last executing test programs: 5m31.924155718s ago: executing program 32 (id=203): r0 = syz_open_procfs(0x0, &(0x7f0000000140)='ns\x00') r1 = open_tree(r0, &(0x7f0000000300)='./cgroup\x00', 0x89801) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x482, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x7, 0xd, 0x9, 0xffdffffc, 0x6, "00001000"}) write$binfmt_aout(r2, &(0x7f0000000400)=ANY=[], 0xff2e) ioctl$TCSETS(r2, 0x40045431, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x83, "00000000000000000000ffff00"}) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000080)={0x0, 0xfffffffd, 0x0, 0x6, 0x1, "e315bc1cc24ff7b7cdb242e1ff0aa6905446b3"}) r3 = syz_open_pts(r2, 0x0) r4 = dup3(r3, r2, 0x0) read$FUSE(r4, &(0x7f0000003f80)={0x2020}, 0x2020) fstat(r1, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e23, 0xcd78, @loopback, 0x7fff}, 0x1c) 5m20.190797875s ago: executing program 33 (id=274): r0 = syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x101b01) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, &(0x7f0000002600)={0x0, 0x2, "5a77bd318786aeb879ca62cdab2a02fa560186d85b25a5665a3247e500f61681905db88235f8a5447dd2a2ed6e91626f068881e50f68530c2b21a100efb76cba37ff3111d6847e0c7f719e169a596e5fc008daefba68f6222103472bc55704cdb72b4b996ed82ccb1eaae27969d008ba7d34171113d806726615380fe65a6a0a72e19c2b60bd6276fd8bb6363d10f70da60fd53ded22c87eb2be010e4a62fb73c33424b437bb192c9d06ea6ed04983fe5c5ca033dfce0a82575ef14eee686be0fc58e384f93a13e4e8bbf599394baea3a9ca1864f0a35d6cc38fca32ad6b39905a9727d2001457df7be7e1aefe3635b2ee97c143f28def4b73905ca14d90d1f6"}) ioctl$USBDEVFS_CLEAR_HALT(r0, 0x80045515, &(0x7f0000000040)={0x1, 0x1}) 4m28.971635349s ago: executing program 3 (id=1494): openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x440841, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x381, 0x0) r0 = socket$inet6(0xa, 0x800000000000002, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x4c881, &(0x7f0000000540)={0xa, 0x4e24, 0x10, @mcast2}, 0x1c) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) connect$inet6(r1, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x8001}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000400)=0x1, 0x4) setsockopt$inet6_tcp_TLS_TX(r1, 0x11a, 0x2, &(0x7f00000003c0)=@ccm_128={{0x303}, "63a7d38a4937c1fc", "5f90d5f023d7bd5bd799356c95abffc8", "09fe3f67", "0aa3b9dd5fe7a771"}, 0x28) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001480)='blkio.bfq.io_service_bytes\x00', 0x275a, 0x0) write$tun(r2, &(0x7f0000000340)=ANY=[], 0x141) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r2, 0x0) setsockopt$inet6_tcp_TLS_TX(r1, 0x11a, 0x1, &(0x7f0000000080)=@gcm_128={{0x303}, "b7a41f2300", "d21b0e8a0e000000000000000600", "1d1cbe23", "ecba06893bcdc493"}, 0x28) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) recvfrom(r1, &(0x7f0000002800)=""/4071, 0xfffffffffffffdab, 0x17, 0x0, 0x0) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000240)=ANY=[], 0x27c}}, 0x0) writev(r1, &(0x7f0000001400)=[{&(0x7f0000000140)="58ddb007a47a8b1f458ab677d557ca50def8e5bc61dbc50bca64f7e76268cd64007095adfef77465b69ec03139854d6f03d5f9bd019fe046035ef7049f48fcc7321c34faca94ff08f59edaf2ab55eedcc278df823564618627217a527b971bdfa0afd948a6cdb9e05ccaef35c22047246a7b97a8e1b645e51c47b296c759c8dfd56beb8fa15c800ad060ab378a269557bc053d9be903", 0x96}, {&(0x7f0000000300)="2ea63d218bc1023b2e6eceeb92d548803a43d4dddc2433c76650030c188f490311ff86da69fab1539139f6dda31739c2bb4412dd471137e2a53496c5f7707e01ccfb826f2eb96895230862e11d56c19af139de912ac5e68a99080e428443fcfba8b0460290c6275affe9953a97260b0304fd7ef159c9cd30cae1bcc75d568d353575ec3b5293fb80de85c7562804230489274831b2c17dccccc523ada66a46", 0x9f}, {&(0x7f0000000440)="63e73686513c53aec098be4b2dfc27b5be1f5f85f54c24efb8fc94ccaac29f1378e04daa49f8dcbda8b0faff57761a0ce8a311802e5dd07a159721cac7d2250f4359e04727386cc7d1a3e8bf93339f3df1340041f71046f2b1d9a80af70fb8246258d09c310af3bef017fde1fd8ce505cd4858549192a95e512257b6c676a7ebb41230e4e4fb23e9666bfdc8bc2ca77bbd11810836df4a6f3dbe3ee75c34b07c64e1af6d62d54fccb9f281eac16eca7129aa4355fd53", 0xb6}, {&(0x7f0000000500)="de21cff472aa580c2ee9f858", 0xfc96}, {&(0x7f00000014c0)="8fa68a274cab49b9c806172798e6a829701bb4eefee6919e0a30fa83a50170b6a3b499361f95ab6ff05f9001332b3a463b64282a924b0dcf6499c8c9b23d7290ab896ed6e2c7280dcda0336864e06d9570ea2cc78330859fa73080f5ddd3fd2b943287b312357816e9cfaa9e8941dd981f837506cabc6e016e507076819ff37d790c0b868166925649c9a74f4afc322ac971832fc3f12ba4dd3931c773134441bd46d9b10095eaabcfb846ac5fa9ea76f3547884091f073880656438f4406cf2051edb37139066dcaed45a544f5f92cccb1db0e2e503de3d4216d961dea1cbd9119a3f49b8bcdfe7078a7706296712eab5bd91b189f0140892b56c46912cc16dbe9fb469502eb67f36e8531dbfbed70615a836d32b5dabcf933201c97b29209e071433edb1b92ba47b514232654a36067c9b241737eb902ede1e18f99757339d2858bbe9c48484ec608e5fae534c4580d22fcd6ad28a786e0f5e675bc264ca03cf081038cb872e039100f94d25a7b5b9f2f18815e948aa65513c63a61e68c6a4ef4888980b54e3b7332112ee424e65172b2076528cd11cf63d7f4ff88c9eabf2c388bcb02beaa7e9c33cbe26149703fd3d511283739fa9638b1d6290a53b679227ee54d0fb232befdc92e59396c5bb818926e8a30a38a0aa358e1c818dbc27646fb4dc43168540cf724358d07124937cb3baa5365970e14240d727a8111d250202b39e8e3d6ff5e250eb09fdd83b8a129015567ae0f71a6b9166cd3718e3a83e711271f2ffd2d968e1153a38a8c5995e5c46fb8f22613690852bbea407b417eff9fd86e685025cbad82174164c3529407c4a27af5c6fdd911a4a87b7365655d5275c5719151b4440752785ff416a8e3a1f83f70e1f5d2538348b839f4e965e586e8b28a8aa94b79bc4e23d97d159af010918721be419234850fbeac52bb5de10a199f6591ab4deea9670e8b3d9f9341cddef4f3fe1b08a4f1943329cfa12c3972fc50525b8ebb5923235bbecd182d486169cf51e8c69259a404c0867328943358e95ad690a9c8eea73ddde677ebfe6f0d5f2e3a03541291e09a30bcce4b66550c28c6ba6cc431bb0fa87848652fb9319577a38a8ad45a87647b523fe3e452d90306c4c690b47d3c840ebbb1d96abb0735b21f557f5de101b7fbb7618d9739fabf89b8fb34c02493d1bfc31e80b1a9fcdac8aaf0fd69a0aee6f456705420ea3e7df30b478dd12ee137a6d6747750e5d6a7e5d308276c0ebd77377f000296108954f5371a9c84a01a18a76bee8ea849ddaf492a35f943ac395b9dddbd5ee05f6d75ac40237a0690584d7afaa3e117135b1406e03c9e49223ee48feccab18a3fd0325ed281bc70fb41b4f13905744afcbb588b8daee6d635007cf96dbd9549726c4cf9e350072702058bb533a4bb598a06e5505e8393b2793cc6ac2d66a0529b2aa7991a30f8bdd2bec5ac7ca2064e7b3a2a2d510de4675a7a6ce5d1729c2b98dbb08ab4a33cbd83484092d48b9c4fac7b7b6191057a2acf109565c6d49d9be0f1f2838650cdc36ad835fd78be83c6df052659ed1e8242d45891442a54205311da1814b18ed7fcc7c5bd979434040cd2133fd35ab946ff87e807a48a4802a1e4cce7cef4f2f555029cdecadaf99c5c3bf65db4be3940bfedb87cc491ac59d027496d87a792961f1f59cb72df3280b1845722282745fa77dfa1fce5e67e09466475c0e988719e528d39815cdfe0d16a6de1d871cfc4778ed47e8a7d3b2dfeea2083a41b061848324fe15e90c2dac3303992fdc42ba1a1995b87154a618660094a942074c5e02ed1a11293c5276b06439468f99c9d184c0152c44308c64c432277fe367a7fac9c9fb08d9dc8949e8ab9740a357fdc9d69df07375d011947b43072f554d63831af4319664e735c3eb08c0afe5120bd89b4d0654b6266aa4709ea2beb3dfd0449d2c3fde3f1098c9f73d994a741bb9f3c5322743c310fd7881856e5d529f4a9eb7dc43c0be6c36653b2cda92a7f07247450d666ca88863c6880d656eb8006bfe2f96543bf683fe3126e03ccf2120878a4fc46bdf64e11e323637ae0024a3d6fa52729591758c36a5ddeff1d1c5ba3e1bfedad1ff460f05ce276f1f3c2d70f9c6c5927a8fd15e65bc9c648b7dfccde510f5bf46bab8f2c5e21cb129dbf3f4df7a5a831f198f21fee429d73646eab00b1542941108592708fe8f53613d6b7dc1e4999374317b57c1e4a974fedd089c4295682d1a03d770b7639e80d25b0f428dfd3c46be492fc80b5c4913e476845a359dbe4187fd0027bd9fc814ba6a2877b61b637878f2af7ef18a0858fe5c7e75ecf92e735452456089efae8a13d3e6ac9d28c18cb1ca54522066edbf9e67ab4cf158b63c7b4d25146bafa14163cd4d171ad97f3ef93cfabae0557e237bbbe9cb80144b03f6fdb7d357d253235ddbde503829403657fdde516d3974091c40c6b9dd245f730458e1fd594f6b694af0150cbd31b6d0fb3bc04eb5096e704e039eecf4be9e93eb2f841878538ed1c46d015b1a792b599ed9225577460f72e6b4e271e5e6eeed34f69cfd76683e21d87e3ee8ed88df79901f9354823824fa6b67a91e2626161436327fc58879085d87db5dd94e09a0d24c7c381fb8fdc7198d2c2fece49e6496a119023852fca717d2ff2f9ed5e0715ddebd267ed0b8378ad852b03a539e6d03025b4a04f2483bdb79a4bd233ce3b6bd30d736ad0784b978861badc236e7106d23f26eac50e93d8ab012dc7c5d85d4f944aaa27378efc99572f932344cddc488ffa9210dc6b8f0cc29d07110362485eaa5b4b196a49c7080633c1befe802207ed0a172fa0b61fea6305f04d7b755a6e5e162aa8047f80647ad0bae8143226ce3aa8de3b0c0fc4e7cd6baab274fba47abf95ae88584778325250063855a4b9f0c966efa43dc0196d3dec619c490181c259b341b3fd370bab0b66af3cb1e9365cf6b62e44d939d36ffcc6badb924f44e86337360efbf4e3f9bd716adbc3f0ba6055ec9790504c9f3865f47e422b1c6ba16c07d0df618cc572b36ec8e519db90a499424a7d689e6fbcc9be1abd843512ec16540c6c7c6d6e2cf50ab2014e4208c2abb0ddfd2ef9dece79389f21d7a9985903f7f01b0394d268349fa41a487bacfe8deba2ffca815ad0b1c6ffa5af2eba6d9436ad298c4e11b68451c7ff001c02ddd3ceb153a865327845349e8b817aa8ed24924f49260f8209d0ddcacf5306d9222320776162fe8396914fa22c85bc261661fa547c3063e20ca37c0862c3b9abd3da9b02e3f58d89be00003509bae9b82f60975c0687c500bb213a580f6e9f08b207d7c31748e3fda05a0cc76b1fdd563610a2bb09a57020d85026a57a178c38839b5b88cd8434d1f0308d872c7356a6445de801ff14c133bda3b42b9ca099fb3ee0d5c7a835f56ed30aa75d47cd97c329b682879290faee167334500d2fe596564f3e4064f41cf3469aaae846f1e84f3d8a7f42d98d0b6b67913c376d6bbde3027aa41b753ace165f88379981685f918ada5043800b5e0a0865dcda94df85fefa9348d6ec4e1ffbd940d023fbbd3b77d5db572981dbe40cbae9f010c1ea02718b1c4b7d0447c9d83d1afea58097a0467d6cdd47aef05f97dab63462f6ea61f4b611040b30e7cf60a499aa9d0bc50c08463f25a47d2dbc958fe1d1cf2399dcf1952987b6fcbc97bf73b12177c374c8fd56c8228fc796c958687104f4eb9d46ab80eeeeedb7096a67ee440ae92a65cbf6f81939e3d1050c67245036b5dcc13d577fbb4d9c3fbf2e2e61aa154074ae225c54e23289c4ef41a07a49a9d40f3103f4c9dfd4d750cc646adadd2e1fe24c74ce099d753d4c59d806a0b7f576ac37ac58a51a120f93162c43d16c1f7e5289c75f5f0a5b838d020040c9ce512ca35d08f42acd24cdbc2e6b1ac3c6809a5ed9e272155e9fa55349bc3ce0e3f2d1624dc60e2396b954587bbab275f38911e86b826b85730c6670a92a221cdcbf18ee0c44aec4591fcd12204b3049a1b5da1215a4cf88ecbe2d877ef975f4f661999d17d7d9ec14e0895ce25034dac4705d50ae42ca162778d0dcfc4e9180517be0daca5deb10773f93e2c61a5fe9b823218a97c35d0d7b436b2e1afb670b5a4c6dacd401afd1832c1dd96e8eba7734954070c6796cc80707441404cfe95fabf214bf03a6e4643ca559c2b8dcf1fa871114f3dc973a056c9aee7cd0ed4cbaf18298377e750869551632c1713bd8372e3f11fa02edf0a68d2c01245459d9e78597ac1eec75064024c1f3c98260d34b611ba8fa4b2022babd44b76ea70c718df8268dba447038b1539f0499603cf2d79bcc49c35a8cf38892d982d153d72253a22ae68da65e84d6399e81a14ebf89ba446630814d9dcf8914acafc8603a5396167c5aa99814af62c1c39a6ba76ad2c6c51a6d56d89fbda5334e626540ef1b1ecad53247531fcdd661a48d28a6d48bac8ef70c888b00db57edceee94425df5161e1b1a1bec9c897e01867442ed8ba000b5f75832a8ec57ef0737994b95f40eac48f3c8da5db80e965fcdf3f0bbb4439a7123b59987f0fdac96bc7ce09c013562ff7c0cb23a882828e45a51f7e748db90c5eaacfdf3657d11a348f747ddd860387de41be3376a5dabf4296bc05282cb73fcd60c4a4148d9e872ae86e30b22db1ce5452ad9fe3fea029f94a583d301e74eac1818da3f1279c63690db6e7166ddaacd1278716fa3221daaa27c98fd97b88e63208d604505ad8f31bd2b83a19f89480b71198d8a31c89cadd258ce338afe1a26b0db248c1a39fe027716e417e45bb6c9a68cab1cd6c3445e9796ee1003650e97eccdadc9bea540e2c8253652c8f1586ba7e508cd29d53467bad11eef729796dbe83d3fc0bc15762c2f1de34c6380a6725f94600a82d87ccf80948babcadec31ca654671d17de360f20aaf04f4d44951661fe8fe7731174ec3aaf330aebeaed9620f694859785a36c5f787ce35e4425ed3387710fa346f04db11255c6985fa4cdbe54d25c942264b3383d60903bd2677611850fe125b", 0xdf3}], 0x5) setsockopt$sock_int(r1, 0x1, 0x7, &(0x7f00000000c0)=0xffff1884, 0x4) 4m28.834942122s ago: executing program 3 (id=1498): r0 = socket$inet6(0xa, 0x2, 0x3a) connect$inet6(r0, &(0x7f0000000180)={0xa, 0x4e24, 0xb, @mcast2, 0x9}, 0x1c) r1 = socket$key(0xf, 0x3, 0x2) (async) r2 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0) writev(r2, &(0x7f00000001c0)=[{&(0x7f0000000100)="6680", 0x22}], 0x1) (async) sendmsg$nl_xfrm(r2, &(0x7f0000000400)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f00000003c0)={&(0x7f00000002c0)=@polexpire={0xc0, 0x1b, 0x400, 0x70bd2d, 0x25dfdbff, {{{@in=@remote, @in=@local, 0x4e24, 0xfe1d, 0x4e23, 0x0, 0x2, 0x0, 0xa0, 0x2e}, {0xfffffffffffffd5e, 0x9, 0x5, 0x3, 0x100000001, 0xaba, 0x2, 0x9}, {0x1, 0x2, 0x870, 0x6}, 0x4, 0x6e6bb8, 0x1, 0x1, 0x1, 0x3}, 0x10}}, 0xc0}, 0x1, 0x0, 0x0, 0x6000004}, 0x82) sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={0x0, 0x10}}, 0x0) r3 = socket$key(0xf, 0x3, 0x2) sendmmsg(r3, &(0x7f0000000180), 0x0, 0x20008080) r4 = syz_create_resource$binfmt(&(0x7f0000000000)='./file1\x00') (async) munmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000000)={[0x0, 0x100000000, 0x2, 0x81, 0x100000, 0x0, 0x2004c8, 0x8000000, 0x0, 0x0, 0x7, 0x0, 0x10005, 0x0, 0x2, 0xffffffffffffffff], 0x0, 0x200}) syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000000)={0x0, &(0x7f0000000100)=[@code={0x1, 0x81, {"0f22e5c744240060420000c744240233d8cecbc7442406000000000f011c24668f38896810c4027958b20000000064449966baf80cb83284af80ef66bafc0c66ed66baf80cb8cc07ff8aef66bafc0cb8d4000000ef48b8f8000000000000000f23c00f2135030009000f23f8450f2244"}}], 0x81}) (async) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)={0x0, 0x0, [{0xf88e470f, 0xed}]}) (async) r5 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) (async) ioctl$KVM_SET_REGS(r7, 0x4090ae82, &(0x7f0000000200)={[0x445, 0x9, 0xfffffffffffffffd, 0x10000000, 0x10000, 0x3, 0x4002004c2, 0x7ff, 0x9, 0x0, 0xfc, 0x80, 0x89, 0x0, 0x8, 0x8d], 0x100000, 0x240446}) (async) ioctl$KVM_RUN(r7, 0xae80, 0x0) ioctl$KVM_RUN(r7, 0xae80, 0x0) (async) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x100}) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) (async) ioctl$UFFDIO_MOVE(0xffffffffffffffff, 0xc028aa05, &(0x7f0000000080)={&(0x7f0000189000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x2000}) write$binfmt_script(0xffffffffffffffff, &(0x7f0000000080)={'#! ', './file1', [{}]}, 0xc) (async) close(0xffffffffffffffff) (async) execveat$binfmt(0xffffffffffffff9c, r4, 0x0, 0x0, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_SEND(0xffffffffffffffff, 0xc0182101, 0x0) prlimit64(0x0, 0xd, &(0x7f0000000000)={0x0, 0x10000}, 0x0) (async) timer_create(0x1, 0x0, 0x0) 4m28.664329286s ago: executing program 3 (id=1506): socket$inet6_udp(0xa, 0x2, 0x0) syz_open_dev$loop(&(0x7f0000000080), 0x7, 0x20800) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000005100), 0x600, 0x0) r0 = syz_create_resource$binfmt(&(0x7f0000000000)='./file1\x00') socket$inet6_udplite(0xa, 0x2, 0x88) openat$binfmt(0xffffffffffffff9c, r0, 0x42, 0x1ff) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)) openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) r1 = mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, r1, 0x0, &(0x7f0000000140)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@any_dev={0x3, 0xc41, 0x0, 0x0, 0x1000, 0x800007, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = dup(r3) r5 = syz_io_uring_setup(0x5b17, &(0x7f0000000000)={0x0, 0xc995, 0x4000, 0x0, 0x2de, 0x0, r4}, &(0x7f0000000080), &(0x7f0000000100), &(0x7f00000001c0)) syz_ublk_setup_queues(r4, r2, &(0x7f0000000380)={0x0, 0x2, 0x1000, 0xfffffffe, 0x23c}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x704, 0x100, 0x1000000, 0x2033f, 0x0, r4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xffffffff, 0x80, 0x0, 0xdd}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x9b59, 0x10, 0x0, 0x8005a03}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x2, 0x4000, 0x1, 0xdfffffff, 0x0, r5}}], 0x1, 0x0, 0x0) 4m28.557312559s ago: executing program 3 (id=1509): mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='dev\x00', 0x1ff) mount(0x0, &(0x7f0000000500)='dev\x00', &(0x7f0000000600)='devtmpfs\x00', 0x0, 0x0) syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040f905ffff0001010203010902200001010080fa0904000002ff0000000705810240000007050202"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./file0\x00', 0x0) mount$tmpfs(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x80, 0x0) mount$tmpfs(0x0, &(0x7f0000000180)='./file0\x00', 0x0, 0x86022, &(0x7f00000005c0)=ANY=[@ANYBLOB='nr_inodes=5,nr_blocks=2']) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='dev/ttyUSB0\x00', 0x2, 0x0) ioctl$SNDRV_TIMER_IOCTL_CREATE(r0, 0xc02054a5, &(0x7f0000000040)={0xe0, 0xffffffffffffffff, 'id0\x00'}) socket$netlink(0x10, 0x3, 0x8000000004) socketpair$unix(0x1, 0x5, 0x0, 0x0) openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000100)='/proc/thread-self/attr/exec\x00', 0x2, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$VHOST_GET_VRING_ENDIAN(r1, 0x4008af14, &(0x7f0000000080)={0x1, 0x1}) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1, 0x810, 0xffffffffffffffff, 0x4000) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) mount$cgroup2(0x0, &(0x7f0000000280)='./file0\x00', &(0x7f00000002c0), 0x2000000, 0x0) mount$overlay(0x0, 0x0, &(0x7f0000000180), 0x0, 0x0) mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0x3, 0x20132, 0xffffffffffffffff, 0xb2993000) bind$netlink(r2, &(0x7f0000000080)={0x10, 0x0, 0x3, 0x67a4f9ecf23f9497}, 0xc) munmap(&(0x7f0000001000/0x3000)=nil, 0x3000) r3 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r3) ptrace$poke(0x4, r3, &(0x7f00000011c0), 0xfffffffffffffffe) r4 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x40000, 0xd5) newfstatat(0xffffffffffffff9c, &(0x7f0000000140)='dev/ttyUSB0\x00', &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x0}, 0x2000) setresuid(r5, r5, 0x0) openat$cgroup_ro(r4, 0x0, 0x0, 0x0) 4m27.302377282s ago: executing program 3 (id=1526): r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000000)={0x810003, 0x0, 0x8, 0xff7ffff4}, 0x10) write(r0, &(0x7f00000000c0)="240000001e005f0214fffffffffffff8070000000b000000ff60000008000b000d000000", 0x24) 4m27.108441797s ago: executing program 3 (id=1532): mkdirat(0xffffffffffffff9c, &(0x7f0000000050)='./sys\x00', 0x1ed) mount(0x0, 0x0, &(0x7f0000000070)='sysfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='./sys/bus/platform/devices/pcspkr/driver_override\x00', 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config\x00', 0x1ed) mount(0x0, &(0x7f0000000500)='./config\x00', &(0x7f0000000600)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000700)='./config/usb_gadget/g1\x00', 0x1ed) r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/usb_gadget/g1/idProduct\x00', 0x1, 0x0) write(r1, &(0x7f0000000b00)='0x', 0x2) close(r1) mkdirat(0xffffffffffffff9c, &(0x7f0000000c00)='./config/usb_gadget/g1/functions/uvc.usb0\x00', 0x1ed) mkdirat(0xffffffffffffff9c, 0x0, 0x1ed) symlinkat(&(0x7f0000000e00)='./config/usb_gadget/g1/functions/uvc.usb0/control/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000f00)='./config/usb_gadget/g1/functions/uvc.usb0/control/class/fs/h\x00') symlinkat(&(0x7f0000001000)='./config/usb_gadget/g1/functions/uvc.usb0/control/header/h\x00', 0xffffffffffffff9c, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000001200)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/header/h\x00', 0x1ed) mkdirat(0xffffffffffffff9c, &(0x7f0000001400)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/uncompressed/u/360p\x00', 0x1ed) symlinkat(&(0x7f0000001700)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f0000001800)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/class/fs/h\x00') symlinkat(&(0x7f0000001900)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f0000001a00)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/class/hs/h\x00') symlinkat(&(0x7f0000001b00)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f0000001c00)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/class/ss/h\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000001d00)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ed) symlinkat(&(0x7f0000001e00)='./config/usb_gadget/g1/functions/uvc.usb0\x00', 0xffffffffffffff9c, &(0x7f0000001f00)='./config/usb_gadget/g1/configs/c.1/uvc.usb0\x00') r2 = openat(0xffffffffffffff9c, &(0x7f0000002000)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r2, &(0x7f0000002100)='usbip-vudc.0', 0xc) 4m27.108188727s ago: executing program 34 (id=1532): mkdirat(0xffffffffffffff9c, &(0x7f0000000050)='./sys\x00', 0x1ed) mount(0x0, 0x0, &(0x7f0000000070)='sysfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='./sys/bus/platform/devices/pcspkr/driver_override\x00', 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config\x00', 0x1ed) mount(0x0, &(0x7f0000000500)='./config\x00', &(0x7f0000000600)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000700)='./config/usb_gadget/g1\x00', 0x1ed) r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/usb_gadget/g1/idProduct\x00', 0x1, 0x0) write(r1, &(0x7f0000000b00)='0x', 0x2) close(r1) mkdirat(0xffffffffffffff9c, &(0x7f0000000c00)='./config/usb_gadget/g1/functions/uvc.usb0\x00', 0x1ed) mkdirat(0xffffffffffffff9c, 0x0, 0x1ed) symlinkat(&(0x7f0000000e00)='./config/usb_gadget/g1/functions/uvc.usb0/control/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000f00)='./config/usb_gadget/g1/functions/uvc.usb0/control/class/fs/h\x00') symlinkat(&(0x7f0000001000)='./config/usb_gadget/g1/functions/uvc.usb0/control/header/h\x00', 0xffffffffffffff9c, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000001200)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/header/h\x00', 0x1ed) mkdirat(0xffffffffffffff9c, &(0x7f0000001400)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/uncompressed/u/360p\x00', 0x1ed) symlinkat(&(0x7f0000001700)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f0000001800)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/class/fs/h\x00') symlinkat(&(0x7f0000001900)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f0000001a00)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/class/hs/h\x00') symlinkat(&(0x7f0000001b00)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f0000001c00)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/class/ss/h\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000001d00)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ed) symlinkat(&(0x7f0000001e00)='./config/usb_gadget/g1/functions/uvc.usb0\x00', 0xffffffffffffff9c, &(0x7f0000001f00)='./config/usb_gadget/g1/configs/c.1/uvc.usb0\x00') r2 = openat(0xffffffffffffff9c, &(0x7f0000002000)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r2, &(0x7f0000002100)='usbip-vudc.0', 0xc) 4m17.952557767s ago: executing program 4 (id=1702): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x8000, 0x0) mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=ANY=[@ANYRESHEX]) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetlb.1GB.usage_in_bytes\x00', 0x275a, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fde000/0x18000)=nil, &(0x7f0000000080)=[@text32={0x20, 0x0}], 0x1, 0x48, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 4m17.893228819s ago: executing program 4 (id=1705): mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) chmod(&(0x7f0000000180)='./file0\x00', 0x296) r0 = syz_open_dev$evdev(&(0x7f0000000080), 0x0, 0x8c2) ioctl$EVIOCSABS20(r0, 0x40044591, 0x0) ioctl$BTRFS_IOC_QUOTA_RESCAN_STATUS(r0, 0x8040942d, 0x0) openat(0xffffffffffffff9c, 0x0, 0x20842, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='.\x00', 0x100, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x80a61, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) ioctl$TUNSETVNETHDRSZ(r2, 0x400454d8, 0x0) fsetxattr$system_posix_acl(r1, &(0x7f0000000080)='system.posix_acl_access\x00', &(0x7f0000000040)=ANY=[@ANYBLOB="020000000100000000000100c16198040001000000000010000300000000002000000000000000"], 0x24, 0x1) setreuid(0xffffffffffffffff, 0xee01) setxattr$incfs_metadata(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140), 0x0, 0x0, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) getsockopt$IP6T_SO_GET_INFO(0xffffffffffffffff, 0x29, 0x40, 0x0, &(0x7f0000000200)) 4m17.808577481s ago: executing program 4 (id=1706): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=@updpolicy={0xb8, 0x13, 0xcb23c9c9931e99e9, 0x70bd2b, 0x0, {{@in6=@private0, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa, 0x40, 0x50, 0x87, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0xfffffffc}, {0x0, 0x0, 0x0, 0x800000}, 0x4, 0x6e6bb8}}, 0xb8}, 0x1, 0x0, 0x0, 0x4000800}, 0x8004) 4m17.808385581s ago: executing program 4 (id=1707): r0 = socket(0x10, 0x803, 0x0) readv(0xffffffffffffffff, &(0x7f00000003c0)=[{0x0}, {0x0}, {0x0}, {0x0}, {&(0x7f0000000340)=""/88, 0x58}], 0x5) sendto(r0, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f0000002040)=[{{0x0, 0x0, 0x0}, 0x2}], 0x1, 0x40000022, 0x0) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000000)=""/85, 0x55}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x1c}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0xbe8}, {&(0x7f00000007c0)=""/154, 0x53}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}}], 0x4000000000003b4, 0x600000000000000, &(0x7f0000003700)={0x77359400}) 4m17.807975871s ago: executing program 4 (id=1708): r0 = socket(0x10, 0x3, 0x0) write(r0, &(0x7f0000000000)="1c0000001a005f0014f9f40700090400810000000001400000000000", 0x1c) r1 = socket$inet_udp(0x2, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/tracing/trace_pipe\x00', 0x800, 0x0) r3 = socket$inet_tcp(0x2, 0x1, 0x0) mount$9p_fd(0x0, &(0x7f0000000040)='./debug/tracing/trace_pipe\x00', &(0x7f0000000100), 0x2008040, &(0x7f0000000180)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r2, @ANYBLOB=',wfdno=', @ANYRESHEX=r3, @ANYBLOB]) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x2c2002, 0x0) r5 = syz_usb_connect$hid(0x3, 0x36, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x8, 0x17ef, 0x60b5, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0xd0, 0x3, "", [{{0x9, 0x4, 0x0, 0x9, 0xc, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0xb, 0x0, 0x1, {0x22, 0x29}}, {{{0x9, 0x5, 0x81, 0x3, 0x200, 0x5, 0x95, 0xfd}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r5, 0x0, 0x0) r6 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0) r8 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dev/mapper/control\x00', 0x0, 0x0) ioctl(r8, 0xc138fd06, &(0x7f0000000000)="0400000000000000000000003801000000000000000000000000000032") setsockopt$packet_int(r7, 0x107, 0xf, &(0x7f0000006ffc)=0x4000000000000200, 0xe50fb6c50bc849c9) socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) getsockname$packet(r9, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000040)=0xffffffffffffff73) bind$packet(r7, &(0x7f0000000000)={0x11, 0x0, r10, 0x1, 0x0, 0x6, @link_local}, 0x14) sendto$inet6(r7, &(0x7f0000000580)="02043c0001000000010e0200c52cf7c20675e005b02f0800eb2b2ff0dadb897c6b112002faffffff3066090cb600c5471d130aaf14c85443b705ca7952ad90e59066321a54e7", 0x46, 0x40001, 0x0, 0x0) ioctl$sock_inet_SIOCSIFBRDADDR(r0, 0x891a, &(0x7f0000000300)={'veth0_to_bridge\x00', {0x2, 0x4e21, @loopback}}) ptrace(0x10, r6) memfd_create(&(0x7f0000000180)='[\v\xdbX\xae[\x1a\xa9\xfd\xfa\xad\xd1md\xc8\x85HX\xa9%\f\x1ae\xe0\x00\x00\x00\x00\xfb\xff\x00\x00\x81\x9eG\xd9,\xe2\xc6a\x9f\xe8\xf1\xb3\x86\xe2+Op\xd0\xa2\x82\x1eb;(\xb5\xe1jS\xd6\x91%||\xa0\x8ez\xadT\xc8\f\xe5\x89\xbf3:\x99\x1e\xac`\xc3\xcf\xd3\xae\xd2\a\x11\xa9\xa5^\xff\xf5\x95\xd2q#\xc6\xca\x97\x9d\xcb\x1e\x80\xd6\xd5%N&\xf8#\x80z8Z\xd2}\xf5\xe4\x9f5\x9b\x01\xf9t\xbb\x1er\x14\xdb\xd3\xcd\xfd\xbdnC\xecz\xabq\x95t*T9\xa9\b X \x04\"\x17\xbf\xcb\xccF\xda\xcf\xdd^\xa0\x15\xc0\xcb^h>\x1b\xb5d\xc7\x7f0\x9a&\xb0\x12#\x9c`\xa6\xed\x05\x95g\a\xccYb\xaf\xe9\xb6G?\x9f\xf5\xfe\xc1\xc0JJ\xc8\xd9d\x80\x13\x8fX\xb4\x19\xc4\\\xcb\x89-)\x90\x01\v\xac^\xdbBQ|\xaej;\x92\\\xf8u\x19Y\xee\x99EI\xf1t\xadn<\x9b\xc9\x87\xd0\xa7\x1a\x81\xb9\xc87sq\xd7\x15\xd6\x91O\x9c\x99!9>\xff\xa8\xfa\xe6=d\xcf\xca\xa9\xc61!\xc6P\x13\xd0\x88gZ\xbe\xdfl\xfa\xff\xb0m;d07tx\xbb\xabd\xe5\x16\xc4\xae\xf0', 0x0) syz_usb_control_io$hid(r5, &(0x7f0000000040)={0x24, 0x0, 0x0, 0x0, &(0x7f00000001c0)={0x0, 0x22, 0xfffffffffffffebe, {0xfffffffffffffe8d, 0x21, 0x2, 0x13}}}, &(0x7f0000000380)={0x2c, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$KVM_GET_MSRS_sys(r4, 0xc008ae88, &(0x7f00000000c0)={0x3, 0x0, [{0x377, 0x0, 0x3}, {0xa04, 0x0, 0x200}, {0x22d, 0x0, 0x7ff}]}) r11 = syz_open_dev$usbfs(&(0x7f0000000140), 0xb, 0x2) ioctl$USBDEVFS_DISCONNECT_CLAIM(r11, 0x8108551b, &(0x7f0000000000)={0x0, 0x2, "687562000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400"}) setsockopt$inet_int(r1, 0x0, 0x22, &(0x7f00000002c0)=0x103, 0x4) 4m16.172681704s ago: executing program 4 (id=1742): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="fc010000190001000000000000000200fc020000000000000000000000000000000000000000000000000000000000004e21000300000000020000202f000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="01000000000000000000000000000000fdffffffffffffff00000000000000000000000000000000000000000000000000000000000000001d00000000000000000000000000000000000000000000000000000000000000dd020000000000000500000000000000000000000000000044010500"], 0x1fc}}, 0x0) 4m1.140424858s ago: executing program 35 (id=1742): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="fc010000190001000000000000000200fc020000000000000000000000000000000000000000000000000000000000004e21000300000000020000202f000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="01000000000000000000000000000000fdffffffffffffff00000000000000000000000000000000000000000000000000000000000000001d00000000000000000000000000000000000000000000000000000000000000dd020000000000000500000000000000000000000000000044010500"], 0x1fc}}, 0x0) 3m16.634162305s ago: executing program 6 (id=2722): r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000140)={0x100, 0x6}, 0x4) setsockopt$packet_fanout_data(r0, 0x107, 0x16, &(0x7f0000000100)={0x2, &(0x7f0000000180)=[{0x28, 0x0, 0x0, 0xfffff034}, {0x6, 0x80, 0xfd}]}, 0x10) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000000)=0x9, 0x4) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'ip_vti0\x00', 0x0}) sendto$packet(r1, &(0x7f0000000180)="0b03feff4f00021202004788aa96a13bb1000011000088ca1a00", 0x1fffc, 0x0, &(0x7f0000000140)={0x11, 0x1200, r2}, 0x14) 3m16.322414103s ago: executing program 6 (id=2727): r0 = openat$selinux_attr(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/attr/fscreate\x00', 0x2, 0x0) write$selinux_attr(r0, 0x0, 0x0) (async) openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0) (async) socket(0x2, 0x4, 0xfffffffe) (async) r1 = socket$inet_icmp(0x2, 0x2, 0x1) bind$inet(r1, &(0x7f0000000100)={0x2, 0x4e24, @private=0xa010181}, 0x10) (async) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) (async) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) (async) r3 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r3, 0x10e, 0xc, 0x0, 0x0) sendmsg$nl_generic(r3, 0x0, 0x40816) (async) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) mkdirat$cgroup(r4, &(0x7f0000000080)='syz1\x00', 0x1ff) (async) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x0, 0x1113, 0xffffffffffffffff, 0x0) (async) write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000c40), 0x12) r5 = openat$cgroup_type(r2, &(0x7f0000000100), 0x2, 0x0) write$cgroup_type(r5, &(0x7f0000000340), 0x9) (async) socket$inet6_tcp(0xa, 0x1, 0x0) (async) r6 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000002180), 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r6, 0x41007701, &(0x7f0000000040)='[%-{]*[') 3m16.320599723s ago: executing program 6 (id=2729): syz_open_dev$usbfs(&(0x7f0000000080), 0x75, 0x10b701) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000440)={0xffffffffffffffff}) pipe2$9p(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000000), 0xffffff8c, &(0x7f0000000100)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@version_u}]}}) write$P9_RVERSION(r2, &(0x7f0000000080)=ANY=[@ANYBLOB="150000006bffff"], 0x15) 3m16.317671573s ago: executing program 6 (id=2731): r0 = socket(0x10, 0x802, 0x0) write(r0, &(0x7f0000000100)="1c0000001800077bab092500090007000a0700000000000600213693", 0x1c) 3m16.271817035s ago: executing program 6 (id=2734): syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) setns(0xc9, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000003c0), 0xb8080, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000080)={'syzkaller1\x00', 0x1}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) r5 = dup(r4) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) write$tun(r3, &(0x7f00000000c0)=ANY=[@ANYBLOB="001c86dd0700100bb8001400000060ec97000fc83c00fe8000000000000000000000000000aaff02000000000000000000000000000111"], 0xffe) r6 = socket$netlink(0x10, 0x3, 0x0) writev(r6, &(0x7f0000000300)=[{&(0x7f0000000000)="390000001300034700bb5be1c3e4feff0600000005000000450000002500000019000d00000008000d00000000000006040000000000f93132", 0x39}], 0x1) syz_ublk_setup_queues(r2, r0, &(0x7f0000000180)={0x0, 0x20000, 0x0, 0x1, 0x154, 0x0, r2}, 0x0, 0x1, &(0x7f0000000340)={0x2e, 0x5, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, '\x00', {0xfff9, 0x42, 0x0, 0x0}}, 0x0) syz_io_uring_setup(0x3f42, &(0x7f0000000000)={0x0, 0x72a2, 0x80, 0x2, 0x2c9}, &(0x7f0000000080), &(0x7f00000000c0), &(0x7f0000000100)) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000140)='sysfs\x00', 0x0, 0x0) r7 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./sys/devices/system/clocksource/clocksource0/current_clocksource\x00', 0x1, 0x0) write(r7, &(0x7f0000000400)="9c89eadc93d62c5d7ffa022f0130d891ce512dd9a8f16d24792b925e8265e67afd7a53", 0x23) syz_io_uring_setup(0x67de, &(0x7f0000000140)={0x0, 0xd736, 0x8000, 0x2, 0x2f2}, &(0x7f00000001c0), &(0x7f0000000200), &(0x7f0000000240)) syz_io_uring_setup(0x644a, &(0x7f0000000280)={0x0, 0x2a60, 0x2000, 0x3, 0x64}, &(0x7f0000000300), &(0x7f0000000340), &(0x7f00000004c0)) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cpuacct.usage_percpu_user\x00', 0x275a, 0x0) write$binfmt_script(r8, &(0x7f0000000000), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000003, 0x28011, r8, 0x0) open(&(0x7f00009e1000)='./file0\x00', 0x60840, 0x0) r9 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r9, @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) writev(r9, &(0x7f0000001440)=[{&(0x7f0000001200)="371f", 0x2}, {&(0x7f0000001340)="15d0ce74016d43c8bceb5f5c9f33", 0xe}], 0x2) preadv(r8, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x1, 0x0, 0x0) r10 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) process_vm_writev(r10, &(0x7f0000000640)=[{&(0x7f0000000580)=""/153, 0x99}], 0x1, &(0x7f0000001d80)=[{&(0x7f0000000500)=""/117, 0x75}], 0x1, 0x0) 3m16.110940379s ago: executing program 6 (id=2738): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f00000002c0), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000300)={'batadv_slave_0\x00', 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), r3) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000300)={'bond_slave_0\x00', 0x0}) sendmsg$ETHTOOL_MSG_TSINFO_GET(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="000329bd7840fcdbdf251900000014007f0000000100", @ANYRES32=r5, @ANYBLOB="0800030006000000"], 0x28}, 0x1, 0x0, 0x0, 0x4004110}, 0x8000) sendmsg$ETHTOOL_MSG_WOL_GET(r0, &(0x7f0000000500)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000340)={0x144, r1, 0x200, 0x70bd26, 0x25dfdbfd, {}, [@HEADER={0x64, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_macvtap\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syz_tun\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}]}, @HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vxcan1\x00'}]}, @HEADER={0x50, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_bond\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_virt_wifi\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syzkaller0\x00'}]}, @HEADER={0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}, @HEADER={0x50, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r5}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_batadv\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}]}, 0x144}, 0x1, 0x0, 0x0, 0x4040001}, 0x4004891) r6 = syz_open_dev$usbfs(&(0x7f0000000000), 0x75, 0x50100) r7 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCETHTOOL(r7, 0x8946, &(0x7f0000000080)={'veth0_to_hsr\x00', &(0x7f0000000540)=@ethtool_rxnfc={0x29, 0xc, 0x7, {0x10, @sctp_ip6_spec={@ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x35}}, @rand_addr=' \x01\x00', 0x4e20, 0x4e23, 0x1}, {0x0, @multicast, 0x52, 0x0, [0x6, 0x3]}, @usr_ip4_spec={@broadcast, @rand_addr=0x64010102, 0x6, 0x8, 0x1, 0x2e}, {0x0, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, 0x3, 0xff90, [0x7ff, 0x7]}, 0x9, 0x2}, 0x3, [0x4, 0x81, 0x9]}}) syz_genetlink_get_family_id$devlink(&(0x7f0000000080), r7) r8 = accept4$packet(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000140)=0x14, 0x0) getsockopt$packet_int(r8, 0x107, 0x14, &(0x7f0000000180), &(0x7f00000001c0)=0x4) r9 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000018105e04da0700000000000109022400010000000009040000090300000009210000000122220009058103"], 0x0) syz_usb_control_io$hid(r9, 0x0, 0x0) syz_usb_control_io$hid(r9, &(0x7f0000000000)={0x24, 0x0, 0x0, &(0x7f0000000280)={0x0, 0x22, 0x22, {[@main=@item_012={0x2, 0x0, 0x9, "4ede"}, @global=@item_012={0x2, 0x1, 0x7, "0100"}, @local=@item_4={0x3, 0x2, 0x8, "db835a9a"}, @local=@item_4={0x3, 0x2, 0x4, "465bd5ad"}, @main=@item_4={0x3, 0x0, 0xb, "8e4a2a43"}, @main=@item_012={0x2, 0x0, 0x9, "3eb0"}, @local=@item_4={0x3, 0x2, 0x2, "b09ea549"}, @main=@item_4={0x3, 0x0, 0x8, "e89af7ff"}]}}, 0x0}, 0x0) ioctl$USBDEVFS_ALLOW_SUSPEND(r6, 0x5522) sendmsg$NL80211_CMD_GET_MESH_CONFIG(r0, &(0x7f00000006c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000680)={&(0x7f0000000640)={0x14, 0x0, 0x8, 0x70bd26, 0x25dfdbfd, {{}, {@void, @void}}, [""]}, 0x14}, 0x1, 0x0, 0x0, 0x80}, 0x8000) r10 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$SEG6(&(0x7f0000000200), r10) ioctl$USBDEVFS_ALLOW_SUSPEND(r6, 0x5522) 3m12.279815049s ago: executing program 5 (id=2806): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$ARPT_SO_SET_REPLACE(r0, 0x0, 0x60, &(0x7f0000000340)={'filter\x00', 0x7, 0x4, 0x3e8, 0x218, 0x218, 0x108, 0x218, 0x300, 0x300, 0x4, 0x0, {[{{@arp={@local, @broadcast, 0xff000000, 0xff000000, 0xf, 0xf, {@mac=@dev={'\xaa\xaa\xaa\xaa\xaa', 0x43}, {[0xff, 0xff, 0xff, 0xff]}}, {@mac=@local, {[0xff, 0xff, 0x0, 0xff]}}, 0xffff, 0x9, 0x0, 0x40, 0x3f0, 0x2, 'bond0\x00', 'pimreg0\x00', {}, {}, 0x0, 0x4}, 0xc0, 0x108}, @unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0x6af, 'syz1\x00', {0xed}}}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @empty, @remote, @broadcast, 0x8, 0x1}}}, {{@arp={@local, @initdev={0xac, 0x1e, 0x0, 0x0}, 0xffffff00, 0xffffff00, 0x5, 0xe, {@empty, {[0x0, 0x0, 0xff, 0xff, 0x0, 0xff]}}, {@empty, {[0x0, 0x0, 0xff, 0xff, 0xff]}}, 0x80, 0x9, 0x0, 0x6, 0x9, 0x5, 'veth0_to_bridge\x00', 'gretap0\x00', {0xff}, {0xff}, 0x0, 0x13}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffc}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x438) r1 = fsopen(&(0x7f00000003c0)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0x0) r3 = openat$cgroup_int(r2, &(0x7f00000001c0)='cgroup.max.depth\x00', 0x2, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r4, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000cc0)=[{&(0x7f0000000000)=ANY=[@ANYBLOB="2c0000001000010000000000000000001c0000000c00000000000000000000000c0016000600", @ANYRESDEC=r4], 0x2c}], 0x1}, 0x51) write$cgroup_int(r3, &(0x7f0000000000)=0x2, 0x12) r5 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r5, 0x6, 0x0, 0x0, 0x0) r6 = fsmount(r5, 0x0, 0x0) r7 = openat$cgroup(r6, &(0x7f0000000080)='syz1\x00', 0x200002, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) mkdirat(r8, &(0x7f0000000180)='./file0\x00', 0xc) ioctl$SIOCSIFHWADDR(r8, 0x8991, &(0x7f0000000000)={'veth0_vlan\x00', @random="010000201000"}) openat$cgroup_type(r7, &(0x7f00000001c0), 0x2, 0x0) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000040)={0x1, 0x0, [{0x880, 0x0, 0x4000000000000008}]}) r9 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, 0x0) ioctl$KVM_CREATE_VM(r9, 0xae01, 0x0) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000040)={0x4f}) read(r1, &(0x7f0000000200)=""/100, 0x64) r10 = socket$netlink(0x10, 0x3, 0x0) openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000000), 0x35c, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) r11 = getpid() process_vm_readv(r11, &(0x7f00000000c0), 0x7, &(0x7f0000000d00)=[{&(0x7f0000000780)=""/199}, {&(0x7f0000000880)=""/26, 0x22}, {&(0x7f00000008c0)=""/5}, {&(0x7f0000000900)=""/219}, {&(0x7f0000000a00)=""/205}, {&(0x7f0000000b80)=""/124}, {&(0x7f0000000c00)=""/59}, {&(0x7f0000000c40)=""/143}], 0x286, 0x0) sendmsg$netlink(r10, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f00000000c0)=ANY=[], 0x2c}], 0x1, 0x0, 0x0, 0x8000}, 0x2000c010) 3m12.23912817s ago: executing program 5 (id=2810): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x83, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f0000000240)="b805000000090200e1490000320f01d9660ff7e31bf7ecec05000000b90000c0fe0fae41d90100b9800000c00f3209083667dbd20f300f0826f30fc7b205000000660fc775022e0ffa600c980f320f3566b85700", 0x54}], 0x1, 0x17, 0x0, 0x0) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000140)=[@text16={0x10, 0x0}], 0x1, 0x6bb6c4a5b2d35090, 0x0, 0x0) ioctl$KVM_SET_CPUID2(r2, 0x4008ae90, &(0x7f00000003c0)={0x1, 0x0, [{0x1, 0x0, 0x5, 0x9, 0x80104000, 0xffffffff, 0xc}]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000100)={'ip6gre0\x00', &(0x7f0000000000)={'syztnl1\x00', 0x0, 0x29, 0xff, 0x3, 0x7ff, 0x0, @mcast2, @empty, 0x8000, 0x7800, 0x92, 0x3}}) r3 = socket(0x3, 0x800, 0x0) sendmsg$nl_xfrm(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="1c0000001e00010026bd706e6e24139e07"], 0x40}}, 0x90) 3m12.008597236s ago: executing program 5 (id=2811): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$TIPC_NL_NET_SET(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000300)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010000000040000000000f0000001c0007800c000400002e0000000000000c0003"], 0x30}}, 0x0) 3m12.008293646s ago: executing program 5 (id=2812): r0 = socket$inet6(0xa, 0x800000000000002, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x4c881, &(0x7f0000000540)={0xa, 0x4e24, 0x10, @mcast2}, 0x1c) sendmmsg$inet6(r0, &(0x7f0000000200)=[{{0x0, 0x0, &(0x7f0000000600)=[{&(0x7f0000000800)='z', 0x1}], 0x1, &(0x7f00000010c0)=ANY=[], 0xa1}}], 0x1, 0x2401c444) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) connect$inet6(r1, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x8001}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000400)=0x1, 0x4) setsockopt$inet6_tcp_TLS_TX(r1, 0x11a, 0x2, &(0x7f00000003c0)=@ccm_128={{0x303}, "63a7d38a4937c1fc", "5f90d5f023d7bd5bd799356c95abffc8", "09fe3f67", "0aa3b9dd5fe7a771"}, 0x28) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001480)='blkio.bfq.io_service_bytes\x00', 0x275a, 0x0) write$tun(r2, &(0x7f0000000340)=ANY=[], 0x141) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r2, 0x0) setsockopt$inet6_tcp_TLS_TX(r1, 0x11a, 0x1, &(0x7f0000000080)=@gcm_128={{0x303}, "b7a41f2300", "d21b0e8a0e000000000000000600", "1d1cbe23", "ecba06893bcdc493"}, 0x28) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) recvfrom(r1, &(0x7f0000002800)=""/4071, 0xfffffffffffffdab, 0x17, 0x0, 0x0) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, 0x0, 0x0) writev(r1, &(0x7f0000001400)=[{&(0x7f0000000140)="58ddb007a47a8b1f458ab677d557ca50def8e5bc61dbc50bca64f7e76268cd64007095adfef77465b69ec03139854d6f03d5f9bd019fe046035ef7049f48fcc7321c34faca94ff08f59edaf2ab55eedcc278df823564618627217a527b971bdfa0afd948a6cdb9e05ccaef35c22047246a7b97a8e1b645e51c47b296c759c8dfd56beb8fa15c800ad060ab378a269557bc053d9be903", 0x96}, {&(0x7f0000000300)="2ea63d218bc1023b2e6eceeb92d548803a43d4dddc2433c76650030c188f490311ff86da69fab1539139f6dda31739c2bb4412dd471137e2a53496c5f7707e01ccfb826f2eb96895230862e11d56c19af139de912ac5e68a99080e428443fcfba8b0460290c6275affe9953a97260b0304fd7ef159c9cd30cae1bcc75d568d353575ec3b5293fb80de85c7562804230489274831b2c17dccccc523ada66a46", 0x9f}, {&(0x7f0000000440)="63e73686513c53aec098be4b2dfc27b5be1f5f85f54c24efb8fc94ccaac29f1378e04daa49f8dcbda8b0faff57761a0ce8a311802e5dd07a159721cac7d2250f4359e04727386cc7d1a3e8bf93339f3df1340041f71046f2b1d9a80af70fb8246258d09c310af3bef017fde1fd8ce505cd4858549192a95e512257b6c676a7ebb41230e4e4fb23e9666bfdc8bc2ca77bbd11810836df4a6f3dbe3ee75c34b07c64e1af6d62d54fccb9f281eac16eca7129aa4355fd53", 0xb6}, {&(0x7f0000000500)="de21cff472aa580c2ee9f858", 0xc}, {&(0x7f00000014c0)="8fa68a274cab49b9c806172798e6a829701bb4eefee6919e0a30fa83a50170b6a3b499361f95ab6ff05f9001332b3a463b64282a924b0dcf6499c8c9b23d7290ab896ed6e2c7280dcda0336864e06d9570ea2cc78330859fa73080f5ddd3fd2b943287b312357816e9cfaa9e8941dd981f837506cabc6e016e507076819ff37d790c0b868166925649c9a74f4afc322ac971832fc3f12ba4dd3931c773134441bd46d9b10095eaabcfb846ac5fa9ea76f3547884091f073880656438f4406cf2051edb37139066dcaed45a544f5f92cccb1db0e2e503de3d4216d961dea1cbd9119a3f49b8bcdfe7078a7706296712eab5bd91b189f0140892b56c46912cc16dbe9fb469502eb67f36e8531dbfbed70615a836d32b5dabcf933201c97b29209e071433edb1b92ba47b514232654a36067c9b241737eb902ede1e18f99757339d2858bbe9c48484ec608e5fae534c4580d22fcd6ad28a786e0f5e675bc264ca03cf081038cb872e039100f94d25a7b5b9f2f18815e948aa65513c63a61e68c6a4ef4888980b54e3b7332112ee424e65172b2076528cd11cf63d7f4ff88c9eabf2c388bcb02beaa7e9c33cbe26149703fd3d511283739fa9638b1d6290a53b679227ee54d0fb232befdc92e59396c5bb818926e8a30a38a0aa358e1c818dbc27646fb4dc43168540cf724358d07124937cb3baa5365970e14240d727a8111d250202b39e8e3d6ff5e250eb09fdd83b8a129015567ae0f71a6b9166cd3718e3a83e711271f2ffd2d968e1153a38a8c5995e5c46fb8f22613690852bbea407b417eff9fd86e685025cbad82174164c3529407c4a27af5c6fdd911a4a87b7365655d5275c5719151b4440752785ff416a8e3a1f83f70e1f5d2538348b839f4e965e586e8b28a8aa94b79bc4e23d97d159af010918721be419234850fbeac52bb5de10a199f6591ab4deea9670e8b3d9f9341cddef4f3fe1b08a4f1943329cfa12c3972fc50525b8ebb5923235bbecd182d486169cf51e8c69259a404c0867328943358e95ad690a9c8eea73ddde677ebfe6f0d5f2e3a03541291e09a30bcce4b66550c28c6ba6cc431bb0fa87848652fb9319577a38a8ad45a87647b523fe3e452d90306c4c690b47d3c840ebbb1d96abb0735b21f557f5de101b7fbb7618d9739fabf89b8fb34c02493d1bfc31e80b1a9fcdac8aaf0fd69a0aee6f456705420ea3e7df30b478dd12ee137a6d6747750e5d6a7e5d308276c0ebd77377f000296108954f5371a9c84a01a18a76bee8ea849ddaf492a35f943ac395b9dddbd5ee05f6d75ac40237a0690584d7afaa3e117135b1406e03c9e49223ee48feccab18a3fd0325ed281bc70fb41b4f13905744afcbb588b8daee6d635007cf96dbd9549726c4cf9e350072702058bb533a4bb598a06e5505e8393b2793cc6ac2d66a0529b2aa7991a30f8bdd2bec5ac7ca2064e7b3a2a2d510de4675a7a6ce5d1729c2b98dbb08ab4a33cbd83484092d48b9c4fac7b7b6191057a2acf109565c6d49d9be0f1f2838650cdc36ad835fd78be83c6df052659ed1e8242d45891442a54205311da1814b18ed7fcc7c5bd979434040cd2133fd35ab946ff87e807a48a4802a1e4cce7cef4f2f555029cdecadaf99c5c3bf65db4be3940bfedb87cc491ac59d027496d87a792961f1f59cb72df3280b1845722282745fa77dfa1fce5e67e09466475c0e988719e528d39815cdfe0d16a6de1d871cfc4778ed47e8a7d3b2dfeea2083a41b061848324fe15e90c2dac3303992fdc42ba1a1995b87154a618660094a942074c5e02ed1a11293c5276b06439468f99c9d184c0152c44308c64c432277fe367a7fac9c9fb08d9dc8949e8ab9740a357fdc9d69df07375d011947b43072f554d63831af4319664e735c3eb08c0afe5120bd89b4d0654b6266aa4709ea2beb3dfd0449d2c3fde3f1098c9f73d994a741bb9f3c5322743c310fd7881856e5d529f4a9eb7dc43c0be6c36653b2cda92a7f07247450d666ca88863c6880d656eb8006bfe2f96543bf683fe3126e03ccf2120878a4fc46bdf64e11e323637ae0024a3d6fa52729591758c36a5ddeff1d1c5ba3e1bfedad1ff460f05ce276f1f3c2d70f9c6c5927a8fd15e65bc9c648b7dfccde510f5bf46bab8f2c5e21cb129dbf3f4df7a5a831f198f21fee429d73646eab00b1542941108592708fe8f53613d6b7dc1e4999374317b57c1e4a974fedd089c4295682d1a03d770b7639e80d25b0f428dfd3c46be492fc80b5c4913e476845a359dbe4187fd0027bd9fc814ba6a2877b61b637878f2af7ef18a0858fe5c7e75ecf92e735452456089efae8a13d3e6ac9d28c18cb1ca54522066edbf9e67ab4cf158b63c7b4d25146bafa14163cd4d171ad97f3ef93cfabae0557e237bbbe9cb80144b03f6fdb7d357d253235ddbde503829403657fdde516d3974091c40c6b9dd245f730458e1fd594f6b694af0150cbd31b6d0fb3bc04eb5096e704e039eecf4be9e93eb2f841878538ed1c46d015b1a792b599ed9225577460f72e6b4e271e5e6eeed34f69cfd76683e21d87e3ee8ed88df79901f9354823824fa6b67a91e2626161436327fc58879085d87db5dd94e09a0d24c7c381fb8fdc7198d2c2fece49e6496a119023852fca717d2ff2f9ed5e0715ddebd267ed0b8378ad852b03a539e6d03025b4a04f2483bdb79a4bd233ce3b6bd30d736ad0784b978861badc236e7106d23f26eac50e93d8ab012dc7c5d85d4f944aaa27378efc99572f932344cddc488ffa9210dc6b8f0cc29d07110362485eaa5b4b196a49c7080633c1befe802207ed0a172fa0b61fea6305f04d7b755a6e5e162aa8047f80647ad0bae8143226ce3aa8de3b0c0fc4e7cd6baab274fba47abf95ae88584778325250063855a4b9f0c966efa43dc0196d3dec619c490181c259b341b3fd370bab0b66af3cb1e9365cf6b62e44d939d36ffcc6badb924f44e86337360efbf4e3f9bd716adbc3f0ba6055ec9790504c9f3865f47e422b1c6ba16c07d0df618cc572b36ec8e519db90a499424a7d689e6fbcc9be1abd843512ec16540c6c7c6d6e2cf50ab2014e4208c2abb0ddfd2ef9dece79389f21d7a9985903f7f01b0394d268349fa41a487bacfe8deba2ffca815ad0b1c6ffa5af2eba6d9436ad298c4e11b68451c7ff001c02ddd3ceb153a865327845349e8b817aa8ed24924f49260f8209d0ddcacf5306d9222320776162fe8396914fa22c85bc261661fa547c3063e20ca37c0862c3b9abd3da9b02e3f58d89be00003509bae9b82f60975c0687c500bb213a580f6e9f08b207d7c31748e3fda05a0cc76b1fdd563610a2bb09a57020d85026a57a178c38839b5b88cd8434d1f0308d872c7356a6445de801ff14c133bda3b42b9ca099fb3ee0d5c7a835f56ed30aa75d47cd97c329b682879290faee167334500d2fe596564f3e4064f41cf3469aaae846f1e84f3d8a7f42d98d0b6b67913c376d6bbde3027aa41b753ace165f88379981685f918ada5043800b5e0a0865dcda94df85fefa9348d6ec4e1ffbd940d023fbbd3b77d5db572981dbe40cbae9f010c1ea02718b1c4b7d0447c9d83d1afea58097a0467d6cdd47aef05f97dab63462f6ea61f4b611040b30e7cf60a499aa9d0bc50c08463f25a47d2dbc958fe1d1cf2399dcf1952987b6fcbc97bf73b12177c374c8fd56c8228fc796c958687104f4eb9d46ab80eeeeedb7096a67ee440ae92a65cbf6f81939e3d1050c67245036b5dcc13d577fbb4d9c3fbf2e2e61aa154074ae225c54e23289c4ef41a07a49a9d40f3103f4c9dfd4d750cc646adadd2e1fe24c74ce099d753d4c59d806a0b7f576ac37ac58a51a120f93162c43d16c1f7e5289c75f5f0a5b838d020040c9ce512ca35d08f42acd24cdbc2e6b1ac3c6809a5ed9e272155e9fa55349bc3ce0e3f2d1624dc60e2396b954587bbab275f38911e86b826b85730c6670a92a221cdcbf18ee0c44aec4591fcd12204b3049a1b5da1215a4cf88ecbe2d877ef975f4f661999d17d7d9ec14e0895ce25034dac4705d50ae42ca162778d0dcfc4e9180517be0daca5deb10773f93e2c61a5fe9b823218a97c35d0d7b436b2e1afb670b5a4c6dacd401afd1832c1dd96e8eba7734954070c6796cc80707441404cfe95fabf214bf03a6e4643ca559c2b8dcf1fa871114f3dc973a056c9aee7cd0ed4cbaf18298377e750869551632c1713bd8372e3f11fa02edf0a68d2c01245459d9e78597ac1eec75064024c1f3c98260d34b611ba8fa4b2022babd44b76ea70c718df8268dba447038b1539f0499603cf2d79bcc49c35a8cf38892d982d153d72253a22ae68da65e84d6399e81a14ebf89ba446630814d9dcf8914acafc8603a5396167c5aa99814af62c1c39a6ba76ad2c6c51a6d56d89fbda5334e626540ef1b1ecad53247531fcdd661a48d28a6d48bac8ef70c888b00db57edceee94425df5161e1b1a1bec9c897e01867442ed8ba000b5f75832a8ec57ef0737994b95f40eac48f3c8da5db80e965fcdf3f0bbb4439a7123b59987f0fdac96bc7ce09c013562ff7c0cb23a882828e45a51f7e748db90c5eaacfdf3657d11a348f747ddd860387de41be3376a5dabf4296bc05282cb73fcd60c4a4148d9e872ae86e30b22db1ce5452ad9fe3fea029f94a583d301e74eac1818da3f1279c63690db6e7166ddaacd1278716fa3221daaa27c98fd97b88e63208d604505ad8f31bd2b83a19f89480b71198d8a31c89cadd258ce338afe1a26b0db248c1a39fe027716e417e45bb6c9a68cab1cd6c3445e9796ee1003650e97eccdadc9bea540e2c8253652c8f1586ba7e508cd29d53467bad11eef729796dbe83d3fc0bc15762c2f1de34c6380a6725f94600a82d87ccf80948babcadec31ca654671d17de360f20aaf04f4d44951661fe8fe7731174ec3aaf330aebeae", 0xdbc}], 0x5) setsockopt$sock_int(r1, 0x1, 0x7, &(0x7f00000000c0)=0xffff1884, 0x4) 3m11.86790671s ago: executing program 5 (id=2813): mkdir(&(0x7f0000000000)='my_sys\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='my_sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='my_sys/bus/pci/devices/0000:00:03.0/resource1\x00', 0x2, 0x0) mmap(&(0x7f0000800000)=nil, 0x1000, 0x3, 0x11, r0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cgroup.kill\x00', 0x275a, 0x0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000003c0), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000002100), 0x80, &(0x7f00000002c0)={{'fd', 0x3d, r2}, 0x2c, {'rootmode', 0x3d, 0x4000}}) read$FUSE(r2, &(0x7f00000021c0)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r2, &(0x7f0000000080)={0x50, 0x0, r3, {0x7, 0x29, 0x5, 0xffffffff9080edc4, 0x7, 0x0, 0x0, 0x4, 0x0, 0x0, 0x2, 0x4}}, 0x50) syz_fuse_handle_req(r2, &(0x7f00000042c0)="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100", 0x2000, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000006380)={0x20, 0x0, 0x8000000000, {0x0, 0x1c}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_fuse_handle_req(r2, &(0x7f00000083c0)="99529ca7d265e2dba44891e35e7d5dab7921b730436ecd4e999a25bcf86a25f8f029c0dd50373e90b7cf7779b12ecd4423c5b13cfac186975cd723976f3c747612913029d42517c189364bc59d8ebad53ed1b86f8f66c99b1f9b5b40d78cef1f14f81815d53bdca7fef40607358db69eb8c0b1f6b0942ab4b1ee7ca8deb4eddef06381a3d1c52d6147fc5109c7c607591497a6b2477f60cc881d3219c96bffb34aadec3fa97250713cce17cd536721bf9c40a019531ed0bbad139e26a3d4d39b68ab1bf37cb1a4bd197a8789cb1940cd86d9e56713bc36c7cffd07a311f5bc2e91f16d152eb480645e85ec9b3bf09c7fa140dced0afd55d7b99e90a96e7748e2d0dc09672ac199ce529e631efe1783769819c182ca106f6184bcbb387ed246c43562d74c36ac3a7ec2f0e11f70bad0007c03bb9c0d2dacc2148cce4a4aea327c7319016ad146b52bfae0357f9e892e9bec61a13c93551cfa3d4f4bfa7585c93bb0bef01a9114f3dc54179cf9a57fe88f5cff3403e33c9d09e3e9c2e10f1f16894e1b59e3cad47c1f202cf7b756f2851fc96d09459c9a8d34c19e6a3525cd5001aac5181f57286d0e1e88ce5092c7c76b6abdaebf2c499aa47587b48eb12a2b72548c190b0324ebedb81a63333b6edb25550f859c5ccc404a944ff7f61af8800888192fbd4c8e0e417d1d181b4b335a6f52e0a7dae18397e81e3f747cab7be902ed903bdd6a622f178f9b4244718ee1206237257374d2fd1466ab6135ef7ef4a114ae170eafe9cd78cf9ffc36974cbc4b8003072bed78765a0b9f1240f24dec6a9e46db9bb498d40f727c0cbf8f4a6a49539bd0805caf65d80130d7fb60a69dc7ed890874a17530c042cf33a977d331435d68ef33885f638c777ad49564ca77d8b81ddd853a21cd55d95b627310dd633a4f005853a5506cd8f744c367f3cb6998b0fa97de6bb35b166b0c6408c4e0a38ed26235a88520c38ca97ac8a6dc81e6dc6483d383fa09f198997b8eea1c68c9e3320683c9a02dd89ddc34c241e7294ccc88d6b35762892e8746e558bfbc2251949f2ecb763dad5b975eaf36e2864be6a41d3e20514d32f5d4b6350dc7e3cc3a85428ea98efb3b1edc2a2ec1e618452949cc7e2ba1251990168fee342d4f304b7a7af9162bcbe6b09c75d7420d2c547b4e3cee1836df6eddd5dff73a4e308fcd8eaa7a33e6980a6f8ead03257a37d72d3b265d02fa42f57db877654ed513e31c35e1af0bd28511d6b57cfe07b27cbe9767a534b426dfc3dd257d5899444f34cbf4dc74b9eab2e7e3e1e1a8a6ac5e4359d653506b299a5b7c67b92dc462f1216655f952362a3387ad9966b606d98e8d1b544dc27dc6bc78fd18a446736e25c51143db9886b6c09812d5825b5d9e0932f218ff8bea4d9e1c4df9c9d4eb19336d48163a921c4ff1f0beef26b01b7e8c0d23fb59b84e229eaabb791f2cffc9aa4db75162cbfe4c9ae8d76a5b6bc4bff20e3f8f125b9aadb3e728d7f78d61fd55f46b7f59511b876e6563256686e44f25cf38d393a9b762bada272eba8df28e4086c4cd2fe3c9fab97756fb145373e6ca1991bb1ee6589e49c821ff29f047970819f88f724bd077cd3f0ae463d99b3e53078431e3f9bebabc5289a65479359efe3909186aac60a29f561de8c590988c913c9e693ab8106e8287f6565eee6735f7c88cad7124d1c8d9ff347e97912824088ee954de01c6d8a06447f06899607eadbfd078bc3df506252005749378dbd7399c9eca60b81dc0d88dedec31e5cf6e7b6d6d411958df8f9e0bf4443e8d3bdfe49d05f811d17088024d0629fc8ab8e05e309bf55e8e60d342623765f4e8d2dc4a90291cd4354ff9568c8170e6ea56e028bcf2719595253adb8c84050bb9ce4927a1c1f4560da87d109ceda90bbe45a1717763d8025f1ff40f157185ddf17079da272ae10c4f34162caf4b0d31221a57b3059fd449c87554d968a54b2eebd760dc3263c40d9eedf5905d5699d29706ea6e9e81ff2bf92489a06deffe7e978661f37a88450783e23f107c2bfce000dfc91c5fca49e46d9ea978f215a45984699f0d2503b30a741e13be56b7abe3e5663c0825c3cb04ead44ce97719c4ee6f4cdd3c452775ad7163d5c9034583cc2dbc2b0c04917a3e1aa3d0a8bb6fcf94d7922eb1d543c09185827aeb1b72ae7103ef2c014af2ff4b47fca40fb0e66ddf0264476d7a84e9b8dc551d4c407bdbac6757f7a25bd404b45bec1091696203cc438860131ad5f2fd80e3c45629864dd9f7d302b66fb8fb86735c9a6dcf8b135a273dd2ae9473bc905081be9fcb8f91b1ddba1ac692798dac0b9ccffe0319a779f5e10c65f294b22fe475283b023f9cd890e92c5447b1bc1528255c5af383bc1fb6e72cb9a67215a9e25cde63c89baa8c7125c7e8b748b728d07d9cb66778404f54e6a9e3ae1ae82f3d0ce77199f23f94a01b71b805b476fedbebeb52c83a1b857f23ba438c56a6c4c2a5909f721e6e3d240e4a16455e92220d13022ce7ec0b1365ba4e67aa6ecb324f8826579e12cebdfc0d8af63e83b5e5624d5b791f99093f9a27f7baea9fd10111209c0857a04f07408111063ef34026aee27a3d51b40e53883f9094402534bdd21cc49d7f5593e99cb204cd805bee4add0f82cf4b6dc5da14d6b79fbc68c9ccf7fb5fe774f8879e13079b024a8ad24bf123c420d630837a84ba05abf0ae4dc3fc04f25c7f74ff91d0d609c958642a48551e51b5c0074a56a7da10ce153b08cabea636f8489d8e7b655758a41d7f7474c9d76bf4d54d789bfceaffef139854065de6a94b0275a9626aab99ae838364b1a491e55017e4212b6b01f7a41bc9c215ecd17c49a8610db28c699259c58b81a0e84c45fd8e719c05c48501c49e8a6515044d247f58e4cd0bf22fd6ae31f45339d1f801196d426c52269b1aaffaf18e2a03760bb231cb7cefa6d72f1d7eb6a3bbd65d0914221b8fbf531dbd562eb4a1b28983ac7d83d4813b10b34c9525ba644f61a2c4800d4fe96a7bca63da1041ed73cc57fb9d42f9dfc8ca41d80292bbb311c89b0a0fcee1d88a025a7416863342aea00e6f049cb2ddebd17c5c617ff562a8af0c965cbe8341431a30ea239e4a62aa2b19757a3b0de04229a9907f8610c27b26591405845bf8b5b83706ed18d910c4f68777378366ff565617b19168a04560a32ce5ad64aaef9f4377118c4335b24826cdcde78fb4bdb11498553f56d8dfeb3a482c70cc6580c399b92339cbdb3464fcc7b00e9839fd0d2b8b6db90c56b33593a0048bf7983421f29b1285c81a239045b96a9b0cacd70d6d9853206471f06915efc8d3ec4c50fb13601abc73247a656066fd7b329159b3ce9e3302b4c0d6aec58cb0946a8ee8e7f55f1af604f1edb4d887fa6292dc0ce57705c1a25dc62650c127d11a364b397aefc2fcc3a164bdc53165a461b01de9180c1461b309c75af0911b4cc1b8aa05652b62119c87b4b235c573aa15b1516cddf61efd6a7f8c953fbaaee9c0e800e8f519e1494de850ddb976864088fe0cf90bbc54395078ea2501e8baa84d6807e184105bc2a140b663416496886422643bbf764d406af06e7d086678828defda0b648b25666b7b5ea29e927141740d5be0e61bf25d40b8404ffd3c67bb855b11d4faf82b7b8051615c101c3deb0601a0fa9ecd8b4a95082ccbc8222b0982802dd8430e653d6eea2786dc3a91397135faffdc65a5bae048f5c463b1a6648becce961d39d063d28d1ad6dafcea0b0878379adb16cc0d4cea572abeacd9a168a4fe2e338092b5bc93ecf02ac6ccda03e5b23adf511fdf7a79442093233b79c67d3fdd3c36c96a8f67aa79e4743d99cf963ae6161877f73656eb0314d889f4b8649bbce8a759f90eac6c006197b54b2bbac7c9b237f1e3dc099c62a65481960e6ad697fc66316ac084ba99c60f58bf44ff45f3b2006cbc4196a25f124dfaf247e863a855ef6070deb45219a922dcf2be9bd01c340e1ca5ed7c3ddac9f7a677c5d00610991d21e0751ac8044585b39f3fec5b672a11a9bce32196c2003d01ea50b0f0403e16df188ecbbb74f295f01398363ddfecdb63a49347c912c125670205d7b6be999688df85bb7d5ac12b62b4fdc4eadcc2a9a7897028404f697b007603a0ad588c772952d6670ee870771774ad157c0b9cccd4b2192d835606198ea0c65036ae4e406cdc539ff3aa81fa20b7ab58d6f3abdb69cc1f503d593f7025d2035e7f21db76336efc2843a0dc9bd2eb8794718134ee68fc57d4d2bcc18969d08177f442b87433b48540c661940cf9e2462c53efa310c7e47487deab2ae15b1978ef05aa1e14110943f649d82486f710a39854409e74edcaf06b4a92d3580b9cdabf83c6351657698d3d5af7514f382e75d1c912cded577258603fc9ed002e010747cddf7885d34afc9a84d82696c6660cb5ecafb68b564908fc49c4db6a187d037241a26b1141cf20f2e968a53366db0f60b79cd98cf3c897c50b7b9728e6e7100f99e4d5ed2428dbd285516ca6660777a39b4b2617c1be5b0232d60b9c8099f5daedbf190109439c40b46090985200d6c0501313f3fa4d244864575c275faca47aeff32c7b3e3c59392618562a7c2d4b3af85a37a8847f595352024cb63d3a9085c2a502c6a3248f43c5fc828e636cb634b2d393d853ae2dc9605985cf85c060860a90256c7b574c1e01c320687a2bb0b2d51cc2950c485f2ffa5db0ad7aaf753f543de7f86efb775c6bac2989a33757a28836fd27f9347229a0004bd2e546994c69c678fe5717f613f905d945c072004c3a80e0e54215e19ff9972521890d4e705e429f16fc35fe5a15f2e6b75cd719d38f76b087b62e4b5dcdb35f4baa2bab167150bafb6c69e260ca51004bc826d46b77c3f67eaa08497294868e6d91b7b867e4da62052f4f891677256cfbaf19cf32bad99a7da69d8a66537686f89a58d78c7eeaa99cd38009a1a32582bedc5c718e57b19cd405ae659a89909356a07fcef89384d160fa5ae6683cc379642aea4f0c915f72d679bd521399cb16112f2abdede3001400b4a64d2173e153a68631183679b56b8f389ba889784133453a7e892fd3b092f5040870a3cfd6f982990143e7c0882b4ff4c5d049192d36925a25ae4be441aa30dc7e74398b340c45b52c73ed3b0cd640e3cc9fd4be24e7355f386106f65895f1ee850b2a781d1d1d322ca5a3b0fdb78ce1eda048ece94af25437969c99c58c08f1446ca5541e03987a20fd75283e3e116dc4c9222ab7522e4ccf6da14aef49cac9a6a2cd4aba1c54d49e6da4179a66b84e384cd3da53908579b28c11d525ebdc4dc69074cef8a9ecd3aab98f2858769d656b46141c3a4e69a5ed6c0a732c9ec1fce080eaebf537fa5e17236a44ba9c931f555d193e475ffafd20c53ccbab607c1a15fd06742a64691205eb0d00f7f40e4dd8efb279cf09b2522aac0729a631aacb92d5cfa2ce6bb07385b981890b5916755d5cc3a51c8c36bd2987068cc24fcf73840895ca9bbb9aff1059601f771afedf0a48d5921103920515b27d7e607951982feba197df8c61600feb3622b9eea13a4db4068728cb98cca76cfae197f6258758490bf41673ee29acd91fd296ec863c646e0ca6a0f0e9de146c663ba13d962964d7c32804fd12a14c1ca7212ad48bdfab469c6570dca562220ecbe7b6b163ed4c9361c5c10bed5c92861b8786ada20a99245d282e4454187ec02adfe354e30647cb10661c85168f7958e3ce69ab48c9455214707a63c9b1167f0845a6bfcce2a96cd53eab430f13cd527f1666290719a47c517cfa22fec2e9916af8aa93c78e567993d7fb8ee60fc4b903b8c67a3658302c5e5f35250c30427e4c055b6c54705bc599861f80b7200d361965ff98c88cc698a2615cadeac4bdfd3d613377cea52d2bbcb7e6b78ac31d4b2c33eaf0b2ed40b963e3cb25c7dfea3ebfe7b4aff2aaaaf184dc80ab649a108e2c830ce7eaea58a263392aa9cd13d7f7bd607dc7c804b19dfa41b3e5a5155201a87311e22062c93896e70f3a5c4b03521300b61cc311ebd5beb9838d0ed207c6bfc99e4392508e95804b10b36024f32e1fe1138e9ee7773f797b2bc6be7416f4e9691ef4c2a8d06af6c8b84bd1e6fd1ba3d3183475ef6c139ccf8dcf37671fbb96a2ab5e0e042f7c4728cf30bcc1a0de28a5024276ceaa194b4926e7f6a97b78bac36e47f832d56a96cd266434d37bcf2c2f57877717d91b1854972f832354acc207a2ee8caace7504e0e6197dd7e64a01c4c67bb2de8acc0cccc6c6bff0b0cbfe345542c5a795dfa48cc0990ab5702574d36494bc44c20f5b324f7c984d986cc8cb40cb2550076d96a069b6688d22171beed2dc5b6ff3ede8fff4c4a9de6d3817357a7ca7d24d87300b4545ebbac8cf7f09ec637a4f4d6bd07673709b6c363a75ccef585610c5f15de7851b5ab53e02a757bfc3caeb9a9a8996beffdc0cfd1201b6cd99cb035584e51a6c15a5d2e17d2f8aa6b41e26809392fac6caed1e02a53dcea8a413203608780dab33315a76eba24d540e4c5b9790420834bc8d4e47bc65ae52a54c0ff308427a8d7aff746aa6589d17514e40fee5d0b3533cf4ad2c5f9d96db9f50bd69ed8c92b860e199a35cf268c66ed13516a3b4b024f62d4b2a656067eece95575bdb4907efc488a9821bc3a9c81dd11b2128b7a01aa7a9ce6e73de3b4e9beced70206f91575baddbcbe5722337953c8016a0f4b62120d776c43b7d1a879b692107954f45acdf8967dcaa994aad4922d4fe093e16c2d0090906f5036af99e50bb09b04e9c9b3b5085abf621297ce203010249cede92e9b66b446b86b43eaaae228dfdd3b4408c12b404bb727f7e969e7da04fc59900112bf8d38af0416dc616e75f167aa1352215f07115a6f4eb6bb5fff6f5c2fc9ab906392036b44090e65fdaf017dc53bc94e0807d679d793df18cc44e6c846d414cef1569530f7692daf91eaaf4ae89fe2522f2c9cf33b6ca508ebcd006bc1a61f0c800553aff9dc7d57200b25ecb83e1e0b8cd29520b63aa649d3f71a62570eee56e03223ddf31f0c04fa686b7f6dd054e7a259d9ba335c2c5b2c508897506c0db7f01878dec1411c33f0af61b81dbcf9ff8bdc0c50044963a79f3ee1462150c6bd03a32dbdfef8d72f0b8b3a395ffb0cc85792e7bc867feb5e312cb64e29e193388e9f173c162f4a1320a6f99ea3795fb77d982605959909a1aa11076fcc779ea6b80ec1bf0edfc2569ec04d15a0bdeebccf3c75393dca5e81663532f8ced12d08e4c2ae6e2954d427c7bf053dc4718f56f453bc88d74045bd2f9747aae9b5298a0de927f1d6b1308f4e1483487f083e71ed09298deb52bb10079b13def7453eb432498069edb5ade70c5c54913684d934a3febf78753ac13300a91f467ff3f6e2f00898f015d08f7739047b321b3eaee5ad8aa7adbf7833f014d8c576a491af9fca6843b327ed513821cb3951b2e67a275225d7af6b382e2f955adaacba5d1fdea2223202dee132b91d5cf381b51da94145255f584a70c5e8d11e06a44afa6599bf3ed0cb61703eba254333af53afac60e54cf6397f9f7302249ab644f0b576c713b15007be1f4f9bb213660bca8a70251472b86669d361ef968f542e81ddbe8f4d2e9cabe8d7bf6a31f14a2cc272963553a424c105e7750437ec5bf316e30ce60b4b0c27ccc1eb27e60f6472fef27654da49905ff9c01b28695310ecd8701aedff25a83da4b7c41995f902bdf249769dcb53a3efa894710dd66ba8745ae2253cc6b75a038183a0bee21226d48239320efad6727093e4f94bbc2fdcc216200d903c32bb9f16dd17d5dac423ae0696f3decc576b8f1fdce63d0532370af7d1e2fa2ca5c5d17bd88f5e3abb4792dac8689ca13752f83d753b06b037bf5a80a3748983790352775685b0414c9d74849fd217e388f904278ddb6b0abdda941b61579c796e2bb77a9bc363b18642c401faa502a31011544111b6eedaa369976c814773d83220a75f31026d6ad0b8b4298ea6062234db232bc435e096e84f740e55bb14d46ae04af0500aa5bb218aff6c76aa8a8e3140a1b0d6638538fd7f30fa8d992e53abf8af2fbc16b9e8a668c1aac72cea1a746ee5f7f3392a4ec8f1d19f2f426b6069b1cd347cbc38bceba96ce5da49198083403143c740c04639cd1089abb34fe812d85921c47437604f684bca44a1eaa965c0a6e1c1fd1f70ee932af3455b36184cc15934cdb3f28959d37d8fc10696f8ec1e4b0c3d1b9ff74a01b796d1bb68954a3768c8bcec741b3b69da892f8922142b16b2cabb469a9906b34216243fac80374c10e178c5fd36440f8d7a8588a9c2510d86ffa8cb68ce8c330d2111c94724e522f04573dad43bce252eb505d29ca9379a6b281519d38b7174f3ae8f185544f3003c936a7e6b23ca97a313aac6a061caa45fda73522f3061767bb4e33dbe4bde390eb0f07225a8aef939cb6ab2ada10c02527281abad394cd4ea9f59467a08b72047cdb75d7b2b98e5b4542554a60f953ac7a4b980f42518eec05ff2c044549cab0cf33eef36dfbabcbc0300009d898862d2194cfcdd9a713c30bbe52291105193656ea5eb830873ac956469d31689cc3c69edb5cb9a6e31ce3e6fb50ddd4e52ef9fdeacfc0db21e1e83e0d8d0a64f17cacb4dc208a893e7fd8ffa86cfc554dfba3d9fd281115eccb4b9d909f2fbf3fbb66bedd7b5db3f6d4f076f5d8fb54f8832896f8ef6f624162f1dd589be7a8e87dd5065708a8b0bfb18a5c2299f5605ac8a11c1add55b2018e6099380a70bee3e0727ca6ec58928fe6eb3147b47401e8d822eebade713b58335787669e5e0de5d328a1067df4cd9124665bb02ee8adfd1b3618374ef167df1f0fe79456f78aee3da4c1bf397e4637b0cf41a0f4a2910efd02b17bf5f3c15b0084b36fa7d4e85a53e5be366b428244eeba7499c3e54397227928e2ff6e583f332d6f7e8cf4d058f379b58a7d03a4bfa454bb4b6d543804b8970e6a9fe8886179eb418a8ce9e509e8433571f7d32378f2e983fa418c8c91760ec9fb20968e7fc23b7c4ac71693b2576ac0f8ce2020ff1e7a7ff24301b48b544fb29a1ca4f2502daded865e488a16dd33ec67b2eee3025cdc5ef90f253c4b5e0a61d51e495b675c5a1d55b4ba3812c5f44cd08487e61d36b0c2dc32d27333a5ee8a0906bfbcd388bd9389d1509912c0471c7b706a5aff880569a3fb11ac5f14d780deb4c1b1afe30fb6b8daf87b27a4ceb869d587a97f2f5af8d819aa47bbf207db68a6ecbbefb1e109ed0bfbbf3b54fba9e79de8fad9c3bcd3e74b8b92ccea3ff5c558c6cd72d78a711fc39df603bd4aa1439dd302258edd2204e52d7f435c6f552b612fbc321bea971195cd4d8bb033e2a779e239164d7eea6d8fd233b0b9b776246564cfcf44b31a83031a2413bf98a398c9f93da243cef9ce73d81bade8ad551fb0ffa75bc874c11d23ac9d7752f22a0f54c3870f3314a83e64332db810da1ebb288e10c4eb9be9ec037317b8f813e68160a887da3f5c0389510a0734b69ef275e19973b169d340610cf2112e9964cc0566b9b690c3feb36c8526491d3a563f0bead2abbcf0665e048aa3f929351b2f89876580633a403250ae3b5244c8c0e996bf888938dfc8920348d88e272e6eadc7c0387ca1dae228bd620ce3975d43b58758d9412d304a227245587065f58c4573ba2557f1d8333ba007709b1239d682f03405b22135757178fb701bbde81d2f8faaa7666c025d8a8bb426dc4b8e61aed79b3b3d3a9b01ee9142772d869677ede166e7a8be8ab84cdd6946b1478ce77ba307213971cfb24c86c344310f279e38d22254bf4caf83c02e715cb0550e615dc9f8dd2400fa749e3527493c15fb454c158e4c0603ae6e962b7890058ec7c10f0618ee274a15bca6ca9fe5bc5f9e7797c0950299912be9c58463c07d667d4bffe8aa590ae43db08512b40f3d265026bef2facdd508984e5f6d2ac7ef573397f14ed2e2ccdcbe5796e60ae64d173814906d1da5a5bfe8a2a4c5d6bb0b3315b878b4877d0c045f6e6cfa0dfc1ea4de7abe26f2b2d8c93299ed1d83f1b7853c756bfa346cd53b008fec169883983fe0f2405777dd85e17b2e4e8b23432c0dc4c386d67b6597184d0b4b95877362304638484cc0951400f66ee8391dd44417c58b3d46a8345a8049fcd70f7b5f4a6f912e2b18760947c74ef2b732b342878d7e7cc99902de87db36469555fbbfe76189f108d6ab31f4727fe4e22d075afaf6cc726ab17a5e1b4ab6c8f29a459da3c4266b5ad8ff55906a190f8b19a3bb92a50df49647c03d5d6106ec07e9300038d059a75b54ac31683ef8e5eee946e1c84d016ee1e7800a92c0a3823b62e0417fe86b191951f65abc0c38c1e0e8f1121a04b62a8a720790560f922804b1b7e7eaa497e1bede6e3d0dcf0312dbf221561958fa1e85a8f99e6fc82f919e78c17d1beda16cfef25fb5d00f7c32df9a51eac76000c988ffdf011564aa0e319764b16a5a7c728a470ff70772fb76c9ada26a0ac073fcbfa12501c2454b19e02d928e3939a40bfff76c002533b3849cdf8016728445131e5f1e292b7d3dc06bb3a3cfff6fabae0b7341694a8938c1d2497cd70b76c337c9a312e96c8f736d7625a535e1906eba53d199221ca60202a65be0f7e530aca10e61fa39c7601d65954e5ed4cab94345c6b89c7f8a0de5c61a7945e1564731b6715331d13263b2961a163382f7c4934d847033860e402f3aadb4f3e6cf47a97a2031401da4d2c8de8c80cdad71b97b4deb2075a02282f958ac6772354e67f097ca693778224b80892490015e7d697fb9107f75cea708178ffec93fb1d44e8493bad1d42c918e661219ea819e0200759037a5a585c0fe074fd407536fe58013f42612c41bfc66e16870d7a9c00ee93a3122b253fecbf5de3837641f4a1376af0f053463413c26c29f9a346318565276856b963da30ba6ab8c4c8ef6cfddc432328586d9d9829895835759bcde0851ae0c838a3927ea63fe5ba793fae94da61cab00fc05f3a265a2da1221bb2b66775ed7ba856b41011652d4984991e56249360ddfc997245ac1547a1c16382d42df383a8d1c852643b24895c422712e79c436fdfffece4ed1c50922d4f25296aaf6b204522086d188bee254f8303b60537ead1195ac5dd301286f0042dd68aa05a70e4beb779aa0b61a316f736b72c9ab7ed860a0908a078f4b8a53f2df0abf993f689de4b02b9138ca5047fb0bfc9ba3b92bff033e36fc9553260b008cef3d147c62d1d3944fd1eaff79bc5a922ec2190907bfda1b51c2c7fb867db1f8e13a37b5e3ae0165e93350b958a239ec1f2b78561cff854b975307b5b5dd23b040602a5a36bd79947ee04c7d0e5e30f9c4c79f7b4e6eada98bfc6c357cdf8939213423f1b21ba26cfc2b2756ea3eb992372db0ab8a7c37d8ae96bf3ed6be873c1891550ef741812032e1ae938326c399ee43a3061602dda006f1b6b620bebb6a5752bee77e8acf9921ebf4d4c8af7eb5e937c65697c0664c594e31a62377a25605051996c474ca322ce8e0e6ef8a7988be", 0x2000, &(0x7f0000000b40)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000980)={0xd8, 0x0, 0xfffffffffffffff9, [{{0x0, 0x2, 0x2, 0x100, 0x3, 0x5, {0x6, 0x9, 0x4, 0x80000000000000fc, 0x3, 0x0, 0x7fffffff, 0x58, 0x4, 0x9000, 0x9, r4, r5, 0x1, 0x4}}, {0x20000000000000, 0x537, 0x2b, 0xf3, ':-(\\\xc9\x80\x00\x00\t\xc3\x00\x00\xf39|\xd8mM\x92\x8d\x14\xd3\xa4a\xb6\x02E\x89\x85V\xc2\x06\x00\x00\x00\x00\x00+\x13;\b\x01\x00'}}]}, 0x0, 0x0, 0x0}) mount$fuseblk(&(0x7f0000000040), &(0x7f0000000080)='my_sys/bus/pci/devices/0000:00:03.0/resource1\x00', &(0x7f00000000c0), 0x1000010, &(0x7f0000000340)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0xc000}, 0x2c, {'user_id', 0x3d, r4}, 0x2c, {'group_id', 0x3d, 0xffffffffffffffff}, 0x2c, {[{@max_read={'max_read', 0x3d, 0x2}}, {@allow_other}, {@default_permissions}, {@allow_other}, {@allow_other}, {@max_read={'max_read', 0x3d, 0x10001}}, {@default_permissions}, {@default_permissions}], [{@dont_hash}, {@dont_measure}, {@fsname={'fsname', 0x3d, 'cgroup.kill\x00'}}]}}) ioctl$TIOCGPGRP(r0, 0x540f, &(0x7f0000000180)) fcntl$lock(r1, 0x7, &(0x7f0000000000)={0x0, 0x2, 0x1b9, 0x7fffffff}) fcntl$lock(r1, 0x5, &(0x7f0000000140)={0x0, 0x1, 0x4, 0x7}) syz_clone(0xca700, 0x0, 0x0, 0x0, 0x0, 0x0) r6 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) getsockopt$bt_l2cap_L2CAP_CONNINFO(r6, 0x6, 0x2, 0x0, &(0x7f0000000280)) 3m11.811677071s ago: executing program 5 (id=2814): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0) (async) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) (async, rerun: 32) mremap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x4000, 0x3, &(0x7f0000005000/0x4000)=nil) (rerun: 32) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r1, 0x107, 0xa, &(0x7f0000000440)=0x2, 0x4) setsockopt$packet_rx_ring(r1, 0x107, 0x5, &(0x7f0000003180)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x7ff, 0xf84, 0x3}, 0x1c) (async) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000800), 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) (async) mount$overlay(0x0, &(0x7f00000003c0)='./file0\x00', &(0x7f0000000240), 0x0, &(0x7f0000000280)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) umount2(&(0x7f00000002c0)='./file0\x00', 0xb) 3m0.922943257s ago: executing program 36 (id=2738): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f00000002c0), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000300)={'batadv_slave_0\x00', 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), r3) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000300)={'bond_slave_0\x00', 0x0}) sendmsg$ETHTOOL_MSG_TSINFO_GET(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="000329bd7840fcdbdf251900000014007f0000000100", @ANYRES32=r5, @ANYBLOB="0800030006000000"], 0x28}, 0x1, 0x0, 0x0, 0x4004110}, 0x8000) sendmsg$ETHTOOL_MSG_WOL_GET(r0, &(0x7f0000000500)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000340)={0x144, r1, 0x200, 0x70bd26, 0x25dfdbfd, {}, [@HEADER={0x64, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_macvtap\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syz_tun\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}]}, @HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vxcan1\x00'}]}, @HEADER={0x50, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_bond\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_virt_wifi\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syzkaller0\x00'}]}, @HEADER={0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}, @HEADER={0x50, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r5}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_batadv\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}]}, 0x144}, 0x1, 0x0, 0x0, 0x4040001}, 0x4004891) r6 = syz_open_dev$usbfs(&(0x7f0000000000), 0x75, 0x50100) r7 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCETHTOOL(r7, 0x8946, &(0x7f0000000080)={'veth0_to_hsr\x00', &(0x7f0000000540)=@ethtool_rxnfc={0x29, 0xc, 0x7, {0x10, @sctp_ip6_spec={@ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x35}}, @rand_addr=' \x01\x00', 0x4e20, 0x4e23, 0x1}, {0x0, @multicast, 0x52, 0x0, [0x6, 0x3]}, @usr_ip4_spec={@broadcast, @rand_addr=0x64010102, 0x6, 0x8, 0x1, 0x2e}, {0x0, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, 0x3, 0xff90, [0x7ff, 0x7]}, 0x9, 0x2}, 0x3, [0x4, 0x81, 0x9]}}) syz_genetlink_get_family_id$devlink(&(0x7f0000000080), r7) r8 = accept4$packet(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000140)=0x14, 0x0) getsockopt$packet_int(r8, 0x107, 0x14, &(0x7f0000000180), &(0x7f00000001c0)=0x4) r9 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000018105e04da0700000000000109022400010000000009040000090300000009210000000122220009058103"], 0x0) syz_usb_control_io$hid(r9, 0x0, 0x0) syz_usb_control_io$hid(r9, &(0x7f0000000000)={0x24, 0x0, 0x0, &(0x7f0000000280)={0x0, 0x22, 0x22, {[@main=@item_012={0x2, 0x0, 0x9, "4ede"}, @global=@item_012={0x2, 0x1, 0x7, "0100"}, @local=@item_4={0x3, 0x2, 0x8, "db835a9a"}, @local=@item_4={0x3, 0x2, 0x4, "465bd5ad"}, @main=@item_4={0x3, 0x0, 0xb, "8e4a2a43"}, @main=@item_012={0x2, 0x0, 0x9, "3eb0"}, @local=@item_4={0x3, 0x2, 0x2, "b09ea549"}, @main=@item_4={0x3, 0x0, 0x8, "e89af7ff"}]}}, 0x0}, 0x0) ioctl$USBDEVFS_ALLOW_SUSPEND(r6, 0x5522) sendmsg$NL80211_CMD_GET_MESH_CONFIG(r0, &(0x7f00000006c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000680)={&(0x7f0000000640)={0x14, 0x0, 0x8, 0x70bd26, 0x25dfdbfd, {{}, {@void, @void}}, [""]}, 0x14}, 0x1, 0x0, 0x0, 0x80}, 0x8000) r10 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$SEG6(&(0x7f0000000200), r10) ioctl$USBDEVFS_ALLOW_SUSPEND(r6, 0x5522) 2m56.726738847s ago: executing program 37 (id=2814): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0) (async) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) (async, rerun: 32) mremap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x4000, 0x3, &(0x7f0000005000/0x4000)=nil) (rerun: 32) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r1, 0x107, 0xa, &(0x7f0000000440)=0x2, 0x4) setsockopt$packet_rx_ring(r1, 0x107, 0x5, &(0x7f0000003180)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x7ff, 0xf84, 0x3}, 0x1c) (async) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000800), 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) (async) mount$overlay(0x0, &(0x7f00000003c0)='./file0\x00', &(0x7f0000000240), 0x0, &(0x7f0000000280)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) umount2(&(0x7f00000002c0)='./file0\x00', 0xb) 1m26.464480259s ago: executing program 7 (id=4486): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup(r0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) write$tun(r2, &(0x7f0000000180)=ANY=[@ANYBLOB="083c86dd0001110004600000a60c6eec00be00443cfffe80000000fffffffffffffff50000aaff020000000000000000000000000001", @ANYRESDEC=r1], 0xfdef) 1m26.43173288s ago: executing program 7 (id=4488): socket$inet_tcp(0x2, 0x1, 0x0) mknodat$loop(0xffffffffffffff9c, &(0x7f0000000180)='./file2\x00', 0x6000, 0x0) r0 = open(&(0x7f00000003c0)='./file2\x00', 0x81, 0x10dd722b6e14c3dd) ioctl$BTRFS_IOC_DEFRAG(r0, 0x4c00, 0x3) r1 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000000), 0x109640, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2000003, 0x12, r1, 0x969b5000) accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000080)) futex(0x0, 0xa, 0x0, 0x0, &(0x7f0000048000)=0x2, 0x800000) fadvise64(r1, 0x5, 0x4, 0x2) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) 1m26.344981911s ago: executing program 7 (id=4489): getsockopt$ARPT_SO_GET_INFO(0xffffffffffffffff, 0x0, 0x60, &(0x7f00000000c0)={'filter\x00', 0x0, [0xfffffff7, 0x5, 0x8]}, 0x0) r0 = socket$netlink(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0100000000000000000005000000180001801400020073797a5f74756e00000000000000000005000600010000000800090001000000050002"], 0x44}, 0x1, 0x0, 0x0, 0x2000000}, 0x0) 1m26.292278063s ago: executing program 7 (id=4491): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x780, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x25) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000440)=[@text64={0x40, &(0x7f0000002080)="460f019800a00000440f3802745a0348b800680000000000000f23c80f21f835080080000f23f8400f1f00f080055900000075470f35c421f97e4704440f20c0350c000000440f22c00f2097c4a2791e52b4", 0x52}], 0x1, 0x4c, 0x0, 0x0) ioctl$KVM_SET_VAPIC_ADDR(r2, 0x4008ae93, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x2a) mount$bind(&(0x7f0000000280)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) chroot(&(0x7f0000000580)='./file0/../file0\x00') mount$bind(&(0x7f0000000040)='.\x00', &(0x7f00000008c0)='./file0\x00', 0x0, 0x2a05004, 0x0) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000080)='./file0/../file0\x00') ioctl$KVM_RUN(r2, 0xae80, 0x0) 1m26.179304306s ago: executing program 7 (id=4496): syz_usb_connect$uac1(0x0, 0xb1, &(0x7f00000005c0)=ANY=[@ANYBLOB="12010000000000106b1d0101890f0000030109029f0003010000000904000000010100000a24", @ANYRES64], 0x0) syz_usb_connect$printer(0x0, 0x0, 0x0, &(0x7f0000000280)={0xa, &(0x7f0000000040)={0xa, 0x6, 0x201, 0x1, 0x7, 0x6, 0x8, 0x4}, 0x0, 0x0}) mprotect(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0) mlock(&(0x7f0000ffa000/0x2000)=nil, 0x2000) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup(r0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) write$tun(r2, &(0x7f0000000180)=ANY=[@ANYBLOB="083c86dd0001110004600000a60c6eec00be00442ffffe8000000000000000000005000000aaff020000000000000000000000000001", @ANYRESDEC=r1], 0xfdef) 1m26.102055127s ago: executing program 7 (id=4497): r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000000)={0x810003, 0x0, 0x8, 0xff7ffff4}, 0x10) write(r0, &(0x7f00000000c0)="240000001e005f0214fffffffffffff8070000000b0000000000000008000b000d000000", 0x24) 1m26.060107058s ago: executing program 38 (id=4497): r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000000)={0x810003, 0x0, 0x8, 0xff7ffff4}, 0x10) write(r0, &(0x7f00000000c0)="240000001e005f0214fffffffffffff8070000000b0000000000000008000b000d000000", 0x24) 53.230512671s ago: executing program 2 (id=4925): r0 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000100)={'wlan1\x00'}) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000440)={0x7}, 0x10) r1 = socket$nl_audit(0x10, 0x3, 0x9) setsockopt$netlink_NETLINK_PKTINFO(r1, 0x10e, 0x3, 0x0, 0x0) r2 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r2, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbfb, 0x2ffffffff}, 0xc) open(0x0, 0x143142, 0x0) r3 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r3, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbfb, 0x2ffffffff}, 0xc) sendmsg$nl_generic(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="940000001200110e0000000000000000cb00000097"], 0x94}, 0x1, 0x0, 0x0, 0x800}, 0x4000) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r5, 0x10e, 0x1, &(0x7f0000000040)=0x7, 0x4) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x2, 0x6, 0xfffa}, 0x3a, [0x8000, 0x3, 0xf, 0x8, 0x80, 0x2, 0x3, 0x7f, 0x20000006, 0x20000000, 0x6, 0x5f, 0x9, 0x5, 0xffff2d37, 0xffffff01, 0x6, 0x3, 0x0, 0x5, 0x4, 0x0, 0xa, 0x3c1b, 0x1, 0x24, 0x800000d, 0x1, 0x0, 0xffffffff, 0xe661, 0x4, 0x7, 0x3, 0x8, 0x4c74, 0x80000000, 0x242, 0x3, 0xc, 0x0, 0x8071, 0x7, 0x6, 0xffffffff, 0x7, 0x5, 0x3e, 0x8f, 0x6, 0x6, 0x0, 0x5, 0x4, 0x8, 0x3ff, 0x80, 0xfffffff9, 0x5, 0x6, 0x8, 0x4, 0x1, 0x40], [0x10000007, 0x9, 0x8000012d, 0x8004, 0x5, 0xfffffff3, 0x129432e2, 0xc8, 0xf9, 0xe, 0x2ff, 0x1, 0x9, 0xfffffffc, 0x4, 0x10001, 0x0, 0x3, 0x2f, 0xe, 0x6, 0x78, 0xea4, 0x0, 0x3, 0x7, 0x7fff, 0x6, 0x400, 0x401, 0x6, 0xbb0c, 0xff, 0x5, 0x1000005, 0x5f31, 0x1000d, 0x4e0, 0x2, 0x4, 0xb, 0x4, 0x9, 0x4, 0xf, 0xffff8001, 0x47, 0x31f3, 0x1, 0xfe000000, 0xfffe, 0x202, 0x4, 0x9, 0x3, 0x3, 0x9, 0x1, 0x3, 0x3, 0xbc45, 0x3, 0x42, 0x3], [0x5, 0x408, 0x4, 0x5, 0xfffffffe, 0x100, 0x8d2, 0x9, 0x5, 0x7fff, 0x2, 0x5, 0x8, 0x4, 0x5, 0x5, 0x4, 0x1ef, 0x2, 0x8, 0x86, 0x3, 0x303c, 0x3e7, 0xb, 0xc, 0x2, 0x2, 0x3, 0x20000008, 0x4004, 0xffffff11, 0x6, 0x38, 0x800003, 0x200, 0x83, 0x3, 0x4, 0x2950bfaf, 0x1000, 0xa2, 0x3, 0xa9, 0x5, 0x6, 0xac8, 0xbf, 0x4002, 0x3, 0x7ff, 0x12b, 0x4, 0x40000001, 0xa, 0x0, 0x5, 0x1c, 0x120000, 0x3, 0x1, 0x80a2ed, 0x4, 0x25], [0x9, 0xbb33, 0x7, 0xb, 0x5, 0x938, 0x6, 0x6, 0x0, 0xb9, 0x9, 0x1ff, 0x2, 0x57, 0x5, 0x3, 0x101, 0x10000, 0x9, 0x7fff, 0xffff, 0xa620, 0x1, 0x78b, 0x1, 0x2, 0x14c, 0x60a7, 0x6, 0x16, 0xffffffff, 0x80000002, 0x5, 0x1, 0xc8, 0x1, 0xfffff000, 0x5, 0x3, 0x0, 0x500, 0x9602, 0x7, 0xaf, 0x8, 0x6, 0x1, 0x5, 0x5, 0x8, 0x30b1d693, 0xa1f, 0xf44, 0x7, 0x1, 0x6c1b, 0x0, 0x4, 0x5, 0xb1e, 0xd7, 0x200, 0xffff343e, 0xfff]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) sendmsg$netlink(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000580)=ANY=[@ANYBLOB="3400000013000100000100dffddbdf25070000f61600000008000000", @ANYRES32, @ANYBLOB="14001a8008"], 0x34}], 0x1, 0x0, 0x0, 0x4000}, 0x0) 53.230441331s ago: executing program 2 (id=4926): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$TIPC_NL_NET_SET(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000300)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010000000000000000000f00002e1c0007800c000400002e0000000000000c0003"], 0x30}}, 0x0) 53.230105161s ago: executing program 2 (id=4927): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="fc010000190001000000000000000000fc020000002b00000000000000000000000000000000000000000000000000004e21000300000000020000202f000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="01000000000000000000000000000000fdffffffffffffff00000000000000000000000000000000000000000000000000000000000000001d00000000000000000000000000000000000000000000000000000000000000dd020000000000000500000000000000000000000000000044010500fc0200000000000000000000000000010000000032"], 0x1fc}}, 0x0) 53.180594321s ago: executing program 2 (id=4928): r0 = gettid() timer_create(0x2, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)=0x0) timer_settime(r1, 0x0, &(0x7f00000002c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) clock_nanosleep(0x2, 0x0, &(0x7f0000000040)={0x0, 0x989680}, 0x0) r2 = open(&(0x7f0000000000)='./file0\x00', 0x80140, 0x38) fcntl$setsig(r2, 0xa, 0x21) fcntl$setlease(r2, 0x400, 0x1) open$dir(&(0x7f0000000080)='./file0\x00', 0x40000, 0x0) close_range(r2, 0xffffffffffffffff, 0x0) syz_clone(0x640c7000, 0x0, 0x0, 0x0, 0x0, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x2000, 0x0) gettid() (async) timer_create(0x2, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) (async) timer_settime(r1, 0x0, &(0x7f00000002c0)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) (async) clock_nanosleep(0x2, 0x0, &(0x7f0000000040)={0x0, 0x989680}, 0x0) (async) open(&(0x7f0000000000)='./file0\x00', 0x80140, 0x38) (async) fcntl$setsig(r2, 0xa, 0x21) (async) fcntl$setlease(r2, 0x400, 0x1) (async) open$dir(&(0x7f0000000080)='./file0\x00', 0x40000, 0x0) (async) close_range(r2, 0xffffffffffffffff, 0x0) (async) syz_clone(0x640c7000, 0x0, 0x0, 0x0, 0x0, 0x0) (async) open(&(0x7f00000000c0)='./file0\x00', 0x2000, 0x0) (async) 53.048543805s ago: executing program 2 (id=4931): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r0, &(0x7f0000000000), 0x6) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x10) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000400)={0x0, 0x5, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2) ioctl$KVM_RUN(r4, 0xae80, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/module/kvm/parameters/nx_huge_pages\x00', 0x2, 0x0) write(r5, &(0x7f0000000800)='1', 0x1) r6 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/module/kvm/parameters/nx_huge_pages_recovery_ratio\x00', 0x2, 0x0) write(r6, &(0x7f0000000a00)='1', 0x1) mmap$KVM_VCPU(&(0x7f0000000000/0xa000)=nil, 0x930, 0x2000003, 0x2013, r4, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) mkdir(&(0x7f0000000300)='./sys\x00', 0x4) r7 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r8 = openat$cgroup_subtree(r7, &(0x7f0000000200), 0x2, 0x0) rmdir(&(0x7f00000000c0)='./cgroup/../file0\x00') preadv2(r8, &(0x7f0000001580)=[{&(0x7f0000000240)=""/126, 0x7e}], 0x1, 0x101, 0x8, 0x14) r9 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x4206, r9) ptrace(0x4207, r9) r10 = socket$nl_xfrm(0x10, 0x3, 0x6) getsockopt$sock_cred(r10, 0x1, 0x11, &(0x7f0000000040)={0x0}, &(0x7f0000000080)=0xc) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000140)={'\x00', 0x68, 0x7fffffff, 0x4, 0x0, 0xb, r11}) openat$selinux_user(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) 53.025509205s ago: executing program 2 (id=4933): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="fc010000190001000000000000000000fc020000000000000000000400000000000000000000000000000000000000004e21000300000000020000202f000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="01000000000000000000000000000000fdffffffffffffff00000000000000000000000000000000000000000000000000000000000000001d00000000000000000000000000000000000000000000000000000000000000dd020000000000000500000000000000000000000000000044010500"], 0x1fc}}, 0x0) 37.988842277s ago: executing program 39 (id=4933): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="fc010000190001000000000000000000fc020000000000000000000400000000000000000000000000000000000000004e21000300000000020000202f000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="01000000000000000000000000000000fdffffffffffffff00000000000000000000000000000000000000000000000000000000000000001d00000000000000000000000000000000000000000000000000000000000000dd020000000000000500000000000000000000000000000044010500"], 0x1fc}}, 0x0) 6.227249357s ago: executing program 9 (id=5508): add_key$fscrypt_v1(0x0, &(0x7f0000000080)={'fscrypt:', @desc3}, 0x0, 0x0, 0xffffffffffffffff) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000002b40)=ANY=[], 0x20}}, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x201, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f00000004c0)={0x0, 0x0, @pic={0x80, 0x7, 0xe1, 0x81, 0x9, 0xf9, 0x8, 0x42, 0x81, 0x8, 0xc, 0x4, 0xf9, 0x4, 0x2, 0x3}}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000000)={[0x1000000000006e, 0x0, 0xd, 0x20, 0x3, 0x2, 0x80000000106c, 0x100, 0x8000000000000, 0x21, 0x1c00000, 0x8, 0x0, 0x2, 0x0, 0x8000], 0x58000, 0x3c4210}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 5.914361064s ago: executing program 8 (id=5517): r0 = syz_usb_connect(0x0, 0x81, &(0x7f0000000800)=ANY=[@ANYBLOB="12010000a7420040ab0501030001010203010902240001000000000904000002aad45c0009058e02000000000009050a06"], 0x0) syz_usb_control_io$uac1(r0, 0x0, &(0x7f00000004c0)={0x44, &(0x7f0000000280)={0x40, 0x3, 0x4, "9854bef0"}, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)={0x20, 0x83, 0x1, "cb"}, 0x0, 0x0}) r1 = socket(0x4, 0x80000, 0xc) (async) r2 = socket$nl_generic(0x10, 0x3, 0x10) (async) r3 = syz_genetlink_get_family_id$devlink(&(0x7f0000000600), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_GET(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000000)={0x14, r3, 0x303, 0x0, 0x0, {0x13}}, 0x14}}, 0x4) (async) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000000), &(0x7f0000000040)=0xc) 5.17405106s ago: executing program 9 (id=5518): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) listen(0xffffffffffffffff, 0x8) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = add_key$user(&(0x7f0000000540), &(0x7f0000000580)={'syz', 0x0}, &(0x7f00000005c0)="8bea7f29", 0xfffffffffffffeea, 0xfffffffffffffffe) keyctl$setperm(0x5, r2, 0x0) add_key$user(&(0x7f0000000d80), &(0x7f0000000dc0)={'syz', 0x0}, &(0x7f0000000e00)="07ac738b65", 0x5, 0xfffffffffffffffe) r3 = dup(r1) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000100)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) chdir(&(0x7f0000000000)='./cgroup\x00') mkdirat(0xffffffffffffff9c, 0x0, 0x4d) ioctl$XFS_IOC_GETBMAP(r1, 0xc0205826, &(0x7f0000000180)={0x1000, 0x1, 0x25, 0x0, 0x1}) rename(&(0x7f0000000200)='./file0\x00', &(0x7f0000000140)='./file0\x00') write$tun(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="bbbbbbbb00000000000088a84800811400670014071375cb7c1e0001ac1414aaf110c8cfde1484d74800686de43559152ef56ffa158de9750000007195020599a9387d1b276ce5db145355f6dd099e24e9991f03f9de09c60dfbcae103c781ea"], 0x2a) 5.113345021s ago: executing program 0 (id=5519): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$TIPC_NL_NET_SET(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000300)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010000000000000000000f0000001c0007800c000400002e0003000000000c0003"], 0x30}}, 0x0) 4.930698985s ago: executing program 0 (id=5520): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$TIPC_NL_NET_SET(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000300)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB], 0x30}}, 0x0) 4.930250725s ago: executing program 0 (id=5521): r0 = socket$inet_tcp(0x2, 0x1, 0x0) unshare(0x20060400) r1 = syz_open_procfs(0x0, &(0x7f0000000140)='net/ip6_flowlabel\x00') preadv2(r1, 0x0, 0x0, 0x5, 0x101, 0x1) getsockopt$IPT_SO_GET_INFO(r0, 0x0, 0x40, &(0x7f0000000040)={'security\x00', 0x0, [0x8, 0x5, 0x0, 0x10000, 0x1]}, &(0x7f0000000100)=0x54) r2 = fsopen(&(0x7f00000000c0)='udf\x00', 0x1) fsconfig$FSCONFIG_SET_STRING(r2, 0x1, &(0x7f0000000180)='rootcontext', &(0x7f0000000040)='E\xe1\x85\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r2, 0x1, &(0x7f0000000000)='rootcontext', &(0x7f0000000080)='^\x00', 0x0) bind$inet(r0, &(0x7f00000000c0)={0x2, 0x4e20, @broadcast}, 0x10) read$FUSE(0xffffffffffffffff, &(0x7f00000001c0)={0x2020, 0x0, 0x0, 0x0}, 0x2020) quotactl_fd$Q_SETQUOTA(r1, 0xffffffff80000802, r3, &(0x7f0000002200)={0x0, 0x4, 0x100000001, 0x95, 0x6, 0x9, 0x0, 0x100000001, 0xffffffff}) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r4, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x4}, 0x6) write$bt_hci(r4, &(0x7f0000000080)=ANY=[@ANYBLOB="0000ffff3201"], 0x138) sendto$inet(r0, &(0x7f0000000140)="ed", 0x1, 0x20008005, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x1f}}, 0x10) recvfrom(r0, 0x0, 0x0, 0xc058ee1503c68355, 0x0, 0x0) 4.930101105s ago: executing program 9 (id=5522): r0 = userfaultfd(0x80001) r1 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TIOCL_SELLOADLUT(r1, 0x541c, &(0x7f0000000000)={0x5, 0x7, 0x4, 0x9, 0x7}) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000400)={0x0, 0x1, 0x0, 0x100000, &(0x7f0000000000/0x100000)=nil}) r4 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r4, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10) connect$inet(r4, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) sendto$inet(r4, &(0x7f00000004c0)='<', 0x381, 0x805, 0x0, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_PRE_FAULT_MEMORY(r5, 0xc040aed5, &(0x7f0000000240)={0x0, 0x100000}) ioctl$KVM_GET_DIRTY_LOG(r3, 0x4010ae42, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000/0x3000)=nil}) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000080)={0xaa, 0x68}) ioctl$UFFDIO_COPY(0xffffffffffffffff, 0xc028aa05, &(0x7f0000000180)={&(0x7f00002b9000/0x400000)=nil, &(0x7f00003ab000/0x2000)=nil, 0x400000, 0x2, 0x2}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) ioctl$UFFDIO_ZEROPAGE(r0, 0xc020aa07, &(0x7f0000000180)={{&(0x7f0000ffc000/0x2000)=nil, 0x2000}}) syz_usb_connect(0x0, 0x24, &(0x7f0000000300)={{0x12, 0x1, 0x200, 0x5, 0x47, 0xec, 0x20, 0x4b4, 0x6831, 0x6b27, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x2, 0x0, 0xa0, 0x23, "", [{{0x9, 0x4, 0x20, 0x6, 0x0, 0x7c, 0xf3, 0x15, 0xe5}}]}}]}}, 0x0) 4.840535617s ago: executing program 0 (id=5523): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0xa, 0x8000000000002}) r1 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) r2 = socket$netlink(0x10, 0x3, 0xc) ioctl$sock_bt_hidp_HIDPCONNADD(r1, 0x400448c8, &(0x7f0000000380)={r1, r2, 0xb, 0x3, &(0x7f0000000340)="f81222", 0x4, 0x26, 0x4, 0x8f, 0x3, 0x2, 0x7, 'syz1\x00'}) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) (async) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) r4 = socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x2, 0x0) (async) r5 = socket$unix(0x1, 0x2, 0x0) bind$unix(r5, &(0x7f0000003000)=@file={0x1}, 0x6e) (async) bind$unix(r5, &(0x7f0000003000)=@file={0x1}, 0x6e) r6 = landlock_create_ruleset(&(0x7f0000000240)={0x1fff}, 0x18, 0x0) landlock_create_ruleset(&(0x7f0000000080)={0xf4da, 0x1, 0x3}, 0x18, 0x0) (async) r7 = landlock_create_ruleset(&(0x7f0000000080)={0xf4da, 0x1, 0x3}, 0x18, 0x0) landlock_restrict_self(r7, 0x0) landlock_restrict_self(r6, 0x0) (async) landlock_restrict_self(r6, 0x0) connect$unix(r4, &(0x7f0000000640)=@file={0x1}, 0x6e) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r8 = dup3(r3, r0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) (async) r9 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r9, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r9, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r8, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) (async) ioctl$BINDER_WRITE_READ(r8, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r8, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f00000006c0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000180)={@flat=@weak_handle={0x77682a85, 0x1001}, @ptr={0x70742a85, 0x0, 0x0, 0x1f, 0x1, 0x14}, @ptr={0x70742a85, 0x0, 0x0, 0x0, 0x0, 0x32}}, &(0x7f0000000680)={0x0, 0x18, 0x40}}, 0x1000}], 0x0, 0x0, 0x0}) 4.840296967s ago: executing program 0 (id=5524): syz_usb_connect$uac3(0x5, 0x80, &(0x7f0000000080)=ANY=[@ANYBLOB="12010003000000401e04373240000102030109026e000301635002080b0002010130020904000600010130"], &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0}) 4.400577426s ago: executing program 8 (id=5527): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000040)={0x2000000000000004, &(0x7f0000000000)=[{0x94, 0x0, 0x0, 0x80000001}, {0x6, 0x0, 0x6}]}, 0x10) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000540), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000840)={0x1fd, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r2, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) setsockopt$inet_opts(0xffffffffffffffff, 0x0, 0x4, &(0x7f0000000000)="8907040400", 0x5) r4 = socket(0x10, 0x3, 0x0) dup(0xffffffffffffffff) write(r4, &(0x7f0000000180)="2000000012005f0214f9f4070000fbe40a0000000000", 0x41d) 3.500326305s ago: executing program 8 (id=5528): syz_usb_connect$uac2(0x2, 0x82, &(0x7f0000001a80)={{0x12, 0x1, 0x250, 0x0, 0x0, 0x0, 0x8, 0x13e5, 0x1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x70, 0x3, 0x1, 0x7, 0x0, 0xe, {0x8, 0xb, 0x1, 0x2, 0x1, 0xf, 0x20, 0x8}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0x5, 0x1, 0x10}, [@feature_unit={0x7, 0x24, 0x6, 0x6, 0x4, [0x6]}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x3b7, 0x8, 0x6, 0x0, {0x8, 0x25, 0x1, 0x1, 0x28, 0x4, 0x3ff}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x8, 0x4, 0x6, 0x8, {0x8, 0x25, 0x1, 0x3, 0xc, 0x2, 0x1}}}}}}}}]}}, &(0x7f0000001c40)={0x0, 0x0, 0x0, 0x0}) r0 = syz_usb_connect$hid(0x3, 0x92, &(0x7f0000000040)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x10, 0x46d, 0xc71c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0xa0, 0x8f, "", [{{0x9, 0x4, 0x0, 0xb7, 0x2, 0x3, 0x0, 0x2, 0x0, {0x9, 0x21, 0x5, 0x6, 0x1, {0x22, 0x2b}}, {{{0x9, 0x5, 0x81, 0x3, 0x40, 0x8, 0xc1, 0xf9}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) ioctl$USBDEVFS_CLEAR_HALT(0xffffffffffffffff, 0xc0105502, 0x0) syz_usb_control_io(r0, &(0x7f0000000000)={0x2c, &(0x7f0000000100)={0x20, 0x2, 0xd5, {0x28, 0x3, "82631b612b8526792c3cbdeace918d0fb74237cc6e446c4e88e78881ce2a52973661d67a0c55"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f0000000280)={'\x00', 0xec, 0x8, 0x8, 0x507a8289, 0x100000001, 0x0}) timer_create(0x0, &(0x7f0000000300)={0x0, 0x3f, 0x4, @tid=r1}, &(0x7f0000000340)) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cpuacct.usage_percpu_user\x00', 0x275a, 0x0) write$binfmt_script(r4, &(0x7f0000000000), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000003, 0x28011, r4, 0x0) preadv(r4, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x1, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_FPU(r4, 0x41a0ae8d, &(0x7f0000000240)={'\x00', 0x14, 0xa, 0xbc, 0x0, 0x7, 0x10000, 0x2, '\x00', 0xc94}) ioctl$KVM_RUN(r5, 0xae80, 0x0) 3.148639033s ago: executing program 1 (id=5535): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000001000010700000100000000000a000000060001001b"], 0x1c}}, 0x0) r2 = syz_genetlink_get_family_id$team(&(0x7f0000000080), r1) sendmsg$TEAM_CMD_OPTIONS_GET(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000240)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010029bd7000fedbdf2502"], 0x20}, 0x1, 0x0, 0x30000, 0x8001}, 0x4000000) 3.148190293s ago: executing program 1 (id=5536): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000040)={0x2000000000000004, &(0x7f0000000000)=[{0x94, 0x0, 0x0, 0x80000001}, {0x6, 0x0, 0x6}]}, 0x10) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000540), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000840)={0x1fd, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r2, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) setsockopt$inet_opts(0xffffffffffffffff, 0x0, 0x4, &(0x7f0000000000)="8907040400", 0x5) r4 = socket(0x10, 0x3, 0x0) dup(0xffffffffffffffff) write(r4, &(0x7f0000000180)="2000000012005f0214f9f4070000fbe40a0000000000", 0x41d) 2.231615183s ago: executing program 1 (id=5537): add_key$fscrypt_v1(0x0, &(0x7f0000000080)={'fscrypt:', @desc3}, 0x0, 0x0, 0xffffffffffffffff) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000002b40)=ANY=[], 0x20}}, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x201, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f00000004c0)={0x0, 0x0, @pic={0x80, 0x7, 0xe1, 0x81, 0x9, 0xf9, 0x8, 0x42, 0x81, 0x8, 0xc, 0x4, 0xf9, 0x4, 0x2, 0x3}}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000000)={[0x1000000000006e, 0x0, 0xd, 0x20, 0x3, 0x2, 0x80000000106c, 0x100, 0x8000000000000, 0x21, 0x1c00000, 0x8, 0x0, 0x2, 0x0, 0x8000], 0x58000, 0x3c4210}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 2.133691135s ago: executing program 8 (id=5538): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x2000, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe7000/0x18000)=nil, &(0x7f0000000900)=[@text32={0x20, 0x0}], 0x1, 0x20, 0x0, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) munlockall() mlock2(&(0x7f0000381000/0x4000)=nil, 0x4000, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000200)={0x1, 0x0, [{0x4b564d01, 0x0, 0x1001}]}) close_range(r0, 0xffffffffffffffff, 0x0) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r3, &(0x7f00000007c0)={0x1f, 0x0, @none, 0x4, 0x3}, 0xe) 1.826853761s ago: executing program 0 (id=5540): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000001500)=ANY=[@ANYBLOB="12010000000000407d1ef62c00000000000109022400010000000009040000010300020009210000000122070009058103"], 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/profiling', 0x1, 0x0) write(r2, &(0x7f0000000180)="70d8b6", 0x3) getsockopt$inet6_int(r1, 0x29, 0x4e, 0x0, &(0x7f0000000040)) (async, rerun: 32) syz_usb_control_io$hid(r0, 0x0, 0x0) (async, rerun: 32) syz_usb_control_io(r0, &(0x7f0000000400)={0x2c, &(0x7f0000000000)={0x0, 0x30, 0x8, {0x8, 0x22, "59a1b95388e8"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) 1.770287513s ago: executing program 9 (id=5541): sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000c80)={0x160, 0x0, 0x2, 0xa50e823f883a8ccb, 0x0, 0x0, {0x7, 0x0, 0x10}, [@CTA_EXPECT_NAT={0x14c, 0xa, 0x0, 0x1, [@CTA_EXPECT_NAT_DIR={0x8, 0x1, 0x1, 0x0, 0x1}, @CTA_EXPECT_NAT_DIR={0x8}, @CTA_EXPECT_NAT_DIR={0x8, 0x1, 0x1, 0x0, 0x1}, @CTA_EXPECT_NAT_TUPLE={0x54, 0x2, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x6}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x36}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0xfffe}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x3}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x10}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x9a}}]}, @CTA_EXPECT_NAT_TUPLE={0x78, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x1}}, @CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8, 0x2, @empty}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x21}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @loopback}, {0x14, 0x4, @mcast1}}}]}, @CTA_EXPECT_NAT_TUPLE={0x64, 0x2, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @ipv4={'\x00', '\xff\xff', @broadcast}}, {0x14, 0x4, @dev={0xfe, 0x80, '\x00', 0x19}}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x6}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x11}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x11}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}]}]}]}, 0x160}, 0x1, 0x0, 0x0, 0x40010}, 0x4008000) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) shutdown(r0, 0x0) sendmsg$inet(r1, &(0x7f0000009380)={0x0, 0x0, 0x0}, 0x44080) r2 = socket(0xf, 0xa, 0x8000000) sendto(r2, &(0x7f0000000c40)="120000001200e7ef007b0000000000faffa0", 0x12, 0x8800, 0x0, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000540)=ANY=[@ANYBLOB="7c0100001000130726bd70000000000000000000000000000000ffffe0000002ac141413001a000000000000000000004e22000100000003020000003a000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="fe8000000000000000000000000000bb0000000032000000fe8000000000000000000000000000aa0000000000000000000000000000000008000000000000000a000000000000000600000000000000000000000000000000000000000000000300000000000000000000000000000000000000000000000200000000000000f8ffffffffffffff0c000000000000000200000029bd70000000000002000100280000000000000068001200726663343534332867636d2861657329290000000000000000000a00000000000000000000000000000000000000000000000000000000000000000000000000e000000080000000316f74eeac053deb73fc018493cc121927a9bca207141b9a451c00aa14000e00000000000000000000000000000000000800160018"], 0x17c}, 0x1, 0x0, 0x0, 0xc0}, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) write$tun(r3, 0x0, 0xfdef) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x20100, 0x0) ioctl$TUNGETFILTER(r5, 0x801054db, &(0x7f0000000080)=""/128) sendmsg$TIPC_CMD_GET_REMOTE_MNG(r2, &(0x7f0000000440)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000400)={&(0x7f0000000340)={0x1c, 0x0, 0x4, 0x70bd27, 0x25dfdbfd}, 0x1c}, 0x1, 0x0, 0x0, 0x8880}, 0x4) recvmmsg(r2, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x321}, {&(0x7f0000000280)=""/85, 0x42}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000580)=""/106, 0x659}, {&(0x7f0000000980)=""/73, 0xd}, {&(0x7f0000000200)=""/77, 0x69}, {&(0x7f00000007c0)=""/141, 0xc4}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}, 0x5}], 0x4000000000003b4, 0x2000, &(0x7f0000003700)={0x77359400}) 1.43414907s ago: executing program 9 (id=5542): r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000000)={0x810003, 0x0, 0x8, 0xff7ffff4}, 0x10) write(r0, &(0x7f00000000c0)="240000001e005f0214fffffffffffff8070000000b0000000000000008000b000d0000fe", 0x24) 1.156955676s ago: executing program 9 (id=5543): r0 = syz_create_resource$binfmt(&(0x7f0000000000)='./file1\x00') r1 = openat$binfmt(0xffffffffffffff9c, r0, 0x42, 0x1ff) write$binfmt_script(r1, &(0x7f0000000080)={'#! ', './file1', [{}]}, 0x2) r2 = syz_usb_connect(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="1201000001018610f4205ae06d6c011703010902240001010000000904690202ff5aa30009050402100000fa000905820240"], 0x0) syz_usb_control_io$hid(r2, 0x0, 0x0) syz_usb_control_io(r2, 0x0, 0x0) syz_usb_control_io(r2, 0x0, &(0x7f0000000b40)={0x44, &(0x7f0000000700)=ANY=[@ANYBLOB="000e50"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r2, 0x0, 0x0) syz_usb_control_io$uac2(r2, 0x0, &(0x7f0000000600)={0x24, &(0x7f0000000340)={0x20, 0x14, 0x1, "dd"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r2, &(0x7f0000000500)={0x14, &(0x7f0000000200)={0x3a3c58752f9ad0de, 0x1, 0xf6, {0xf6, 0xa, "444f25884bb9aef7ec38233cde1d4ca68b2a7147920efece79e0425d5994b9b7cb97f89668caff47b63a4f722d4975d6cd8ee52718935b0ce0deeacf8fea19757d6bfb22c0714be93d17ea3b691bc20358550bf4aac9dae86db36f10ebabc77d6f57503a26a1adaeec24d32f5bdc74ed81c61ebb40e9a24ebd5dbd88a4137b180e5171ad4494942380c1536af59fbb556cf53045cdfa55c41a07a70603fd3d57719a4fde3ca8b0e0ce675dbe597e0f085c15ffb72c6fc60ccbd4d32001b77359325bf981bfa55e6fc58b444dff29d35ec6fa8f424e7e568428a8e248fbc671fee66a5dee1bd01281988da7199e21f5c3a2c27c39"}}, 0x0}, &(0x7f0000000740)={0x1c, &(0x7f0000000540)={0x0, 0xe, 0x29, "7c1d1c3402fc9f91ec4bb0505784e0bb2ffba1fd9e025f174f591c84244749864df2a3823718098bfb"}, &(0x7f0000000680)={0x0, 0xa, 0x1, 0x9}, &(0x7f00000006c0)={0x0, 0x8, 0xfff0, 0x6}}) write$binfmt_misc(r1, &(0x7f0000000b40)="0931bceaececf9", 0x7) syz_usb_connect(0x5, 0x24, &(0x7f0000000500)={{0x12, 0x1, 0x201, 0x82, 0x35, 0x74, 0x10, 0x19d2, 0x8056, 0xe941, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x9, 0x2, 0xc0, 0x2, "", [{{0x9, 0x4, 0x5b, 0x8, 0x0, 0xe0, 0x1, 0x3, 0x8}}]}}]}}, &(0x7f0000000b40)={0x0, 0x0, 0x6d, 0x0}) 1.095839377s ago: executing program 1 (id=5544): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000100)={'ip6tnl0\x00', &(0x7f0000000080)={'syztnl2\x00', 0x0, 0x2f, 0x0, 0x6, 0x9, 0x6f, @mcast2, @private2={0xfc, 0x2, '\x00', 0x1}, 0x1, 0x40, 0x7, 0x7f}}) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000180)={'erspan0\x00', &(0x7f0000000140)={'gretap0\x00', 0x0, 0x10, 0x10, 0x2, 0x5, {{0x8, 0x4, 0x1, 0x3c, 0x20, 0x65, 0x0, 0x58, 0x4, 0x0, @dev={0xac, 0x14, 0x14, 0x18}, @loopback, {[@cipso={0x86, 0x9, 0x1, [{0x7, 0x3, "e6"}]}]}}}}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f00000002c0)={'syztnl0\x00', &(0x7f00000001c0)={'erspan0\x00', 0x0, 0x7800, 0x10, 0x6, 0xfffffff8, {{0x31, 0x4, 0x2, 0x3, 0xc4, 0x64, 0x0, 0x15, 0x29, 0x0, @loopback, @multicast1, {[@timestamp_addr={0x44, 0x1c, 0xcd, 0x1, 0x6, [{@empty}, {@empty, 0x2}, {@broadcast, 0x8001}]}, @cipso={0x86, 0x70, 0x3, [{0x0, 0xa, "73ad30b9a7ab64df"}, {0x7, 0x8, "3c4fe69e7842"}, {0x2, 0x8, "5a95385f6f81"}, {0x0, 0x4, "4ebf"}, {0x1, 0x10, "4407bcb0bf1a30a675297ef98ded"}, {0x7, 0x9, "1646f9374672cd"}, {0x7, 0xc, "c19663f33710bb7e2443"}, {0x7, 0xe, "150743048dc8a7001899059e"}, {0x6, 0xc, "7f83461845ce0112d9fe"}, {0x7, 0xd, "17261d30b7161886243719"}]}, @timestamp={0x44, 0x24, 0x33, 0x0, 0x3, [0x81, 0x2, 0x5, 0x8c, 0x7, 0xfffffff7, 0x5, 0xc]}]}}}}}) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000480)={'syztnl0\x00', &(0x7f0000000300)={'sit0\x00', 0x0, 0x8, 0x8, 0x8, 0xb, {{0x4c, 0x4, 0x2, 0x3, 0x130, 0x66, 0x0, 0x7, 0x29, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @local, {[@noop, @timestamp_prespec={0x44, 0x54, 0xd6, 0x3, 0x2, [{@broadcast, 0x2}, {@multicast1, 0x4}, {@broadcast, 0x8}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0x101}, {@loopback, 0x10}, {@multicast2, 0xf}, {@rand_addr=0x64010100, 0x3}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x9}, {@remote, 0x1}, {@multicast1, 0x3}]}, @timestamp_addr={0x44, 0x2c, 0x33, 0x1, 0x5, [{@broadcast, 0xa}, {@remote, 0xfffffff9}, {@empty, 0x1}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0xa}, {@loopback, 0x2}]}, @ssrr={0x89, 0x27, 0x1f, [@empty, @broadcast, @empty, @rand_addr=0x64010100, @rand_addr=0x64010100, @private=0xa010102, @rand_addr=0x64010100, @multicast1, @multicast1]}, @timestamp_addr={0x44, 0x24, 0xec, 0x1, 0x9, [{@loopback, 0xa8f}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0x2}, {@broadcast, 0x1}, {@broadcast, 0xb9d}]}, @timestamp_prespec={0x44, 0x4c, 0xb0, 0x3, 0x8, [{@loopback, 0xbf}, {@empty}, {@local, 0x3b}, {@dev={0xac, 0x14, 0x14, 0x21}, 0x7ff}, {@loopback, 0x9}, {@multicast2, 0x4}, {@loopback, 0x7fffffff}, {@loopback, 0x6}, {@empty, 0xffffffff}]}, @end]}}}}}) sendmsg$ETHTOOL_MSG_DEBUG_GET(r0, &(0x7f00000005c0)={&(0x7f0000000000), 0xc, &(0x7f0000000580)={&(0x7f00000004c0)={0xac, r1, 0x4, 0x70bd28, 0x25dfdbfe, {}, [@HEADER={0x30, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'wlan1\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}]}, @HEADER={0x54, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r3}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'dvmrp0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r5}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}]}, @HEADER={0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}]}, 0xac}, 0x1, 0x0, 0x0, 0x80}, 0x40b0) r6 = socket$inet6_icmp(0xa, 0x2, 0x3a) setsockopt$inet6_IPV6_ADDRFORM(r6, 0x29, 0x1, &(0x7f0000000600), 0x4) sendmsg$ETHTOOL_MSG_LINKSTATE_GET(r0, &(0x7f0000000740)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000700)={&(0x7f0000000680)={0x6c, 0x0, 0x2, 0x70bd2b, 0x25dfdbfb, {}, [@HEADER={0x58, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r3}, @ETHTOOL_A_HEADER_DEV_NAME={0x14}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_to_batadv\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r5}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bridge_slave_1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r2}]}]}, 0x6c}, 0x1, 0x0, 0x0, 0x24000040}, 0x4000881) r7 = socket$xdp(0x2c, 0x3, 0x0) r8 = socket$xdp(0x2c, 0x3, 0x0) bind$xdp(r7, &(0x7f0000000780)={0x2c, 0x1, r2, 0xf, r8}, 0x10) sendmsg$ETHTOOL_MSG_LINKSTATE_GET(r0, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x3c, r1, 0x2, 0x70bd26, 0x25dfdbfd, {}, [@HEADER={0x28, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_batadv\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) ioctl$XFS_IOC_FSGETXATTRA(r0, 0x801c582d, &(0x7f00000008c0)) madvise(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0xe) r9 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000940), r0) sendmsg$TIPC_NL_BEARER_ENABLE(r0, &(0x7f0000000d40)={&(0x7f0000000900)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000d00)={&(0x7f0000000980)={0x368, r9, 0x4, 0x70bd28, 0x25dfdbff, {}, [@TIPC_NLA_PUBL={0x2c, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x7}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x5}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x1ff}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x5}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x7}]}, @TIPC_NLA_MEDIA={0xc, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}]}, @TIPC_NLA_SOCK={0x44, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_REF={0x8, 0x2, 0xfffffffc}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0xfffffffa}, @TIPC_NLA_SOCK_CON={0x24, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x9}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x5}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0xbf}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x1}]}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x2}]}, @TIPC_NLA_MEDIA={0x74, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0x34, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xc}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x10001}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x7}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3471c67b}]}, @TIPC_NLA_MEDIA_PROP={0x34, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xc48f}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3ff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}]}, @TIPC_NLA_SOCK={0x10, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0xffff}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}]}, @TIPC_NLA_SOCK={0xd0, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_CON={0x4c, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x8}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x200}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0xfffffffe}, @TIPC_NLA_CON_FLAG={0x8}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x101}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x7}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x2}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0xf42b}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x1}]}, @TIPC_NLA_SOCK_CON={0xc, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0xc}]}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0xff}, @TIPC_NLA_SOCK_CON={0x3c, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0xfffffcc5}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x7}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x2}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x7}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x3}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x800}]}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_CON={0x1c, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x400}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x5}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x10001}]}, @TIPC_NLA_SOCK_CON={0xc, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0x8}]}]}, @TIPC_NLA_MEDIA={0xa8, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0x3c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x12}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x81}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x16}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xffff8001}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}]}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x4}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}]}, @TIPC_NLA_MEDIA_PROP={0x44, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x15}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x100}]}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}]}, @TIPC_NLA_BEARER={0x4}, @TIPC_NLA_PUBL={0x44, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x7f000000}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0xaed2}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x8}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x3}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x2}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x729f}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x4}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x9}]}, @TIPC_NLA_SOCK={0x94, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_REF={0x8, 0x2, 0x2}, @TIPC_NLA_SOCK_CON={0x24, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0x1}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0xcb}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x893}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x800}]}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x2}, @TIPC_NLA_SOCK_CON={0x14, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x4}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0xd}]}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_CON={0x3c, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0xfffffff8}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x208}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x349}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x6761}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0xab}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x2}, @TIPC_NLA_CON_NODE={0x8}]}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0xfff}]}]}, 0x368}, 0x1, 0x0, 0x0, 0x40}, 0x400c094) r10 = syz_open_procfs$namespace(0x0, &(0x7f0000000d80)='ns/ipc\x00') r11 = openat$null(0xffffffffffffff9c, &(0x7f0000000dc0), 0x40080, 0x0) ioctl$TUNGETVNETBE(r11, 0x800454df, &(0x7f0000000e00)=0x1) ioctl$TUNGETSNDBUF(r11, 0x800454d3, &(0x7f0000000e40)) ioctl$F2FS_IOC_DEFRAGMENT(r10, 0xc010f508, &(0x7f0000000e80)={0x5, 0x401}) write$tun(r11, &(0x7f0000000ec0)={@val={0x0, 0x8035}, @void, @ipv6=@gre_packet={0x2, 0x6, "b47be8", 0x205, 0x2f, 0x0, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @remote, {[@dstopts={0x87, 0x27, '\x00', [@enc_lim={0x4, 0x1, 0x9}, @enc_lim={0x4, 0x1, 0x8}, @generic={0x2, 0x9a, "42e5c05965d7dbb03ec487e6bd5c4d088b99695fa33c992f418e6fd33bd9211e580dc42c2163213091f8ee479562b98d9a6e973a3e7b9105eba5b52fd528d9874c9ded0492dab6a05d16ae990564eb7eef28749af0224d14072f16456f8e23ec90cebf38685c1e44a2c319243ba5278c2509dfacad1c18d22f0d767b2340dd94e11cd32638f134afd9923d47e8a4017a47cb03f45d10fb0b2b2c"}, @generic={0x9, 0x72, "96b0435a258578cf3a87caafba99a914aef23811e1e14a2717975417d6a0977ad13cd1df01d6dce61fa6b49a568a3f07ece6944f3f58bbe1548a829348db75f33ba8fe81e43207d9e5e111008dd16add1114adeaec1a3daaeb838fe35a211a77487e3d90f6ebd82e3b58f8812ad463c7ec88"}, @enc_lim={0x4, 0x1, 0x6}, @calipso={0x7, 0x10, {0x3, 0x2, 0x3, 0x100, [0x1]}}, @jumbo={0xc2, 0x4, 0xa16b}, @ra={0x5, 0x2, 0x2a1}, @enc_lim={0x4, 0x1, 0x6}]}], {{0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x880b, 0x44, 0x3, [0x3], "d9abed15350790af262b69c9898ea502ccefda9cd306a85a309b23eb89e7a56512daed9eb497b68def5f08ce54b8666b1f393735f878b8ad871eeac5ad914cc82172638a"}, {0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x800, [0x8001, 0x0], "5987a3fb224e925be99d149bda"}, {0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x86dd, [], "cde480c12728942e539144f86a494c9d0dd1497bf45eb5d2c63e5b509b291d67f80c5324d77f53e550"}, {0x8, 0x88be, 0x0, {{0xf, 0x1, 0x5, 0x1, 0x0, 0x0, 0x5, 0x1}, 0x1, {0x8}}}, {0x8, 0x22eb, 0x1, {{0x2, 0x2, 0x4, 0x2, 0x0, 0x0, 0x7, 0x80}, 0x2, {0xe, 0x2, 0x3, 0x19, 0x1, 0x1, 0x2, 0x1}}}, {0x8, 0x6558, 0x0, 'n'}}}}}, 0x231) ioctl$FS_IOC_ENABLE_VERITY(r8, 0x40806685, &(0x7f0000001200)={0x1, 0x2, 0x1000, 0xb, &(0x7f0000001100)="69ef590aae4c9455049b2e", 0x9d, 0x0, &(0x7f0000001140)="1b499e0be282af8961fd8ee3e4bc5fd072abdfa049dab765c84ac2b8f2d2291cc4f6422562975cf52343ed1b01935a5464707cd2550c8cc36e3da9ae09dd75a8bddc854aa02dcde64c6c778d7e85235e5e4903a0e99ee9462d4b24f0cddea19bf8493bedd2004deb82ce352380456889120cfce11a8a5bff351fc5a96941802b0771382f32c9ba4205b052c8fd5f03f9f9d1c9f90049675f6842cef4e0"}) getrandom(&(0x7f0000001280)=""/86, 0x56, 0x2) r12 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_ipv6_tunnel_SIOCADD6RD(r12, 0x89f9, &(0x7f0000001340)={'sit0\x00', &(0x7f0000001300)={@private2, @loopback, 0xa}}) ioctl$KVM_SET_USER_MEMORY_REGION(r11, 0x4020ae46, &(0x7f0000001380)={0x10000, 0x0, 0x41000, 0x1000, &(0x7f0000ffb000/0x1000)=nil}) sendmsg$IPVS_CMD_NEW_DEST(r0, &(0x7f0000001540)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000001500)={&(0x7f0000001440)={0xb4, 0x0, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0xbd1}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x5}, @IPVS_CMD_ATTR_DAEMON={0x44, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x2}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e20}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @broadcast}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x4}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x5}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x6, 0xb, 0xa}, @IPVS_DEST_ATTR_TUN_PORT={0x6, 0xe, 0x4e21}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x10001}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x100}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x9}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0xa3}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x863}]}, 0xb4}, 0x1, 0x0, 0x0, 0x4008800}, 0x20000000) 950.92783ms ago: executing program 1 (id=5545): socket$inet_udp(0x2, 0x2, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000018000)=[@textreal={0x8, &(0x7f0000000080)="f30f0966b8a18200000f23c00f21f86635020002000f23f8f3ab66b98b02000066b89ce5225366ba000000000f300f20e06635200000000f22e00fbfdebaf80c66b856c0668d66efbafc0ced66b9d00b00000f32660f3880affe2bb80f008ec0", 0x60}], 0x1, 0x69, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000540), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x1fd, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) setsockopt$inet_opts(0xffffffffffffffff, 0x0, 0x4, &(0x7f0000000000)="8907040400", 0x5) r3 = socket(0x10, 0x3, 0x0) dup(0xffffffffffffffff) write(r3, &(0x7f0000000180)="2000000012005f0214f9f4070000fbe40a0000000000", 0x41d) 95.608988ms ago: executing program 8 (id=5539): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$TIPC_NL_NET_SET(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000300)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010000000000000000000f0000001c0007800c000400002e0022000000000c0003"], 0x30}}, 0x0) 28.60781ms ago: executing program 8 (id=5546): r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000140), 0x10) ioctl$SIOCGSTAMPNS(r0, 0x8907, 0x0) sendmsg$can_bcm(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="050000000300000000000000", @ANYRES16=r0, @ANYRESDEC=r0], 0x48}}, 0x48000) read(r0, &(0x7f0000000f00)=""/4098, 0x106) 0s ago: executing program 1 (id=5547): syz_usb_connect$uac3(0x5, 0x80, &(0x7f0000000080)=ANY=[@ANYBLOB="12010003000000401e04373240000102030109026e000301635002080b0002010130020904000600010130"], &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0}) kernel console output (not intermixed with test programs): 12426] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4922'. [ 328.375618][T12435] tipc: Started in network mode [ 328.380612][T12435] tipc: Node identity , cluster identity 4711 [ 328.489123][T12444] netlink: 8 bytes leftover after parsing attributes in process `syz.8.4930'. [ 328.539381][T12018] usb 2-1: new high-speed USB device number 23 using dummy_hcd [ 328.554522][T12452] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 328.554557][T12452] rust_binder: Read failure Err(EFAULT) in pid:1003 [ 328.557333][ T36] audit: type=1400 audit(1785918496.899:1830): avc: denied { getopt } for pid=12448 comm="syz.2.4931" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 328.563742][T12452] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 328.592673][T12452] rust_binder: Read failure Err(EFAULT) in pid:1003 [ 328.603674][T12452] rust_binder: 12451:12452 FDA parent offset not aligned correctly [ 328.618637][T12452] rust_binder: 12451:12452 error while translating object: EINVAL [ 328.626514][T12452] rust_binder: Failure in copy_transaction_data: EINVAL [ 328.626542][T12452] rust_binder: 12451:12452 transaction call to 12451:0 failed EINVAL, code 4097 size 112-24 [ 328.644534][ T1786] rust_binder: 12451: undelivered TRANSACTION_ERROR: 29201 [ 328.668003][T12455] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=12455 comm=syz.8.4934 [ 328.689376][T12018] usb 2-1: device descriptor read/64, error -71 [ 328.929403][T12018] usb 2-1: device descriptor read/64, error -71 [ 328.987450][ T458] usb 10-1: unit 3 not found! [ 328.997683][ T458] usb 10-1: USB disconnect, device number 74 [ 329.088043][T12477] netlink: 12 bytes leftover after parsing attributes in process `syz.9.4944'. [ 329.112694][T12479] netlink: 8 bytes leftover after parsing attributes in process `syz.9.4945'. [ 329.139414][ T436] usb 9-1: new high-speed USB device number 65 using dummy_hcd [ 329.169395][T12018] usb 2-1: new high-speed USB device number 24 using dummy_hcd [ 329.172539][T12481] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 329.176999][T12481] rust_binder: Read failure Err(EFAULT) in pid:1214 [ 329.188602][T12481] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 329.195314][T12481] rust_binder: Read failure Err(EFAULT) in pid:1214 [ 329.204208][T12481] rust_binder: 12480:12481 FDA parent offset not aligned correctly [ 329.218813][T12481] rust_binder: 12480:12481 error while translating object: EINVAL [ 329.226769][T12481] rust_binder: Failure in copy_transaction_data: EINVAL [ 329.226795][T12481] rust_binder: 12480:12481 transaction call to 12480:0 failed EINVAL, code 4296 size 112-24 [ 329.246630][ T458] rust_binder: 12480: undelivered TRANSACTION_ERROR: 29201 [ 329.299376][ T436] usb 9-1: Using ep0 maxpacket: 16 [ 329.305765][ T436] usb 9-1: config 0 interface 0 altsetting 183 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 329.320598][T12018] usb 2-1: device descriptor read/64, error -71 [ 329.326924][ T436] usb 9-1: config 0 interface 0 has no altsetting 0 [ 329.333657][ T436] usb 9-1: New USB device found, idVendor=046d, idProduct=c71c, bcdDevice= 0.00 [ 329.348748][ T436] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 329.369914][ T436] usb 9-1: config 0 descriptor?? [ 329.579404][T12018] usb 2-1: device descriptor read/64, error -71 [ 329.580665][T12468] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 329.596521][T12468] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 329.606012][ T458] usb 10-1: new high-speed USB device number 75 using dummy_hcd [ 329.689491][T12018] usb usb2-port1: attempt power cycle [ 329.739384][ T458] usb 10-1: device descriptor read/64, error -71 [ 329.819950][ T436] usbhid 9-1:0.0: can't add hid device: -71 [ 329.825956][ T436] usbhid 9-1:0.0: probe with driver usbhid failed with error -71 [ 329.835846][ T436] usb 9-1: USB disconnect, device number 65 [ 329.989378][ T458] usb 10-1: device descriptor read/64, error -71 [ 330.039410][T12018] usb 2-1: new high-speed USB device number 25 using dummy_hcd [ 330.060411][T12018] usb 2-1: device descriptor read/8, error -71 [ 330.210425][T12018] usb 2-1: device descriptor read/8, error -71 [ 330.229384][ T458] usb 10-1: new high-speed USB device number 76 using dummy_hcd [ 330.346710][T12491] fuse: Unknown parameter 'gd' [ 330.359530][ T458] usb 10-1: device descriptor read/64, error -71 [ 330.459466][T12018] usb 2-1: new high-speed USB device number 26 using dummy_hcd [ 330.491987][T12018] usb 2-1: device descriptor read/8, error -71 [ 330.609394][ T458] usb 10-1: device descriptor read/64, error -71 [ 330.640060][T12018] usb 2-1: device descriptor read/8, error -71 [ 330.689385][ T436] usb 9-1: new full-speed USB device number 66 using dummy_hcd [ 330.729401][ T458] usb usb10-port1: attempt power cycle [ 330.759490][T12018] usb usb2-port1: unable to enumerate USB device [ 330.850764][ T436] usb 9-1: unable to get BOS descriptor or descriptor too short [ 330.858908][ T436] usb 9-1: not running at top speed; connect to a high speed hub [ 330.868204][ T436] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 330.878534][ T436] usb 9-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 330.890415][ T436] usb 9-1: New USB device found, idVendor=2a39, idProduct=3fd4, bcdDevice= 0.40 [ 330.899571][ T436] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 330.907649][ T436] usb 9-1: Product: syz [ 330.911924][ T436] usb 9-1: Manufacturer: syz [ 330.916584][ T436] usb 9-1: SerialNumber: syz [ 331.079408][ T458] usb 10-1: new high-speed USB device number 77 using dummy_hcd [ 331.100421][ T458] usb 10-1: device descriptor read/8, error -71 [ 331.240420][ T458] usb 10-1: device descriptor read/8, error -71 [ 331.316846][ T36] audit: type=1400 audit(1785918499.659:1831): avc: denied { create } for pid=12493 comm="syz.1.4950" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_scsitransport_socket permissive=1 [ 331.341725][ T36] audit: type=1400 audit(1785918499.689:1832): avc: denied { map } for pid=12493 comm="syz.1.4950" path="/proc/233/net/udp" dev="proc" ino=4026532574 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_net_t tclass=file permissive=1 [ 331.499402][ T458] usb 10-1: new high-speed USB device number 78 using dummy_hcd [ 331.530372][ T458] usb 10-1: device descriptor read/8, error -71 [ 331.671163][ T458] usb 10-1: device descriptor read/8, error -71 [ 331.700590][ T3928] usb 2-1: new high-speed USB device number 27 using dummy_hcd [ 331.779575][ T458] usb usb10-port1: unable to enumerate USB device [ 331.839409][ T3928] usb 2-1: device descriptor read/64, error -71 [ 332.099390][ T3928] usb 2-1: device descriptor read/64, error -71 [ 332.359400][ T3928] usb 2-1: new high-speed USB device number 28 using dummy_hcd [ 332.489444][ T3928] usb 2-1: device descriptor read/64, error -71 [ 332.739367][ T3928] usb 2-1: device descriptor read/64, error -71 [ 332.849480][ T3928] usb usb2-port1: attempt power cycle [ 333.085422][T12513] netlink: 12 bytes leftover after parsing attributes in process `syz.9.4957'. [ 333.108188][ T36] audit: type=1400 audit(1785918501.449:1833): avc: denied { read } for pid=12514 comm="syz.9.4958" name="file1" dev="tmpfs" ino=2743 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 333.115971][T12515] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 333.140810][T12515] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 333.154821][ T36] audit: type=1400 audit(1785918501.449:1834): avc: denied { watch } for pid=12514 comm="syz.9.4958" path="/519/file1" dev="tmpfs" ino=2743 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 333.209380][ T3928] usb 2-1: new high-speed USB device number 29 using dummy_hcd [ 333.230418][ T3928] usb 2-1: device descriptor read/8, error -71 [ 333.358463][ T436] usb 9-1: unit 3 not found! [ 333.369899][ T3928] usb 2-1: device descriptor read/8, error -71 [ 333.382716][ T436] usb 9-1: USB disconnect, device number 66 [ 333.439104][T12521] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 333.439129][T12521] rust_binder: Read failure Err(EFAULT) in pid:1027 [ 333.448155][T12521] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 333.455000][T12521] rust_binder: Read failure Err(EFAULT) in pid:1027 [ 333.463635][T12521] rust_binder: 12520:12521 FDA parent offset not aligned correctly [ 333.478592][T12521] rust_binder: 12520:12521 error while translating object: EINVAL [ 333.486691][T12521] rust_binder: Failure in copy_transaction_data: EINVAL [ 333.486719][T12521] rust_binder: 12520:12521 transaction call to 12520:0 failed EINVAL, code 8448 size 112-24 [ 333.504668][ T1786] rust_binder: 12520: undelivered TRANSACTION_ERROR: 29201 [ 333.629371][ T3928] usb 2-1: new high-speed USB device number 30 using dummy_hcd [ 333.661425][ T3928] usb 2-1: device descriptor read/8, error -71 [ 333.698220][T12525] rust_binder: Failure in copy_transaction_data: EINVAL [ 333.698250][T12525] rust_binder: 12524:12525 transaction async to 12524:0 failed EINVAL, code 0 size 0-24 [ 333.715669][ T1786] rust_binder: 12524: undelivered TRANSACTION_COMPLETE [ 333.727949][ T1786] rust_binder: 12524: undelivered TRANSACTION_ERROR: 29201 [ 333.735396][ T65] rust_binder: 12524: undelivered transaction 482, process died [ 333.749077][T12527] bridge_slave_0: default FDB implementation only supports local addresses [ 333.790403][ T3928] usb 2-1: device descriptor read/8, error -71 [ 333.889394][ T436] usb 9-1: new full-speed USB device number 67 using dummy_hcd [ 333.899587][ T3928] usb usb2-port1: unable to enumerate USB device [ 333.943492][T12538] netlink: 12 bytes leftover after parsing attributes in process `syz.9.4967'. [ 334.040844][ T436] usb 9-1: unable to get BOS descriptor or descriptor too short [ 334.049013][ T436] usb 9-1: not running at top speed; connect to a high speed hub [ 334.067250][ T436] usb 9-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 120, changing to 4 [ 334.090865][T12543] tipc: Enabling of bearer rejected, failed to enable media [ 334.099262][ T436] usb 9-1: New USB device found, idVendor=0b05, idProduct=1743, bcdDevice= 0.40 [ 334.125732][ T436] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 334.139381][ T436] usb 9-1: Product: syz [ 334.143577][ T436] usb 9-1: Manufacturer: syz [ 334.158361][ T436] usb 9-1: SerialNumber: syz [ 334.212522][T12545] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 334.239601][T12545] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 334.341832][T12547] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4970'. [ 334.377010][ T436] usb 9-1: 1:1 : unknown format tag 0x5 is detected. processed as MPEG. [ 334.385559][ T436] usb 9-1: found format II with max.bitrate = 512, frame size=4095 [ 334.394642][ T436] usb 9-1: 1:1 : unknown format tag 0x5 is detected. processed as MPEG. [ 334.403350][ T436] usb 9-1: found format II with max.bitrate = 512, frame size=4095 [ 334.413280][ T436] usb 9-1: 2:1: invalid format type 0x1002 is detected, processed as PCM [ 334.431416][ T436] usb 9-1: USB disconnect, device number 67 [ 334.454151][ T689] udevd[689]: error opening ATTR{/sys/devices/platform/dummy_hcd.8/usb9/9-1/9-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 334.477686][T12549] netlink: 28 bytes leftover after parsing attributes in process `syz.1.4971'. [ 334.749397][ T3928] usb 2-1: new high-speed USB device number 31 using dummy_hcd [ 334.909372][ T3928] usb 2-1: Using ep0 maxpacket: 16 [ 334.920469][ T3928] usb 2-1: config 0 interface 0 altsetting 254 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 334.938070][ T3928] usb 2-1: config 0 interface 0 has no altsetting 0 [ 334.945790][ T3928] usb 2-1: New USB device found, idVendor=056a, idProduct=0028, bcdDevice= 0.00 [ 334.967342][ T3928] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 334.976730][ T3928] usb 2-1: config 0 descriptor?? [ 334.982281][T12555] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 334.982300][T12555] rust_binder: Read failure Err(EFAULT) in pid:1267 [ 334.991332][T12555] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 334.991541][ T3928] usbhid 2-1:0.0: couldn't find an input interrupt endpoint [ 334.997941][T12555] rust_binder: Read failure Err(EFAULT) in pid:1267 [ 334.998280][T12555] rust_binder: 12554:12555 FDA parent offset not aligned correctly [ 335.036206][T12555] rust_binder: 12554:12555 error while translating object: EINVAL [ 335.048463][T12555] rust_binder: Failure in copy_transaction_data: EINVAL [ 335.048497][T12555] rust_binder: 12554:12555 transaction call to 12554:0 failed EINVAL, code 10240 size 112-24 [ 335.074818][ T1786] rust_binder: 12554: undelivered TRANSACTION_ERROR: 29201 [ 335.146826][T12561] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 335.155958][T12561] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 335.304169][T12569] x_tables: unsorted underflow at hook 3 [ 335.350693][T12573] netlink: 12 bytes leftover after parsing attributes in process `syz.8.4982'. [ 335.719382][ T3928] usb 9-1: new high-speed USB device number 68 using dummy_hcd [ 335.750668][T12584] overlayfs: workdir and upperdir must be separate subtrees [ 335.827685][T12588] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 335.827713][T12588] rust_binder: Read failure Err(EFAULT) in pid:1276 [ 335.836548][T12588] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 335.844747][T12588] rust_binder: Read failure Err(EFAULT) in pid:1276 [ 335.853175][T12588] rust_binder: 12587:12588 FDA parent offset not aligned correctly [ 335.869644][T12588] rust_binder: 12587:12588 error while translating object: EINVAL [ 335.877518][T12588] rust_binder: Failure in copy_transaction_data: EINVAL [ 335.877550][T12588] rust_binder: 12587:12588 transaction call to 12587:0 failed EINVAL, code 19456 size 112-24 [ 335.890400][ T3928] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 335.895404][ T65] rust_binder: 12587: undelivered TRANSACTION_ERROR: 29201 [ 335.918587][ T3928] usb 9-1: config 1 interface 0 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0 [ 335.937332][T12592] veth1_to_bond: entered allmulticast mode [ 335.939725][ T3928] usb 9-1: config 1 interface 0 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 4 [ 335.943930][T12591] veth1_to_bond: left allmulticast mode [ 335.974042][ T3928] usb 9-1: New USB device found, idVendor=174c, idProduct=55aa, bcdDevice= 1.00 [ 335.983454][ T3928] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 335.992678][ T3928] usb 9-1: Product: syz [ 335.997033][ T3928] usb 9-1: Manufacturer: syz [ 336.001911][ T3928] usb 9-1: SerialNumber: syz [ 336.012882][ T3928] usb-storage 9-1:1.0: USB Mass Storage device detected [ 336.030521][ T3928] usb-storage 9-1:1.0: Quirks match for vid 174c pid 55aa: 400000 [ 336.039271][ T3928] scsi host1: usb-storage 9-1:1.0 [ 336.199596][T12611] netlink: 'syz.9.4997': attribute type 4 has an invalid length. [ 336.212294][T12611] netlink: 'syz.9.4997': attribute type 4 has an invalid length. [ 336.229229][ T436] usb 9-1: USB disconnect, device number 68 [ 336.244403][T12611] netlink: 'syz.9.4997': attribute type 4 has an invalid length. [ 336.285787][T12613] netlink: 28 bytes leftover after parsing attributes in process `syz.9.4998'. [ 336.358699][T12621] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 336.358722][T12621] rust_binder: Read failure Err(EFAULT) in pid:1306 [ 336.369295][T12621] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 336.376337][T12621] rust_binder: Read failure Err(EFAULT) in pid:1306 [ 336.385188][T12621] rust_binder: 12620:12621 FDA parent offset not aligned correctly [ 336.400192][T12621] rust_binder: 12620:12621 error while translating object: EINVAL [ 336.408124][T12621] rust_binder: Failure in copy_transaction_data: EINVAL [ 336.408155][T12621] rust_binder: 12620:12621 transaction call to 12620:0 failed EINVAL, code 28672 size 112-24 [ 336.426399][ T65] rust_binder: 12620: undelivered TRANSACTION_ERROR: 29201 [ 336.618541][T12633] kvm: pic: single mode not supported [ 336.618560][T12633] kvm: pic: level sensitive irq not supported [ 336.818454][T12645] netlink: 28 bytes leftover after parsing attributes in process `syz.9.5010'. [ 336.898627][T12654] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 336.898652][T12654] rust_binder: Read failure Err(EFAULT) in pid:1056 [ 336.910653][T12654] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 336.917756][T12654] rust_binder: Read failure Err(EFAULT) in pid:1056 [ 336.926438][T12654] rust_binder: 12653:12654 FDA parent offset not aligned correctly [ 336.943151][T12654] rust_binder: 12653:12654 error while translating object: EINVAL [ 336.952490][T12654] rust_binder: Failure in copy_transaction_data: EINVAL [ 336.952523][T12654] rust_binder: 12653:12654 transaction call to 12653:0 failed EINVAL, code 30720 size 112-24 [ 336.980415][ T436] rust_binder: 12653: undelivered TRANSACTION_ERROR: 29201 [ 337.042398][T12661] kvm: pic: single mode not supported [ 337.042417][T12661] kvm: pic: level sensitive irq not supported [ 337.130088][T12668] loop8: detected capacity change from 0 to 7 [ 337.150480][T12674] fuse: Bad value for 'fd' [ 337.156152][T12674] configfs-gadget.g1 gadget.0: uvc: uvc_function_bind() [ 337.163218][T12674] configfs-gadget.g1 gadget.0: uvc: Unable to allocate streaming EP [ 337.175816][ T323] Buffer I/O error on dev loop8, logical block 0, async page read [ 337.186655][T12674] udc dummy_udc.0: failed to start g1: -22 [ 337.189550][ T36] audit: type=1400 audit(1785918505.529:1835): avc: denied { setattr } for pid=12667 comm="syz.8.5019" name="NETLINK" dev="sockfs" ino=79447 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 337.192793][ T323] Buffer I/O error on dev loop8, logical block 0, async page read [ 337.225923][T12674] configfs-gadget.g1 gadget.0: probe with driver configfs-gadget.g1 failed with error -22 [ 337.238202][T12674] UDC core: g1: couldn't find an available UDC or it's busy [ 337.250344][ T323] Buffer I/O error on dev loop8, logical block 0, async page read [ 337.264290][ T323] Buffer I/O error on dev loop8, logical block 0, async page read [ 337.272383][T12677] netlink: 24 bytes leftover after parsing attributes in process `syz.8.5022'. [ 337.281576][ T323] Buffer I/O error on dev loop8, logical block 0, async page read [ 337.289869][ T323] Buffer I/O error on dev loop8, logical block 0, async page read [ 337.299539][ T323] Buffer I/O error on dev loop8, logical block 0, async page read [ 337.308115][ T323] Buffer I/O error on dev loop8, logical block 0, async page read [ 337.321881][ T323] Buffer I/O error on dev loop8, logical block 0, async page read [ 337.323596][T12679] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 337.330145][ T323] Buffer I/O error on dev loop8, logical block 0, async page read [ 337.348433][T12679] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 337.365602][T12679] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 337.377397][T12679] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 337.430936][T12685] netlink: 12 bytes leftover after parsing attributes in process `syz.8.5026'. [ 337.509516][ T65] usb 2-1: USB disconnect, device number 31 [ 337.789410][ T1786] usb 9-1: new high-speed USB device number 69 using dummy_hcd [ 337.859441][ T65] usb 2-1: new high-speed USB device number 32 using dummy_hcd [ 337.969367][ T1786] usb 9-1: Using ep0 maxpacket: 16 [ 337.977160][ T1786] usb 9-1: config 0 has an invalid interface number: 105 but max is 0 [ 337.985403][ T1786] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 337.995542][ T1786] usb 9-1: config 0 has no interface number 0 [ 338.006691][ T1786] usb 9-1: New USB device found, idVendor=046d, idProduct=08d3, bcdDevice= b.28 [ 338.020620][ T65] usb 2-1: Using ep0 maxpacket: 16 [ 338.029352][ T1786] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 338.037350][ T1786] usb 9-1: Product: syz [ 338.049212][ T1786] usb 9-1: Manufacturer: syz [ 338.053961][ T1786] usb 9-1: SerialNumber: syz [ 338.059521][ T65] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 338.079615][ T1786] usb 9-1: config 0 descriptor?? [ 338.086287][ T65] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 338.101189][ T65] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= f.89 [ 338.116213][ T65] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 338.124342][ T65] usb 2-1: SerialNumber: syz [ 338.137161][ T65] usb 2-1: cannot find UAC_HEADER [ 338.147305][ T65] snd-usb-audio 2-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 338.163578][ T323] udevd[323]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 338.193521][T12698] netlink: 8 bytes leftover after parsing attributes in process `syz.9.5031'. [ 338.259163][T12702] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 338.259188][T12702] rust_binder: Read failure Err(EFAULT) in pid:1362 [ 338.268148][T12702] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 338.274846][T12702] rust_binder: Read failure Err(EFAULT) in pid:1362 [ 338.283328][T12702] rust_binder: 12701:12702 FDA parent offset not aligned correctly [ 338.297941][T12702] rust_binder: 12701:12702 error while translating object: EINVAL [ 338.297972][ T65] usb 9-1: USB disconnect, device number 69 [ 338.306001][T12702] rust_binder: Failure in copy_transaction_data: EINVAL [ 338.311841][T12702] rust_binder: 12701:12702 transaction call to 12701:0 failed EINVAL, code 59391 size 112-24 [ 338.331856][ T3928] rust_binder: 12701: undelivered TRANSACTION_ERROR: 29201 [ 338.396501][ T36] audit: type=1400 audit(1785918506.739:1836): avc: denied { write } for pid=12709 comm="syz.9.5037" name=".pending_reads" dev="incremental-fs" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 338.423744][ T3928] usb 2-1: USB disconnect, device number 32 [ 338.433688][ T36] audit: type=1326 audit(1785918506.779:1837): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12709 comm="syz.9.5037" exe="/root/ci2-android-6-12-rust/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f6359d9e019 code=0x250000 [ 338.886006][T12715] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 338.896166][T12715] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 338.906613][T12715] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 338.925240][T12715] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 338.939738][T12719] netlink: 24 bytes leftover after parsing attributes in process `syz.1.5041'. [ 338.969998][T12717] netlink: 8 bytes leftover after parsing attributes in process `syz.8.5040'. [ 339.009376][T12717] netlink: 32 bytes leftover after parsing attributes in process `syz.8.5040'. [ 339.154633][T12731] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5046'. [ 339.329381][ T3928] usb 9-1: new full-speed USB device number 70 using dummy_hcd [ 339.490709][ T3928] usb 9-1: unable to get BOS descriptor or descriptor too short [ 339.501286][ T3928] usb 9-1: not running at top speed; connect to a high speed hub [ 339.509961][ T3928] usb 9-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 120, changing to 4 [ 339.522568][ T3928] usb 9-1: New USB device found, idVendor=0e41, idProduct=3020, bcdDevice= 0.40 [ 339.531987][ T3928] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 339.540176][ T3928] usb 9-1: Product: syz [ 339.544430][ T3928] usb 9-1: Manufacturer: syz [ 339.549036][ T3928] usb 9-1: SerialNumber: syz [ 339.636421][T12743] syzkaller0: entered promiscuous mode [ 339.642300][T12743] syzkaller0: entered allmulticast mode [ 339.722138][T12745] netlink: 24 bytes leftover after parsing attributes in process `syz.1.5053'. [ 339.792120][T12757] usb usb7: usbfs: process 12757 (syz.9.5052) did not claim interface 0 before use [ 340.600504][T12764] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5059'. [ 340.925960][T12773] netlink: 12 bytes leftover after parsing attributes in process `syz.9.5062'. [ 340.948238][T12775] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 340.948280][T12775] rust_binder: Read failure Err(EFAULT) in pid:1387 [ 340.957422][T12775] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 340.964355][T12775] rust_binder: Read failure Err(EFAULT) in pid:1387 [ 340.972609][T12018] usb 2-1: new full-speed USB device number 33 using dummy_hcd [ 340.987372][T12775] rust_binder: 12774:12775 FDA parent offset not aligned correctly [ 340.995776][T12775] rust_binder: 12774:12775 error while translating object: EINVAL [ 341.004138][T12775] rust_binder: Failure in copy_transaction_data: EINVAL [ 341.004168][T12775] rust_binder: 12774:12775 transaction call to 12774:0 failed EINVAL, code 63743 size 112-24 [ 341.022253][ T436] rust_binder: 12774: undelivered TRANSACTION_ERROR: 29201 [ 341.058872][ T1530] Bluetooth: hci0: sending frame failed (-49) [ 341.065118][ T53] Bluetooth: hci0: Opcode 0x1003 failed: -49 [ 341.152109][T12018] usb 2-1: unable to get BOS descriptor or descriptor too short [ 341.160290][T12018] usb 2-1: not running at top speed; connect to a high speed hub [ 341.170604][T12018] usb 2-1: New USB device found, idVendor=13e5, idProduct=0001, bcdDevice= 0.40 [ 341.182220][T12018] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 341.191493][T12018] usb 2-1: Product: syz [ 341.196128][T12018] usb 2-1: Manufacturer: syz [ 341.201206][T12018] usb 2-1: SerialNumber: syz [ 341.209599][T12783] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 341.220713][T12783] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 341.412675][T12770] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 341.423484][T12770] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 341.614501][T12018] usb 2-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 341.625995][T12018] usb 2-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 341.638009][T12018] usb 2-1: USB disconnect, device number 33 [ 341.654318][ T323] udevd[323]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 342.156652][ T3928] usb 9-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 342.169572][ T3928] usb 9-1: 2:1: invalid format type 0x1002 is detected, processed as PCM [ 342.178061][ T3928] usb 9-1: 2:1: All rates were zero [ 342.212759][ T3928] usb 9-1: USB disconnect, device number 70 [ 342.457154][T12825] netlink: 8 bytes leftover after parsing attributes in process `syz.9.5085'. [ 342.511203][ T45] usb 2-1: new high-speed USB device number 34 using dummy_hcd [ 342.669372][ T45] usb 2-1: Using ep0 maxpacket: 32 [ 342.675612][ T45] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 342.686853][ T45] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 342.696861][ T45] usb 2-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 342.706155][ T45] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 342.715157][ T45] usb 2-1: config 0 descriptor?? [ 342.727144][ T45] hub 2-1:0.0: USB hub found [ 342.925325][ T45] hub 2-1:0.0: 1 port detected [ 343.328798][ T45] usb 2-1: USB disconnect, device number 34 [ 343.417692][T12837] netlink: 6 bytes leftover after parsing attributes in process `syz.9.5090'. [ 343.502084][T12849] netlink: 'syz.9.5095': attribute type 4 has an invalid length. [ 343.522841][ T36] audit: type=1400 audit(1785918511.869:1838): avc: denied { mounton } for pid=12847 comm="syz.9.5095" path="/593/proc" dev="proc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=dir permissive=1 [ 343.709644][T12863] netlink: 'syz.9.5101': attribute type 46 has an invalid length. [ 343.741388][T12867] netlink: 12 bytes leftover after parsing attributes in process `syz.9.5102'. [ 343.785880][T12865] bridge0: port 1(bridge_slave_0) entered blocking state [ 343.786142][T12871] netlink: 20 bytes leftover after parsing attributes in process `syz.9.5104'. [ 343.793034][T12865] bridge0: port 1(bridge_slave_0) entered disabled state [ 343.809775][T12865] bridge_slave_0: entered allmulticast mode [ 343.816292][T12865] bridge_slave_0: entered promiscuous mode [ 343.827986][T12865] bridge0: port 2(bridge_slave_1) entered blocking state [ 343.835937][T12865] bridge0: port 2(bridge_slave_1) entered disabled state [ 343.844044][T12865] bridge_slave_1: entered allmulticast mode [ 343.850293][T12865] bridge_slave_1: entered promiscuous mode [ 343.856326][ T576] bridge_slave_1: left allmulticast mode [ 343.863816][ T576] bridge_slave_1: left promiscuous mode [ 343.869635][ T576] bridge0: port 2(bridge_slave_1) entered disabled state [ 343.877235][ T576] bridge_slave_0: left allmulticast mode [ 343.884133][ T576] bridge_slave_0: left promiscuous mode [ 343.890331][ T576] bridge0: port 1(bridge_slave_0) entered disabled state [ 344.002413][ T576] veth1_macvtap: left promiscuous mode [ 344.007965][ T576] veth0_vlan: left promiscuous mode [ 344.073464][T12890] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 344.082340][T12890] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 344.093666][T12865] bridge0: port 2(bridge_slave_1) entered blocking state [ 344.100734][T12865] bridge0: port 2(bridge_slave_1) entered forwarding state [ 344.108044][T12865] bridge0: port 1(bridge_slave_0) entered blocking state [ 344.115110][T12865] bridge0: port 1(bridge_slave_0) entered forwarding state [ 344.147031][ T787] bridge0: port 1(bridge_slave_0) entered disabled state [ 344.157357][ T787] bridge0: port 2(bridge_slave_1) entered disabled state [ 344.168696][ T787] bridge0: port 1(bridge_slave_0) entered blocking state [ 344.175767][ T787] bridge0: port 1(bridge_slave_0) entered forwarding state [ 344.183419][ T787] bridge0: port 2(bridge_slave_1) entered blocking state [ 344.190485][ T787] bridge0: port 2(bridge_slave_1) entered forwarding state [ 344.223154][T12865] veth0_vlan: entered promiscuous mode [ 344.235733][T12865] veth1_macvtap: entered promiscuous mode [ 344.291014][T12901] netlink: 44 bytes leftover after parsing attributes in process `syz.0.5098'. [ 344.390697][T12905] netlink: 8 bytes leftover after parsing attributes in process `syz.8.5116'. [ 344.499400][ T3928] usb 2-1: new full-speed USB device number 35 using dummy_hcd [ 344.666056][ T3928] usb 2-1: unable to get BOS descriptor or descriptor too short [ 344.674411][ T3928] usb 2-1: not running at top speed; connect to a high speed hub [ 344.691371][ T3928] usb 2-1: New USB device found, idVendor=13e5, idProduct=0001, bcdDevice= 0.40 [ 344.702575][ T3928] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 344.719362][ T3928] usb 2-1: Product: syz [ 344.723863][ T3928] usb 2-1: Manufacturer: syz [ 344.728457][ T3928] usb 2-1: SerialNumber: syz [ 344.784158][T12911] bridge0: port 1(bridge_slave_0) entered blocking state [ 344.791360][T12911] bridge0: port 1(bridge_slave_0) entered disabled state [ 344.801780][T12911] bridge_slave_0: entered allmulticast mode [ 344.809719][T12911] bridge_slave_0: entered promiscuous mode [ 344.820441][T12911] bridge0: port 2(bridge_slave_1) entered blocking state [ 344.830998][T12911] bridge0: port 2(bridge_slave_1) entered disabled state [ 344.838148][T12911] bridge_slave_1: entered allmulticast mode [ 344.844559][T12911] bridge_slave_1: entered promiscuous mode [ 344.889306][T12911] bridge0: port 2(bridge_slave_1) entered blocking state [ 344.896421][T12911] bridge0: port 2(bridge_slave_1) entered forwarding state [ 344.903719][T12911] bridge0: port 1(bridge_slave_0) entered blocking state [ 344.910758][T12911] bridge0: port 1(bridge_slave_0) entered forwarding state [ 344.935225][ T297] bridge0: port 1(bridge_slave_0) entered disabled state [ 344.944000][T12898] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 344.955465][ T297] bridge0: port 2(bridge_slave_1) entered disabled state [ 344.957097][T12898] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 344.975237][ T297] bridge0: port 1(bridge_slave_0) entered blocking state [ 344.982315][ T297] bridge0: port 1(bridge_slave_0) entered forwarding state [ 344.991795][ T570] bridge0: port 2(bridge_slave_1) entered blocking state [ 344.998830][ T570] bridge0: port 2(bridge_slave_1) entered forwarding state [ 345.031033][T12911] veth0_vlan: entered promiscuous mode [ 345.045133][T12911] veth1_macvtap: entered promiscuous mode [ 345.153385][ T3928] usb 2-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 345.161167][ T3928] usb 2-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 345.170068][ T3928] usb 2-1: USB disconnect, device number 35 [ 345.750038][T12964] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5137'. [ 345.879384][ T458] usb 10-1: new high-speed USB device number 79 using dummy_hcd [ 345.909669][ T3928] usb 9-1: new high-speed USB device number 71 using dummy_hcd [ 346.029391][ T458] usb 10-1: Using ep0 maxpacket: 16 [ 346.035685][ T458] usb 10-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 346.045892][ T458] usb 10-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 346.049391][ T45] usb 2-1: new high-speed USB device number 36 using dummy_hcd [ 346.055601][ T458] usb 10-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= f.89 [ 346.071569][ T458] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 346.079917][ T458] usb 10-1: SerialNumber: syz [ 346.086485][ T458] usb 10-1: cannot find UAC_HEADER [ 346.090542][ T3928] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 346.093891][ T458] snd-usb-audio 10-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 346.102583][ T3928] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 346.118264][ T323] udevd[323]: error opening ATTR{/sys/devices/platform/dummy_hcd.9/usb10/10-1/10-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 346.121310][ T3928] usb 9-1: New USB device found, idVendor=1e7d, idProduct=30d4, bcdDevice= 0.01 [ 346.146341][ T3928] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 346.155432][ T3928] usb 9-1: config 0 descriptor?? [ 346.239405][ T45] usb 2-1: Using ep0 maxpacket: 32 [ 346.245571][ T45] usb 2-1: config 0 has an invalid interface number: 67 but max is 0 [ 346.253711][ T45] usb 2-1: config 0 has no interface number 0 [ 346.261032][ T45] usb 2-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 346.270102][ T45] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 346.278093][ T45] usb 2-1: Product: syz [ 346.282264][ T45] usb 2-1: Manufacturer: syz [ 346.286870][ T45] usb 2-1: SerialNumber: syz [ 346.292836][ T45] usb 2-1: config 0 descriptor?? [ 346.298981][ T45] smsc95xx v2.0.0 [ 346.330390][T12018] usb 10-1: USB disconnect, device number 79 [ 346.563474][ T3928] arvo 0003:1E7D:30D4.0046: unknown main item tag 0x0 [ 346.570390][ T3928] arvo 0003:1E7D:30D4.0046: unknown main item tag 0x0 [ 346.577167][ T3928] arvo 0003:1E7D:30D4.0046: unknown main item tag 0x0 [ 346.583953][ T3928] arvo 0003:1E7D:30D4.0046: unknown main item tag 0x0 [ 346.590990][ T3928] arvo 0003:1E7D:30D4.0046: unknown main item tag 0x0 [ 346.597760][ T3928] arvo 0003:1E7D:30D4.0046: unknown main item tag 0x0 [ 346.604547][ T3928] arvo 0003:1E7D:30D4.0046: unknown main item tag 0x0 [ 346.611999][ T3928] arvo 0003:1E7D:30D4.0046: hidraw0: USB HID v0.00 Device [HID 1e7d:30d4] on usb-dummy_hcd.8-1/input0 [ 346.699547][ T45] smsc95xx 2-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -32 [ 346.710561][ T45] smsc95xx 2-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 346.921699][ T45] smsc95xx 2-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -71 [ 346.933570][ T45] smsc95xx 2-1:0.67: probe with driver smsc95xx failed with error -71 [ 346.945874][ T45] usb 2-1: USB disconnect, device number 36 [ 346.976184][ T311] usb 9-1: USB disconnect, device number 71 [ 347.199385][ T3928] usb 10-1: new high-speed USB device number 80 using dummy_hcd [ 347.349577][ T3928] usb 10-1: Using ep0 maxpacket: 32 [ 347.356114][ T3928] usb 10-1: unable to get BOS descriptor or descriptor too short [ 347.364627][ T3928] usb 10-1: config 1 has an invalid interface number: 242 but max is 2 [ 347.373216][ T3928] usb 10-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 347.385310][ T3928] usb 10-1: config 1 has no interface number 2 [ 347.394591][ T3928] usb 10-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 347.405657][ T3928] usb 10-1: config 1 interface 1 has no altsetting 0 [ 347.414794][ T3928] usb 10-1: New USB device found, idVendor=0499, idProduct=1509, bcdDevice= 0.40 [ 347.424130][ T3928] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 347.433478][ T3928] usb 10-1: Product: syz [ 347.437736][ T3928] usb 10-1: Manufacturer: syz [ 347.442609][ T3928] usb 10-1: SerialNumber: syz [ 347.587818][T12990] syzkaller1: entered promiscuous mode [ 347.589215][T12992] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 347.593508][T12992] rust_binder: Read failure Err(EFAULT) in pid:14 [ 347.593651][T12990] syzkaller1: entered allmulticast mode [ 347.604017][T12992] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 347.613664][T12992] rust_binder: Read failure Err(EFAULT) in pid:14 [ 347.623483][T12992] rust_binder: 12991:12992 FDA parent offset not aligned correctly [ 347.637839][T12992] rust_binder: 12991:12992 error while translating object: EINVAL [ 347.645843][T12992] rust_binder: Failure in copy_transaction_data: EINVAL [ 347.645866][T12992] rust_binder: 12991:12992 transaction call to 12991:0 failed EINVAL, code 65531 size 112-24 [ 347.682161][T12018] rust_binder: 12991: undelivered TRANSACTION_ERROR: 29201 [ 347.699356][ T311] usb 2-1: new full-speed USB device number 37 using dummy_hcd [ 347.812667][T13016] netlink: 8 bytes leftover after parsing attributes in process `syz.9.5158'. [ 347.870965][ T311] usb 2-1: unable to get BOS descriptor or descriptor too short [ 347.881113][ T311] usb 2-1: not running at top speed; connect to a high speed hub [ 347.891096][ T3928] usb 10-1: 1:1 : no or invalid class specific endpoint descriptor [ 347.907198][ T3928] usb 10-1: 1:1 : unsupported format bits 0x2004 [ 347.915405][ T3928] usb 10-1: parse_audio_format_rates_v2v3(): unable to find clock source (clock -22) [ 347.925167][ T311] usb 2-1: New USB device found, idVendor=13e5, idProduct=0001, bcdDevice= 0.40 [ 347.934290][ T311] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 347.943212][ T3928] usb 10-1: selecting invalid altsetting 0 [ 347.949361][ T311] usb 2-1: Product: syz [ 347.953733][ T311] usb 2-1: Manufacturer: syz [ 347.958743][ T3928] usb 10-1: selecting invalid altsetting 0 [ 347.965950][ T311] usb 2-1: SerialNumber: syz [ 347.977966][ T3928] usb 10-1: USB disconnect, device number 80 [ 348.039260][T13037] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 348.039283][T13037] rust_binder: Read failure Err(EFAULT) in pid:1186 [ 348.050745][T13037] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 348.057371][T13037] rust_binder: Read failure Err(EFAULT) in pid:1186 [ 348.065787][T13037] rust_binder: 13036:13037 FDA parent offset not aligned correctly [ 348.080391][T13037] rust_binder: 13036:13037 error while translating object: EINVAL [ 348.088292][T13037] rust_binder: Failure in copy_transaction_data: EINVAL [ 348.088315][T13037] rust_binder: 13036:13037 transaction call to 13036:0 failed EINVAL, code 65533 size 112-24 [ 348.106059][ T45] rust_binder: 13036: undelivered TRANSACTION_ERROR: 29201 [ 348.131933][T13044] block device autoloading is deprecated and will be removed. [ 348.178143][T12983] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 348.186644][T12983] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 348.343025][ T311] usb 2-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 348.360070][ T311] usb 2-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 348.368698][ T311] usb 2-1: USB disconnect, device number 37 [ 348.384553][ T323] udevd[323]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 348.739399][ T3928] usb 9-1: new high-speed USB device number 72 using dummy_hcd [ 348.869559][ T3928] usb 9-1: device descriptor read/64, error -71 [ 348.921135][T13086] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 348.921159][T13086] rust_binder: Read failure Err(EFAULT) in pid:32 [ 348.929902][T13086] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 348.936314][T13086] rust_binder: Read failure Err(EFAULT) in pid:32 [ 348.944734][T13086] rust_binder: 13085:13086 FDA parent offset not aligned correctly [ 348.959458][T13086] rust_binder: 13085:13086 error while translating object: EINVAL [ 348.967305][T13086] rust_binder: Failure in copy_transaction_data: EINVAL [ 348.967331][T13086] rust_binder: 13085:13086 transaction call to 13085:0 failed EINVAL, code 16777216 size 112-24 [ 348.968037][T13089] tipc: Enabling of bearer rejected, failed to enable media [ 348.974890][ T458] rust_binder: 13085: undelivered TRANSACTION_ERROR: 29201 [ 348.988682][T13089] IPv6: Can't replace route, no match found [ 349.008524][ T45] usb 10-1: new high-speed USB device number 81 using dummy_hcd [ 349.109376][ T3928] usb 9-1: device descriptor read/64, error -71 [ 349.171815][ T45] usb 10-1: unable to get BOS descriptor or descriptor too short [ 349.180538][ T45] usb 10-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 349.191099][ T45] usb 10-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 349.201813][ T45] usb 10-1: New USB device found, idVendor=1235, idProduct=0010, bcdDevice= 0.40 [ 349.210989][ T45] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 349.219220][ T45] usb 10-1: Product: syz [ 349.223535][ T45] usb 10-1: Manufacturer: syz [ 349.228215][ T45] usb 10-1: SerialNumber: syz [ 349.235351][ T45] usb 10-1: selecting invalid altsetting 1 [ 349.241323][ T45] usb 10-1: unit 6 not found! [ 349.259385][ T311] usb 2-1: new high-speed USB device number 38 using dummy_hcd [ 349.332574][T13100] tipc: Started in network mode [ 349.337478][T13100] tipc: Node identity 0000000000000000032e, cluster identity 4711 [ 349.359597][ T3928] usb 9-1: new high-speed USB device number 73 using dummy_hcd [ 349.410402][ T311] usb 2-1: config index 0 descriptor too short (expected 39, got 27) [ 349.428725][ T311] usb 2-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 349.439014][ T311] usb 2-1: config 0 interface 0 has no altsetting 0 [ 349.450828][ T311] usb 2-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 349.469367][ T311] usb 2-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 349.477602][ T311] usb 2-1: Product: syz [ 349.481926][ T311] usb 2-1: Manufacturer: syz [ 349.486533][ T311] usb 2-1: SerialNumber: syz [ 349.498135][ T311] usb 2-1: config 0 descriptor?? [ 349.503224][ T3928] usb 9-1: device descriptor read/64, error -71 [ 349.511176][ T311] hub 2-1:0.0: bad descriptor, ignoring hub [ 349.517103][ T311] hub 2-1:0.0: probe with driver hub failed with error -5 [ 349.538687][T13112] FAULT_INJECTION: forcing a failure. [ 349.538687][T13112] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 349.551825][T13112] CPU: 1 UID: 0 PID: 13112 Comm: syz.0.5195 Not tainted syzkaller #0 d75e9a393de9c6a33055d5e25749154d2cb9f431 [ 349.551855][T13112] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 349.551866][T13112] Call Trace: [ 349.551872][T13112] [ 349.551881][T13112] __dump_stack+0x21/0x30 [ 349.551915][T13112] dump_stack_lvl+0x140/0x1c0 [ 349.551932][T13112] ? __cfi_dump_stack_lvl+0x10/0x10 [ 349.551946][T13112] ? selinux_file_ioctl+0x732/0x1480 [ 349.551958][T13112] dump_stack+0x19/0x20 [ 349.551971][T13112] should_fail_ex+0x3c2/0x510 [ 349.551983][T13112] should_fail+0xf/0x20 [ 349.551993][T13112] should_fail_usercopy+0x1e/0x30 [ 349.552005][T13112] _copy_from_user+0x20/0xa0 [ 349.552019][T13112] get_user_ifreq+0x70/0x180 [ 349.552031][T13112] sock_ioctl+0x6f3/0x7e0 [ 349.552043][T13112] ? __cfi_sock_ioctl+0x10/0x10 [ 349.552060][T13112] ? bpf_lsm_file_ioctl+0xd/0x20 [ 349.552075][T13112] ? security_file_ioctl+0x3e/0x110 [ 349.552091][T13112] ? __cfi_sock_ioctl+0x10/0x10 [ 349.552102][T13112] __se_sys_ioctl+0x132/0x1b0 [ 349.552115][T13112] __x64_sys_ioctl+0x7f/0xa0 [ 349.552126][T13112] x64_sys_call+0x1878/0x2ee0 [ 349.552136][T13112] do_syscall_64+0x57/0xf0 [ 349.552148][T13112] ? clear_bhb_loop+0x50/0xa0 [ 349.552163][T13112] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 349.552176][T13112] RIP: 0033:0x7fc5a359e019 [ 349.552186][T13112] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 349.552195][T13112] RSP: 002b:00007fc5a44ed028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 349.552208][T13112] RAX: ffffffffffffffda RBX: 00007fc5a3825fa0 RCX: 00007fc5a359e019 [ 349.552216][T13112] RDX: 0000200000001440 RSI: 00000000000089f0 RDI: 0000000000000004 [ 349.552224][T13112] RBP: 00007fc5a44ed090 R08: 0000000000000000 R09: 0000000000000000 [ 349.552231][T13112] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 349.552237][T13112] R13: 00007fc5a3826038 R14: 00007fc5a3825fa0 R15: 00007ffddca0a3f8 [ 349.552246][T13112] [ 349.909221][ T36] audit: type=1326 audit(1785918518.249:1839): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13120 comm="syz.0.5199" exe="/root/ci2-android-6-12-rust/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fc5a359e019 code=0x0 [ 349.934251][ T3928] usb 9-1: device descriptor read/64, error -71 [ 349.963265][T13123] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 349.971838][T13123] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 349.983794][ T45] usb 10-1: 2:0: failed to get current value for ch 0 (-71) [ 349.994580][ T45] snd-usb-audio 10-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 350.003895][ T311] usb 2-1: selecting invalid altsetting 0 [ 350.013550][ T45] usb 10-1: USB disconnect, device number 81 [ 350.023643][ T323] udevd[323]: error opening ATTR{/sys/devices/platform/dummy_hcd.9/usb10/10-1/10-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 350.029821][ T311] usb 2-1: USB disconnect, device number 38 [ 350.049909][ T3928] usb usb9-port1: attempt power cycle [ 350.308844][ T36] audit: type=1400 audit(1785918518.649:1840): avc: denied { accept } for pid=13134 comm="syz.1.5204" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 350.329567][ T45] usb 10-1: new high-speed USB device number 82 using dummy_hcd [ 350.389595][ T3928] usb 9-1: new high-speed USB device number 74 using dummy_hcd [ 350.410576][ T3928] usb 9-1: device descriptor read/8, error -71 [ 350.491249][ T45] usb 10-1: config 0 has no interfaces? [ 350.496893][ T45] usb 10-1: New USB device found, idVendor=0b05, idProduct=17e0, bcdDevice= 0.00 [ 350.506150][ T45] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 350.514880][ T45] usb 10-1: config 0 descriptor?? [ 350.540309][ T3928] usb 9-1: device descriptor read/8, error -71 [ 350.719395][ T1786] usb 2-1: new high-speed USB device number 39 using dummy_hcd [ 350.724785][T13126] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 350.735918][T13126] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 350.744651][ T311] usb 10-1: USB disconnect, device number 82 [ 350.779392][ T3928] usb 9-1: new high-speed USB device number 75 using dummy_hcd [ 350.810668][ T3928] usb 9-1: device descriptor read/8, error -71 [ 350.869551][ T1786] usb 2-1: Using ep0 maxpacket: 16 [ 350.875681][ T1786] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 350.885833][ T1786] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 350.895481][ T1786] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= f.89 [ 350.904564][ T1786] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 350.912595][ T1786] usb 2-1: SerialNumber: syz [ 350.919130][ T1786] usb 2-1: cannot find UAC_HEADER [ 350.925640][ T1786] snd-usb-audio 2-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 350.938714][ T323] udevd[323]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 350.955580][ T3928] usb 9-1: device descriptor read/8, error -71 [ 351.069472][ T3928] usb usb9-port1: unable to enumerate USB device [ 351.160122][ T3928] usb 2-1: USB disconnect, device number 39 [ 351.249654][T13145] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5208'. [ 351.289849][T13155] FAULT_INJECTION: forcing a failure. [ 351.289849][T13155] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 351.302983][T13155] CPU: 1 UID: 0 PID: 13155 Comm: syz.9.5213 Not tainted syzkaller #0 d75e9a393de9c6a33055d5e25749154d2cb9f431 [ 351.303012][T13155] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 351.303024][T13155] Call Trace: [ 351.303030][T13155] [ 351.303038][T13155] __dump_stack+0x21/0x30 [ 351.303058][T13155] dump_stack_lvl+0x140/0x1c0 [ 351.303071][T13155] ? __cfi_dump_stack_lvl+0x10/0x10 [ 351.303086][T13155] ? _parse_integer+0x2e/0x40 [ 351.303097][T13155] dump_stack+0x19/0x20 [ 351.303109][T13155] should_fail_ex+0x3c2/0x510 [ 351.303121][T13155] should_fail+0xf/0x20 [ 351.303132][T13155] should_fail_usercopy+0x1e/0x30 [ 351.303143][T13155] _copy_from_user+0x20/0xa0 [ 351.303157][T13155] ip6_tnl_siocdevprivate+0x4e7/0xe70 [ 351.303239][T13155] ? __cfi_ip6_tnl_siocdevprivate+0x10/0x10 [ 351.303251][T13155] ? proc_fail_nth_write+0x184/0x220 [ 351.303266][T13155] ? full_name_hash+0xa1/0xf0 [ 351.303280][T13155] dev_ifsioc+0x951/0xc10 [ 351.303319][T13155] dev_ioctl+0xa62/0x1000 [ 351.303333][T13155] sock_ioctl+0x74e/0x7e0 [ 351.303346][T13155] ? __cfi_sock_ioctl+0x10/0x10 [ 351.303358][T13155] ? bpf_lsm_file_ioctl+0xd/0x20 [ 351.303371][T13155] ? security_file_ioctl+0x3e/0x110 [ 351.303387][T13155] ? __cfi_sock_ioctl+0x10/0x10 [ 351.303399][T13155] __se_sys_ioctl+0x132/0x1b0 [ 351.303414][T13155] __x64_sys_ioctl+0x7f/0xa0 [ 351.303426][T13155] x64_sys_call+0x1878/0x2ee0 [ 351.303435][T13155] do_syscall_64+0x57/0xf0 [ 351.303447][T13155] ? clear_bhb_loop+0x50/0xa0 [ 351.303462][T13155] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 351.303475][T13155] RIP: 0033:0x7fa0b7f9e019 [ 351.303485][T13155] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 351.303495][T13155] RSP: 002b:00007fa0b8dea028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 351.303508][T13155] RAX: ffffffffffffffda RBX: 00007fa0b8225fa0 RCX: 00007fa0b7f9e019 [ 351.303516][T13155] RDX: 0000200000001440 RSI: 00000000000089f0 RDI: 0000000000000004 [ 351.303523][T13155] RBP: 00007fa0b8dea090 R08: 0000000000000000 R09: 0000000000000000 [ 351.303530][T13155] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 351.303537][T13155] R13: 00007fa0b8226038 R14: 00007fa0b8225fa0 R15: 00007ffdcd97a318 [ 351.303546][T13155] [ 351.582802][T13169] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 351.582824][T13169] rust_binder: Read failure Err(EFAULT) in pid:71 [ 351.593939][T13169] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 351.600737][T13169] rust_binder: Read failure Err(EFAULT) in pid:71 [ 351.609556][T13169] rust_binder: 13167:13169 FDA parent offset not aligned correctly [ 351.623980][T13169] rust_binder: 13167:13169 error while translating object: EINVAL [ 351.633957][T13169] rust_binder: Failure in copy_transaction_data: EINVAL [ 351.633986][T13169] rust_binder: 13167:13169 transaction call to 13167:0 failed EINVAL, code 33554432 size 112-24 [ 351.652267][ T458] rust_binder: 13167: undelivered TRANSACTION_ERROR: 29201 [ 351.665378][T13175] tipc: Started in network mode [ 351.670306][T13175] tipc: Node identity 0000000000000000222e, cluster identity 4711 [ 351.685174][T13177] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 351.685270][T13177] rust_binder: 13176:13177 got transaction to invalid handle 1 [ 351.706456][T13177] rust_binder: 13176:13177 transaction call to 0:0 failed ENOENT, code 0 size 72-0 [ 351.732660][T13177] rust_binder: 13176: undelivered TRANSACTION_ERROR: 29201 [ 351.751469][T13196] FAULT_INJECTION: forcing a failure. [ 351.751469][T13196] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 351.765129][T13199] netlink: 8 bytes leftover after parsing attributes in process `syz.9.5233'. [ 351.774594][T13196] CPU: 1 UID: 0 PID: 13196 Comm: syz.1.5232 Not tainted syzkaller #0 d75e9a393de9c6a33055d5e25749154d2cb9f431 [ 351.774624][T13196] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 351.774635][T13196] Call Trace: [ 351.774641][T13196] [ 351.774649][T13196] __dump_stack+0x21/0x30 [ 351.774680][T13196] dump_stack_lvl+0x140/0x1c0 [ 351.774703][T13196] ? __cfi_dump_stack_lvl+0x10/0x10 [ 351.774729][T13196] dump_stack+0x19/0x20 [ 351.774753][T13196] should_fail_ex+0x3c2/0x510 [ 351.774774][T13196] should_fail+0xf/0x20 [ 351.774792][T13196] should_fail_usercopy+0x1e/0x30 [ 351.774814][T13196] _copy_to_user+0x24/0xa0 [ 351.774837][T13196] ip6_tnl_siocdevprivate+0x3e8/0xe70 [ 351.774859][T13196] ? __cfi_ip6_tnl_siocdevprivate+0x10/0x10 [ 351.774880][T13196] ? proc_fail_nth_write+0x184/0x220 [ 351.774909][T13196] ? full_name_hash+0xa1/0xf0 [ 351.774933][T13196] dev_ifsioc+0x951/0xc10 [ 351.774961][T13196] dev_ioctl+0xa62/0x1000 [ 351.774988][T13196] sock_ioctl+0x74e/0x7e0 [ 351.775009][T13196] ? __cfi_sock_ioctl+0x10/0x10 [ 351.775033][T13196] ? bpf_lsm_file_ioctl+0xd/0x20 [ 351.775057][T13196] ? security_file_ioctl+0x3e/0x110 [ 351.775085][T13196] ? __cfi_sock_ioctl+0x10/0x10 [ 351.775107][T13196] __se_sys_ioctl+0x132/0x1b0 [ 351.775131][T13196] __x64_sys_ioctl+0x7f/0xa0 [ 351.775153][T13196] x64_sys_call+0x1878/0x2ee0 [ 351.775171][T13196] do_syscall_64+0x57/0xf0 [ 351.775193][T13196] ? clear_bhb_loop+0x50/0xa0 [ 351.775219][T13196] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 351.775244][T13196] RIP: 0033:0x7ff17e99e019 [ 351.775261][T13196] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 351.775286][T13196] RSP: 002b:00007ff17f8d8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 351.775308][T13196] RAX: ffffffffffffffda RBX: 00007ff17ec25fa0 RCX: 00007ff17e99e019 [ 351.775324][T13196] RDX: 0000200000001440 RSI: 00000000000089f0 RDI: 0000000000000004 [ 351.775338][T13196] RBP: 00007ff17f8d8090 R08: 0000000000000000 R09: 0000000000000000 [ 351.775351][T13196] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 351.775364][T13196] R13: 00007ff17ec26038 R14: 00007ff17ec25fa0 R15: 00007ffcf19c0c28 [ 351.775382][T13196] [ 351.848046][T13211] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 351.903618][T13212] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 351.906905][T13211] rust_binder: Read failure Err(EFAULT) in pid:1235 [ 351.911561][T13212] rust_binder: Read failure Err(EFAULT) in pid:1235 [ 351.961915][T13211] rust_binder: 13210:13211 FDA parent offset not aligned correctly [ 352.038813][T13211] rust_binder: 13210:13211 error while translating object: EINVAL [ 352.046709][T13211] rust_binder: Failure in copy_transaction_data: EINVAL [ 352.046735][T13211] rust_binder: 13210:13211 transaction call to 13210:0 failed EINVAL, code 50331648 size 112-24 [ 352.067992][ T1786] rust_binder: 13210: undelivered TRANSACTION_ERROR: 29201 [ 352.081300][ T36] audit: type=1326 audit(1785918520.429:1841): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13215 comm="syz.8.5240" exe="/root/ci2-android-6-12-rust/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f013d99e019 code=0x0 [ 352.268715][T13224] tipc: Cannot configure node identity twice [ 352.289404][ T3928] usb 2-1: new high-speed USB device number 40 using dummy_hcd [ 352.314502][T13234] FAULT_INJECTION: forcing a failure. [ 352.314502][T13234] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 352.327690][T13234] CPU: 0 UID: 0 PID: 13234 Comm: syz.9.5248 Not tainted syzkaller #0 d75e9a393de9c6a33055d5e25749154d2cb9f431 [ 352.327717][T13234] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 352.327729][T13234] Call Trace: [ 352.327735][T13234] [ 352.327741][T13234] __dump_stack+0x21/0x30 [ 352.327771][T13234] dump_stack_lvl+0x140/0x1c0 [ 352.327795][T13234] ? __cfi_dump_stack_lvl+0x10/0x10 [ 352.327821][T13234] ? netdev_run_todo+0xc62/0xce0 [ 352.327844][T13234] ? check_stack_object+0x138/0x150 [ 352.327857][T13234] dump_stack+0x19/0x20 [ 352.327870][T13234] should_fail_ex+0x3c2/0x510 [ 352.327882][T13234] should_fail+0xf/0x20 [ 352.327892][T13234] should_fail_usercopy+0x1e/0x30 [ 352.327904][T13234] _copy_to_user+0x24/0xa0 [ 352.327918][T13234] put_user_ifreq+0x7c/0xc0 [ 352.327930][T13234] sock_ioctl+0x77d/0x7e0 [ 352.327941][T13234] ? __cfi_sock_ioctl+0x10/0x10 [ 352.327953][T13234] ? bpf_lsm_file_ioctl+0xd/0x20 [ 352.327969][T13234] ? security_file_ioctl+0x3e/0x110 [ 352.327994][T13234] ? __cfi_sock_ioctl+0x10/0x10 [ 352.328013][T13234] __se_sys_ioctl+0x132/0x1b0 [ 352.328036][T13234] __x64_sys_ioctl+0x7f/0xa0 [ 352.328058][T13234] x64_sys_call+0x1878/0x2ee0 [ 352.328077][T13234] do_syscall_64+0x57/0xf0 [ 352.328098][T13234] ? clear_bhb_loop+0x50/0xa0 [ 352.328120][T13234] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 352.328141][T13234] RIP: 0033:0x7fa0b7f9e019 [ 352.328155][T13234] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 352.328171][T13234] RSP: 002b:00007fa0b8dea028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 352.328190][T13234] RAX: ffffffffffffffda RBX: 00007fa0b8225fa0 RCX: 00007fa0b7f9e019 [ 352.328205][T13234] RDX: 0000200000001440 RSI: 00000000000089f0 RDI: 0000000000000004 [ 352.328220][T13234] RBP: 00007fa0b8dea090 R08: 0000000000000000 R09: 0000000000000000 [ 352.328233][T13234] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 352.328247][T13234] R13: 00007fa0b8226038 R14: 00007fa0b8225fa0 R15: 00007ffdcd97a318 [ 352.328260][T13234] [ 352.539366][ T3928] usb 2-1: Using ep0 maxpacket: 16 [ 352.550617][ T3928] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 352.568537][ T3928] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 352.579097][ T3928] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= f.89 [ 352.588565][ T3928] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 352.596600][ T3928] usb 2-1: SerialNumber: syz [ 352.605688][ T3928] usb 2-1: cannot find UAC_HEADER [ 352.625920][ T3928] snd-usb-audio 2-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 352.650532][ T323] udevd[323]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 352.706323][T13250] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 352.706349][T13250] rust_binder: Read failure Err(EFAULT) in pid:88 [ 352.715254][T13250] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 352.727968][T13250] rust_binder: Read failure Err(EFAULT) in pid:88 [ 352.736538][T13250] rust_binder: 13249:13250 FDA parent offset not aligned correctly [ 352.751250][T13250] rust_binder: 13249:13250 error while translating object: EINVAL [ 352.759668][T13250] rust_binder: Failure in copy_transaction_data: EINVAL [ 352.759697][T13250] rust_binder: 13249:13250 transaction call to 13249:0 failed EINVAL, code 67108864 size 112-24 [ 352.777686][ T3928] rust_binder: 13249: undelivered TRANSACTION_ERROR: 29201 [ 352.835724][T13254] netlink: 8 bytes leftover after parsing attributes in process `syz.9.5257'. [ 352.860024][ T1786] usb 2-1: USB disconnect, device number 40 [ 352.944212][T13265] tipc: Started in network mode [ 352.949158][T13265] tipc: Node identity , cluster identity 4711 [ 353.071225][T13284] FAULT_INJECTION: forcing a failure. [ 353.071225][T13284] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 353.084392][T13284] CPU: 1 UID: 0 PID: 13284 Comm: syz.0.5268 Not tainted syzkaller #0 d75e9a393de9c6a33055d5e25749154d2cb9f431 [ 353.084421][T13284] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 353.084431][T13284] Call Trace: [ 353.084437][T13284] [ 353.084444][T13284] __dump_stack+0x21/0x30 [ 353.084474][T13284] dump_stack_lvl+0x140/0x1c0 [ 353.084499][T13284] ? __cfi_dump_stack_lvl+0x10/0x10 [ 353.084525][T13284] ? check_stack_object+0x138/0x150 [ 353.084547][T13284] dump_stack+0x19/0x20 [ 353.084570][T13284] should_fail_ex+0x3c2/0x510 [ 353.084592][T13284] should_fail+0xf/0x20 [ 353.084611][T13284] should_fail_usercopy+0x1e/0x30 [ 353.084633][T13284] _copy_to_user+0x24/0xa0 [ 353.084658][T13284] simple_read_from_buffer+0xed/0x160 [ 353.084684][T13284] proc_fail_nth_read+0x1aa/0x220 [ 353.084711][T13284] ? __cfi_proc_fail_nth_read+0x10/0x10 [ 353.084738][T13284] ? bpf_lsm_file_permission+0xd/0x20 [ 353.084761][T13284] ? __cfi_proc_fail_nth_read+0x10/0x10 [ 353.084787][T13284] vfs_read+0x28b/0xc70 [ 353.084806][T13284] ? __cfi_vfs_read+0x10/0x10 [ 353.084825][T13284] ? __kasan_check_write+0x18/0x20 [ 353.084845][T13284] ? mutex_lock+0x97/0x1d0 [ 353.084871][T13284] ? __cfi_mutex_lock+0x10/0x10 [ 353.084898][T13284] ksys_read+0x145/0x260 [ 353.084917][T13284] ? __cfi_ksys_read+0x10/0x10 [ 353.084937][T13284] ? __kasan_check_read+0x15/0x20 [ 353.084956][T13284] __x64_sys_read+0x7f/0x90 [ 353.084975][T13284] x64_sys_call+0x2638/0x2ee0 [ 353.084993][T13284] do_syscall_64+0x57/0xf0 [ 353.085013][T13284] ? clear_bhb_loop+0x50/0xa0 [ 353.085039][T13284] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 353.085063][T13284] RIP: 0033:0x7fc5a355e84e [ 353.085081][T13284] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 353.085099][T13284] RSP: 002b:00007fc5a44ecfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 353.085120][T13284] RAX: ffffffffffffffda RBX: 00007fc5a44ed6c0 RCX: 00007fc5a355e84e [ 353.085135][T13284] RDX: 000000000000000f RSI: 00007fc5a44ed0a0 RDI: 0000000000000005 [ 353.085149][T13284] RBP: 00007fc5a44ed090 R08: 0000000000000000 R09: 0000000000000000 [ 353.085162][T13284] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 353.085174][T13284] R13: 00007fc5a3826038 R14: 00007fc5a3825fa0 R15: 00007ffddca0a3f8 [ 353.085191][T13284] [ 353.321737][ T10] usb 10-1: new high-speed USB device number 83 using dummy_hcd [ 353.373561][T13293] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 353.373579][T13293] rust_binder: Read failure Err(EFAULT) in pid:113 [ 353.382655][T13293] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 353.389177][T13293] rust_binder: Read failure Err(EFAULT) in pid:113 [ 353.397587][T13293] rust_binder: 13292:13293 FDA parent offset not aligned correctly [ 353.412092][T13293] rust_binder: 13292:13293 error while translating object: EINVAL [ 353.420029][T13293] rust_binder: Failure in copy_transaction_data: EINVAL [ 353.420053][T13293] rust_binder: 13292:13293 transaction call to 13292:0 failed EINVAL, code 134217728 size 112-24 [ 353.438442][ T45] rust_binder: 13292: undelivered TRANSACTION_ERROR: 29201 [ 353.475987][T13297] netlink: 8 bytes leftover after parsing attributes in process `syz.8.5274'. [ 353.479402][ T10] usb 10-1: Using ep0 maxpacket: 32 [ 353.494764][ T10] usb 10-1: config 0 has an invalid interface number: 67 but max is 0 [ 353.502971][ T10] usb 10-1: config 0 has no interface number 0 [ 353.514206][ T10] usb 10-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 353.532286][ T10] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 353.540805][ T10] usb 10-1: Product: syz [ 353.546229][ T10] usb 10-1: Manufacturer: syz [ 353.551764][T13303] FAULT_INJECTION: forcing a failure. [ 353.551764][T13303] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 353.564878][ T10] usb 10-1: SerialNumber: syz [ 353.575478][T13303] CPU: 0 UID: 0 PID: 13303 Comm: syz.8.5277 Not tainted syzkaller #0 d75e9a393de9c6a33055d5e25749154d2cb9f431 [ 353.575510][T13303] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 353.575523][T13303] Call Trace: [ 353.575529][T13303] [ 353.575537][T13303] __dump_stack+0x21/0x30 [ 353.575568][T13303] dump_stack_lvl+0x140/0x1c0 [ 353.575594][T13303] ? __cfi_dump_stack_lvl+0x10/0x10 [ 353.575618][T13303] ? bpf_lsm_file_permission+0xd/0x20 [ 353.575644][T13303] ? check_stack_object+0x10f/0x150 [ 353.575663][T13303] dump_stack+0x19/0x20 [ 353.575687][T13303] should_fail_ex+0x3c2/0x510 [ 353.575709][T13303] should_fail+0xf/0x20 [ 353.575728][T13303] should_fail_usercopy+0x1e/0x30 [ 353.575750][T13303] _copy_from_user+0x20/0xa0 [ 353.575774][T13303] __sys_bind+0x1f4/0x430 [ 353.575877][T13303] ? __cfi___sys_bind+0x10/0x10 [ 353.575904][T13303] ? __kasan_check_read+0x15/0x20 [ 353.575924][T13303] __x64_sys_bind+0x7e/0x90 [ 353.575947][T13303] x64_sys_call+0x1ffd/0x2ee0 [ 353.575965][T13303] do_syscall_64+0x57/0xf0 [ 353.575986][T13303] ? clear_bhb_loop+0x50/0xa0 [ 353.576012][T13303] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 353.576036][T13303] RIP: 0033:0x7f013d99e019 [ 353.576054][T13303] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 353.576071][T13303] RSP: 002b:00007f013e8bb028 EFLAGS: 00000246 ORIG_RAX: 0000000000000031 [ 353.576101][T13303] RAX: ffffffffffffffda RBX: 00007f013dc25fa0 RCX: 00007f013d99e019 [ 353.576116][T13303] RDX: 000000000000000e RSI: 00002000000007c0 RDI: 0000000000000004 [ 353.576129][T13303] RBP: 00007f013e8bb090 R08: 0000000000000000 R09: 0000000000000000 [ 353.576142][T13303] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 353.576156][T13303] R13: 00007f013dc26038 R14: 00007f013dc25fa0 R15: 00007ffda70941f8 [ 353.576173][T13303] [ 353.767935][ T10] usb 10-1: config 0 descriptor?? [ 353.773805][ T10] smsc95xx v2.0.0 [ 353.782727][T13307] tipc: Started in network mode [ 353.787641][T13307] tipc: Node identity , cluster identity 4711 [ 353.849371][ T45] usb 2-1: new high-speed USB device number 41 using dummy_hcd [ 353.974326][T13259] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 353.983009][T13259] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 353.999373][ T45] usb 2-1: Using ep0 maxpacket: 16 [ 354.005549][ T45] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 354.016461][ T45] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 354.029265][ T45] usb 2-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 354.038330][ T45] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 354.046910][ T45] usb 2-1: config 0 descriptor?? [ 354.051919][ T3928] usb 9-1: new low-speed USB device number 76 using dummy_hcd [ 354.210769][ T3928] usb 9-1: unable to get BOS descriptor or descriptor too short [ 354.219400][ T3928] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x88 has an invalid bInterval 0, changing to 10 [ 354.230495][ T3928] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 354.240199][ T3928] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0xC is Bulk; changing to Interrupt [ 354.250044][ T3928] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0xF has invalid wMaxPacketSize 0 [ 354.259718][ T3928] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid wMaxPacketSize 0 [ 354.271453][ T3928] usb 9-1: string descriptor 0 read error: -22 [ 354.277675][ T3928] usb 9-1: New USB device found, idVendor=0763, idProduct=1002, bcdDevice=5f.84 [ 354.286833][ T3928] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 354.295533][ T3928] usb 9-1: config 0 descriptor?? [ 354.300800][T13311] raw-gadget.3 gadget.8: fail, usb_ep_enable returned -22 [ 354.315035][ T689] udevd[689]: error opening ATTR{/sys/devices/platform/dummy_hcd.8/usb9/9-1/9-1:0.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 354.332132][T13322] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 354.340901][T13322] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 354.353470][ T10] smsc95xx 10-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -71 [ 354.364507][ T10] smsc95xx 10-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 354.373979][ T10] smsc95xx 10-1:0.67 (unnamed net_device) (uninitialized): Failed to write reg index 0x00000014: -71 [ 354.381948][ T36] audit: type=1400 audit(1785918522.729:1842): avc: denied { unlink } for pid=13318 comm="syz.9.5283" name="file0" dev="fuse" ino=5 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=chr_file permissive=1 [ 354.384998][ T10] smsc95xx 10-1:0.67: probe with driver smsc95xx failed with error -71 [ 354.418112][ T10] usb 10-1: USB disconnect, device number 83 [ 355.080174][T13326] netlink: 8 bytes leftover after parsing attributes in process `syz.9.5285'. [ 355.097218][T13328] binder: Bad value for 'max' [ 355.135570][T13330] tipc: Cannot configure node identity twice [ 355.159948][T13334] netlink: 8 bytes leftover after parsing attributes in process `syz.9.5289'. [ 355.439374][ T3928] usb 10-1: new high-speed USB device number 84 using dummy_hcd [ 355.599361][ T3928] usb 10-1: Using ep0 maxpacket: 16 [ 355.605575][ T3928] usb 10-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 355.615994][ T3928] usb 10-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 355.625706][ T3928] usb 10-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= f.89 [ 355.634895][ T3928] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 355.643009][ T3928] usb 10-1: SerialNumber: syz [ 355.649672][ T3928] usb 10-1: cannot find UAC_HEADER [ 355.656165][ T3928] snd-usb-audio 10-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 355.670513][ T323] udevd[323]: error opening ATTR{/sys/devices/platform/dummy_hcd.9/usb10/10-1/10-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 355.890157][ T3928] usb 10-1: USB disconnect, device number 84 [ 356.602530][ T45] usbhid 2-1:0.0: can't add hid device: -71 [ 356.610566][ T45] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 356.622070][ T45] usb 2-1: USB disconnect, device number 41 [ 356.650867][ T3928] usb 10-1: new high-speed USB device number 85 using dummy_hcd [ 356.800883][ T3928] usb 10-1: unable to get BOS descriptor or descriptor too short [ 356.809690][ T3928] usb 10-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 356.820210][ T3928] usb 10-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 356.829660][ T3928] usb 10-1: config 1 interface 0 has no altsetting 0 [ 356.839491][ T10] usb 9-1: USB disconnect, device number 76 [ 356.841598][ T3928] usb 10-1: New USB device found, idVendor=041e, idProduct=3237, bcdDevice= 0.40 [ 356.860967][ T3928] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 356.870199][ T3928] usb 10-1: Product: syz [ 356.874563][ T3928] usb 10-1: Manufacturer: syz [ 356.879255][ T3928] usb 10-1: SerialNumber: syz [ 357.099969][ T3928] usb 10-1: 0:1 : does not exist [ 357.109642][ T3928] usb 10-1: USB disconnect, device number 85 [ 357.123093][ T312] udevd[312]: error opening ATTR{/sys/devices/platform/dummy_hcd.9/usb10/10-1/10-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 357.488757][T13353] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 357.488783][T13353] rust_binder: Read failure Err(EFAULT) in pid:1266 [ 357.490644][T13355] tipc: Started in network mode [ 357.497902][T13353] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 357.503561][T13355] tipc: Node identity , cluster identity 4711 [ 357.508359][T13353] rust_binder: Read failure Err(EFAULT) in pid:1266 [ 357.527789][T13353] rust_binder: 13352:13353 FDA parent offset not aligned correctly [ 357.542585][T13357] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5299'. [ 357.551641][T13353] rust_binder: 13352:13353 error while translating object: EINVAL [ 357.559580][T13353] rust_binder: Failure in copy_transaction_data: EINVAL [ 357.559608][T13353] rust_binder: 13352:13353 transaction call to 13352:0 failed EINVAL, code 536870912 size 112-24 [ 357.577987][ T10] rust_binder: 13352: undelivered TRANSACTION_ERROR: 29201 [ 357.674675][T13370] tipc: Started in network mode [ 357.679631][T13370] tipc: Node identity , cluster identity 4711 [ 357.710690][ T36] audit: type=1400 audit(1785918526.059:1843): avc: denied { map } for pid=13360 comm="syz.8.5301" path="/dev/ptmx" dev="devtmpfs" ino=24 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ptmx_t tclass=chr_file permissive=1 [ 357.859378][ T3928] usb 10-1: new full-speed USB device number 86 using dummy_hcd [ 358.010409][ T3928] usb 10-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 358.020706][ T3928] usb 10-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 358.029668][ T3928] usb 10-1: config 1 has no interface number 0 [ 358.035892][ T3928] usb 10-1: config 1 interface 1 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 358.050317][ T3928] usb 10-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 358.059620][ T3928] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 358.067697][ T3928] usb 10-1: Product: syz [ 358.072130][ T3928] usb 10-1: Manufacturer: syz [ 358.076824][ T3928] usb 10-1: SerialNumber: syz [ 358.083449][ T3928] usb 10-1: selecting invalid altsetting 1 [ 358.283888][T13363] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 358.292452][T13363] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 358.300902][ T3928] cdc_ncm 10-1:1.1: bind() failure [ 358.307068][ T3928] usb 10-1: USB disconnect, device number 86 [ 358.749393][ T3928] usb 9-1: new high-speed USB device number 77 using dummy_hcd [ 358.813234][T13394] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 358.813254][T13394] rust_binder: Read failure Err(EFAULT) in pid:130 [ 358.822079][T13394] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 358.828586][T13394] rust_binder: Read failure Err(EFAULT) in pid:130 [ 358.836986][T13394] rust_binder: 13393:13394 FDA parent offset not aligned correctly [ 358.851446][T13394] rust_binder: 13393:13394 error while translating object: EINVAL [ 358.859261][T13394] rust_binder: Failure in copy_transaction_data: EINVAL [ 358.859279][T13394] rust_binder: 13393:13394 transaction call to 13393:0 failed EINVAL, code 553648128 size 112-24 [ 358.877409][ T10] rust_binder: 13393: undelivered TRANSACTION_ERROR: 29201 [ 358.900638][ T3928] usb 9-1: unable to get BOS descriptor or descriptor too short [ 358.908925][ T3928] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 358.919040][ T3928] usb 9-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 358.928285][ T3928] usb 9-1: config 1 interface 0 has no altsetting 0 [ 358.936571][ T3928] usb 9-1: New USB device found, idVendor=041e, idProduct=3237, bcdDevice= 0.40 [ 358.945785][ T3928] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 358.954994][ T3928] usb 9-1: Product: syz [ 358.959206][ T3928] usb 9-1: Manufacturer: syz [ 358.959987][T13398] netlink: 8 bytes leftover after parsing attributes in process `syz.9.5315'. [ 358.963862][ T3928] usb 9-1: SerialNumber: syz [ 358.994115][T13402] Bluetooth: ISO socket layer initialized [ 358.995021][T13403] netlink: 964 bytes leftover after parsing attributes in process `syz.9.5317'. [ 359.182105][ T3928] usb 9-1: 0:1 : does not exist [ 359.189257][ T3928] usb 9-1: USB disconnect, device number 77 [ 359.199511][ T312] udevd[312]: error opening ATTR{/sys/devices/platform/dummy_hcd.8/usb9/9-1/9-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 359.239374][ T10] usb 10-1: new high-speed USB device number 87 using dummy_hcd [ 359.390502][ T10] usb 10-1: config 1 interface 2 altsetting 1 endpoint 0x82 has invalid wMaxPacketSize 0 [ 359.401647][ T10] usb 10-1: New USB device found, idVendor=041e, idProduct=4068, bcdDevice= 0.40 [ 359.410788][ T10] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 359.418856][ T10] usb 10-1: Product: syz [ 359.423145][ T10] usb 10-1: Manufacturer: syz [ 359.427837][ T10] usb 10-1: SerialNumber: syz [ 359.495692][T13409] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5319'. [ 359.640095][ T10] usb 10-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 359.650376][ T10] usb 10-1: 4:0: cannot get min/max values for control 2 (id 4) [ 359.660758][ T10] usb 10-1: 4:0: failed to get current value for ch 1 (-22) [ 359.674969][ T10] usb 10-1: USB disconnect, device number 87 [ 359.687364][ T323] udevd[323]: error opening ATTR{/sys/devices/platform/dummy_hcd.9/usb10/10-1/10-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 360.039387][ T1786] usb 9-1: new high-speed USB device number 78 using dummy_hcd [ 360.200469][ T1786] usb 9-1: config 160 has an invalid interface number: 200 but max is 0 [ 360.209734][ T1786] usb 9-1: config 160 has no interface number 0 [ 360.216075][ T1786] usb 9-1: config 160 interface 200 has no altsetting 0 [ 360.224924][ T1786] usb 9-1: New USB device found, idVendor=21bb, idProduct=2070, bcdDevice=87.0b [ 360.243713][ T1786] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 360.254895][ T1786] usb 9-1: Product: syz [ 360.259463][ T1786] usb 9-1: Manufacturer: syz [ 360.264233][ T1786] usb 9-1: SerialNumber: syz [ 360.453177][T13458] FAULT_INJECTION: forcing a failure. [ 360.453177][T13458] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 360.466344][T13458] CPU: 1 UID: 0 PID: 13458 Comm: syz.9.5333 Not tainted syzkaller #0 d75e9a393de9c6a33055d5e25749154d2cb9f431 [ 360.466374][T13458] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 360.466386][T13458] Call Trace: [ 360.466394][T13458] [ 360.466403][T13458] __dump_stack+0x21/0x30 [ 360.466430][T13458] dump_stack_lvl+0x140/0x1c0 [ 360.466449][T13458] ? __cfi_dump_stack_lvl+0x10/0x10 [ 360.466475][T13458] dump_stack+0x19/0x20 [ 360.466499][T13458] should_fail_ex+0x3c2/0x510 [ 360.466522][T13458] should_fail+0xf/0x20 [ 360.466534][T13458] should_fail_usercopy+0x1e/0x30 [ 360.466546][T13458] _copy_from_iter+0x1a6/0x1520 [ 360.466560][T13458] ? __cfi__copy_from_iter+0x10/0x10 [ 360.466574][T13458] tun_get_user+0x231/0x3720 [ 360.466585][T13458] ? arch_stack_walk+0x10a/0x170 [ 360.466604][T13458] ? ptr_ring_consume+0x430/0x430 [ 360.466623][T13458] ? _parse_integer+0x2e/0x40 [ 360.466649][T13458] ? kstrtoull+0x13b/0x1e0 [ 360.466668][T13458] ? __kasan_check_write+0x18/0x20 [ 360.466679][T13458] ? ref_tracker_alloc+0x32b/0x5b0 [ 360.466692][T13458] ? __cfi_ref_tracker_alloc+0x10/0x10 [ 360.466704][T13458] ? selinux_file_permission+0x318/0xb60 [ 360.466715][T13458] ? __kasan_check_write+0x18/0x20 [ 360.466725][T13458] ? proc_fail_nth_write+0x184/0x220 [ 360.466750][T13458] tun_chr_write_iter+0x1fa/0x310 [ 360.466778][T13458] vfs_write+0x762/0xfd0 [ 360.466799][T13458] ? __cfi_vfs_write+0x10/0x10 [ 360.466816][T13458] ksys_write+0x145/0x260 [ 360.466826][T13458] ? __cfi_ksys_write+0x10/0x10 [ 360.466836][T13458] ? __kasan_check_read+0x15/0x20 [ 360.466846][T13458] __x64_sys_write+0x7f/0x90 [ 360.466857][T13458] x64_sys_call+0x271c/0x2ee0 [ 360.466866][T13458] do_syscall_64+0x57/0xf0 [ 360.466883][T13458] ? clear_bhb_loop+0x50/0xa0 [ 360.466909][T13458] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 360.466932][T13458] RIP: 0033:0x7fa0b7f9e019 [ 360.466948][T13458] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 360.466959][T13458] RSP: 002b:00007fa0b8dea028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 360.466971][T13458] RAX: ffffffffffffffda RBX: 00007fa0b8225fa0 RCX: 00007fa0b7f9e019 [ 360.466979][T13458] RDX: 000000000000002a RSI: 0000200000000280 RDI: 0000000000000003 [ 360.466986][T13458] RBP: 00007fa0b8dea090 R08: 0000000000000000 R09: 0000000000000000 [ 360.466993][T13458] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 360.466999][T13458] R13: 00007fa0b8226038 R14: 00007fa0b8225fa0 R15: 00007ffdcd97a318 [ 360.467008][T13458] [ 360.532633][T13428] tmpfs: Unknown parameter 'c uN(bǀH/s' [ 360.736006][ T1786] usb 9-1: MIDIStreaming interface descriptor not found [ 360.746021][ T1786] usb 9-1: USB disconnect, device number 78 [ 360.999373][ T3928] usb 10-1: new high-speed USB device number 88 using dummy_hcd [ 361.009366][ T10] usb 2-1: new full-speed USB device number 42 using dummy_hcd [ 361.150661][ T3928] usb 10-1: unable to get BOS descriptor or descriptor too short [ 361.159147][ T3928] usb 10-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 361.169430][ T3928] usb 10-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 361.170854][ T10] usb 2-1: unable to get BOS descriptor or descriptor too short [ 361.178386][ T3928] usb 10-1: config 1 interface 0 has no altsetting 0 [ 361.186478][ T10] usb 2-1: not running at top speed; connect to a high speed hub [ 361.194193][ T3928] usb 10-1: New USB device found, idVendor=041e, idProduct=3237, bcdDevice= 0.40 [ 361.202688][ T10] usb 2-1: New USB device found, idVendor=13e5, idProduct=0001, bcdDevice= 0.40 [ 361.209791][ T3928] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 361.218737][ T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 361.226723][ T3928] usb 10-1: Product: syz [ 361.234992][ T10] usb 2-1: Product: syz [ 361.243177][ T10] usb 2-1: Manufacturer: syz [ 361.248155][ T10] usb 2-1: SerialNumber: syz [ 361.253817][ T3928] usb 10-1: Manufacturer: syz [ 361.260217][ T3928] usb 10-1: SerialNumber: syz [ 361.345159][T13469] netlink: 8 bytes leftover after parsing attributes in process `syz.8.5338'. [ 361.422234][T13475] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 361.422271][T13475] rust_binder: Read failure Err(EFAULT) in pid:1305 [ 361.431149][T13475] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 361.437754][T13475] rust_binder: Read failure Err(EFAULT) in pid:1305 [ 361.446392][T13475] rust_binder: 13474:13475 FDA parent offset not aligned correctly [ 361.460993][T13475] rust_binder: 13474:13475 error while translating object: EINVAL [ 361.462452][T13462] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 361.469892][T13475] rust_binder: Failure in copy_transaction_data: EINVAL [ 361.477692][T13462] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 361.479263][T13475] rust_binder: 13474:13475 transaction call to 13474:0 failed EINVAL, code 1275068416 size 112-24 [ 361.505499][ T3928] usb 10-1: 0:1 : does not exist [ 361.520881][ T3928] usb 10-1: USB disconnect, device number 88 [ 361.534310][T12018] rust_binder: 13474: undelivered TRANSACTION_ERROR: 29201 [ 361.642625][ T10] usb 2-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 361.650881][ T10] usb 2-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 361.665451][ T10] usb 2-1: USB disconnect, device number 42 [ 361.678232][ T323] udevd[323]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 361.862241][ T36] audit: type=1400 audit(1785918530.209:1844): avc: denied { execute } for pid=13493 comm="syz.8.5347" path="/dev/rnullb0" dev="devtmpfs" ino=31 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 361.923063][T13494] tipc: Started in network mode [ 361.927999][T13494] tipc: Node identity 2007ff, cluster identity 4711 [ 361.934612][T13494] tipc: Node number set to 2099199 [ 361.971397][T13498] netlink: 'syz.8.5349': attribute type 4 has an invalid length. [ 361.980216][T13498] netlink: 'syz.8.5349': attribute type 4 has an invalid length. [ 362.015778][T13498] SELinux: failed to load policy [ 362.264821][T13535] FAULT_INJECTION: forcing a failure. [ 362.264821][T13535] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 362.278140][T13535] CPU: 0 UID: 0 PID: 13535 Comm: syz.1.5365 Not tainted syzkaller #0 d75e9a393de9c6a33055d5e25749154d2cb9f431 [ 362.278171][T13535] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 362.278183][T13535] Call Trace: [ 362.278190][T13535] [ 362.278198][T13535] __dump_stack+0x21/0x30 [ 362.278228][T13535] dump_stack_lvl+0x140/0x1c0 [ 362.278251][T13535] ? __cfi_dump_stack_lvl+0x10/0x10 [ 362.278273][T13535] ? x64_sys_call+0x271c/0x2ee0 [ 362.278290][T13535] ? entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 362.278316][T13535] dump_stack+0x19/0x20 [ 362.278338][T13535] should_fail_ex+0x3c2/0x510 [ 362.278359][T13535] should_fail+0xf/0x20 [ 362.278378][T13535] should_fail_usercopy+0x1e/0x30 [ 362.278399][T13535] _copy_from_iter+0x1a6/0x1520 [ 362.278424][T13535] ? __cfi__copy_from_iter+0x10/0x10 [ 362.278445][T13535] ? __check_object_size+0x54c/0x870 [ 362.278466][T13535] ? __cfi___check_object_size+0x10/0x10 [ 362.278485][T13535] ? __kasan_check_write+0x18/0x20 [ 362.278503][T13535] ? __build_skb_around+0x2a4/0x590 [ 362.278527][T13535] skb_copy_datagram_from_iter+0xf4/0x6f0 [ 362.278545][T13535] ? napi_alloc_skb+0x212/0x560 [ 362.278567][T13535] tun_get_user+0xd99/0x3720 [ 362.278586][T13535] ? ptr_ring_consume+0x430/0x430 [ 362.278603][T13535] ? _parse_integer+0x2e/0x40 [ 362.278620][T13535] ? kstrtoull+0x13b/0x1e0 [ 362.278639][T13535] ? __kasan_check_write+0x18/0x20 [ 362.278656][T13535] ? ref_tracker_alloc+0x32b/0x5b0 [ 362.278677][T13535] ? __cfi_ref_tracker_alloc+0x10/0x10 [ 362.278697][T13535] ? selinux_file_permission+0x318/0xb60 [ 362.278718][T13535] ? __kasan_check_write+0x18/0x20 [ 362.278735][T13535] ? proc_fail_nth_write+0x184/0x220 [ 362.278761][T13535] tun_chr_write_iter+0x1fa/0x310 [ 362.278787][T13535] vfs_write+0x762/0xfd0 [ 362.278805][T13535] ? __cfi_vfs_write+0x10/0x10 [ 362.278827][T13535] ksys_write+0x145/0x260 [ 362.278846][T13535] ? __cfi_ksys_write+0x10/0x10 [ 362.278866][T13535] ? __kasan_check_read+0x15/0x20 [ 362.278885][T13535] __x64_sys_write+0x7f/0x90 [ 362.278905][T13535] x64_sys_call+0x271c/0x2ee0 [ 362.278922][T13535] do_syscall_64+0x57/0xf0 [ 362.278944][T13535] ? clear_bhb_loop+0x50/0xa0 [ 362.278968][T13535] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 362.278992][T13535] RIP: 0033:0x7ff17e99e019 [ 362.279017][T13535] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 362.279033][T13535] RSP: 002b:00007ff17f8d8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 362.279054][T13535] RAX: ffffffffffffffda RBX: 00007ff17ec25fa0 RCX: 00007ff17e99e019 [ 362.279070][T13535] RDX: 000000000000002a RSI: 0000200000000280 RDI: 0000000000000003 [ 362.279083][T13535] RBP: 00007ff17f8d8090 R08: 0000000000000000 R09: 0000000000000000 [ 362.279105][T13535] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 362.279118][T13535] R13: 00007ff17ec26038 R14: 00007ff17ec25fa0 R15: 00007ffcf19c0c28 [ 362.279135][T13535] [ 362.387902][T13528] netlink: 8 bytes leftover after parsing attributes in process `syz.8.5363'. [ 362.615185][T13552] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5371'. [ 362.829491][T12018] usb 9-1: new full-speed USB device number 79 using dummy_hcd [ 362.889045][T13570] tipc: Cannot configure node identity twice [ 362.939392][ T1786] usb 2-1: new high-speed USB device number 43 using dummy_hcd [ 362.990784][T12018] usb 9-1: unable to get BOS descriptor or descriptor too short [ 362.998856][T12018] usb 9-1: not running at top speed; connect to a high speed hub [ 363.008638][T12018] usb 9-1: New USB device found, idVendor=13e5, idProduct=0001, bcdDevice= 0.40 [ 363.017700][T12018] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 363.025707][T12018] usb 9-1: Product: syz [ 363.030127][T12018] usb 9-1: Manufacturer: syz [ 363.034705][T12018] usb 9-1: SerialNumber: syz [ 363.089364][ T1786] usb 2-1: Using ep0 maxpacket: 16 [ 363.095532][ T1786] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 363.106440][ T1786] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 363.116195][ T1786] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 363.129065][ T1786] usb 2-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 363.138188][ T1786] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 363.146823][ T1786] usb 2-1: config 0 descriptor?? [ 363.242446][T13548] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 363.251365][T13548] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 363.440976][T13593] ref_tracker: memory allocation failure, unreliable refcount tracker. [ 363.445342][T12018] usb 9-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 363.456891][T12018] usb 9-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 363.466378][T12018] usb 9-1: USB disconnect, device number 79 [ 363.554713][ T1786] microsoft 0003:045E:07DA.0047: unknown main item tag 0x0 [ 363.562047][ T1786] microsoft 0003:045E:07DA.0047: unknown main item tag 0x0 [ 363.569259][ T1786] microsoft 0003:045E:07DA.0047: unknown main item tag 0x0 [ 363.576477][ T1786] microsoft 0003:045E:07DA.0047: unknown main item tag 0x0 [ 363.583736][ T1786] microsoft 0003:045E:07DA.0047: unknown main item tag 0x0 [ 363.590985][ T1786] microsoft 0003:045E:07DA.0047: unknown main item tag 0x0 [ 363.598195][ T1786] microsoft 0003:045E:07DA.0047: unknown main item tag 0x0 [ 363.605509][ T1786] microsoft 0003:045E:07DA.0047: unknown main item tag 0x0 [ 363.613122][ T1786] microsoft 0003:045E:07DA.0047: unknown main item tag 0x0 [ 363.623199][ T1786] input: HID 045e:07da as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/0003:045E:07DA.0047/input/input37 [ 363.694926][ T1786] microsoft 0003:045E:07DA.0047: input,hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.1-1/input0 [ 363.775476][ T36] audit: type=1400 audit(1785918532.119:1845): avc: denied { map } for pid=13611 comm="syz.0.5393" path="socket:[87459]" dev="sockfs" ino=87459 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 363.786126][T13614] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 363.798783][T13614] rust_binder: Read failure Err(EFAULT) in pid:148 [ 363.811697][T13614] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 363.818255][T13614] rust_binder: Read failure Err(EFAULT) in pid:148 [ 363.827151][T13614] rust_binder: 13613:13614 FDA parent offset not aligned correctly [ 363.841586][T13614] rust_binder: 13613:13614 error while translating object: EINVAL [ 363.849457][T13614] rust_binder: Failure in copy_transaction_data: EINVAL [ 363.849480][T13614] rust_binder: 13613:13614 transaction call to 13613:0 failed EINVAL, code 3356491776 size 112-24 [ 363.867750][ T1786] rust_binder: 13613: undelivered TRANSACTION_ERROR: 29201 [ 364.024115][T13631] FAULT_INJECTION: forcing a failure. [ 364.024115][T13631] name failslab, interval 1, probability 0, space 0, times 0 [ 364.036787][T13631] CPU: 0 UID: 0 PID: 13631 Comm: syz.0.5400 Not tainted syzkaller #0 d75e9a393de9c6a33055d5e25749154d2cb9f431 [ 364.036817][T13631] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 364.036829][T13631] Call Trace: [ 364.036836][T13631] [ 364.036851][T13631] __dump_stack+0x21/0x30 [ 364.036882][T13631] dump_stack_lvl+0x140/0x1c0 [ 364.036906][T13631] ? __cfi_dump_stack_lvl+0x10/0x10 [ 364.036930][T13631] ? stack_depot_save_flags+0x38/0x800 [ 364.036954][T13631] dump_stack+0x19/0x20 [ 364.036978][T13631] should_fail_ex+0x3c2/0x510 [ 364.036999][T13631] should_failslab+0xac/0x100 [ 364.037021][T13631] kmem_cache_alloc_noprof+0x42/0x410 [ 364.037040][T13631] ? napi_complete_done+0x323/0x790 [ 364.037066][T13631] ? tun_get_user+0x2673/0x3720 [ 364.037085][T13631] ? inet_frag_find+0x6ae/0x18b0 [ 364.037112][T13631] ? ksys_write+0x145/0x260 [ 364.037132][T13631] ? __x64_sys_write+0x7f/0x90 [ 364.037151][T13631] inet_frag_find+0x6ae/0x18b0 [ 364.037176][T13631] ? __cfi_ip4_obj_cmpfn+0x10/0x10 [ 364.037203][T13631] ? __cfi_inet_frag_find+0x10/0x10 [ 364.037228][T13631] ? ip_route_input_rcu+0x1be9/0x26b0 [ 364.037249][T13631] ? ip_route_input_noref+0x150/0x150 [ 364.037270][T13631] ip_defrag+0x287/0x1d70 [ 364.037296][T13631] ? ipt_do_table+0x2ba/0x1540 [ 364.037315][T13631] ? __cfi_ip_defrag+0x10/0x10 [ 364.037336][T13631] ? ip_route_input_noref+0xdb/0x150 [ 364.037354][T13631] ? __cfi_ip_route_input_noref+0x10/0x10 [ 364.037372][T13631] ip_local_deliver+0x168/0x360 [ 364.037393][T13631] ? __cfi_ip_local_deliver+0x10/0x10 [ 364.037416][T13631] ? ip_rcv_finish_core+0xcd7/0x1460 [ 364.037439][T13631] ? __cfi_ip_local_deliver+0x10/0x10 [ 364.037461][T13631] ip_sublist_rcv+0x83a/0x9b0 [ 364.037484][T13631] ? ip_list_rcv+0x450/0x450 [ 364.037505][T13631] ? __cfi_ip_rcv_finish+0x10/0x10 [ 364.037526][T13631] ? ip_rcv_core+0x833/0xd00 [ 364.037549][T13631] ip_list_rcv+0x3e8/0x450 [ 364.037573][T13631] ? __cfi_ip_list_rcv+0x10/0x10 [ 364.037598][T13631] ? __cfi_ip_list_rcv+0x10/0x10 [ 364.037623][T13631] __netif_receive_skb_list_core+0x830/0x880 [ 364.037650][T13631] ? kasan_save_track+0x3e/0x80 [ 364.037672][T13631] ? kasan_save_alloc_info+0x3a/0x50 [ 364.037699][T13631] ? tun_chr_write_iter+0x1fa/0x310 [ 364.037727][T13631] ? entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 364.037753][T13631] ? set_rps_cpu+0x670/0x670 [ 364.037779][T13631] netif_receive_skb_list_internal+0x847/0xb00 [ 364.037807][T13631] ? __cfi_netif_receive_skb_list_internal+0x10/0x10 [ 364.037836][T13631] ? eth_type_trans+0x333/0x6f0 [ 364.037871][T13631] napi_complete_done+0x323/0x790 [ 364.037898][T13631] ? __cfi_napi_complete_done+0x10/0x10 [ 364.037924][T13631] ? napi_gro_frags+0x7f8/0xde0 [ 364.037952][T13631] ? tun_get_user+0x2656/0x3720 [ 364.037969][T13631] tun_get_user+0x2673/0x3720 [ 364.037989][T13631] ? ptr_ring_consume+0x430/0x430 [ 364.038008][T13631] ? _parse_integer+0x2e/0x40 [ 364.038027][T13631] ? kstrtoull+0x13b/0x1e0 [ 364.038047][T13631] ? __kasan_check_write+0x18/0x20 [ 364.038065][T13631] ? ref_tracker_alloc+0x32b/0x5b0 [ 364.038088][T13631] ? __cfi_ref_tracker_alloc+0x10/0x10 [ 364.038110][T13631] ? selinux_file_permission+0x318/0xb60 [ 364.038129][T13631] ? __kasan_check_write+0x18/0x20 [ 364.038147][T13631] ? proc_fail_nth_write+0x184/0x220 [ 364.038174][T13631] tun_chr_write_iter+0x1fa/0x310 [ 364.038201][T13631] vfs_write+0x762/0xfd0 [ 364.038221][T13631] ? __cfi_vfs_write+0x10/0x10 [ 364.038243][T13631] ksys_write+0x145/0x260 [ 364.038262][T13631] ? __cfi_ksys_write+0x10/0x10 [ 364.038282][T13631] ? __kasan_check_read+0x15/0x20 [ 364.038299][T13631] __x64_sys_write+0x7f/0x90 [ 364.038318][T13631] x64_sys_call+0x271c/0x2ee0 [ 364.038335][T13631] do_syscall_64+0x57/0xf0 [ 364.038355][T13631] ? clear_bhb_loop+0x50/0xa0 [ 364.038378][T13631] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 364.038399][T13631] RIP: 0033:0x7fc5a359e019 [ 364.038416][T13631] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 364.038433][T13631] RSP: 002b:00007fc5a44ed028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 364.038454][T13631] RAX: ffffffffffffffda RBX: 00007fc5a3825fa0 RCX: 00007fc5a359e019 [ 364.038469][T13631] RDX: 000000000000002a RSI: 0000200000000280 RDI: 0000000000000003 [ 364.038483][T13631] RBP: 00007fc5a44ed090 R08: 0000000000000000 R09: 0000000000000000 [ 364.038495][T13631] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 364.038507][T13631] R13: 00007fc5a3826038 R14: 00007fc5a3825fa0 R15: 00007ffddca0a3f8 [ 364.038522][T13631] [ 364.099380][T12018] usb 10-1: new high-speed USB device number 89 using dummy_hcd [ 364.619386][T12018] usb 10-1: device descriptor read/64, error -71 [ 364.859408][T12018] usb 10-1: device descriptor read/64, error -71 [ 364.929390][ T3928] usb 9-1: new full-speed USB device number 80 using dummy_hcd [ 365.081057][ T3928] usb 9-1: unable to get BOS descriptor or descriptor too short [ 365.089444][ T3928] usb 9-1: not running at top speed; connect to a high speed hub [ 365.099210][ T3928] usb 9-1: New USB device found, idVendor=13e5, idProduct=0001, bcdDevice= 0.40 [ 365.108344][T12018] usb 10-1: new high-speed USB device number 90 using dummy_hcd [ 365.116135][ T3928] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 365.124525][ T3928] usb 9-1: Product: syz [ 365.128800][ T3928] usb 9-1: Manufacturer: syz [ 365.133880][ T3928] usb 9-1: SerialNumber: syz [ 365.187309][T13656] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5412'. [ 365.242965][ T36] audit: type=1400 audit(1785918533.589:1846): avc: denied { remount } for pid=13657 comm="syz.0.5413" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 365.268952][T12018] usb 10-1: device descriptor read/64, error -71 [ 365.311675][T13662] kvm: kvm [13661]: vcpu0, guest rIP: 0x1a Unhandled WRMSR(0xc2) = 0x60205551c51b0c39 [ 365.345292][T13643] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 365.359546][T13643] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 365.509501][T12018] usb 10-1: device descriptor read/64, error -71 [ 365.519785][ T10] usb 2-1: USB disconnect, device number 43 [ 365.579372][ T3928] usb 9-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 365.590487][ T3928] usb 9-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 365.613298][ T3928] usb 9-1: USB disconnect, device number 80 [ 365.629574][T12018] usb usb10-port1: attempt power cycle [ 365.706447][T13681] tipc: Started in network mode [ 365.718810][T13681] tipc: Node identity , cluster identity 4711 [ 365.841395][T13687] kvm: pic: single mode not supported [ 365.880141][T13690] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5425'. [ 365.979407][T12018] usb 10-1: new high-speed USB device number 91 using dummy_hcd [ 366.020341][T12018] usb 10-1: device descriptor read/8, error -71 [ 366.150482][T12018] usb 10-1: device descriptor read/8, error -71 [ 366.160142][ T36] audit: type=1400 audit(1785918534.509:1847): avc: denied { checkpoint_restore } for pid=13701 comm="syz.0.5430" capability=40 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 366.259077][T13707] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=1005 sclass=netlink_xfrm_socket pid=13707 comm=syz.8.5431 [ 366.399460][T12018] usb 10-1: new high-speed USB device number 92 using dummy_hcd [ 366.420365][T12018] usb 10-1: device descriptor read/8, error -71 [ 366.469273][T13715] tipc: Cannot configure node identity twice [ 366.519396][ T311] usb 9-1: new full-speed USB device number 81 using dummy_hcd [ 366.551127][T12018] usb 10-1: device descriptor read/8, error -71 [ 366.659545][T12018] usb usb10-port1: unable to enumerate USB device [ 366.680337][ T311] usb 9-1: config 32 interface 0 altsetting 0 endpoint 0x85 has invalid wMaxPacketSize 0 [ 366.690249][ T311] usb 9-1: New USB device found, idVendor=19b5, idProduct=0021, bcdDevice=98.c7 [ 366.699261][ T311] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 366.914018][ T311] usb 9-1: string descriptor 0 read error: -71 [ 366.920390][ T311] hub 9-1:32.0: bad descriptor, ignoring hub [ 366.926385][ T311] hub 9-1:32.0: probe with driver hub failed with error -5 [ 366.949700][ T311] usb 9-1: USB disconnect, device number 81 [ 366.969403][T12018] usb 10-1: new full-speed USB device number 93 using dummy_hcd [ 367.120779][T12018] usb 10-1: unable to get BOS descriptor or descriptor too short [ 367.128938][T12018] usb 10-1: not running at top speed; connect to a high speed hub [ 367.138851][T12018] usb 10-1: New USB device found, idVendor=13e5, idProduct=0001, bcdDevice= 0.40 [ 367.148044][T12018] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 367.156149][T12018] usb 10-1: Product: syz [ 367.160416][T12018] usb 10-1: Manufacturer: syz [ 367.165090][T12018] usb 10-1: SerialNumber: syz [ 367.378239][T13722] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 367.386854][T13722] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 367.480608][T13733] netlink: 8 bytes leftover after parsing attributes in process `syz.8.5440'. [ 367.613460][T12018] usb 10-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 367.621019][T12018] usb 10-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 367.629657][T12018] usb 10-1: USB disconnect, device number 93 [ 367.639896][ T323] udevd[323]: error opening ATTR{/sys/devices/platform/dummy_hcd.9/usb10/10-1/10-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 367.729366][ T10] usb 2-1: new full-speed USB device number 44 using dummy_hcd [ 367.735456][ T36] audit: type=1400 audit(1785918536.079:1848): avc: denied { map } for pid=13739 comm="syz.0.5444" path="socket:[87031]" dev="sockfs" ino=87031 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 367.905666][ T10] usb 2-1: unable to get BOS descriptor or descriptor too short [ 367.915639][ T10] usb 2-1: not running at top speed; connect to a high speed hub [ 367.925475][ T10] usb 2-1: New USB device found, idVendor=13e5, idProduct=0001, bcdDevice= 0.40 [ 367.934564][ T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 367.942900][ T10] usb 2-1: Product: syz [ 367.947073][ T10] usb 2-1: Manufacturer: syz [ 367.951736][ T10] usb 2-1: SerialNumber: syz [ 368.160214][T13735] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 368.168832][T13735] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 368.187247][T13758] tipc: Cannot configure node identity twice [ 368.409424][ T1786] usb 9-1: new high-speed USB device number 82 using dummy_hcd [ 368.434154][ T10] usb 2-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 368.441713][ T10] usb 2-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 368.450272][ T10] usb 2-1: USB disconnect, device number 44 [ 368.458562][ T323] udevd[323]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 368.560644][ T1786] usb 9-1: unable to get BOS descriptor or descriptor too short [ 368.569016][ T1786] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 368.579160][ T1786] usb 9-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 368.588032][ T1786] usb 9-1: config 1 interface 0 has no altsetting 0 [ 368.596070][ T1786] usb 9-1: New USB device found, idVendor=041e, idProduct=3237, bcdDevice= 0.40 [ 368.605140][ T1786] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 368.613178][ T1786] usb 9-1: Product: syz [ 368.617335][ T1786] usb 9-1: Manufacturer: syz [ 368.621927][ T1786] usb 9-1: SerialNumber: syz [ 368.830448][ T1786] usb 9-1: 0:1 : does not exist [ 368.837259][ T1786] usb 9-1: USB disconnect, device number 82 [ 368.844720][ T312] udevd[312]: error opening ATTR{/sys/devices/platform/dummy_hcd.8/usb9/9-1/9-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 369.273982][T13781] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5459'. [ 369.387962][T13790] netlink: 36 bytes leftover after parsing attributes in process `syz.8.5463'. [ 369.399405][ T1786] usb 10-1: new full-speed USB device number 94 using dummy_hcd [ 369.550812][ T1786] usb 10-1: unable to get BOS descriptor or descriptor too short [ 369.558996][ T1786] usb 10-1: not running at top speed; connect to a high speed hub [ 369.569143][ T1786] usb 10-1: New USB device found, idVendor=13e5, idProduct=0001, bcdDevice= 0.40 [ 369.578440][ T1786] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 369.586741][ T1786] usb 10-1: Product: syz [ 369.591169][ T1786] usb 10-1: Manufacturer: syz [ 369.595875][ T1786] usb 10-1: SerialNumber: syz [ 369.779377][T12018] usb 9-1: new high-speed USB device number 83 using dummy_hcd [ 369.802835][T13779] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 369.811412][T13779] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 369.940745][T12018] usb 9-1: unable to get BOS descriptor or descriptor too short [ 369.949167][T12018] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 369.959411][T12018] usb 9-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 369.968310][T12018] usb 9-1: config 1 interface 0 has no altsetting 0 [ 369.976647][T12018] usb 9-1: New USB device found, idVendor=041e, idProduct=3237, bcdDevice= 0.40 [ 369.986322][T12018] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 369.994379][T12018] usb 9-1: Product: syz [ 369.998624][T12018] usb 9-1: Manufacturer: syz [ 370.003266][T12018] usb 9-1: SerialNumber: syz [ 370.083082][ T1786] usb 10-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 370.090806][ T1786] usb 10-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 370.099298][ T1786] usb 10-1: USB disconnect, device number 94 [ 370.211658][T12018] usb 9-1: 0:1 : does not exist [ 370.218578][T12018] usb 9-1: USB disconnect, device number 83 [ 370.227819][ T312] udevd[312]: error opening ATTR{/sys/devices/platform/dummy_hcd.8/usb9/9-1/9-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 371.159375][ T1786] usb 10-1: new full-speed USB device number 95 using dummy_hcd [ 371.310696][ T1786] usb 10-1: unable to get BOS descriptor or descriptor too short [ 371.318813][ T1786] usb 10-1: not running at top speed; connect to a high speed hub [ 371.328700][ T1786] usb 10-1: New USB device found, idVendor=13e5, idProduct=0001, bcdDevice= 0.40 [ 371.337878][ T1786] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 371.346033][ T1786] usb 10-1: Product: syz [ 371.350751][ T1786] usb 10-1: Manufacturer: syz [ 371.355423][ T1786] usb 10-1: SerialNumber: syz [ 371.562840][T13833] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 371.571416][T13833] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 371.822690][ T1786] usb 10-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 371.830282][ T1786] usb 10-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 371.838791][ T1786] usb 10-1: USB disconnect, device number 95 [ 371.847520][ T323] udevd[323]: error opening ATTR{/sys/devices/platform/dummy_hcd.9/usb10/10-1/10-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 372.119402][T12018] usb 2-1: new high-speed USB device number 45 using dummy_hcd [ 372.219140][T13856] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 372.219161][T13856] rust_binder: Read failure Err(EFAULT) in pid:1403 [ 372.228024][T13856] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 372.234690][T13856] rust_binder: Read failure Err(EFAULT) in pid:1403 [ 372.243077][T13856] rust_binder: 13855:13856 FDA parent offset not aligned correctly [ 372.257830][T13856] rust_binder: 13855:13856 error while translating object: EINVAL [ 372.265840][T13856] rust_binder: Failure in copy_transaction_data: EINVAL [ 372.265864][T13856] rust_binder: 13855:13856 transaction call to 13855:0 failed EINVAL, code 4294967271 size 112-24 [ 372.284079][ T10] rust_binder: 13855: undelivered TRANSACTION_ERROR: 29201 [ 372.291776][T12018] usb 2-1: unable to get BOS descriptor or descriptor too short [ 372.300700][T12018] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 372.310852][T12018] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 372.319753][T12018] usb 2-1: config 1 interface 0 has no altsetting 0 [ 372.327668][T12018] usb 2-1: New USB device found, idVendor=041e, idProduct=3237, bcdDevice= 0.40 [ 372.336881][T12018] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 372.345338][T12018] usb 2-1: Product: syz [ 372.349730][T12018] usb 2-1: Manufacturer: syz [ 372.354454][T12018] usb 2-1: SerialNumber: syz [ 372.565695][T12018] usb 2-1: 0:1 : does not exist [ 372.574465][T12018] usb 2-1: USB disconnect, device number 45 [ 372.609370][ T311] usb 9-1: new full-speed USB device number 84 using dummy_hcd [ 372.709768][ T10] usb 10-1: new high-speed USB device number 96 using dummy_hcd [ 372.760617][ T311] usb 9-1: unable to get BOS descriptor or descriptor too short [ 372.768651][ T311] usb 9-1: not running at top speed; connect to a high speed hub [ 372.778249][ T311] usb 9-1: New USB device found, idVendor=13e5, idProduct=0001, bcdDevice= 0.40 [ 372.787398][ T311] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 372.795462][ T311] usb 9-1: Product: syz [ 372.800231][ T311] usb 9-1: Manufacturer: syz [ 372.804815][ T311] usb 9-1: SerialNumber: syz [ 372.859357][ T10] usb 10-1: Using ep0 maxpacket: 16 [ 372.865628][ T10] usb 10-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 372.876689][ T10] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 19, changing to 8 [ 372.887779][ T10] usb 10-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 372.900830][ T10] usb 10-1: New USB device found, idVendor=05ac, idProduct=0324, bcdDevice= 0.00 [ 372.909965][ T10] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 372.918670][ T10] usb 10-1: config 0 descriptor?? [ 373.011876][T13862] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 373.020412][T13862] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 373.090765][T13875] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5493'. [ 373.200770][T13872] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 373.209291][T13872] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 373.262534][ T311] usb 9-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 373.271514][ T311] usb 9-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 373.280111][ T311] usb 9-1: USB disconnect, device number 84 [ 373.288934][ T323] udevd[323]: error opening ATTR{/sys/devices/platform/dummy_hcd.8/usb9/9-1/9-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 373.420983][ T10] magicmouse 0003:05AC:0324.0048: unknown main item tag 0x0 [ 373.428371][ T10] magicmouse 0003:05AC:0324.0048: unknown main item tag 0x0 [ 373.435684][ T10] magicmouse 0003:05AC:0324.0048: unknown main item tag 0x0 [ 373.443135][ T10] magicmouse 0003:05AC:0324.0048: unknown main item tag 0x0 [ 373.450451][ T10] magicmouse 0003:05AC:0324.0048: unknown main item tag 0x0 [ 373.457741][ T10] magicmouse 0003:05AC:0324.0048: unknown main item tag 0x0 [ 373.465141][ T10] magicmouse 0003:05AC:0324.0048: unknown main item tag 0x0 [ 373.472452][ T10] magicmouse 0003:05AC:0324.0048: unknown main item tag 0x0 [ 373.480475][ T10] magicmouse 0003:05AC:0324.0048: hidraw0: USB HID v10.00 Device [HID 05ac:0324] on usb-dummy_hcd.9-1/input0 [ 373.621559][ T10] usb 10-1: USB disconnect, device number 96 [ 374.279368][ T9] usb 9-1: new full-speed USB device number 85 using dummy_hcd [ 374.339107][T13893] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 374.339123][T13893] rust_binder: Read failure Err(EFAULT) in pid:488 [ 374.347925][T13893] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 374.354461][T13893] rust_binder: Read failure Err(EFAULT) in pid:488 [ 374.362900][T13893] rust_binder: 13892:13893 FDA parent offset not aligned correctly [ 374.377300][T13893] rust_binder: 13892:13893 error while translating object: EINVAL [ 374.385136][T13893] rust_binder: Failure in copy_transaction_data: EINVAL [ 374.385158][T13893] rust_binder: 13892:13893 transaction call to 13892:0 failed EINVAL, code 4294967288 size 112-24 [ 374.403318][ T311] rust_binder: 13892: undelivered TRANSACTION_ERROR: 29201 [ 374.431450][ T9] usb 9-1: unable to get BOS descriptor or descriptor too short [ 374.439475][ T9] usb 9-1: not running at top speed; connect to a high speed hub [ 374.449158][ T9] usb 9-1: New USB device found, idVendor=13e5, idProduct=0001, bcdDevice= 0.40 [ 374.458250][ T9] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 374.466254][ T9] usb 9-1: Product: syz [ 374.470457][ T9] usb 9-1: Manufacturer: syz [ 374.475055][ T9] usb 9-1: SerialNumber: syz [ 374.669375][ T311] usb 2-1: new high-speed USB device number 46 using dummy_hcd [ 374.681846][T13888] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 374.690382][T13888] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 374.820746][ T311] usb 2-1: unable to get BOS descriptor or descriptor too short [ 374.829189][ T311] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 374.839371][ T311] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 374.848235][ T311] usb 2-1: config 1 interface 0 has no altsetting 0 [ 374.856388][ T311] usb 2-1: New USB device found, idVendor=041e, idProduct=3237, bcdDevice= 0.40 [ 374.865477][ T311] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 374.873565][ T311] usb 2-1: Product: syz [ 374.877738][ T311] usb 2-1: Manufacturer: syz [ 374.883191][ T311] usb 2-1: SerialNumber: syz [ 374.942284][ T9] usb 9-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 374.949897][ T9] usb 9-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 374.958413][ T9] usb 9-1: USB disconnect, device number 85 [ 374.969890][ T323] udevd[323]: error opening ATTR{/sys/devices/platform/dummy_hcd.8/usb9/9-1/9-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 375.095499][ T311] usb 2-1: 0:1 : does not exist [ 375.102369][ T311] usb 2-1: USB disconnect, device number 46 [ 375.109145][ T312] udevd[312]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 375.209092][T13912] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5506'. [ 375.839375][ T9] usb 2-1: new high-speed USB device number 47 using dummy_hcd [ 375.939375][ T10] usb 9-1: new high-speed USB device number 86 using dummy_hcd [ 375.989372][ T9] usb 2-1: Using ep0 maxpacket: 16 [ 375.995517][ T9] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 376.005737][ T9] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 376.015502][ T9] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= f.89 [ 376.024565][ T9] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 376.032559][ T9] usb 2-1: SerialNumber: syz [ 376.038899][ T9] usb 2-1: cannot find UAC_HEADER [ 376.045288][ T9] snd-usb-audio 2-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 376.058072][ T323] udevd[323]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 376.090418][ T10] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 376.100236][ T10] usb 9-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8E has invalid maxpacket 0 [ 376.109971][ T10] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0xA has invalid wMaxPacketSize 0 [ 376.119675][ T10] usb 9-1: config 0 interface 0 altsetting 0 bulk endpoint 0xA has invalid maxpacket 0 [ 376.130702][ T10] usb 9-1: New USB device found, idVendor=05ab, idProduct=0301, bcdDevice= 1.00 [ 376.139785][ T10] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 376.147759][ T10] usb 9-1: Product: syz [ 376.151942][ T10] usb 9-1: Manufacturer: syz [ 376.156531][ T10] usb 9-1: SerialNumber: syz [ 376.161736][ T10] usb 9-1: config 0 descriptor?? [ 376.167492][ T10] ums-isd200 9-1:0.0: USB Mass Storage device detected [ 376.400721][ T10] ums-isd200 9-1:0.0: probe with driver ums-isd200 failed with error -22 [ 376.479981][T12018] usb 2-1: USB disconnect, device number 47 [ 376.568055][ T36] audit: type=1400 audit(1785918544.909:1849): avc: denied { create } for pid=13941 comm="syz.8.5517" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ipx_socket permissive=1 [ 376.659572][T13948] tipc: Cannot configure node identity twice [ 376.667051][T12018] usb 9-1: USB disconnect, device number 86 [ 376.737132][T13958] rust_binder: 13957:13958 got transaction to invalid handle 1 [ 376.744777][T13958] rust_binder: 13957:13958 transaction async to 0:0 failed ENOENT, code 0 size 104-24 [ 376.754957][ T311] rust_binder: 13957: undelivered TRANSACTION_ERROR: 29201 [ 377.009378][ T311] usb 10-1: new high-speed USB device number 97 using dummy_hcd [ 377.139370][ T311] usb 10-1: device descriptor read/64, error -71 [ 377.389369][ T311] usb 10-1: device descriptor read/64, error -71 [ 377.649377][ T311] usb 10-1: new high-speed USB device number 98 using dummy_hcd [ 377.779374][ T311] usb 10-1: device descriptor read/64, error -71 [ 378.029413][ T311] usb 10-1: device descriptor read/64, error -71 [ 378.131708][T13975] tipc: Started in network mode [ 378.136585][T13975] tipc: Node identity 0000000000000000002e0021, cluster identity 4711 [ 378.144890][ T311] usb usb10-port1: attempt power cycle [ 378.162599][T13979] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5531'. [ 378.359382][ T10] usb 9-1: new full-speed USB device number 87 using dummy_hcd [ 378.489376][ T311] usb 10-1: new high-speed USB device number 99 using dummy_hcd [ 378.510294][ T311] usb 10-1: device descriptor read/8, error -71 [ 378.521232][ T10] usb 9-1: unable to get BOS descriptor or descriptor too short [ 378.529360][ T10] usb 9-1: not running at top speed; connect to a high speed hub [ 378.539209][ T10] usb 9-1: New USB device found, idVendor=13e5, idProduct=0001, bcdDevice= 0.40 [ 378.548314][ T10] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 378.556689][ T10] usb 9-1: Product: syz [ 378.560988][ T10] usb 9-1: Manufacturer: syz [ 378.565581][ T10] usb 9-1: SerialNumber: syz [ 378.640359][ T311] usb 10-1: device descriptor read/8, error -71 [ 378.779105][T13973] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 378.787651][T13973] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 378.879386][ T311] usb 10-1: new high-speed USB device number 100 using dummy_hcd [ 378.900369][ T311] usb 10-1: device descriptor read/8, error -71 [ 378.973188][ T10] usb 9-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 378.981176][ T10] usb 9-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 378.990872][ T10] usb 9-1: USB disconnect, device number 87 [ 378.998788][ T323] udevd[323]: error opening ATTR{/sys/devices/platform/dummy_hcd.8/usb9/9-1/9-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 379.040438][ T311] usb 10-1: device descriptor read/8, error -71 [ 379.149429][ T311] usb usb10-port1: unable to enumerate USB device [ 379.816822][T14004] bridge0: port 1(bridge_slave_0) entered blocking state [ 379.824877][T14004] bridge0: port 1(bridge_slave_0) entered disabled state [ 379.832233][T14004] bridge_slave_0: entered allmulticast mode [ 379.838428][T14004] bridge_slave_0: entered promiscuous mode [ 379.845097][T14004] bridge0: port 2(bridge_slave_1) entered blocking state [ 379.852287][T14004] bridge0: port 2(bridge_slave_1) entered disabled state [ 379.854862][T14011] netlink: 8 bytes leftover after parsing attributes in process `syz.9.5541'. [ 379.859544][T14004] bridge_slave_1: entered allmulticast mode [ 379.874401][T14004] bridge_slave_1: entered promiscuous mode [ 380.431575][T14004] bridge0: port 2(bridge_slave_1) entered blocking state [ 380.438621][T14004] bridge0: port 2(bridge_slave_1) entered forwarding state [ 380.445895][T14004] bridge0: port 1(bridge_slave_0) entered blocking state [ 380.452929][T14004] bridge0: port 1(bridge_slave_0) entered forwarding state [ 380.461665][ T297] bridge_slave_1: left allmulticast mode [ 380.467361][ T297] bridge_slave_1: left promiscuous mode [ 380.472980][ T297] bridge0: port 2(bridge_slave_1) entered disabled state [ 380.509746][ T297] bridge_slave_0: left allmulticast mode [ 380.515438][ T297] bridge_slave_0: left promiscuous mode [ 380.521401][ T297] bridge0: port 1(bridge_slave_0) entered disabled state [ 380.649408][ T9] usb 10-1: new high-speed USB device number 101 using dummy_hcd [ 380.700171][ T571] bridge0: port 1(bridge_slave_0) entered disabled state [ 380.739518][ T571] bridge0: port 2(bridge_slave_1) entered disabled state [ 380.781252][ T297] tipc: Left network mode [ 380.799403][ T9] usb 10-1: Using ep0 maxpacket: 16 [ 380.805718][ T9] usb 10-1: config 1 has an invalid interface number: 105 but max is 0 [ 380.814036][ T9] usb 10-1: config 1 has no interface number 0 [ 380.820701][ T9] usb 10-1: config 1 interface 105 altsetting 2 bulk endpoint 0x4 has invalid maxpacket 16 [ 380.830720][ T9] usb 10-1: config 1 interface 105 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 64 [ 380.840963][ T9] usb 10-1: config 1 interface 105 has no altsetting 0 [ 380.849108][ T9] usb 10-1: New USB device found, idVendor=20f4, idProduct=e05a, bcdDevice=6c.6d [ 380.858261][ T9] usb 10-1: New USB device strings: Mfr=1, Product=23, SerialNumber=3 [ 380.866600][ T9] usb 10-1: Product: syz [ 380.866996][ T571] bridge0: port 1(bridge_slave_0) entered blocking state [ 380.870896][ T9] usb 10-1: Manufacturer: syz [ 380.877898][ T571] bridge0: port 1(bridge_slave_0) entered forwarding state [ 380.882736][ T9] usb 10-1: SerialNumber: syz [ 380.890567][ T571] bridge0: port 2(bridge_slave_1) entered blocking state [ 380.896902][T14017] raw-gadget.1 gadget.9: fail, usb_ep_enable returned -22 [ 380.901476][ T571] bridge0: port 2(bridge_slave_1) entered forwarding state [ 380.908693][T14017] raw-gadget.1 gadget.9: fail, usb_ep_enable returned -22 [ 381.059540][ T297] veth1_macvtap: left promiscuous mode [ 381.065059][ T297] veth0_vlan: left promiscuous mode [ 381.241481][T14004] veth0_vlan: entered promiscuous mode [ 381.252511][T14004] veth1_macvtap: entered promiscuous mode [ 381.326610][T14017] raw-gadget.1 gadget.9: fail, usb_ep_enable returned -22 [ 381.333858][T14017] raw-gadget.1 gadget.9: fail, usb_ep_enable returned -22 [ 381.382503][ T36] audit: type=1400 audit(1785918549.729:1850): avc: denied { mounton } for pid=14004 comm="syz-executor" path="/root/syzkaller.wbgI2J/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=90648 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1 [ 381.450108][ T36] audit: type=1400 audit(1785918549.799:1851): avc: denied { mount } for pid=14004 comm="syz-executor" name="/" dev="binder" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 381.527538][T14027] tipc: Started in network mode [ 381.532478][T14027] tipc: Node identity 0000000000000000002e0022, cluster identity 4711 [ 381.742149][ T9] aqc111 10-1:1.105 (unnamed net_device) (uninitialized): Failed to read(0x1) reg index 0x0001: -32 [ 381.859461][ T10] usb 2-1: new high-speed USB device number 48 using dummy_hcd [ 381.954977][ T9] aqc111 10-1:1.105 eth1: register 'aqc111' at usb-dummy_hcd.9-1, USB-C 3.1 to 5GBASE-T Ethernet Adapter, 86:48:3f:96:62:84 [ 381.991264][ T297] ------------[ cut here ]------------ [ 381.996795][ T297] WARNING: CPU: 1 PID: 297 at net/ipv6/xfrm6_tunnel.c:341 xfrm6_tunnel_net_exit+0xc4/0x140 [ 382.006979][ T297] Modules linked in: [ 382.010903][ T297] CPU: 1 UID: 0 PID: 297 Comm: kworker/u8:3 Not tainted syzkaller #0 d75e9a393de9c6a33055d5e25749154d2cb9f431 [ 382.022563][ T297] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 382.032634][ T297] Workqueue: netns cleanup_net [ 382.037430][ T297] RIP: 0010:xfrm6_tunnel_net_exit+0xc4/0x140 [ 382.043457][ T297] Code: e8 f1 62 d6 fc 4b 83 3c 3e 00 75 19 e8 65 9f 7d fc 49 81 ff f8 07 00 00 74 1b e8 57 9f 7d fc 49 83 c7 08 eb c9 e8 4c 9f 7d fc <0f> 0b 49 81 ff f8 07 00 00 75 e5 49 8d 9e 00 08 00 00 45 31 ff 4a [ 382.063116][ T297] RSP: 0018:ffffc9000b6bfb90 EFLAGS: 00010293 [ 382.069198][ T297] RAX: ffffffff8509d274 RBX: ffff8881238cd8c0 RCX: ffff88812f98b900 [ 382.077343][ T297] RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffff88811a698000 [ 382.085351][ T297] RBP: ffffc9000b6bfbb0 R08: 0000000000000003 R09: 0000000000000004 [ 382.093374][ T297] R10: dffffc0000000000 R11: fffff520016d7f04 R12: dffffc0000000000 [ 382.101366][ T10] usb 2-1: unable to get BOS descriptor or descriptor too short [ 382.101374][ T297] R13: dffffc0000000000 R14: ffff88811a698000 R15: 0000000000000000 [ 382.101393][ T297] FS: 0000000000000000(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 382.109941][ T10] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 382.116987][ T297] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 382.117007][ T297] CR2: 00007ffcf835ba68 CR3: 000000011c210000 CR4: 00000000003526b0 [ 382.126321][ T10] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 382.136152][ T297] DR0: 00000000000082a1 DR1: 0000000000000000 DR2: 0000000000000000 [ 382.142974][ T10] usb 2-1: config 1 interface 0 has no altsetting 0 [ 382.150584][ T297] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 382.150604][ T297] Call Trace: [ 382.150611][ T297] [ 382.150619][ T297] cleanup_net+0x6bd/0xc90 [ 382.150647][ T297] ? __cfi_cleanup_net+0x10/0x10 [ 382.168680][T14017] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 382.174126][ T297] ? kick_pool+0xb9/0x540 [ 382.174159][ T297] process_scheduled_works+0x7f7/0x1060 [ 382.182674][T14017] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 382.185401][ T297] worker_thread+0xc99/0x13f0 [ 382.189809][ T10] usb 2-1: New USB device found, idVendor=041e, idProduct=3237, bcdDevice= 0.40 [ 382.192751][ T297] kthread+0x2c7/0x360 [ 382.197961][ T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 382.205980][ T297] ? __cfi_worker_thread+0x10/0x10 [ 382.206012][ T297] ? __cfi_kthread+0x10/0x10 [ 382.206030][ T297] ret_from_fork+0x67/0xa0 [ 382.212330][ T10] usb 2-1: Product: syz [ 382.215880][ T297] ? __cfi_kthread+0x10/0x10 [ 382.215908][ T297] ret_from_fork_asm+0x1a/0x30 [ 382.227007][ T9] usb 10-1: USB disconnect, device number 101 [ 382.228280][ T297] [ 382.228291][ T297] ---[ end trace 0000000000000000 ]--- [ 382.230909][ T297] ------------[ cut here ]------------ [ 382.238096][ T149] aqc111 10-1:1.105 eth1: Failed to write(0x61) reg index 0x0000: -71 [ 382.241400][ T297] WARNING: CPU: 1 PID: 297 at net/ipv6/xfrm6_tunnel.c:344 xfrm6_tunnel_net_exit+0x119/0x140 [ 382.250040][ T9] aqc111 10-1:1.105 eth1: unregister 'aqc111' usb-dummy_hcd.9-1, USB-C 3.1 to 5GBASE-T Ethernet Adapter [ 382.254423][ T297] Modules linked in: [ 382.254441][ T297] CPU: 1 UID: 0 PID: 297 Comm: kworker/u8:3 Tainted: G W syzkaller #0 d75e9a393de9c6a33055d5e25749154d2cb9f431 [ 382.259067][ T10] usb 2-1: Manufacturer: syz [ 382.263467][ T297] Tainted: [W]=WARN [ 382.267904][ T149] aqc111 10-1:1.105 eth1: Failed to write(0x1) reg index 0x0006: -19 [ 382.272174][ T297] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 382.272189][ T297] Workqueue: netns cleanup_net [ 382.277123][ T10] usb 2-1: SerialNumber: syz [ 382.282999][ T297] [ 382.283008][ T297] RIP: 0010:xfrm6_tunnel_net_exit+0x119/0x140 [ 382.286278][ T149] aqc111 10-1:1.105 eth1: Failed to write(0x1) reg index 0x0001: -19 [ 382.291454][ T297] Code: fc 4b 83 bc 3e 00 08 00 00 00 75 19 e8 10 9f 7d fc 49 81 ff f8 07 00 00 74 1b e8 02 9f 7d fc 49 83 c7 08 eb c5 e8 f7 9e 7d fc <0f> 0b 49 81 ff f8 07 00 00 75 e5 e8 e7 9e 7d fc 5b 41 5c 41 5e 41 [ 382.291472][ T297] RSP: 0018:ffffc9000b6bfb90 EFLAGS: 00010293 [ 382.291488][ T297] RAX: ffffffff8509d2c9 RBX: ffff88811a698800 RCX: ffff88812f98b900 [ 382.291503][ T297] RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffff88811a698808 [ 382.291515][ T297] RBP: ffffc9000b6bfbb0 R08: 0000000000000003 R09: 0000000000000004 [ 382.302955][ T149] aqc111 10-1:1.105 eth1: Failed to write(0x1) reg index 0x0001: -19 [ 382.305129][ T297] R10: dffffc0000000000 R11: fffff520016d7f04 R12: dffffc0000000000 [ 382.315529][ T149] aqc111 10-1:1.105 eth1: Failed to read(0x1) reg index 0x0001: -19 [ 382.326297][ T297] R13: dffffc0000000000 R14: ffff88811a698000 R15: 0000000000000008 [ 382.326315][ T297] FS: 0000000000000000(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 382.330789][ T149] aqc111 10-1:1.105 eth1: Failed to write(0x1) reg index 0x0001: -19 [ 382.343314][ T297] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 382.348130][ T149] aqc111 10-1:1.105 eth1: Failed to write(0x61) reg index 0x0000: -19 [ 382.351669][ T297] CR2: 00007ffcf835ba68 CR3: 000000011594a000 CR4: 00000000003526b0 [ 382.351688][ T297] DR0: 00000000000082a1 DR1: 0000000000000000 DR2: 0000000000000000 [ 382.351700][ T297] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 382.351713][ T297] Call Trace: [ 382.360363][ T149] aqc111 10-1:1.105 eth1: Error submitting the control message: status=-19 [ 382.369820][ T297] [ 382.374595][ T149] aqc111 10-1:1.105 eth1: Error submitting the control message: status=-19 [ 382.379119][ T297] cleanup_net+0x6bd/0xc90 [ 382.381965][ T149] aqc111 10-1:1.105 eth1: Error submitting the control message: status=-19 [ 382.387477][ T297] ? __cfi_cleanup_net+0x10/0x10 [ 382.395612][ T149] aqc111 10-1:1.105 eth1: Error submitting the control message: status=-19 [ 382.415194][ T297] ? kick_pool+0xb9/0x540 [ 382.535976][ T10] usb 2-1: 0:1 : does not exist [ 382.544528][ T297] process_scheduled_works+0x7f7/0x1060 [ 382.544559][ T297] worker_thread+0xc99/0x13f0 [ 382.565727][ T10] usb 2-1: USB disconnect, device number 48 [ 382.569078][ T297] kthread+0x2c7/0x360 [ 382.569108][ T297] ? __cfi_worker_thread+0x10/0x10 [ 382.616946][ T297] ? __cfi_kthread+0x10/0x10 [ 382.621545][ T297] ret_from_fork+0x67/0xa0 [ 382.625962][ T297] ? __cfi_kthread+0x10/0x10 [ 382.630577][ T297] ret_from_fork_asm+0x1a/0x30 [ 382.635342][ T297] [ 382.638344][ T297] ---[ end trace 0000000000000000 ]--- [ 382.671375][ T9] aqc111 10-1:1.105 eth1: Failed to read(0x1) reg index 0x0002: -19 [ 382.679488][ T9] aqc111 10-1:1.105 eth1: Failed to write(0x1) reg index 0x0002: -19 [ 382.689604][ T9] aqc111 10-1:1.105 eth1: Failed to write(0x1) reg index 0x0002: -19 [ 382.697813][ T9] aqc111 10-1:1.105 eth1: Failed to write(0x61) reg index 0x0000: -19 [ 382.803021][ T9] aqc111 10-1:1.105 eth1 (unregistered): Failed to write(0x1) reg index 0x0002: -19 [ 382.815505][ T9] aqc111 10-1:1.105 eth1 (unregistered): Failed to write(0x1) reg index 0x0002: -19 [ 382.825115][ T9] aqc111 10-1:1.105 eth1 (unregistered): Failed to write(0x61) reg index 0x0000: -19 [ 382.828154][ T297] ------------[ cut here ]------------ [ 382.840082][ T297] WARNING: CPU: 1 PID: 297 at net/xfrm/xfrm_state.c:3217 xfrm_state_fini+0x2be/0x310 [ 382.849557][ T297] Modules linked in: [ 382.853449][ T297] CPU: 1 UID: 0 PID: 297 Comm: kworker/u8:3 Tainted: G W syzkaller #0 d75e9a393de9c6a33055d5e25749154d2cb9f431 [ 382.866552][ T297] Tainted: [W]=WARN [ 382.870411][ T297] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 382.880488][ T297] Workqueue: netns cleanup_net [ 382.885259][ T297] RIP: 0010:xfrm_state_fini+0x2be/0x310 [ 382.890830][ T297] Code: 3c 20 00 74 08 48 89 df e8 2f 21 f1 fc 48 8b 3b e8 47 14 dc fc 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc e8 92 5d 98 fc <0f> 0b e9 b0 fd ff ff e8 86 5d 98 fc 0f 0b e9 18 fe ff ff e8 7a 5d [ 382.910453][ T297] RSP: 0018:ffffc9000b6bfb70 EFLAGS: 00010293 [ 382.916533][ T297] RAX: ffffffff84ef142e RBX: ffff8881238cd8c0 RCX: ffff88812f98b900 [ 382.924508][ T297] RDX: 0000000000000000 RSI: 0000000000c00000 RDI: ffff88812f98b900 [ 382.932485][ T297] RBP: ffffc9000b6bfb98 R08: ffffffff87d42767 R09: 1ffffffff0fa84ec [ 382.940460][ T297] R10: dffffc0000000000 R11: fffffbfff0fa84ed R12: 1ffffffff0fa8240 [ 382.948435][ T297] R13: dffffc0000000000 R14: ffff8881238ce4c0 R15: dffffc0000000000 [ 382.956458][ T297] FS: 0000000000000000(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 382.965400][ T297] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 382.971990][ T297] CR2: 00007fc5a37ef2f8 CR3: 0000000123834000 CR4: 00000000003526b0 [ 382.979969][ T297] DR0: 00000000000082a1 DR1: 0000000000000000 DR2: 0000000000000000 [ 382.987920][ T297] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 382.995891][ T297] Call Trace: [ 382.999164][ T297] [ 383.002102][ T297] xfrm_net_exit+0x31/0x80 [ 383.006619][ T297] cleanup_net+0x6bd/0xc90 [ 383.011046][ T297] ? __cfi_cleanup_net+0x10/0x10 [ 383.015981][ T297] ? kick_pool+0xb9/0x540 [ 383.020313][ T297] process_scheduled_works+0x7f7/0x1060 [ 383.025855][ T297] worker_thread+0xc99/0x13f0 [ 383.030589][ T297] kthread+0x2c7/0x360 [ 383.034659][ T297] ? __cfi_worker_thread+0x10/0x10 [ 383.039770][ T297] ? __cfi_kthread+0x10/0x10 [ 383.044358][ T297] ret_from_fork+0x67/0xa0 [ 383.048758][ T297] ? __cfi_kthread+0x10/0x10 [ 383.053352][ T297] ret_from_fork_asm+0x1a/0x30 [ 383.058137][ T297] [ 383.061176][ T297] ---[ end trace 0000000000000000 ]---