 1-1:0.0: aiptek_irq - usb_submit_urb failed with result -19 [ 128.899953][ T19] usb 4-1: Using ep0 maxpacket: 32 [ 128.906427][ T19] usb 4-1: config index 0 descriptor too short (expected 35577, got 27) [ 128.914898][ T19] usb 4-1: config 1 has too many interfaces: 92, using maximum allowed: 32 [ 128.923522][ T19] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 92 [ 128.932585][ T19] usb 4-1: config 1 has no interface number 0 [ 128.938669][ T19] usb 4-1: config 1 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 128.949653][ T19] usb 4-1: config 1 interface 1 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 17 [ 128.962878][ T19] usb 4-1: New USB device found, idVendor=0e41, idProduct=5051, bcdDevice=d5.e8 [ 128.971914][ T19] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 129.296841][ T28] audit: type=1400 audit(1794037186.249:4534): avc: denied { ioctl } for pid=2335 comm="syz.1.562" path="socket:[25026]" dev="sockfs" ino=25026 ioctlcmd=0x7436 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 129.321742][ T2335] ================================================================== [ 129.329900][ T2335] BUG: KASAN: use-after-free in mutex_lock+0x86/0x1b0 [ 129.336758][ T2335] Write of size 8 at addr ffff888131676950 by task syz.1.562/2335 [ 129.344542][ T2335] [ 129.346857][ T2335] CPU: 1 PID: 2335 Comm: syz.1.562 Tainted: G W syzkaller #0 [ 129.355602][ T2335] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 129.365655][ T2335] Call Trace: [ 129.368916][ T2335] [ 129.372014][ T2335] __dump_stack+0x21/0x24 [ 129.376421][ T2335] dump_stack_lvl+0x110/0x170 [ 129.381131][ T2335] ? __cfi_dump_stack_lvl+0x8/0x8 [ 129.386139][ T2335] ? mutex_lock+0x86/0x1b0 [ 129.390542][ T2335] print_address_description+0x71/0x200 [ 129.396078][ T2335] print_report+0x4a/0x60 [ 129.400391][ T2335] kasan_report+0x122/0x150 [ 129.405499][ T2335] ? mutex_lock+0x86/0x1b0 [ 129.409906][ T2335] kasan_check_range+0x249/0x2a0 [ 129.415093][ T2335] __kasan_check_write+0x14/0x20 [ 129.420013][ T2335] mutex_lock+0x86/0x1b0 [ 129.424240][ T2335] ? __cfi_mutex_lock+0x10/0x10 [ 129.429077][ T2335] ? kfree+0x6f/0xf0 [ 129.432954][ T2335] ? l2tp_session_put+0xaf/0x1a0 [ 129.437878][ T2335] ? l2tp_session_delete+0x3df/0x4d0 [ 129.443151][ T2335] pppol2tp_release+0x178/0x2b0 [ 129.447990][ T2335] sock_close+0xc9/0x220 [ 129.452214][ T2335] ? __cfi_sock_close+0x10/0x10 [ 129.457049][ T2335] __fput+0x1fd/0x8f0 [ 129.461034][ T2335] ____fput+0x15/0x20 [ 129.465003][ T2335] task_work_run+0x1e1/0x250 [ 129.469664][ T2335] ? __cfi_task_work_run+0x10/0x10 [ 129.474775][ T2335] ? __cfi___close_range+0x10/0x10 [ 129.479871][ T2335] exit_to_user_mode_loop+0x9b/0xb0 [ 129.485061][ T2335] exit_to_user_mode_prepare+0x87/0xd0 [ 129.490503][ T2335] syscall_exit_to_user_mode+0x1a/0x30 [ 129.495949][ T2335] do_syscall_64+0x58/0xa0 [ 129.500350][ T2335] ? clear_bhb_loop+0x30/0x80 [ 129.505021][ T2335] ? clear_bhb_loop+0x30/0x80 [ 129.509689][ T2335] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 129.515569][ T2335] RIP: 0033:0x7f34bd19fb19 [ 129.519968][ T2335] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 129.539733][ T2335] RSP: 002b:00007fff131afea8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 129.548157][ T2335] RAX: 0000000000000000 RBX: 00007fff131aff90 RCX: 00007f34bd19fb19 [ 129.556109][ T2335] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 129.564237][ T2335] RBP: 000000000001f8fb R08: 0000000000000001 R09: 0000000000000000 [ 129.572626][ T2335] R10: 0000001b2db20000 R11: 0000000000000246 R12: 00007fff131affd0 [ 129.580585][ T2335] R13: 00007f34bd425fac R14: 000000000001f92e R15: 00007f34bd425fa0 [ 129.588543][ T2335] [ 129.591547][ T2335] [ 129.593856][ T2335] Allocated by task 2336: [ 129.598162][ T2335] kasan_set_track+0x4b/0x70 [ 129.602742][ T2335] kasan_save_alloc_info+0x1f/0x30 [ 129.607919][ T2335] __kasan_kmalloc+0x95/0xb0 [ 129.612491][ T2335] __kmalloc+0xb4/0x1e0 [ 129.616628][ T2335] l2tp_session_create+0x38/0xbd0 [ 129.621758][ T2335] pppol2tp_connect+0xbf5/0x1640 [ 129.626777][ T2335] __sys_connect+0x3da/0x460 [ 129.631785][ T2335] __x64_sys_connect+0x7a/0x90 [ 129.636541][ T2335] x64_sys_call+0x88d/0x9a0 [ 129.641046][ T2335] do_syscall_64+0x4c/0xa0 [ 129.645444][ T2335] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 129.651321][ T2335] [ 129.653623][ T2335] Freed by task 2335: [ 129.657578][ T2335] kasan_set_track+0x4b/0x70 [ 129.662157][ T2335] kasan_save_free_info+0x2b/0x40 [ 129.667161][ T2335] ____kasan_slab_free+0x132/0x180 [ 129.672343][ T2335] __kasan_slab_free+0x11/0x20 [ 129.677112][ T2335] slab_free_freelist_hook+0xc2/0x190 [ 129.682512][ T2335] __kmem_cache_free+0xb7/0x1b0 [ 129.687373][ T2335] kfree+0x6f/0xf0 [ 129.691093][ T2335] l2tp_session_put+0xaf/0x1a0 [ 129.695848][ T2335] l2tp_session_delete+0x3df/0x4d0 [ 129.700945][ T2335] pppol2tp_release+0x169/0x2b0 [ 129.705781][ T2335] sock_close+0xc9/0x220 [ 129.710018][ T2335] __fput+0x1fd/0x8f0 [ 129.713996][ T2335] ____fput+0x15/0x20 [ 129.717981][ T2335] task_work_run+0x1e1/0x250 [ 129.722558][ T2335] exit_to_user_mode_loop+0x9b/0xb0 [ 129.727826][ T2335] exit_to_user_mode_prepare+0x87/0xd0 [ 129.733272][ T2335] syscall_exit_to_user_mode+0x1a/0x30 [ 129.738717][ T2335] do_syscall_64+0x58/0xa0 [ 129.743111][ T2335] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 129.748986][ T2335] [ 129.751380][ T2335] The buggy address belongs to the object at ffff888131676800 [ 129.751380][ T2335] which belongs to the cache kmalloc-512 of size 512 [ 129.765413][ T2335] The buggy address is located 336 bytes inside of [ 129.765413][ T2335] 512-byte region [ffff888131676800, ffff888131676a00) [ 129.778666][ T2335] [ 129.781003][ T2335] The buggy address belongs to the physical page: [ 129.787390][ T2335] page:ffffea0004c59d00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x131674 [ 129.797607][ T2335] head:ffffea0004c59d00 order:2 compound_mapcount:0 compound_pincount:0 [ 129.805909][ T2335] flags: 0x4000000000010200(slab|head|zone=1) [ 129.811996][ T2335] raw: 4000000000010200 0000000000000000 dead000000000001 ffff888100042f00 [ 129.820564][ T2335] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 129.829124][ T2335] page dumped because: kasan: bad access detected [ 129.835560][ T2335] page_owner tracks the page as allocated [ 129.841258][ T2335] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 287, tgid 287 (syz-executor), ts 24382420111, free_ts 0 [ 129.862076][ T2335] post_alloc_hook+0x1f5/0x210 [ 129.866920][ T2335] prep_new_page+0x1c/0x110 [ 129.871427][ T2335] get_page_from_freelist+0x2ca9/0x2d20 [ 129.876962][ T2335] __alloc_pages+0x1fa/0x610 [ 129.881539][ T2335] alloc_slab_page+0x6e/0xf0 [ 129.886112][ T2335] new_slab+0x98/0x3e0 [ 129.890163][ T2335] ___slab_alloc+0x70f/0xb70 [ 129.894822][ T2335] __slab_alloc+0x5e/0xa0 [ 129.899159][ T2335] __kmem_cache_alloc_node+0x204/0x2d0 [ 129.904911][ T2335] kmalloc_trace+0x29/0xb0 [ 129.909310][ T2335] inetdev_init+0x81/0x510 [ 129.913712][ T2335] inetdev_event+0x1f4/0x10a0 [ 129.918378][ T2335] raw_notifier_call_chain+0xa1/0x110 [ 129.923732][ T2335] call_netdevice_notifiers+0x119/0x190 [ 129.929267][ T2335] register_netdevice+0x1186/0x1550 [ 129.934448][ T2335] veth_newlink+0x66a/0xd60 [ 129.938936][ T2335] page_owner free stack trace missing [ 129.944281][ T2335] [ 129.946583][ T2335] Memory state around the buggy address: [ 129.952190][ T2335] ffff888131676800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 129.960232][ T2335] ffff888131676880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 129.968270][ T2335] >ffff888131676900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 129.976306][ T2335] ^ [ 129.982958][ T2335] ffff888131676980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 129.991000][ T2335] ffff888131676a00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 129.999039][ T2335] ================================================================== [ 130.017626][ T2335] Disabling lock debugging due to kernel taint [ 130.017844][ T28] audit: type=1400 audit(1794037186.969:4535): avc: denied { read } for pid=85 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 130.046542][ T28] audit: type=1400 audit(1794037186.969:4536): avc: denied { search } for pid=85 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 130.067973][ T28] audit: type=1400 audit(1794037186.969:4537): avc: denied { write } for pid=85 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 130.089368][ T28] audit: type=1400 audit(1794037186.969:4538): avc: denied { add_name } for pid=85 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 130.109981][ T28] audit: type=1400 audit(1794037186.969:4539): avc: denied { create } for pid=85 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 130.130501][ T28] audit: type=1400 audit(1794037186.969:4540): avc: denied { append open } for pid=85 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 130.153446][ T28] audit: type=1400 audit(1794037186.969:4541): avc: denied { getattr } for pid=85 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 130.299948][ T19] usb 1-1: new high-speed USB device number 15 using dummy_hcd [ 130.479932][ T19] usb 1-1: Using ep0 maxpacket: 16 [ 130.486249][ T19] usb 1-1: config 0 has an invalid interface number: 34 but max is 0 [ 130.494566][ T19] usb 1-1: config 0 has no interface number 0 [ 130.500733][ T19] usb 1-1: config 0 interface 34 altsetting 0 bulk endpoint 0xA has invalid maxpacket 1023 [ 130.510819][ T19] usb 1-1: config 0 interface 34 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 80 [ 130.522234][ T19] usb 1-1: New USB device found, idVendor=0b95, idProduct=772a, bcdDevice=82.73 [ 130.531340][ T19] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 130.539339][ T19] usb 1-1: Product: syz [ 130.543623][ T19] usb 1-1: Manufacturer: syz [ 130.548228][ T19] usb 1-1: SerialNumber: syz [ 130.553673][ T19] usb 1-1: config 0 descriptor?? [ 130.558953][ T2340] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 130.566200][ T2340] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 130.775963][ T2340] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 130.783251][ T2340] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 130.991678][ T19] asix 1-1:0.34 (unnamed net_device) (uninitialized): invalid hw address, using random [ 131.038387][ T60] usb 3-1: USB disconnect, device number 12 [ 131.341426][ T24] usb 4-1: USB disconnect, device number 15 [ 132.810166][ T19] asix 1-1:0.34 (unnamed net_device) (uninitialized): Failed to write reg index 0x0012: -71 [ 132.820403][ T19] asix: probe of 1-1:0.34 failed with error -71 [ 132.827525][ T19] usb 1-1: USB disconnect, device number 15