last executing test programs: 2.952385218s ago: executing program 0 (id=125): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r1, 0x11b, 0x3, &(0x7f0000000140)=0x40, 0x4) unshare(0x22020400) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = openat$incfs(r2, &(0x7f00000002c0)='.pending_reads\x00', 0x82, 0x8) r4 = socket$xdp(0x2c, 0x3, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40a01, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$TUNSETLINK(r5, 0x400454cd, 0x339) r7 = dup(r6) ioctl$SIOCSIFHWADDR(r7, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) r8 = socket$inet_udp(0x2, 0x2, 0x0) lseek(r8, 0x3, 0x6) setsockopt$XDP_UMEM_REG(r4, 0x11b, 0x4, &(0x7f0000000340)={&(0x7f0000000000)=""/62, 0x328000, 0x800, 0x9, 0x2}, 0x20) setsockopt$XDP_UMEM_COMPLETION_RING(r4, 0x11b, 0x6, &(0x7f0000000080)=0x1, 0x4) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r0) sendmsg$NL80211_CMD_DEL_KEY(r0, &(0x7f00000003c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000280)=ANY=[@ANYBLOB="4c000400", @ANYRES16=r9, @ANYBLOB="000827bd7000fcdbdf250c00000012000a0016c9f259b6fd402d39726348697d00000800090001ac0f00090007007b5f98f45c00000005000800000000000800370002000000"], 0x4c}, 0x1, 0x0, 0x0, 0x4000}, 0x4) setsockopt$XDP_RX_RING(r4, 0x11b, 0x2, &(0x7f0000001980)=0x100, 0x4) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000580)={'batadv_slave_1\x00', 0x0}) setsockopt$XDP_UMEM_FILL_RING(r4, 0x11b, 0x5, &(0x7f0000000300)=0x2, 0x4) ioctl$BTRFS_IOC_QUOTA_RESCAN_WAIT(r3, 0x942e, 0x0) bind$xdp(r4, &(0x7f0000000100)={0x2c, 0x0, r10}, 0x10) bind$xdp(r1, &(0x7f0000000240)={0x2c, 0x1, r10, 0x0, r4}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r11 = socket$packet(0x11, 0x2, 0x300) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r11, 0x8933, &(0x7f00000001c0)={'batadv_slave_1\x00'}) r12 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r12, 0x29, 0x2, 0x0, 0x0) 2.798283882s ago: executing program 0 (id=128): ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) mount(0x0, &(0x7f0000000040)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/max_speed\x00', 0x1, 0x0) close(r0) 2.797958962s ago: executing program 0 (id=129): openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x42, 0x0) r0 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r0, 0x4008ae89, &(0x7f0000000080)={0x1, 0x0, [{0x40000071, 0x0, 0xff00000000047ffe}]}) userfaultfd(0x801) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) close(r1) timer_create(0x0, &(0x7f0000000200)={0x0, 0x21, 0x2, @tid=0xffffffffffffffff}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x60d5, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r2, 0x1, &(0x7f0000000040), 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./trace\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./trace\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./trace/set_event\x00', 0x2, 0x0) write(r3, &(0x7f0000000400)='!*:', 0x3) 2.646024046s ago: executing program 0 (id=131): r0 = syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x56a, 0x9a, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x0, 0x2, 0x0, {0x9, 0x21, 0x2000, 0x0, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x8}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150825ff0904a1010901a1007508950109308102c0c0"], 0x0}, 0x0) syz_usb_control_io$uac2(0xffffffffffffffff, &(0x7f0000000240)={0x14, &(0x7f00000005c0)={0x40, 0xc, 0xdf, {0xdf, 0x31, "334955dce47a61f33f26886df72f2a050de5cce3017915ccf68a2a0b6fef5e5ce4bed73db1dbdbe6a82dc7a828b2187cbe9041a2d4de0b04939c720c79d7e231ac9e51987a02ebf6bcfbee100c21a650970544af3178b4eb713fdfa407b1d1009186030f5af214404837be6cf747a89c72bf881acb1d14d9a4594974f22dfbc9dbd419f4d19986e4f436e127abe473f9c433fd71f829e3eb4c7ba3c99ac8ac4e0fa509e37ef35b6ec86d870e59638e4babe130926edb4412d39fd3b2d79b6322efeb88ae135a601f9c30c2247c60009d1397f0428ac6045dc1b649c0fa"}}, &(0x7f00000001c0)={0x0, 0x3, 0x6c, @string={0x6c, 0x3, "5e8d8b17105243834ca7833ef475fef1619dec0c1a6350106e906694645d4dcaf4209a0d761de61e19d88a8557629f37914df6269f49ed20a0c945d549f8362987c02f59a307d5fe72511f9b0b79772a3e58e0919c2e601f45bdd9e5c6998ca486fcc765c84572738d17"}}}, &(0x7f0000000540)={0x44, &(0x7f0000000280)={0x0, 0x10, 0xf1, "fb26eff7b86200b48345c439af02a6b6c10920bd7a9d0928215c7c40333cc6ef1da7e044a0d7eac685470a792d8d0a39a14a9a0d99116dbbbd7fd90796e6c43176d720ca1697230cbb778841657fb4baa64d08e4dfaaf406425037c239f286169257654a5e246aa178e5bb8624c236e1c59f2b6d8a9158735410bb47743b7b908b06dda4fdf8726ef79c77c49c1aed5c37bef642f169cca9df9772e9478c26dbefd5f6656ea5b92cb963fb73e4144ab55b5f784c04e69bb698a5106af6fa0c043afe32f6e75352a647f4ec427d56780079b1a24e9671538a3214ffe6e93b7ef37ec69adad79e6995f2b4fa883e892f4466"}, &(0x7f0000000380)={0x0, 0xa, 0x1, 0x2}, &(0x7f00000003c0)={0x0, 0x8, 0x1, 0x3}, &(0x7f0000000400)={0x20, 0x81, 0x3, 'r9_'}, &(0x7f0000000440)={0x20, 0x82, 0x1, 'o'}, &(0x7f0000000480)={0x20, 0x83, 0x1, "f7"}, &(0x7f00000004c0)={0x20, 0x84, 0x1, "1d"}, &(0x7f0000000500)={0x20, 0x85, 0x3, "e68066"}}) (async) syz_usb_control_io$uac2(0xffffffffffffffff, &(0x7f0000000240)={0x14, &(0x7f00000005c0)={0x40, 0xc, 0xdf, {0xdf, 0x31, "334955dce47a61f33f26886df72f2a050de5cce3017915ccf68a2a0b6fef5e5ce4bed73db1dbdbe6a82dc7a828b2187cbe9041a2d4de0b04939c720c79d7e231ac9e51987a02ebf6bcfbee100c21a650970544af3178b4eb713fdfa407b1d1009186030f5af214404837be6cf747a89c72bf881acb1d14d9a4594974f22dfbc9dbd419f4d19986e4f436e127abe473f9c433fd71f829e3eb4c7ba3c99ac8ac4e0fa509e37ef35b6ec86d870e59638e4babe130926edb4412d39fd3b2d79b6322efeb88ae135a601f9c30c2247c60009d1397f0428ac6045dc1b649c0fa"}}, &(0x7f00000001c0)={0x0, 0x3, 0x6c, @string={0x6c, 0x3, "5e8d8b17105243834ca7833ef475fef1619dec0c1a6350106e906694645d4dcaf4209a0d761de61e19d88a8557629f37914df6269f49ed20a0c945d549f8362987c02f59a307d5fe72511f9b0b79772a3e58e0919c2e601f45bdd9e5c6998ca486fcc765c84572738d17"}}}, &(0x7f0000000540)={0x44, &(0x7f0000000280)={0x0, 0x10, 0xf1, "fb26eff7b86200b48345c439af02a6b6c10920bd7a9d0928215c7c40333cc6ef1da7e044a0d7eac685470a792d8d0a39a14a9a0d99116dbbbd7fd90796e6c43176d720ca1697230cbb778841657fb4baa64d08e4dfaaf406425037c239f286169257654a5e246aa178e5bb8624c236e1c59f2b6d8a9158735410bb47743b7b908b06dda4fdf8726ef79c77c49c1aed5c37bef642f169cca9df9772e9478c26dbefd5f6656ea5b92cb963fb73e4144ab55b5f784c04e69bb698a5106af6fa0c043afe32f6e75352a647f4ec427d56780079b1a24e9671538a3214ffe6e93b7ef37ec69adad79e6995f2b4fa883e892f4466"}, &(0x7f0000000380)={0x0, 0xa, 0x1, 0x2}, &(0x7f00000003c0)={0x0, 0x8, 0x1, 0x3}, &(0x7f0000000400)={0x20, 0x81, 0x3, 'r9_'}, &(0x7f0000000440)={0x20, 0x82, 0x1, 'o'}, &(0x7f0000000480)={0x20, 0x83, 0x1, "f7"}, &(0x7f00000004c0)={0x20, 0x84, 0x1, "1d"}, &(0x7f0000000500)={0x20, 0x85, 0x3, "e68066"}}) 2.121929719s ago: executing program 2 (id=141): socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000f00)={'dummy0\x00', &(0x7f0000000000)=@ethtool_cmd={0x14, 0x28, 0xffffffff, 0xfffd, 0xa, 0x9, 0x10, 0x6, 0x2, 0x40, 0x1, 0x9, 0x9, 0xd, 0xff, 0xfffffffd, [0x3, 0x3]}}) ioctl$BLKRASET(0xffffffffffffffff, 0x1262, &(0x7f0000000040)=0x3) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="240000001000010700000000004000000a000000060001001800000008000a"], 0x24}, 0x1, 0x0, 0x0, 0x20040000}, 0x0) 2.121557178s ago: executing program 2 (id=142): prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) ioctl$RNDGETENTCNT(0xffffffffffffffff, 0x80045200, &(0x7f0000000040)) prlimit64(0x0, 0x2, &(0x7f0000000040)={0x633, 0xffffffffffffffff}, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)=[{&(0x7f0000000080)=ANY=[@ANYBLOB="6c00000066001f03"], 0x6c}], 0x1}, 0x0) mprotect(&(0x7f0000000000/0xa000)=nil, 0xa000, 0xa) flock(0xffffffffffffffff, 0x1) getrlimit(0x0, &(0x7f0000000000)) prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x0) r1 = accept4$unix(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000180)=0x6e, 0x80800) recvmmsg(r1, &(0x7f0000008b40)=[{{&(0x7f00000001c0)=@x25={0x9, @remote}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000240)=""/203, 0xcb}, {&(0x7f0000000340)=""/9, 0x9}, {&(0x7f0000000380)=""/69, 0x45}, {&(0x7f0000000400)=""/28, 0x1c}, {&(0x7f0000000440)=""/128, 0x80}, {&(0x7f00000004c0)=""/169, 0xa9}], 0x6, &(0x7f0000000600)=""/4096, 0x1000}, 0x3bae}, {{&(0x7f0000001600)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @remote}}}, 0x80, &(0x7f00000016c0)=[{&(0x7f0000000080)=""/64, 0x40}], 0x1}, 0x8}, {{&(0x7f0000001700)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @loopback}}}, 0x80, &(0x7f0000001940)=[{&(0x7f0000001780)=""/5, 0x5}, {&(0x7f0000002600)=""/120, 0x78}, {&(0x7f00000017c0)=""/72, 0x48}, {&(0x7f0000001880)=""/43, 0x2b}, {&(0x7f00000018c0)=""/95, 0x5f}], 0x5, &(0x7f00000019c0)=""/224, 0xe0}, 0x2}, {{&(0x7f0000001ac0)=@hci, 0x80, &(0x7f0000001c40)=[{&(0x7f0000005440)=""/256, 0xfd}], 0x1, &(0x7f0000001c80)=""/225, 0xfffffffffffffe5a}, 0x800}, {{&(0x7f0000001d80)=@l2tp={0x2, 0x0, @private}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001e00)=""/207, 0xcf}, {&(0x7f0000001f00)=""/194, 0xc2}], 0x2, &(0x7f0000008f40)=""/155, 0x9b}}, {{&(0x7f0000002100)=@isdn, 0x80, &(0x7f0000002500)=[{&(0x7f0000002180)=""/43, 0x2b}, {&(0x7f00000021c0)=""/169, 0xa9}, {&(0x7f0000002280)=""/238, 0xee}, {&(0x7f0000002380)=""/33, 0x21}, {&(0x7f00000023c0)=""/41, 0x29}, {&(0x7f0000002400)=""/172, 0xac}, {&(0x7f00000024c0)=""/64, 0x40}], 0x7}}, {{&(0x7f0000002580)=@pppoe={0x18, 0x0, {0x0, @broadcast}}, 0x80, &(0x7f0000002b00)=[{&(0x7f0000002900)=""/254, 0xfe}, {&(0x7f0000002700)=""/224, 0xe0}, {&(0x7f0000002800)}, {&(0x7f0000002840)=""/7, 0x7}, {&(0x7f0000002880)=""/83, 0x53}, {&(0x7f0000008e00)=""/259, 0x103}, {&(0x7f0000002a00)=""/240, 0xf0}], 0x7, &(0x7f0000002b80)=""/30, 0x1e}, 0x3}, {{&(0x7f0000002bc0)=@xdp, 0x80, &(0x7f00000041c0)=[{&(0x7f0000002c40)=""/193, 0xc1}, {&(0x7f0000002d40)=""/70, 0x46}, {&(0x7f0000002dc0)=""/5, 0x5}, {&(0x7f0000002e00)=""/84, 0x54}, {&(0x7f0000002e80)=""/230, 0xe6}, {&(0x7f0000002f80)=""/217, 0xd9}, {&(0x7f0000003080)=""/58, 0x3a}, {&(0x7f00000030c0)=""/4096, 0x1000}, {&(0x7f00000040c0)=""/255, 0xff}], 0x9, &(0x7f0000004280)=""/120, 0x78}, 0x8000}, {{&(0x7f0000004300)=@ax25={{0x3, @default}, [@null, @null, @bcast, @rose, @netrom, @rose, @remote, @bcast]}, 0x80, &(0x7f0000001680)=[{&(0x7f0000004380)=""/4096, 0x1000}, {&(0x7f0000005380)=""/192, 0xc0}, {&(0x7f0000009000)=""/193, 0xc1}], 0x3, &(0x7f0000005580)=""/4096, 0x1000}, 0x9}, {{&(0x7f0000006580)=@rxrpc=@in6={0x21, 0x0, 0x2, 0x1c, {0xa, 0x0, 0x0, @mcast2}}, 0x80, &(0x7f0000007ac0)=[{&(0x7f0000006600)=""/58, 0x3a}, {&(0x7f0000006640)=""/81, 0x51}, {&(0x7f00000066c0)=""/118, 0x76}, {&(0x7f0000006740)=""/168, 0xa8}, {&(0x7f0000006800)=""/4096, 0x1000}, {&(0x7f0000007800)=""/184, 0xb8}, {&(0x7f00000078c0)=""/200, 0xc8}, {&(0x7f00000079c0)=""/196, 0xc4}], 0x8, &(0x7f0000007b40)=""/4096, 0x1000}, 0x6}], 0xa, 0x10020, &(0x7f0000008dc0)={0x0, 0x989680}) syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), 0xffffffffffffffff) 2.08748526s ago: executing program 2 (id=143): r0 = openat2(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)={0x4a0000, 0x2c, 0x3}, 0x18) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x810, r0, 0x0) r1 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000100), 0x2) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000001680)={0x14, 0x14, 0x1, 0x4, 0x25dfdbfd, {0x2}}, 0x14}, 0x1, 0x0, 0x0, 0x24004805}, 0x0) ftruncate(0xffffffffffffffff, 0xffff) r3 = memfd_create(&(0x7f00000000c0)='./{*%]/+\x00', 0x1) ioctl$UDMABUF_CREATE(r0, 0x40187542, &(0x7f00000003c0)={r3, 0x0, 0xfffffffff0000000, 0xfffffffff0000000}) fcntl$addseals(0xffffffffffffffff, 0x409, 0x7) ioctl$PTP_PIN_GETFUNC(r0, 0xc0603d06, &(0x7f0000000400)={'\x00', 0x8, 0x1}) ioctl$UDMABUF_CREATE(r1, 0x40187542, &(0x7f0000000140)={0xffffffffffffffff, 0x0, 0x0, 0x4000}) ioctl$FS_IOC_SETFLAGS(r1, 0x40086602, &(0x7f0000000080)=0x4) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0xffffffff) ioctl$TCFLSH(r4, 0x80045439, 0x40bea7b87a0000) ioctl$EXT4_IOC_GET_ES_CACHE(r4, 0xc020662a, &(0x7f0000000180)={0x4, 0xcd49, 0x6, 0x7, 0x9, 0x0, [{0x6, 0x9, 0x6, '\x00', 0x2}, {0x4, 0x6, 0x0, '\x00', 0x2c00}, {0x5, 0x0, 0x8}, {0x2, 0x7, 0x8}, {0x3, 0x3, 0xa, '\x00', 0x301}, {0x4, 0x3, 0x7, '\x00', 0x80}, {0x1ff, 0x80000000, 0x80, '\x00', 0x801}, {0x5, 0x800, 0x7fff, '\x00', 0x101}, {0x3, 0x8001, 0x0, '\x00', 0x1000}]}) 2.07165126s ago: executing program 2 (id=144): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000022, &(0x7f0000000200)=0x1, 0x4) setsockopt$inet6_int(r0, 0x29, 0x46, 0x0, 0x0) sendto$inet6(r0, &(0x7f0000000240)="c4", 0x1, 0x20000845, &(0x7f0000000100)={0xa, 0xffff, 0x0, @rand_addr, 0x5}, 0x1c) r1 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) symlinkat(&(0x7f0000000080)='.\x00', 0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00') openat2$dir(0xffffffffffffff9c, &(0x7f0000000180)='./file0/file0/../file0\x00', &(0x7f0000000300)={0x2000, 0x0, 0x10}, 0x18) r2 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000000)={[0xf0, 0x1, 0x1, 0x8, 0x5, 0x3, 0x55b7, 0x5e, 0x80000001, 0x3, 0x10000, 0x7, 0x6, 0x87, 0x3, 0x9], 0xe000, 0x5084}) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000004, 0x50, 0xffffffffffffffff, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./file0/file0/../file0\x00', 0x541a81, 0x0) write(r3, &(0x7f0000000200)='always', 0x6) r4 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r4, &(0x7f0000000280)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r4, &(0x7f0000000c80)={0x2, 0x4e21, @empty}, 0x10) sendto$inet(r4, &(0x7f0000000340)='\x00', 0x1, 0x4c001, 0x0, 0x0) recvfrom$inet(r4, &(0x7f0000000080)=""/8, 0x8, 0xa9100123, 0x0, 0x0) setsockopt$SO_TIMESTAMP(r1, 0x1, 0x3e, &(0x7f00000000c0)=0x8, 0x4) write(r1, 0x0, 0x45) 2.011462551s ago: executing program 2 (id=145): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, 0x0) statx(0xffffffffffffffff, 0x0, 0x100, 0x100, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r0, r3, 0x0) r4 = accept$unix(0xffffffffffffffff, &(0x7f0000000180), &(0x7f0000000200)=0x6e) flock(r4, 0xc) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000002380)={[0x4, 0x8000000000000001, 0x15, 0x4, 0x9, 0x4, 0x55, 0x95, 0xffff, 0xbc, 0x4, 0x9, 0x9, 0xfffffffffffffff9, 0x4, 0xfffffffffffffffb], 0xa000, 0x200}) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cpuacct.usage_percpu\x00', 0x275a, 0x0) fallocate(r5, 0x0, 0x6, 0x1) read$FUSE(0xffffffffffffffff, &(0x7f00000002c0)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r5, &(0x7f0000002300)={0xfffffffffffffd4f, 0x0, r6, {0x7, 0x2d, 0xa, 0xffffffff808640c8, 0x9, 0xfff8, 0x26cf, 0x5, 0x0, 0x0, 0x4, 0x9}}, 0x50) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, 0x0, 0xffffffffffffff6d}], 0x1, 0x40, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 1.905544733s ago: executing program 2 (id=146): r0 = syz_usb_connect(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12014101175129205705092006c70102010109022400010200100009045819028ab53800090506020001000006090582020002"], 0x0) r1 = memfd_create(&(0x7f0000000240)='+\x8b\x8a\xa9\x16\x11\x91J\xbc+ \x18\x17\xc2:}\xa3\x9bO\xdd\xdf\xdf\x92\xd5\xed\xb4\x17\xe5\xd6\x9a\xb2\xd8\x9ba\xde\xb2.F\xc0\x99}|\xaf\xd3\x1d\x84[*_\x9f\x9d\xb0rYP\x1b\x9f \xe0\x9cgq\x103\x89\x11\x87Rv\x169\xdf\xe3>B\x04\x00\x00\x00W\xd3\xec\xfb\xdf?\xa2\x90+\xa4!\xb2\xf2\xff\x90\a\xc3\x12\xc4;\xffh\xf1x=\xb9c\xce\x03h\xdap\x88U\x1788\x82\xd7\xfd\x83\x00Sx\x91%\x99_\xfe\xd4c\x83\x86\x0f\xa4a-\xaf\x9e\xd9\xef\xe0)]\x00F\xfa\x03\xbc4\xc4\x9a\v\x03\x8b\xa4\xf3\x8f\xf4\"\'\xd3\a9\x14H}j&~\xe9\x16\x83o\xbd\xab\xcd[\xbd\xcb\x04\xfc\xe7\xe3\x9e?\x12\xf0\xf4\x83M3\xd88\x92?@\v\xe6\xd1\xd2\xe4\xde\xdaUeJ\x9fR\xd1`\xfa\xc8\v\xed\xfd\x0e\xc8\x89W\x847\x88\x82\x94\x14\xe33\xb7H\xc8b\xd6@3F#\xb7\x04C\x8dm\t\x16a\x0fI\xf4\xfe\xf8\x06j\x19Pz&\xb8\x0f\x98`W\xdb\xc6\"81A\xa4\x8bT\xf1\xcb\xab\xa3\t\xef\xdf&\x0e\xad\x03\x123.\xc2V\xaa\xd5\xf8\xde\x8aV\xa4p{\xcez\xa2\x92\xdb8*wLO\f\x97X\x05\x9a\xc2\xe8\x85\x9d\xcb\xc8\xf0\xc4\x01\x03\xe3?\x9f1\xf4\xfb\xa5y`KB\xdf\xae#\x94C\a\x04\xea\xccG\xf2\b\x8f\xf7\xb1\xe96\x90\xf5P\xa4\'\xce\xe3\xa24\x196\xc5Q\xa1K\x95\xd6\xfal\xe9\xd1\\\r&\xb2c\xb3\x8d\xa7\xb7\xa8\x03S\xbd\xdd\b{\xae\f\x10\xc2\xbb\xd0\xdd*\xa3\xb4\fJ\x00X\xab`N; LF\xa5D\xee\xdf\x7f\x80p\xf6o\x1c\xbdXR\xf2\xa0\x81a\xa1\xe1B\x93Xn\xaf\xfc\x05?\xab\xac\x91x\xa8#\xe1\xbeQ\xd1^\x9b\xb9)\xd3\n\xf7(3!\x18\b\xc0\xaampRl\xfdQ\x03\x8c\xd5\xe4\\\xed\x9a\xd1?\xd21\xc8\x90\x1dl|\xd1\x14\xbc3\xe0\x1e\x0e\xe6\x88Y\x99K\x93\x1c@_P\x8c\xc7\x9eZ\xb74KT:\x8a\xdbJ#w\x18\x14\x00\x93\x86\xa5wo\xf6M\xe7D\xf4*\xe3X\x1d\x19\x83\xa7w\xc7+7\x89s\xed\x8a\xd7O\xdd\rhh`\xc0\xa8$\x06pu\xa0\xd0L\x0ez@I\xb8\x83\xb2f\x93j\a0I\xc8l\xe5\x9b\x06\xb5\xac`d\xa3\xcf/\x14\x10\xab\xab\t\xec\xc1c\fA\xaf\x14\xef\xbap@*7\x86\xdf\',\x03Y\xb1$\xf0\xb5}\xf0\x82%)9`\x8f\x04\x85m\x80\xd2\xcf@\x06}\xea\xe7w`\xa5\x11\x9f\x9b\x9e\x8f\xb7cb\x1a\xe1\xcf\x87\x1c\\\xf5\xc21\xf7\x82C*\xd5;\x00\x00\x00\x00\x03\xba\xe3\xdc\x92\'\x8e\xd5\x7fG\xfd.\x91\x89T\x99t\xd4d,\xd5\x92O\xf1\xafT!Y\x8e\\\xac\xf7\x11R\x05p\x1a\"\r\xe9\xe5\x8b&\x0f\x8c\xfb\xef\xf8\xd5\x18\xde\xeb\xe5\x19\xdd\xebQ8\xc5iS+\x06D\x16\xfe\xf5.\xe5\v\x89\xb0\"\xa3M\xe9\x81\x11P\xdb\xc4\xc2y\x14\x04\x06\xf6\f\xb0\xecz\x8d`\xb5\x9b\xb43\xcc1\xa7\x9e\xa8\xb5\'\xc6MAe\x0f\xd1\xfcG\xc2/\xe8\xe9t\xcaQ\xf1\fI\x1chM\xc1\x92\xe3\xc3\x01M\xc8/\xefJ\xcb\xd0]\f\xff\xf5\x92\xce\x97Z\xea\xe8\x99\xfa\x96\xce\xa7\x02\xad\xa2\xce\x955\xeaNg\x02\xcd\xfd\x1a}.\xd3\"x\x89/8H\xc2\x93B\na)\x86\xa9U\xa0\xb7\x18\xfb\xe9\xd1\x97', 0x3) fcntl$addseals(r1, 0x409, 0x8) mmap(&(0x7f0000fec000/0x4000)=nil, 0x4000, 0x1000001, 0x20013, r1, 0xf38ae000) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) syz_usb_control_io$lan78xx(0xffffffffffffffff, &(0x7f0000000180)={0x14, &(0x7f0000000080)={0x0, 0x4, 0x34, {0x34, 0x30, "b763e5e519f4cad7703479eadd2464007afd60f7804ecca527aaabe3d2d3130d885388dbee1d7fb2c1aab401d4a879dbb9a6"}}, &(0x7f00000000c0)={0x0, 0x3, 0xb7, @string={0xb7, 0x3, "0f2f402e43de40f915a35199b283ccd6199414f559afd12a38ac1378800e682dcadf6f37f72fd6b075b2e81e3eba56839aec2e17e8793e86264e5d6fd18d022c516d04dddfceac0bd0062bb65fc717f6439fac82462280dfc67c94952a5d86f64a89177b439b0f570cd24286227cfb52607fe38a65b322f8632fe94e7ef014c66abe15f07bb519df8e9c1d89a61e85117c8906e218b129fda42cc8e6784223e406ffdf62285103ef7b553bdf94bffeaeb265b2baa2"}}}, &(0x7f00000003c0)={0x34, &(0x7f00000001c0)={0x20, 0x1, 0x7b, "23928925482c2d7bb7445ea28eb1f9370487c58a47f408dcfe946bb85c5e1f40f1c4382193a9336d32ba4b8e86a340c673bf8f2710736ed9b45536c38c270da80cb61a7ca9a3789d075aa7a31f850ac891a0297060dc8b1d32bf286237273016cb7ee7342ac2b7c2bc543c9a140afcd20df03e5f82dd29c15bbec4"}, &(0x7f0000000280)={0x0, 0xa, 0x1, 0x8}, &(0x7f00000002c0)={0x0, 0x8, 0x1, 0x9}, &(0x7f0000000300)={0xc0, 0xa1, 0x4, 0x6}, &(0x7f0000000340)={0x40, 0xa0, 0x4, 0x8}, &(0x7f0000000380)={0xc0, 0xa2, 0x2f, "473e15aab35be52f58e540db95675726bb0856699e8fe42e7cb1673b6f078b12084b7ffadb15541c1305dc6cba63e5"}}) syz_usb_control_io$uac3(r0, 0x0, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) syz_usb_control_io$uac2(r0, 0x0, 0x0) syz_usb_control_io$uac3(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000640)={0x2c, &(0x7f0000000440)={0x20, 0xf, 0x6, "a03911cfb178"}, 0x0, 0x0, 0x0, 0x0}) r2 = syz_open_dev$ptys(0xc, 0x3, 0x1) r3 = syz_usb_connect$cdc_ncm(0x0, 0x7a, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000020000402505a1a44000010203010902680002010040000904000001020e0000052406000105240000000d370f0100000000000000000006241a0000000c241b4800f3ff00050080050905810300020000000904010000020d00000904010102020d0000090582020004000000090503"], 0x0) syz_usb_control_io$cdc_ncm(r3, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r3, 0x0, 0x0) syz_usb_control_io(r3, 0x0, &(0x7f0000000a00)={0x84, &(0x7f0000000480)={0x20, 0x11}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r3, 0x0, &(0x7f0000000000)={0x44, 0x0, 0x0, 0x0, &(0x7f00000009c0)={0x20, 0x80, 0x1c, {0x1, 0x28, 0xe4d, 0x80, 0x3fc, 0x7, 0x5, 0x3, 0x800, 0x1, 0xfffd, 0x6}}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r3, &(0x7f0000000840)={0x2c, &(0x7f0000000680)={0x20, 0x11, 0xa7, {0xa7, 0x1, "f6f18ceff85ef83c9624c4dae608855377aef3628ef38144f326868ef079824450f53286045fcf4c6f3e229469c7610779222e0382fa15229ac7bc0c0ad1208f09e782995e1d2596a06b97554fa931e12f330971d543a430121dd884227b9727913ad87c85ef9c42efdc1baa41afba75dd56f43ec00af3557df790c3b1c582e338c2f88aa8ed63e1a6175df67149f84f739dd30f7b1dc7af5a90d288db42edb013a42bdfdf"}}, &(0x7f0000000740)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x404}}, &(0x7f0000000780)={0x0, 0xf, 0x15, {0x5, 0xf, 0x15, 0x3, [@ss_cap={0xa, 0x10, 0x3, 0x0, 0x0, 0x7, 0x5, 0x9}, @ptm_cap={0x3}, @ptm_cap={0x3}]}}, &(0x7f00000007c0)={0x20, 0x29, 0xf, {0xf, 0x29, 0xa3, 0x80, 0x3, 0x0, "cecd0df1", "55038c9a"}}, &(0x7f0000000800)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x8, 0x8, 0x8, 0xf, 0x9, 0x0, 0xb}}}, &(0x7f0000000cc0)={0x84, &(0x7f0000000880)={0x20, 0xf, 0x54, "76b658d13e249996331975c2da7d8758a73119e32643a325c2e164e37b5ba80092c4605d381e59c5f7c2f8ef806379053c16b9544cce1ac65585e606cd5ccece89099f4fa5f36280de3bbaeeb4d9a10619e65b23"}, &(0x7f0000000900)={0x0, 0xa, 0x1}, &(0x7f0000000940)={0x0, 0x8, 0x1, 0x6}, &(0x7f0000000980)={0x20, 0x0, 0x4, {0x1, 0x2}}, &(0x7f00000009c0)={0x20, 0x0, 0x4, {0x60, 0x2}}, &(0x7f0000000a00)={0x40, 0x7, 0x2, 0xd60}, &(0x7f0000000a40)={0x40, 0x9, 0x1, 0x1}, &(0x7f0000000a80)={0x40, 0xb, 0x2, "dae8"}, &(0x7f0000000ac0)={0x40, 0xf, 0x2, 0x3}, &(0x7f0000000b00)={0x40, 0x13, 0x6, @multicast}, &(0x7f0000000b40)={0x40, 0x17, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1e}}, &(0x7f0000000b80)={0x40, 0x19, 0x2, 'Tv'}, &(0x7f0000000bc0)={0x40, 0x1a, 0x2, 0x5}, &(0x7f0000000c00)={0x40, 0x1c, 0x1, 0xc}, &(0x7f0000000c40)={0x40, 0x1e, 0x1, 0x3}, &(0x7f0000000c80)={0x40, 0x21, 0x1, 0x5}}) ioctl$TIOCSERGETLSR(r2, 0x5459, &(0x7f0000000040)) 1.435437645s ago: executing program 1 (id=147): ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) mount(0x0, &(0x7f0000000040)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/max_speed\x00', 0x1, 0x0) close(r0) 1.407329886s ago: executing program 1 (id=148): write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x5, 0x248, 0x9b99}, 0x25, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x4, 0x2dcd, 0x1, 0xb4, 0xd, 0xa2b9, 0x6, 0x7, 0xe1, 0x6, 0xfc000004, 0x403, 0xbbf, 0x3, 0xfffffffd, 0x101c0, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x8001, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x129, 0x4, 0x16, 0x8, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0xa9, 0xff, 0x0, 0x2, 0x2, 0x2, 0x7, 0x489, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x6, 0x4], [0x9, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x8e, 0x2, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x4, 0x1c, 0x7, 0x1, 0xfffffffe, 0x3, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x7, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3ff, 0x1ff, 0x1, 0x8, 0x67af, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0xc, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x8, 0x491, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x1, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0xc, 0x5, 0x9, 0x5, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x10000a, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x6, 0x7ffe, 0x28, 0x5, 0xd500, 0x8, 0x77, 0xa, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x1af8, 0xbfc, 0x9, 0x5, 0x81, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x7, 0x21, 0x9, 0x81, 0x7, 0x9d87, 0x8, 0x8, 0x4, 0x140f1, 0x5396, 0x3, 0x6, 0x0, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x8, 0x274, 0x6, 0xfffffff9, 0x4, 0x9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x5, 0x8, 0x13fff, 0x1, 0x9]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000800)=ANY=[@ANYBLOB="a4010000100001002dbd700000000000e00000010000000000000000", @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x002'], 0x1a4}}, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0xc], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = dup(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0xe0fe00000000) 1.238578049s ago: executing program 1 (id=149): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000200)={0x73622a85, 0x0, 0x3}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x4c, 0x500, &(0x7f00000002c0)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000340)={@flat=@weak_binder={0x77622a85, 0xa, 0x2}, @fd, @flat=@binder={0x73622a85, 0x100a, 0x1}}, &(0x7f0000000280)={0x0, 0x18, 0x30}}, 0x10}], 0x0, 0x0, 0x0}) 1.238281889s ago: executing program 1 (id=150): sendmmsg$inet(0xffffffffffffffff, &(0x7f00000017c0), 0x0, 0x0) r0 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r0, 0x0, 0x23, &(0x7f0000000740)={@multicast2, @loopback}, 0xc) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0) write(r1, &(0x7f0000000200)='dummy_hcd.0', 0xb) r2 = socket$netlink(0x10, 0x3, 0x0) writev(r2, &(0x7f00000003c0)=[{&(0x7f0000000180)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r2, &(0x7f0000000300)=[{&(0x7f00000001c0)="390000001300034700bb5be1c3e4feff06000000010000004500000025000000190004000400ad000d00000000000006040000000000f93132", 0x39}], 0x1) r3 = syz_open_dev$loop(&(0x7f0000000040), 0x5, 0x278041) fcntl$F_SET_RW_HINT(r3, 0x40c, &(0x7f00000064c0)=0x5) r4 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r4, 0x0, 0x23, &(0x7f0000000080)={@multicast2, @loopback}, 0xc) setsockopt$inet_msfilter(r4, 0x0, 0x29, &(0x7f0000000000)=ANY=[@ANYBLOB="e00000027fa80a0101"], 0x57) setsockopt$inet_mreqsrc(r0, 0x0, 0x24, &(0x7f0000000440)={@multicast2, @loopback, @empty}, 0xc) r5 = socket$netlink(0x10, 0x3, 0x0) writev(r5, &(0x7f00000003c0)=[{&(0x7f0000000180)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) 1.164471482s ago: executing program 1 (id=151): r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x321}, {&(0x7f0000000280)=""/85, 0x21}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000580)=""/106, 0x659}, {&(0x7f0000000980)=""/73, 0xd}, {&(0x7f0000000200)=""/77, 0x69}, {&(0x7f00000007c0)=""/141, 0x119}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41, 0xc3ffffff}, 0x5}], 0x4000000000003b4, 0x2000, &(0x7f0000003700)={0x77359400}) 1.146613292s ago: executing program 1 (id=152): r0 = add_key$keyring(&(0x7f0000000280), &(0x7f00000000c0)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) r1 = add_key(&(0x7f0000000440)='asymmetric\x00', 0x0, &(0x7f00000002c0)="30800201", 0x4, r0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./trace\x00', 0x1df) add_key$fscrypt_v1(&(0x7f0000000040), &(0x7f0000000080)={'fscrypt:', @desc3}, &(0x7f0000000140)={0x0, "7189b7d6a9fcecfaf2c9ec6798be0daf500669db971b7a8ae6093c4be6b113d5f3ac7c2ab9022cddb372c2e4e2683448b124e9ee3a64208468647b104ccb16ed", 0x1e}, 0x48, r1) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r2, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r3, {0x2, 0x0, @dev}, 0x2}}, 0x2e) connect$inet6(r3, &(0x7f0000000080)={0xa, 0x4e20, 0x1, @ipv4={'\x00', '\xff\xff', @remote}, 0x202}, 0x1c) r4 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r4, &(0x7f0000000040)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x40}}, 0x2, 0x9800, 0x0, 0x4}}, 0x2e) mount(0x0, &(0x7f0000000000)='./trace\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./trace/set_event\x00', 0x2, 0x0) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r7 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100), 0x382, 0x0) ioctl$TIOCSETD(r7, 0x5423, &(0x7f0000000000)=0xf) ioctl$TCFLSH(r7, 0x400455c8, 0x1000000000) ioctl$sock_bt_hci(r6, 0x400448cc, 0x0) write(r5, &(0x7f0000000300)="ba", 0xffffffffffffffdc) write$rfkill(r5, &(0x7f00000001c0)={0x7, 0x9, 0x2}, 0x8) 831.054619ms ago: executing program 3 (id=154): r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f0000000080)="120000001200e7ef00341618a585107b462e", 0x12, 0x10, 0x0, 0x0) recvmmsg(r0, &(0x7f0000006480)=[{{0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000300)=""/194, 0xc2}, {&(0x7f0000000500)=""/85, 0x55}, {&(0x7f0000000000)=""/100, 0x64}, {&(0x7f0000003d40)=""/4106, 0x100a}, {&(0x7f0000000400)=""/238, 0xee}, {&(0x7f0000000680)=""/256, 0x100}, {&(0x7f0000000600)=""/72, 0x48}, {&(0x7f00000007c0)=""/238, 0xee}, {&(0x7f0000000580)=""/123, 0x7b}], 0x9}, 0x5e}, {{0x0, 0x0, 0x0}, 0x5}, {{0x0, 0x0, 0x0}, 0x80000000}, {{0x0, 0x0, 0x0}, 0x8}, {{0x0, 0x0, 0x0}, 0x99c5}, {{0x0, 0x0, 0x0}, 0x2090cf}, {{0x0, 0x0, 0x0}, 0xe52}], 0x7, 0x40, 0x0) (fail_nth: 14) 829.99823ms ago: executing program 0 (id=155): r0 = syz_open_dev$usbfs(&(0x7f0000000100), 0x205, 0x8401) r1 = syz_open_dev$usbmon(&(0x7f0000000900), 0x7, 0x0) r2 = fcntl$dupfd(r0, 0x406, r0) ioctl$MON_IOCX_GETX(r1, 0x4018920a, &(0x7f0000000140)={&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @iso}, &(0x7f0000003880)=""/4072, 0xfe8}) ioctl$USBDEVFS_SUBMITURB(r2, 0x8038550a, &(0x7f0000000000)=@urb_type_control={0x2, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48000000, 0x0, 0x0, 0x0}) 787.870211ms ago: executing program 3 (id=156): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x8002, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000280)=[@text32={0x20, &(0x7f0000000500)="b8001800000f23d00f21f8353000000e0f23f83e0fae8d001000000fd8e866baf80cb84a8cce8cef66bafc0cec26640f23dbc7442400b30d45d5c7442406000000000f011c2466baf80cb8dc759680ef66bafc0c66b81342b8a387ca4e0f23d80f21f835800000d00f23f866ba4300ec0f0f49e4b70fbaa9220000000d", 0x7d}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000080)=[@text32={0x20, 0x0, 0x9}], 0x1, 0x1, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) (fail_nth: 1) 352.539621ms ago: executing program 3 (id=157): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x8002, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000040)='oom_score_adj\x00') writev(r2, &(0x7f00000002c0)=[{&(0x7f0000000280)='0', 0x1}], 0x1) capset(&(0x7f0000000080)={0x20071026}, &(0x7f0000000040)={0x200000, 0x200000}) write$binfmt_format(r2, &(0x7f0000000140)='1\x00', 0x2) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x0, 0x32, 0xffffffffffffffff, 0x33ed0000) r4 = socket$inet_udp(0x2, 0x2, 0x0) r5 = memfd_secret(0x80000) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), r2) sendmsg$NL80211_CMD_GET_WOWLAN(r5, &(0x7f0000000300)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x20, r6, 0x200, 0x70bd2c, 0x25dfdbfe, {{}, {@void, @void, @val={0xc, 0x99, {0x2, 0x38}}}}, [""]}, 0x20}, 0x1, 0x0, 0x0, 0x1}, 0xc882) getsockopt$IPT_SO_GET_ENTRIES(r4, 0x0, 0x41, &(0x7f0000000ec0)=ANY=[@ANYBLOB="66696c74657200000000000000000000000000000000000000000000000000007802"], &(0x7f0000003000)=0x2a0) r7 = add_key$keyring(&(0x7f0000000540), &(0x7f0000000180)={'syz', 0x2}, 0x0, 0x0, 0xffffffffffffffff) keyctl$set_timeout(0xf, r7, 0x2) clock_adjtime(0x0, &(0x7f0000000000)={0x3ff, 0x200, 0x2, 0x8, 0x0, 0x0, 0xfffffffffffffff8, 0x0, 0xfffffffffffffffe, 0x100, 0x0, 0x0, 0x80009, 0x0, 0xfffffffffffffffe, 0xfffffffffffffffd, 0x4, 0x0, 0x1000, 0x2, 0x0, 0x1, 0x0, 0x7, 0x1}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0) r8 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/sys/vm/compaction_proactiveness\x00', 0x1, 0x0) write$cgroup_pid(r8, &(0x7f00000009c0), 0x12) keyctl$set_timeout(0xf, r7, 0x79) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000280)=[@text32={0x20, &(0x7f0000000500)="b8001800000f23d00f21f8353000000e0f23f83e0fae8d001000000fd8e866baf80cb84a8cce8cef66bafc0cec26640f23dbc7442400b30d45d5c7442406000000000f011c2466baf80cb8dc759680ef66bafc0c66b81342b8a387ca4e0f23d80f21f835800000d00f23f866ba4300ec0f0f49e4b70fbaa9220000000d", 0x7d}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r1, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000080)=[@text32={0x20, 0x0, 0x9}], 0x1, 0x1, 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) 262.428813ms ago: executing program 3 (id=158): r0 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(r0, &(0x7f0000000480)={0x10, 0x0, 0x25dfdbff, 0x100}, 0xc) (async) bind$netlink(r0, &(0x7f0000000480)={0x10, 0x0, 0x25dfdbff, 0x100}, 0xc) socket(0x1, 0x803, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000003c0)='net/netlink\x00') preadv(r1, &(0x7f0000000a80)=[{&(0x7f0000000840)=""/166, 0xa6}], 0x1, 0x111, 0x0) r2 = socket(0x10, 0x2, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) sendfile(r3, r3, &(0x7f0000000280)=0x3ff, 0x7) (async) sendfile(r3, r3, &(0x7f0000000280)=0x3ff, 0x7) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000240)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000200)={&(0x7f00000002c0)=ANY=[@ANYBLOB="680000000001010300000000000000000100000608000740000000050c00018006000340000100001000164000000c52000000000000000010000580090001007070747000000000080007400000d00a080004800400038008000c400000000208000340fe4025277e8cf88f96a200003002"], 0x68}, 0x1, 0x0, 0x0, 0x24040044}, 0x8800) dup(r3) (async) r4 = dup(r3) setsockopt$netlink_NETLINK_TX_RING(r4, 0x10e, 0xc, &(0x7f0000000000)={0x8}, 0x10) (async) setsockopt$netlink_NETLINK_TX_RING(r4, 0x10e, 0xc, &(0x7f0000000000)={0x8}, 0x10) madvise(&(0x7f0000c00000/0x400000)=nil, 0x400000, 0xe) (async) madvise(&(0x7f0000c00000/0x400000)=nil, 0x400000, 0xe) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) madvise(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x17) (async) madvise(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x17) r5 = userfaultfd(0x80001) ioctl$UFFDIO_API(r5, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r5, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x3}) ioctl$UFFDIO_WRITEPROTECT(r5, 0xc018aa06, &(0x7f0000000140)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1}) mremap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f0000390000/0x1000)=nil) restart_syscall() (async) restart_syscall() write(r2, &(0x7f0000000480)="1c0000001a009b8a140000003b000000000000000100000000000000", 0x1c) restart_syscall() 262.214333ms ago: executing program 3 (id=159): openat$kvm(0xffffffffffffff9c, 0x0, 0x42, 0x0) r0 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r0, 0x4008ae89, &(0x7f0000000080)={0x1, 0x0, [{0x40000071, 0x0, 0xff00000000047ffe}]}) userfaultfd(0x801) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) close(r1) timer_create(0x0, &(0x7f0000000200)={0x0, 0x21, 0x2, @tid=0xffffffffffffffff}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x60d5, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r2, 0x1, &(0x7f0000000040), 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./trace\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./trace\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./trace/set_event\x00', 0x2, 0x0) write(r3, &(0x7f0000000400)='!*:', 0x3) 256.859753ms ago: executing program 3 (id=160): r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000540)) memfd_create(&(0x7f00000009c0)='[\v\xdbX\xae[\x1a\xa9\xfd\xfa\xad\xd1md\xc8\x85HX\xa9%\f\x1ae\xe0\x00\x00\x00\x00\xfb\xff\x00\x00\x81\x9eG\xd9\xd6\x1c\x1b*\x9a!?\x7f\xa5\xad\x9a,\xe2\xc6a\x9f\xe8\xf1\xb3\x86\xe2+Op\xd0\xa2\x82\x1eb;(\xb5\xe1jS\xd6\x91%||\xa0\x8ez\xadT\xc8\f\xe5\x89\xbf#2\x99\x1e\xa1`\xc3\xcf\xd3\xae\xd2\a\x11\xa9\xa5^\xff\xf5\x95\f<\x8f\xc1\x99\x89r\xe1?\xbdu\x98\xc3\xf8\xd2Q#\xc6g\xa0\x85\xd6G\x85\x11X\x8d,\x02\xd45\xb8\xca\x97\x9d\xcb\x1e\x80\xd6\xd5>N&\xf8#\x80z8Z\xd2}\xf5\xe4\x9f5\x9b\x01\xf9t\xbb\x1er\x14\xdb\xd3\xcd\xfd\xbdnC\xec\x8aog\x87BR\x9d\xad\xd4FcB\xda\x95\xc3\xdd\x9d\x8f\x1a\xce\x18\x80\"j\xe1\xba\x1e\x97uX\xccv\xd6\vcz\x92A^\xbc\xceF\xf7\xe5:\xaf\xc5~\xbcJ e\r\x88c\x9d\xb92\xb6i4zq\xb3c\x0f\xb2t\x93\xf2E6b\xfa\xcdJ5\xe3W]`4\xd8D\x05\v\xfc)\xca\xedQ\xd0]Ot\'\xc2tDF\xf9\xa7\xb5(\x83\xa5\x0f\x1d\x1d\x06Dg\x13>\x19\xe85#\aaT\x89=\x104\xd5\x85Q\x96\x91\xea\x172P\xb3:\xadZ\xbc\xbe\x00\xf0\x14\x96\xd9M\xd7\x88QZs\xb2\xe1+$jfQodH\x05/y`~Mx\x02\x00(v\xe6`\x026\xfcgC\xb5\xf0\x13.zb\xc5bj+@\x00\x00\x00\x00\x00\x8e[\xb3\xa3\x87\xb9\xe2_Z\x11\xef\xc2]V\xf3\x03\x94\xb9\xe1\xa68\x8d\\\xe5\xef\xacpM\xf0\xa6\x04\x10\xb7\xc0t\x83\\\xf7\x12k\x9f\x10\xd5Z\x19\xc1\xc1\x80\\o\x97\xce=U\xdd\xaa\x1b\x05\x14\x13\xa6\xbd#\xde\x04\xe6$\xec$3\xf6\x97\xc6\xeaSL\xb7A72M\x88k@\xe5\xa3\n&\x1e\xc84\xa9\xe2\xccM\x906\x95xQ-2p\xd62\'\xec\x0f\x13;I\x95TE_\r\xe7\t!A\x05\xe4\x8f\x9e0\xf8/T\x18\xf7\xa1\x9f\xde1\xd5\x80<\xf5\b\xa9\xec\x85\xaeW\xb3\xd8#)bn \xfb\xf2\x88\xfaR\xff\xdd\x80\x96_\xec5\xf0\x1c\a\x8a\x80\x00@=\r8u+%f:\x1e\x82\xfap\xf6\x89\xea\xba\xe3\xbbM%F\xdb\\\xd1eJJ*\xc67\xca\x03\xa3\xf7(\xbb\xecN\xd4\xe7\xf2:u\x8a\b\xd5\v\xca\xfd\\\xd6\xe3\x05\xb3\x03\xd5\xe0\xd2\xf2{&\x8b\xdf\xa1\xbe}\xb2\xe4y\xbb\xe6\x1f\x10c\xf5WQ\x82\x04\x01C\x83,\x90\x1a\xfa\x8e\x17\x89\xe2\xedX\x8d\rmq\t\xb5$\xb4\x9b\x92z\xd6/-\x13,\xb5%\x8eM/\x04\xa7\x7f\x1b\x85\xf1\xa4X\x17\xbb\x1cR14\xfb!\b\x10\xe8\xb2\xd41gK\xe4\xea\xe39d\bL\xe5\x1b\xbd[\x9bWD:\r&\xe9\vn^\xcc\x86\xe3\xce1>3{\xaa{\xbd0P\x9f\xa68\xf5\x82\xb8\x9aD\x9c{\xe6\xf8\xcbD\xb5aJ\xb0\x92\x89\xbc\x80\x1ch\x89\xe7\xdd]q\x0e,>/\xaf|\xf0\x01V\x7f\xc9?\xba\x16\xe4$+\x02\x00\x00\x00\x00\x00\x00\x00\xa5\x94d9\xaf\xcfq\x8b=\x026\xef\r\x91\x18\xc5\xb6\xb9fM\x8ayZ\xbcd\xa5\x8a\x88\x98\xc3\xfc`\xa6\xba\x1f\x17\v$\x88g\xb4\xad\b\xc1\xddW\xa6\xc1\xb7\xb0\xa3\x84Q\x13GoU\xe2\xb7\x03\x9c\xd5\x0f\xa8\x0ef\"\x15\x82\xe7\xbd\xf8\xca\x10f\xfe6h\xe9\xc3\xc2\xa0O:\xac~\x1a\xf7\xbeF\xbe\xe5\xf0\x81\xd6&\xc00xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r4, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) syz_usb_control_io$uac2(0xffffffffffffffff, &(0x7f0000001400)={0x14, &(0x7f0000001300)={0x20, 0x4, 0xb3, {0xb3, 0x30, "3255176b58448536f3c5e498a295db39a86cbc06fb47afe9a83edb4fc0d8575080751bb4dbbfdc54bd3481064955ce2e177985373a433b9d238df5e826f1665235cae7e39ceb6ec80cb5d8597309bfd4cb5b6597c0a8303e14dbffded13406521935314b9681955b6a46b05967a590bc891bc3c12ca5491c5118918de8fd6773caa8c1e8b5368bf1c539b0e02214a11edc4c861c9ea72c1a8e9eddb39b0c3763c90f769d164c5d26a7ff74dce7e6d62096"}}, &(0x7f00000013c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x3001}}}, &(0x7f00000016c0)={0x44, &(0x7f0000001440)={0x40, 0xc, 0xa9, "341fe49045051fa9f430363a620cd51dca1e2bc1bdec8ffdc3d220e91522973e9b4e485c03793f2561cf4a635cab716b0deaaf5e4341c3e6f8f989add19b3e7b014b972a002ad502e5f78c657b020ee853a146af1af9a4084e5ab660bff5bbe19ddde3f98d1074ab87a11492517e9f24883a6e0d6486f6e1adae634fa0cfaf532cf98755d428f67612a71bfc6f0e095cd7b028902d9c0d74f677ad4449198657de50e3a6531d032f0c"}, &(0x7f0000001500)={0x0, 0xa, 0x1, 0x5}, &(0x7f0000001540)={0x0, 0x8, 0x1, 0x2}, &(0x7f0000001580)={0x20, 0x81, 0x2, "acb2"}, &(0x7f00000015c0)={0x20, 0x82, 0x1, "88"}, &(0x7f0000001600)={0x20, 0x83, 0x3, "c011b3"}, &(0x7f0000001640)={0x20, 0x84, 0x4, "bbc9384d"}, &(0x7f0000001680)={0x20, 0x85, 0x3, "2013e9"}}) recvmsg$unix(r3, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[@cred={{0x1c}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x10}}], 0x60}, 0x80) socketpair$unix(0x1, 0x2, 0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000001c0)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r10 = socket$inet6_tcp(0xa, 0x1, 0x0) r11 = dup(r10) syz_ublk_setup_queues(r8, r9, &(0x7f0000000140)={0x0, 0xba1d, 0x4000, 0x2, 0x3, 0x0, r5}, &(0x7f0000000540)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xcc50, 0x10, 0x1, 0xe8, 0x0, r6}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x267e, 0xa3296, 0x1, 0x375, 0x0, r7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7f69, 0x0, 0x1, 0x3d4}, 0xffffffffffffffff}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe8e3, 0x8000, 0x0, 0x148, 0x0, r6}}], 0x4, 0x0, 0x0) syz_ublk_setup_queues(r11, r9, &(0x7f00000004c0)={0x0, 0xbd, 0x10, 0x1, 0x83}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe708, 0x800, 0x3000002, 0x91, 0x0, r8}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3b00, 0x80, 0x1, 0x3aa, 0x0, r12}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xdc67, 0x2000, 0x4003bfff, 0x802b9}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x8, 0x8, 0x1, 0x26d, 0x0, r11}}], 0x1, 0x0, 0x0) sendmsg$netlink(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000002c0)}, 0x40) 0s ago: executing program 0 (id=161): r0 = socket$tipc(0x1e, 0x2, 0x0) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)) r1 = socket$can_raw(0x1d, 0x3, 0x1) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r2, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f00000000c0)=ANY=[@ANYBLOB="3c0000001000010000000000000000002c00000020000000ff0f00000000000008001c00c900000014003100fc010000000000000000000000000001ef948c95"], 0x3c}], 0x1, 0x0, 0x0, 0xb305e06d8ab48273}, 0x48800) getsockopt$CAN_RAW_RECV_OWN_MSGS(r1, 0x65, 0x4, 0x0, 0x0) r3 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) r4 = syz_usb_connect$midi(0x0, 0x0, 0x0, 0x0) syz_usb_control_io$uac3(r4, 0x0, 0x0) syz_usb_control_io(r4, &(0x7f0000000300)={0x2c, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$uac1(r4, 0x0, 0x0) syz_usb_control_io$rtl8150(r4, 0x0, 0x0) r5 = dup3(r3, r0, 0x0) r6 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x48400) ioctl$SNDRV_TIMER_IOCTL_SELECT(r6, 0x40345410, &(0x7f00000083c0)={{0x1}}) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r6, 0x54a2) ioctl$SNDRV_TIMER_IOCTL_PAUSE(r6, 0x54a3) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r6, 0x5422) ioctl$VHOST_SET_OWNER(r5, 0xaf01, 0x0) setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0xa, 0x0, 0x0) r7 = openat$ttyS3(0xffffffffffffff9c, 0x0, 0x2982, 0x0) ioctl$TIOCSERGETLSR(r7, 0x5459, 0x0) 0s ago: executing program 0 (id=162): r0 = memfd_create(&(0x7f0000000000)='\x103q}2\x9a\xce\xaf\x03\xdfy[\xd9\xffR8\xf4\x1c\bi\xe4^\xd5\xfd\xa9\r\xac7A\x94\xa0\x00\x00\x00\x90+\xd6\x05\r\x84\x87\x1c\b\xdb\xe2\x00\x00A\x90m\xb6&\xd0\x9d\x00\x00\xc5\xb8,\f\xd4s\xb2\x99/\xc0\x9a\xf2O\xdb\x00\x00\x00\x00\x00\x00\r\x1b\xd3\xff<\x83z\x80\x8fQ|\xf5d\x10\x10\xd7\x01M\x7fML\x18\'\x1a<\xfee7{l\x16}\xa0I\x7f\xb5)l\xbb\x02\xfa\xb7\xb6\xa0]\xda8\xe0~\x1c \x91\t\x8b\xbd\x1f\xb3834d1i\x9b\x94\xa6\\\x0e\xe2\xfa\xe5!\xd3\xcf\xfc\xce\xba\xe2\x9f\x05xgL5\x14Y+\xb3\x1axi)<\xf7\x98\xc1\xba\xf4|\xe7|\xc4\xd7\x03\x00\x00\x00\x04D\x15E^7%8\x94y\x98\xf0l\xa0\'Q%\xd4\xda\xee\x81}\xcc\xfd\xa2\xe3M~x\x96\xe3]\xd70\xa2\x17\xca\xde\x1b\xaa\xe0l\xfc\x85\x8fc\x1c{|e\x8bs\xb0\x85E\xce;p)\xf8\xa6\xaa&QC4V\x81\x04\xcf\xd2\x81\xdc\xdf\xd7<\x9f\x93\x8bX\xd4\xea\xb2\xff\b\x92\xc7\x00\xef\xff\x00\x93\x1f\x92\xa7dcY\x9c\x9e9O-\xfcF\xbb\xbd{:IR\xea\xd8$\xe2\xa0\xc2\x8b\x1a\xead\xb8\xe1:6\x15M\x1d\xdak\x8c\x909\xd8\xb3\x02\xe0\x04\x9c\xc2\x06|\xf0\x0f\xa6Y&r\x9b\xc7\x1d\xe7jDf\x87@\x8fg\x15RJwe\xe2\xdcunu\xff`\xa40\xce\xffB%\xe4k\xff\x8d\x06\x0e\x89\xd9DC\x9fF\x9c[M=\xe0^\xa8\xed)\xe8Z\xe8\x99&\x87\x04\xa4\t\xaa\xd8\xd6\xd5pG\xcb\xc4\x8b\xf7\xb8#\xcb\xd8|\xa5\xa6S\x8b\x8cv\xb7)\x02k\xf3L\x03\xbb\xfa\xe1\\\xf1\x8cUj\xd5\xa5\x88GL\xe7_\xfd\x17C=G\x0f\xe9u\x1d\xfeg\xfex\xcd\xaa\xad\x906\xd0sy\xc6T\x93\xae\xd5r\xc8G\xc5\xfdS\xff\x04:`\x1e\xe3;l\xcd&\xd4\xf4\x8eum\x04\x00~\xfa\x05\xd7\xe7X\xc7/\xae5\x93wwT\x13\xbd,\xd6\x16\x84\xcd\xd1\xd8\xe1P_\xbf0\xd8\x8d%Yh\xb5\xb4\"\xf5\x93\xdeh\xce\xa5\xe8\xc8\xec\x88\x89\xf07{\x95\xc9\xd0\xee\xe1\x1d\x80\xcc]-\xc2\xa1\x02ELhI\xd9\xf5\xcfk\x8a&i\xc1\xff9T\x8e\xe2rY\xa3\xd2H9\xfe\x0e\x1e\xac\x0f\xc3\xbd{\xd9\xcc\xbe\xa9\x93\xe0\xa4W\x1cn>\xc1\xf1\x9e\"\x93\x19\x19\x1a\xcc\x7fy\xd2~\x05\x99\xe6\x00o\xca\xe0\xc6\xd4\xf5\xa0\xc8P\xd6;\xf3\xc6~E\xacI\xd4\xe9\xa1|>\x91.K\x81\xa9+\xcf\xff\xcb\xfa\x0f\xe7n\x83H\x12\xac\x80\x16\xf8\x87Q\x97Az\n`\xb6\xe13A\xec\x8d(\\D\xec\xa6\t1\xa0h\xfc\x1f\xdd1@-4\xb4:\xf8\xd5wP \x84m\xe2\xd9\xfcb\xa0\xc3\xc9\xe7W\x86\xd7$\xa4ml\xee\x97[\xb7\xfa', 0x2) ftruncate(r0, 0x80079a0) mmap(&(0x7f0000200000/0x400000)=nil, 0x400000, 0xb, 0x2012, r0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) fcntl$addseals(r0, 0x409, 0x8) r1 = syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000040)=ANY=[], 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, &(0x7f0000000080)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022170000000600ff0901a10185020901150026ff00750895098102c0"], 0x0}, 0x0) r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000680)='/sys/power/disk', 0x2, 0x0) read$FUSE(r2, &(0x7f0000001180)={0x2020}, 0x2020) syz_usb_disconnect(r1) r3 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0) r4 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) dup3(r4, r3, 0x0) r5 = socket$inet6(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r5, 0x8914, &(0x7f0000000a40)={'ip6_vti0\x00', 0x0}) r6 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) fcntl$lock(r6, 0x5, &(0x7f0000000240)={0x0, 0x1, 0x32, 0xffffffff80000001}) connect$bt_sco(r3, &(0x7f00000000c0)={0x1f, @none}, 0x8) ioctl$HIDIOCGREPORTINFO(r3, 0xc00c4809, &(0x7f0000000040)={0x1, 0x2, 0x710f}) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.155' (ED25519) to the list of known hosts. [ 29.463794][ T36] audit: type=1400 audit(1787619611.730:64): avc: denied { mounton } for pid=286 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 29.467037][ T286] cgroup: Unknown subsys name 'net' [ 29.486459][ T36] audit: type=1400 audit(1787619611.740:65): avc: denied { mount } for pid=286 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 29.513745][ T36] audit: type=1400 audit(1787619611.770:66): avc: denied { unmount } for pid=286 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 29.514139][ T286] cgroup: Unknown subsys name 'devices' [ 29.635894][ T286] cgroup: Unknown subsys name 'hugetlb' [ 29.641589][ T286] cgroup: Unknown subsys name 'rlimit' [ 29.735896][ T36] audit: type=1400 audit(1787619612.010:67): avc: denied { setattr } for pid=286 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 29.759066][ T36] audit: type=1400 audit(1787619612.010:68): avc: denied { mounton } for pid=286 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 29.783823][ T36] audit: type=1400 audit(1787619612.010:69): avc: denied { mount } for pid=286 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 29.788407][ T288] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 29.815695][ T36] audit: type=1400 audit(1787619612.090:70): avc: denied { relabelto } for pid=288 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 29.841125][ T36] audit: type=1400 audit(1787619612.090:71): avc: denied { write } for pid=288 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 29.856175][ T286] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 29.867309][ T36] audit: type=1400 audit(1787619612.130:72): avc: denied { read } for pid=286 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 29.900924][ T36] audit: type=1400 audit(1787619612.130:73): avc: denied { open } for pid=286 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 31.209210][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.216394][ T295] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.223472][ T295] bridge_slave_0: entered allmulticast mode [ 31.229893][ T295] bridge_slave_0: entered promiscuous mode [ 31.237261][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.244341][ T295] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.251432][ T295] bridge_slave_1: entered allmulticast mode [ 31.257806][ T295] bridge_slave_1: entered promiscuous mode [ 31.274397][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.281452][ T294] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.288623][ T294] bridge_slave_0: entered allmulticast mode [ 31.294877][ T294] bridge_slave_0: entered promiscuous mode [ 31.309395][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.316561][ T293] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.323610][ T293] bridge_slave_0: entered allmulticast mode [ 31.329921][ T293] bridge_slave_0: entered promiscuous mode [ 31.336134][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.343174][ T294] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.350370][ T294] bridge_slave_1: entered allmulticast mode [ 31.356636][ T294] bridge_slave_1: entered promiscuous mode [ 31.368451][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.375527][ T293] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.382616][ T293] bridge_slave_1: entered allmulticast mode [ 31.388941][ T293] bridge_slave_1: entered promiscuous mode [ 31.420304][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.427375][ T296] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.434549][ T296] bridge_slave_0: entered allmulticast mode [ 31.440743][ T296] bridge_slave_0: entered promiscuous mode [ 31.449941][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.457011][ T296] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.464134][ T296] bridge_slave_1: entered allmulticast mode [ 31.470334][ T296] bridge_slave_1: entered promiscuous mode [ 31.611333][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.618445][ T295] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.625781][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.632833][ T295] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.646188][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.653346][ T294] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.660670][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.667745][ T294] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.679274][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.686344][ T293] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.693611][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.700680][ T293] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.714491][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.721653][ T296] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.728953][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.736005][ T296] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.783400][ T297] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.791028][ T297] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.798890][ T297] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.806464][ T297] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.813785][ T297] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.821013][ T297] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.828306][ T297] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.835558][ T297] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.854936][ T297] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.861977][ T297] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.870494][ T297] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.877538][ T297] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.906139][ T297] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.913193][ T297] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.921152][ T297] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.928196][ T297] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.935917][ T297] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.942971][ T297] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.950898][ T297] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.957938][ T297] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.988594][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.995709][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 32.004358][ T293] veth0_vlan: entered promiscuous mode [ 32.011050][ T295] veth0_vlan: entered promiscuous mode [ 32.028352][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.035419][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 32.048962][ T293] veth1_macvtap: entered promiscuous mode [ 32.063539][ T295] veth1_macvtap: entered promiscuous mode [ 32.092309][ T294] veth0_vlan: entered promiscuous mode [ 32.110392][ T294] veth1_macvtap: entered promiscuous mode [ 32.120607][ T293] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 32.149515][ T296] veth0_vlan: entered promiscuous mode [ 32.179659][ T296] veth1_macvtap: entered promiscuous mode [ 32.234633][ T320] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 32.263093][ T323] process 'syz.1.6' launched '/dev/fd/3' with NULL argv: empty string added [ 32.359609][ T335] FAULT_INJECTION: forcing a failure. [ 32.359609][ T335] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 32.373103][ T335] CPU: 0 UID: 0 PID: 335 Comm: syz.1.9 Not tainted syzkaller #0 f2f9be0cb5819eb91f3cdfab905957d5e4b40d7b [ 32.373134][ T335] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 32.373156][ T335] Call Trace: [ 32.373164][ T335] [ 32.373172][ T335] __dump_stack+0x21/0x30 [ 32.373214][ T335] dump_stack_lvl+0x140/0x1c0 [ 32.373245][ T335] ? __cfi_dump_stack_lvl+0x10/0x10 [ 32.373278][ T335] ? lruvec_init+0x221/0x280 [ 32.373308][ T335] dump_stack+0x19/0x20 [ 32.373339][ T335] should_fail_ex+0x3c2/0x510 [ 32.373366][ T335] should_fail+0xf/0x20 [ 32.373391][ T335] should_fail_usercopy+0x1e/0x30 [ 32.373419][ T335] _copy_from_iter+0x1a6/0x1520 [ 32.373452][ T335] ? __cfi__copy_from_iter+0x10/0x10 [ 32.373482][ T335] ? __check_object_size+0x54c/0x870 [ 32.373507][ T335] ? __cfi___check_object_size+0x10/0x10 [ 32.373530][ T335] ? skb_page_frag_refill+0x22e/0x4f0 [ 32.373558][ T335] ? sk_page_frag_refill+0x5d/0x120 [ 32.373585][ T335] tcp_sendmsg_locked+0x1d98/0x4ac0 [ 32.373621][ T335] ? __cfi_tcp_sendmsg_locked+0x10/0x10 [ 32.373649][ T335] ? check_stack_object+0x10f/0x150 [ 32.373672][ T335] ? __check_object_size+0xdc/0x870 [ 32.373703][ T335] ? __cfi_tcp_sendmsg+0x10/0x10 [ 32.373729][ T335] tcp_sendmsg+0x3e/0xd0 [ 32.373754][ T335] ? __cfi_tcp_sendmsg+0x10/0x10 [ 32.373779][ T335] inet6_sendmsg+0xb7/0x120 [ 32.373807][ T335] ? __cfi_inet6_sendmsg+0x10/0x10 [ 32.373832][ T335] __sys_sendto+0x4a6/0x700 [ 32.373857][ T335] ? __cfi___sys_sendto+0x10/0x10 [ 32.373883][ T335] ? __kasan_check_write+0x18/0x20 [ 32.373907][ T335] ? do_user_addr_fault+0xbf5/0x1230 [ 32.373938][ T335] ? __cfi_ksys_write+0x10/0x10 [ 32.373962][ T335] ? __kasan_check_read+0x15/0x20 [ 32.373984][ T335] __x64_sys_sendto+0xe9/0x100 [ 32.374010][ T335] x64_sys_call+0x2c2c/0x2ee0 [ 32.374028][ T335] do_syscall_64+0x57/0xf0 [ 32.374056][ T335] ? clear_bhb_loop+0x50/0xa0 [ 32.374079][ T335] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 32.374113][ T335] RIP: 0033:0x7f5440f5e90e [ 32.374132][ T335] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 32.374151][ T335] RSP: 002b:00007f5441d93e88 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 32.374175][ T335] RAX: ffffffffffffffda RBX: 00007f5441d956c0 RCX: 00007f5440f5e90e [ 32.374187][ T335] RDX: 0000000000000020 RSI: 00007f5441d94000 RDI: 0000000000000005 [ 32.374198][ T335] RBP: 0000000000000000 R08: 00007f5441d93f04 R09: 000000000000000c [ 32.374208][ T335] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 [ 32.374218][ T335] R13: 00007f5441d93f58 R14: 00007f5441d94000 R15: 0000000000000000 [ 32.374230][ T335] [ 32.712394][ T341] rust_binder: Write failure EINVAL in pid:9 [ 32.833550][ T353] rust_binder: Write failure EFAULT in pid:14 [ 32.955744][ T45] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 33.027481][ T370] netlink: 20 bytes leftover after parsing attributes in process `syz.3.25'. [ 33.067859][ T377] netlink: 8 bytes leftover after parsing attributes in process `syz.3.27'. [ 33.118978][ T383] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 33.132761][ T383] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 33.151726][ T45] usb 2-1: unable to get BOS descriptor or descriptor too short [ 33.166369][ T45] usb 2-1: unable to read config index 0 descriptor/start: -71 [ 33.175140][ T45] usb 2-1: can't read configurations, error -71 [ 33.223762][ T31] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 33.281517][ T395] syzkaller1: entered promiscuous mode [ 33.287203][ T395] syzkaller1: entered allmulticast mode [ 33.385133][ T31] usb 1-1: unable to get BOS descriptor or descriptor too short [ 33.393784][ T31] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 33.405459][ T31] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 33.416120][ T31] usb 1-1: New USB device found, idVendor=1235, idProduct=0010, bcdDevice= 0.40 [ 33.425299][ T31] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 33.433314][ T31] usb 1-1: Product: syz [ 33.438619][ T31] usb 1-1: Manufacturer: syz [ 33.450805][ T31] usb 1-1: SerialNumber: syz [ 33.458518][ T31] usb 1-1: selecting invalid altsetting 1 [ 33.464705][ T31] usb 1-1: unit 6 not found! [ 33.657976][ T31] usb 1-1: 2:0: cannot get min/max values for control 1 (id 2) [ 33.685015][ T31] snd-usb-audio 1-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 33.752751][ T312] udevd[312]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 33.773930][ T10] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 33.884349][ T366] tipc: Can't bind to reserved service type 1 [ 33.891040][ T9] usb 1-1: USB disconnect, device number 2 [ 33.923713][ T10] usb 3-1: Using ep0 maxpacket: 16 [ 33.930090][ T10] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 33.940508][ T10] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 33.950841][ T10] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 33.959950][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 33.968042][ T10] usb 3-1: Product: syz [ 33.972221][ T10] usb 3-1: Manufacturer: syz [ 33.977001][ T10] usb 3-1: SerialNumber: syz [ 34.184675][ T10] usb 3-1: 0:2 : does not exist [ 34.192062][ T10] usb 3-1: 5:0: failed to get current value for ch 0 (-22) [ 34.203231][ T10] usb 3-1: USB disconnect, device number 2 [ 34.215098][ T312] udevd[312]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 34.565942][ T36] kauditd_printk_skb: 90 callbacks suppressed [ 34.565959][ T36] audit: type=1400 audit(1787619616.840:164): avc: denied { nlmsg_write } for pid=437 comm="syz.0.53" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 34.679376][ T36] audit: type=1400 audit(1787619616.950:165): avc: denied { read } for pid=446 comm="syz.1.57" name="event1" dev="devtmpfs" ino=193 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 34.703337][ T36] audit: type=1400 audit(1787619616.950:166): avc: denied { open } for pid=446 comm="syz.1.57" path="/dev/input/event1" dev="devtmpfs" ino=193 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 34.739558][ T36] audit: type=1400 audit(1787619616.960:167): avc: denied { ioctl } for pid=446 comm="syz.1.57" path="/dev/input/event1" dev="devtmpfs" ino=193 ioctlcmd=0x4581 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 34.788388][ T457] netlink: 8 bytes leftover after parsing attributes in process `syz.2.62'. [ 34.793811][ T45] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 34.803832][ T36] audit: type=1400 audit(1787619617.040:168): avc: denied { execute } for pid=450 comm="syz.2.59" path="/proc/29/task/30/net/vlan/vlan0" dev="proc" ino=4026532798 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=file permissive=1 [ 34.833851][ T36] audit: type=1400 audit(1787619617.050:169): avc: denied { mmap_zero } for pid=450 comm="syz.2.59" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=memprotect permissive=1 [ 34.861119][ T36] audit: type=1400 audit(1787619617.130:170): avc: denied { block_suspend } for pid=458 comm="syz.1.63" capability=36 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 34.927591][ T36] audit: type=1400 audit(1787619617.200:171): avc: denied { read } for pid=466 comm="syz.0.66" name="snapshot" dev="devtmpfs" ino=21 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 34.952087][ T36] audit: type=1400 audit(1787619617.200:172): avc: denied { open } for pid=466 comm="syz.0.66" path="/dev/snapshot" dev="devtmpfs" ino=21 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 34.975303][ T36] audit: type=1400 audit(1787619617.200:173): avc: denied { unlink } for pid=466 comm="syz.0.66" name="#1" dev="tmpfs" ino=112 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 34.976956][ T45] usb 4-1: config 1 has an invalid interface number: 93 but max is 0 [ 35.005414][ T45] usb 4-1: config 1 has no interface number 0 [ 35.017209][ T45] usb 4-1: config 1 interface 93 has no altsetting 0 [ 35.024046][ T45] usb 4-1: New USB device found, idVendor=05e3, idProduct=0502, bcdDevice=6b.02 [ 35.033121][ T45] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 35.078152][ T476] kvm: user requested TSC rate below hardware speed [ 35.106690][ T476] kvm: kvm [475]: vcpu0, guest rIP: 0x9114 Unhandled WRMSR(0xc2) = 0x9d00 [ 35.115709][ T476] kvm: kvm [475]: vcpu0, guest rIP: 0x9114 Unhandled WRMSR(0xc1) = 0x9d00 [ 35.133016][ T476] kvm: vcpu 0: requested 14336 ns lapic timer period limited to 200000 ns [ 35.243703][ T10] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 35.252118][ T45] usb 4-1: string descriptor 0 read error: -71 [ 35.258758][ T45] gl620a 4-1:1.93: probe with driver gl620a failed with error -22 [ 35.267877][ T45] usb 4-1: USB disconnect, device number 2 [ 35.403709][ T10] usb 3-1: Using ep0 maxpacket: 16 [ 35.413725][ T10] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 35.424194][ T10] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 35.436302][ T10] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 35.445438][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 35.453448][ T10] usb 3-1: Product: syz [ 35.457722][ T10] usb 3-1: Manufacturer: syz [ 35.462341][ T10] usb 3-1: SerialNumber: syz [ 35.663710][ T31] usb 2-1: new full-speed USB device number 4 using dummy_hcd [ 35.672650][ T10] usb 3-1: 0:2 : does not exist [ 35.679688][ T10] usb 3-1: 5:0: failed to get current value for ch 0 (-22) [ 35.690426][ T10] usb 3-1: USB disconnect, device number 3 [ 35.702069][ T312] udevd[312]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 35.717789][ T45] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 35.815689][ T31] usb 2-1: config 0 interface 0 altsetting 13 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 35.828726][ T31] usb 2-1: config 0 interface 0 has no altsetting 0 [ 35.835442][ T31] usb 2-1: New USB device found, idVendor=28bd, idProduct=0933, bcdDevice= 0.00 [ 35.844559][ T31] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 35.858848][ T31] usb 2-1: config 0 descriptor?? [ 35.874752][ T45] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 35.884940][ T45] usb 1-1: config 1 interface 0 altsetting 1 has 3 endpoint descriptors, different from the interface descriptor's value: 4 [ 35.899343][ T45] usb 1-1: New USB device found, idVendor=174c, idProduct=55aa, bcdDevice= 1.00 [ 35.908453][ T45] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 35.916926][ T45] usb 1-1: Product: syz [ 35.921166][ T45] usb 1-1: Manufacturer: syz [ 35.925814][ T45] usb 1-1: SerialNumber: syz [ 35.932618][ T45] usb-storage 1-1:1.0: USB Mass Storage device detected [ 35.941627][ T45] usb-storage 1-1:1.0: Quirks match for vid 174c pid 55aa: 400000 [ 35.952706][ T45] scsi host1: usb-storage 1-1:1.0 [ 35.955516][ T512] fuse: Unknown parameter 'grou00000000000000000000' [ 36.139700][ T424] usb 1-1: USB disconnect, device number 3 [ 36.268660][ T31] input: HID 28bd:0933 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/0003:28BD:0933.0001/input/input4 [ 36.282321][ T31] uclogic 0003:28BD:0933.0001: input,hidraw0: USB HID v10.01 Mouse [HID 28bd:0933] on usb-dummy_hcd.1-1/input0 [ 36.303901][ T10] usb 4-1: new low-speed USB device number 3 using dummy_hcd [ 36.433728][ T10] usb 4-1: device descriptor read/64, error -71 [ 36.469597][ T31] usb 2-1: USB disconnect, device number 4 [ 36.673742][ T10] usb 4-1: device descriptor read/64, error -71 [ 36.764441][ T535] fuse: Unknown parameter 'grou00000000000000000000' [ 36.913705][ T10] usb 4-1: new low-speed USB device number 4 using dummy_hcd [ 37.018223][ T552] can: request_module (can-proto-7) failed. [ 37.025112][ T552] random: crng reseeded on system resumption [ 37.043683][ T10] usb 4-1: device descriptor read/64, error -71 [ 37.080677][ T556] fuse: Unknown parameter 'grou00000000000000000000' [ 37.210082][ T31] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 37.313728][ T10] usb 4-1: device descriptor read/64, error -71 [ 37.364825][ T31] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 37.385959][ T31] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 37.399455][ T31] usb 1-1: New USB device found, idVendor=044f, idProduct=b65d, bcdDevice= 0.00 [ 37.409019][ T31] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 37.418666][ T31] usb 1-1: config 0 descriptor?? [ 37.425077][ T45] usb 3-1: new full-speed USB device number 4 using dummy_hcd [ 37.428802][ T10] usb usb4-port1: attempt power cycle [ 37.533763][ T388] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 37.585084][ T45] usb 3-1: config 1 interface 0 has no altsetting 0 [ 37.593305][ T45] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 37.603088][ T45] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 37.611543][ T45] usb 3-1: Product: syz [ 37.615995][ T45] usb 3-1: Manufacturer: syz [ 37.620820][ T45] usb 3-1: SerialNumber: syz [ 37.683737][ T388] usb 2-1: Using ep0 maxpacket: 32 [ 37.690597][ T388] usb 2-1: config 0 interface 0 altsetting 6 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 37.701842][ T388] usb 2-1: config 0 interface 0 altsetting 6 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 37.715279][ T388] usb 2-1: config 0 interface 0 has no altsetting 0 [ 37.721943][ T388] usb 2-1: New USB device found, idVendor=04e7, idProduct=0009, bcdDevice= 0.00 [ 37.731326][ T388] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 37.741489][ T388] usb 2-1: config 0 descriptor?? [ 37.793704][ T10] usb 4-1: new low-speed USB device number 5 using dummy_hcd [ 37.814808][ T10] usb 4-1: device descriptor read/8, error -71 [ 37.828278][ T45] cdc_ether 3-1:1.0: probe with driver cdc_ether failed with error -71 [ 37.841273][ T31] hid-thrustmaster 0003:044F:B65D.0002: unknown main item tag 0x0 [ 37.851103][ T45] usb 3-1: USB disconnect, device number 4 [ 37.858119][ T31] hid-thrustmaster 0003:044F:B65D.0002: unknown main item tag 0x0 [ 37.866633][ T31] hid-thrustmaster 0003:044F:B65D.0002: unknown main item tag 0x0 [ 37.874522][ T31] hid-thrustmaster 0003:044F:B65D.0002: unknown main item tag 0x0 [ 37.882373][ T31] hid-thrustmaster 0003:044F:B65D.0002: unknown main item tag 0x0 [ 37.890237][ T31] hid-thrustmaster 0003:044F:B65D.0002: unknown main item tag 0x0 [ 37.898115][ T31] hid-thrustmaster 0003:044F:B65D.0002: unknown main item tag 0x0 [ 37.906946][ T31] hid-thrustmaster 0003:044F:B65D.0002: hidraw0: USB HID v0.00 Device [HID 044f:b65d] on usb-dummy_hcd.0-1/input0 [ 37.919222][ T31] hid-thrustmaster 0003:044F:B65D.0002: Wrong number of endpoints? [ 37.954749][ T10] usb 4-1: device descriptor read/8, error -71 [ 38.046534][ C1] hid-thrustmaster 0003:044F:B65D.0002: URB to get model id failed with error -71 [ 38.056744][ T45] usb 1-1: USB disconnect, device number 4 [ 38.152106][ T388] elo 0003:04E7:0009.0003: unknown main item tag 0x1 [ 38.158947][ T388] elo 0003:04E7:0009.0003: unknown main item tag 0xe [ 38.166636][ T388] elo 0003:04E7:0009.0003: hidraw0: USB HID vd.8f Device [HID 04e7:0009] on usb-dummy_hcd.1-1/input0 [ 38.193726][ T10] usb 4-1: new low-speed USB device number 6 using dummy_hcd [ 38.214721][ T10] usb 4-1: device descriptor read/8, error -71 [ 38.354780][ T10] usb 4-1: device descriptor read/8, error -71 [ 38.372756][ T572] ======================================================= [ 38.372756][ T572] WARNING: The mand mount option has been deprecated and [ 38.372756][ T572] and is ignored by this kernel. Remove the mand [ 38.372756][ T572] option from the mount to silence this warning. [ 38.372756][ T572] ======================================================= [ 38.408069][ T572] SELinux: security_context_str_to_sid (syt|v\{‹) failed with errno=-22 [ 38.419757][ T424] usb 2-1: USB disconnect, device number 5 [ 38.473802][ T10] usb usb4-port1: unable to enumerate USB device [ 38.508153][ T578] FAULT_INJECTION: forcing a failure. [ 38.508153][ T578] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 38.521312][ T578] CPU: 1 UID: 0 PID: 578 Comm: syz.2.110 Not tainted syzkaller #0 f2f9be0cb5819eb91f3cdfab905957d5e4b40d7b [ 38.521343][ T578] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 38.521357][ T578] Call Trace: [ 38.521364][ T578] [ 38.521373][ T578] __dump_stack+0x21/0x30 [ 38.521410][ T578] dump_stack_lvl+0x140/0x1c0 [ 38.521432][ T578] ? __cfi_dump_stack_lvl+0x10/0x10 [ 38.521453][ T578] ? bpf_lsm_file_permission+0xd/0x20 [ 38.521474][ T578] ? check_stack_object+0x10f/0x150 [ 38.521491][ T578] dump_stack+0x19/0x20 [ 38.521511][ T578] should_fail_ex+0x3c2/0x510 [ 38.521530][ T578] should_fail+0xf/0x20 [ 38.521546][ T578] should_fail_usercopy+0x1e/0x30 [ 38.521564][ T578] _copy_from_user+0x20/0xa0 [ 38.521586][ T578] __sys_bind+0x1f4/0x430 [ 38.521601][ T578] ? __cfi___sys_bind+0x10/0x10 [ 38.521618][ T578] ? __kasan_check_read+0x15/0x20 [ 38.521633][ T578] __x64_sys_bind+0x7e/0x90 [ 38.521648][ T578] x64_sys_call+0x1ffd/0x2ee0 [ 38.521662][ T578] do_syscall_64+0x57/0xf0 [ 38.521682][ T578] ? clear_bhb_loop+0x50/0xa0 [ 38.521698][ T578] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 38.521723][ T578] RIP: 0033:0x7f691b59e0d9 [ 38.521735][ T578] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 38.521748][ T578] RSP: 002b:00007f691c543028 EFLAGS: 00000246 ORIG_RAX: 0000000000000031 [ 38.521764][ T578] RAX: ffffffffffffffda RBX: 00007f691b825fa0 RCX: 00007f691b59e0d9 [ 38.521776][ T578] RDX: 0000000000000006 RSI: 0000200000000000 RDI: 0000000000000004 [ 38.521785][ T578] RBP: 00007f691c543090 R08: 0000000000000000 R09: 0000000000000000 [ 38.521795][ T578] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 38.521804][ T578] R13: 00007f691b826038 R14: 00007f691b825fa0 R15: 00007ffce1f40d08 [ 38.521817][ T578] [ 38.807868][ T587] FAULT_INJECTION: forcing a failure. [ 38.807868][ T587] name failslab, interval 1, probability 0, space 0, times 1 [ 38.820526][ T587] CPU: 0 UID: 0 PID: 587 Comm: syz.2.114 Not tainted syzkaller #0 f2f9be0cb5819eb91f3cdfab905957d5e4b40d7b [ 38.820548][ T587] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 38.820558][ T587] Call Trace: [ 38.820563][ T587] [ 38.820569][ T587] __dump_stack+0x21/0x30 [ 38.820594][ T587] dump_stack_lvl+0x140/0x1c0 [ 38.820616][ T587] ? __cfi_dump_stack_lvl+0x10/0x10 [ 38.820637][ T587] ? mutex_unlock+0x90/0x240 [ 38.820654][ T587] dump_stack+0x19/0x20 [ 38.820674][ T587] should_fail_ex+0x3c2/0x510 [ 38.820692][ T587] should_failslab+0xac/0x100 [ 38.820711][ T587] __kmalloc_cache_noprof+0x41/0x470 [ 38.820728][ T587] ? io_ring_ctx_alloc+0x61/0x1dc0 [ 38.820744][ T587] io_ring_ctx_alloc+0x61/0x1dc0 [ 38.820759][ T587] ? __kasan_check_read+0x15/0x20 [ 38.820773][ T587] ? __x64_sys_io_uring_enter+0x110/0x110 [ 38.820797][ T587] io_uring_create+0x2e0/0x13f0 [ 38.820813][ T587] ? __kasan_check_write+0x18/0x20 [ 38.820829][ T587] __se_sys_io_uring_setup+0x2a4/0x2b0 [ 38.820850][ T587] ? __x64_sys_io_uring_setup+0x80/0x80 [ 38.820873][ T587] ? __kasan_check_read+0x15/0x20 [ 38.820888][ T587] __x64_sys_io_uring_setup+0x5f/0x80 [ 38.820909][ T587] x64_sys_call+0x22c0/0x2ee0 [ 38.820923][ T587] do_syscall_64+0x57/0xf0 [ 38.820943][ T587] ? clear_bhb_loop+0x50/0xa0 [ 38.820958][ T587] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 38.820982][ T587] RIP: 0033:0x7f691b59e0d9 [ 38.820995][ T587] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 38.821007][ T587] RSP: 002b:00007f691c542ee8 EFLAGS: 00000206 ORIG_RAX: 00000000000001a9 [ 38.821023][ T587] RAX: ffffffffffffffda RBX: 0000200000000948 RCX: 00007f691b59e0d9 [ 38.821035][ T587] RDX: 00002000000009c8 RSI: 0000200000000948 RDI: 0000000000000e26 [ 38.821045][ T587] RBP: 0000200000000940 R08: 0000000000000008 R09: 0000000000000000 [ 38.821054][ T587] R10: 00002000000009d0 R11: 0000000000000206 R12: 00002000000009c8 [ 38.821065][ T587] R13: 00002000000009d0 R14: 00007f691c542fd8 R15: 0000000000000002 [ 38.821077][ T587] [ 39.071007][ T598] fuse: Unknown parameter 'group_i00000000000000000000' [ 39.103723][ T388] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 39.127217][ T600] FAULT_INJECTION: forcing a failure. [ 39.127217][ T600] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 39.140589][ T600] CPU: 1 UID: 0 PID: 600 Comm: syz.3.116 Not tainted syzkaller #0 f2f9be0cb5819eb91f3cdfab905957d5e4b40d7b [ 39.140622][ T600] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 39.140635][ T600] Call Trace: [ 39.140642][ T600] [ 39.140651][ T600] __dump_stack+0x21/0x30 [ 39.140686][ T600] dump_stack_lvl+0x140/0x1c0 [ 39.140717][ T600] ? __cfi_dump_stack_lvl+0x10/0x10 [ 39.140748][ T600] ? bpf_lsm_file_permission+0xd/0x20 [ 39.140781][ T600] ? check_stack_object+0x10f/0x150 [ 39.140807][ T600] dump_stack+0x19/0x20 [ 39.140836][ T600] should_fail_ex+0x3c2/0x510 [ 39.140872][ T600] should_fail+0xf/0x20 [ 39.140895][ T600] should_fail_usercopy+0x1e/0x30 [ 39.140922][ T600] _copy_from_user+0x20/0xa0 [ 39.140953][ T600] __sys_bind+0x1f4/0x430 [ 39.140975][ T600] ? __cfi___sys_bind+0x10/0x10 [ 39.141000][ T600] ? __kasan_check_read+0x15/0x20 [ 39.141023][ T600] __x64_sys_bind+0x7e/0x90 [ 39.141044][ T600] x64_sys_call+0x1ffd/0x2ee0 [ 39.141065][ T600] do_syscall_64+0x57/0xf0 [ 39.141095][ T600] ? clear_bhb_loop+0x50/0xa0 [ 39.141117][ T600] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 39.141153][ T600] RIP: 0033:0x7f409319e0d9 [ 39.141170][ T600] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 39.141188][ T600] RSP: 002b:00007f40940b9028 EFLAGS: 00000246 ORIG_RAX: 0000000000000031 [ 39.141212][ T600] RAX: ffffffffffffffda RBX: 00007f4093425fa0 RCX: 00007f409319e0d9 [ 39.141229][ T600] RDX: 0000000000000014 RSI: 0000200000000000 RDI: 0000000000000004 [ 39.141244][ T600] RBP: 00007f40940b9090 R08: 0000000000000000 R09: 0000000000000000 [ 39.141258][ T600] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 39.141271][ T600] R13: 00007f4093426038 R14: 00007f4093425fa0 R15: 00007ffd2842c818 [ 39.141290][ T600] [ 39.200325][ T602] FAULT_INJECTION: forcing a failure. [ 39.200325][ T602] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 39.241009][ T604] raw_sendmsg: syz.3.118 forgot to set AF_INET. Fix it! [ 39.242409][ T602] CPU: 0 UID: 0 PID: 602 Comm: syz.1.117 Not tainted syzkaller #0 f2f9be0cb5819eb91f3cdfab905957d5e4b40d7b [ 39.242477][ T602] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 39.242547][ T602] Call Trace: [ 39.242586][ T602] [ 39.242620][ T602] __dump_stack+0x21/0x30 [ 39.242725][ T602] dump_stack_lvl+0x140/0x1c0 [ 39.242800][ T602] ? __cfi_dump_stack_lvl+0x10/0x10 [ 39.242886][ T602] dump_stack+0x19/0x20 [ 39.242957][ T602] should_fail_ex+0x3c2/0x510 [ 39.243021][ T602] should_fail+0xf/0x20 [ 39.243083][ T602] should_fail_usercopy+0x1e/0x30 [ 39.243154][ T602] _copy_from_user+0x20/0xa0 [ 39.243227][ T602] proc_control+0xa9/0x140 [ 39.243286][ T602] ? destroy_async+0x210/0x210 [ 39.243338][ T602] ? mutex_lock+0x97/0x1d0 [ 39.243402][ T602] ? __kasan_check_write+0x18/0x20 [ 39.243461][ T602] ? mutex_unlock+0x90/0x240 [ 39.243515][ T602] usbdev_ioctl+0xc96/0x2120 [ 39.243575][ T602] ? __cfi_usbdev_ioctl+0x10/0x10 [ 39.243628][ T602] ? bpf_lsm_file_ioctl+0xd/0x20 [ 39.243714][ T602] ? security_file_ioctl+0x3e/0x110 [ 39.243779][ T602] ? __cfi_usbdev_ioctl+0x10/0x10 [ 39.243829][ T602] __se_sys_ioctl+0x135/0x1b0 [ 39.243894][ T602] __x64_sys_ioctl+0x7f/0xa0 [ 39.243980][ T602] x64_sys_call+0x1878/0x2ee0 [ 39.244043][ T602] do_syscall_64+0x57/0xf0 [ 39.244120][ T602] ? clear_bhb_loop+0x50/0xa0 [ 39.244172][ T602] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 39.244262][ T602] RIP: 0033:0x7f5440f9e0d9 [ 39.244320][ T602] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 39.244369][ T602] RSP: 002b:00007f5441d95028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 39.244423][ T602] RAX: ffffffffffffffda RBX: 00007f5441225fa0 RCX: 00007f5440f9e0d9 [ 39.244464][ T602] RDX: 0000200000000100 RSI: 00000000c0185500 RDI: 0000000000000003 [ 39.244504][ T602] RBP: 00007f5441d95090 R08: 0000000000000000 R09: 0000000000000000 [ 39.244541][ T602] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 39.244572][ T602] R13: 00007f5441226038 R14: 00007f5441225fa0 R15: 00007ffc129dc738 [ 39.244621][ T602] [ 39.555235][ T613] FAULT_INJECTION: forcing a failure. [ 39.555235][ T613] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 39.585191][ T613] CPU: 0 UID: 0 PID: 613 Comm: syz.0.121 Not tainted syzkaller #0 f2f9be0cb5819eb91f3cdfab905957d5e4b40d7b [ 39.585224][ T613] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 39.585238][ T613] Call Trace: [ 39.585244][ T613] [ 39.585253][ T613] __dump_stack+0x21/0x30 [ 39.585288][ T613] dump_stack_lvl+0x140/0x1c0 [ 39.585317][ T613] ? __cfi_dump_stack_lvl+0x10/0x10 [ 39.585356][ T613] ? check_stack_object+0x138/0x150 [ 39.585380][ T613] dump_stack+0x19/0x20 [ 39.585409][ T613] should_fail_ex+0x3c2/0x510 [ 39.585435][ T613] should_fail+0xf/0x20 [ 39.585458][ T613] should_fail_usercopy+0x1e/0x30 [ 39.585485][ T613] _copy_to_user+0x24/0xa0 [ 39.585516][ T613] simple_read_from_buffer+0xed/0x160 [ 39.585548][ T613] proc_fail_nth_read+0x1aa/0x220 [ 39.585581][ T613] ? __cfi_proc_fail_nth_read+0x10/0x10 [ 39.585613][ T613] ? __cfi_raw_sendmsg+0x10/0x10 [ 39.585636][ T613] ? bpf_lsm_file_permission+0xd/0x20 [ 39.585666][ T613] ? __cfi_proc_fail_nth_read+0x10/0x10 [ 39.585698][ T613] vfs_read+0x288/0xc70 [ 39.585719][ T613] ? __kasan_check_write+0x18/0x20 [ 39.585743][ T613] ? __cfi_vfs_read+0x10/0x10 [ 39.585765][ T613] ? __kasan_check_write+0x18/0x20 [ 39.585786][ T613] ? mutex_lock+0x97/0x1d0 [ 39.585808][ T613] ? __cfi_mutex_lock+0x10/0x10 [ 39.585832][ T613] ksys_read+0x145/0x260 [ 39.585854][ T613] ? __cfi_ksys_read+0x10/0x10 [ 39.585878][ T613] ? __kasan_check_read+0x15/0x20 [ 39.585900][ T613] __x64_sys_read+0x7f/0x90 [ 39.585922][ T613] x64_sys_call+0x2638/0x2ee0 [ 39.585943][ T613] do_syscall_64+0x57/0xf0 [ 39.585972][ T613] ? clear_bhb_loop+0x50/0xa0 [ 39.585994][ T613] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 39.586028][ T613] RIP: 0033:0x7ff1a7f5e90e [ 39.586046][ T613] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 39.586064][ T613] RSP: 002b:00007ff1a8ee1fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 39.586087][ T613] RAX: ffffffffffffffda RBX: 00007ff1a8ee26c0 RCX: 00007ff1a7f5e90e [ 39.586104][ T613] RDX: 000000000000000f RSI: 00007ff1a8ee20a0 RDI: 0000000000000003 [ 39.586118][ T613] RBP: 00007ff1a8ee2090 R08: 0000000000000000 R09: 0000000000000000 [ 39.586132][ T613] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 39.586145][ T613] R13: 00007ff1a8226038 R14: 00007ff1a8225fa0 R15: 00007ffd4d06e838 [ 39.586163][ T613] [ 39.593888][ T388] usb 3-1: Using ep0 maxpacket: 16 [ 39.622290][ T36] kauditd_printk_skb: 32 callbacks suppressed [ 39.622334][ T36] audit: type=1400 audit(1787619621.890:206): avc: denied { create } for pid=614 comm="syz.3.122" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 39.642901][ T388] usb 3-1: config index 0 descriptor too short (expected 51443, got 18) [ 39.711023][ T36] audit: type=1400 audit(1787619621.980:207): avc: denied { mounton } for pid=614 comm="syz.3.122" path="/31/file0" dev="tmpfs" ino=181 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=fifo_file permissive=1 [ 39.869179][ T388] usb 3-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 39.910502][ T388] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 39.918597][ T388] usb 3-1: Product: syz [ 39.922785][ T388] usb 3-1: Manufacturer: syz [ 39.927428][ T388] usb 3-1: SerialNumber: syz [ 39.941745][ T620] fuse: Unknown parameter 'group_i00000000000000000000' [ 39.957525][ T388] r8152-cfgselector 3-1: Unknown version 0x0000 [ 39.962180][ T36] audit: type=1400 audit(1787619622.230:208): avc: denied { setopt } for pid=621 comm="syz.0.125" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 39.963966][ T388] r8152-cfgselector 3-1: config 0 descriptor?? [ 40.005086][ T36] audit: type=1400 audit(1787619622.280:209): avc: denied { bind } for pid=621 comm="syz.0.125" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 40.041798][ T624] overlayfs: failed to resolve './bus': -2 [ 40.049119][ T626] overlayfs: failed to resolve './bus': -2 [ 40.110920][ T36] audit: type=1400 audit(1787619622.380:210): avc: denied { mount } for pid=632 comm="syz.0.129" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 40.140313][ T36] audit: type=1400 audit(1787619622.410:211): avc: denied { search } for pid=632 comm="syz.0.129" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 40.166802][ T36] audit: type=1400 audit(1787619622.410:212): avc: denied { read write } for pid=632 comm="syz.0.129" name="set_event" dev="tracefs" ino=1049 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=file permissive=1 [ 40.209082][ T36] audit: type=1400 audit(1787619622.410:213): avc: denied { open } for pid=632 comm="syz.0.129" path="/43/trace/set_event" dev="tracefs" ino=1049 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=file permissive=1 [ 40.239491][ T36] audit: type=1400 audit(1787619622.510:214): avc: denied { unmount } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 40.280020][ T36] audit: type=1400 audit(1787619622.550:215): avc: denied { write } for pid=634 comm="syz.1.130" name="ptp0" dev="devtmpfs" ino=196 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 40.280484][ T639] capability: warning: `syz.1.130' uses deprecated v2 capabilities in a way that may be insecure [ 40.327998][ T641] FAULT_INJECTION: forcing a failure. [ 40.327998][ T641] name failslab, interval 1, probability 0, space 0, times 0 [ 40.340800][ T641] CPU: 1 UID: 0 PID: 641 Comm: syz.1.132 Not tainted syzkaller #0 f2f9be0cb5819eb91f3cdfab905957d5e4b40d7b [ 40.340830][ T641] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 40.340844][ T641] Call Trace: [ 40.340851][ T641] [ 40.340859][ T641] __dump_stack+0x21/0x30 [ 40.340894][ T641] dump_stack_lvl+0x140/0x1c0 [ 40.340923][ T641] ? __cfi_dump_stack_lvl+0x10/0x10 [ 40.340953][ T641] ? __kasan_check_write+0x18/0x20 [ 40.340975][ T641] ? proc_fail_nth_write+0x184/0x220 [ 40.341007][ T641] ? __cfi_proc_fail_nth_write+0x10/0x10 [ 40.341039][ T641] dump_stack+0x19/0x20 [ 40.341068][ T641] should_fail_ex+0x3c2/0x510 [ 40.341093][ T641] should_failslab+0xac/0x100 [ 40.341120][ T641] kmem_cache_alloc_noprof+0x42/0x410 [ 40.341142][ T641] ? getname_flags+0xcc/0x6b0 [ 40.341166][ T641] ? __cfi_vfs_write+0x10/0x10 [ 40.341189][ T641] getname_flags+0xcc/0x6b0 [ 40.341213][ T641] getname+0x1b/0x30 [ 40.341243][ T641] do_sys_openat2+0xda/0x1d0 [ 40.341274][ T641] ? fput+0x1a4/0x230 [ 40.341302][ T641] ? do_sys_open+0x100/0x100 [ 40.341332][ T641] ? ksys_write+0x1f3/0x260 [ 40.341354][ T641] ? __cfi_ksys_write+0x10/0x10 [ 40.341378][ T641] __x64_sys_openat+0x13a/0x170 [ 40.341410][ T641] x64_sys_call+0xe69/0x2ee0 [ 40.341430][ T641] do_syscall_64+0x57/0xf0 [ 40.341459][ T641] ? clear_bhb_loop+0x50/0xa0 [ 40.341481][ T641] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 40.341514][ T641] RIP: 0033:0x7f5440f9e0d9 [ 40.341532][ T641] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 40.341549][ T641] RSP: 002b:00007f5441d95028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 40.341572][ T641] RAX: ffffffffffffffda RBX: 00007f5441225fa0 RCX: 00007f5440f9e0d9 [ 40.341588][ T641] RDX: 0000000000000000 RSI: 0000200000000200 RDI: ffffffffffffff9c [ 40.341603][ T641] RBP: 00007f5441d95090 R08: 0000000000000000 R09: 0000000000000000 [ 40.341617][ T641] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 40.341630][ T641] R13: 00007f5441226038 R14: 00007f5441225fa0 R15: 00007ffc129dc738 [ 40.341649][ T641] [ 40.568725][ T31] r8152-cfgselector 3-1: USB disconnect, device number 5 [ 40.591609][ T647] fuse: Unknown parameter 'group_i00000000000000000000' [ 40.683692][ T388] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 40.722886][ T424] rust_binder: 424:424 release transaction 5 in, still active [ 40.788687][ T668] netlink: 72 bytes leftover after parsing attributes in process `syz.2.142'. [ 40.797987][ T668] mmap: syz.2.142 (668): VmData 29114368 exceed data ulimit 1587. Update limits or use boot option ignore_rlimit_data. [ 40.845087][ T388] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 40.856273][ T388] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 40.863800][ T424] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 40.869360][ T388] usb 1-1: New USB device found, idVendor=056a, idProduct=009a, bcdDevice= 0.00 [ 40.885810][ T388] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 40.898424][ T388] usb 1-1: config 0 descriptor?? [ 41.044875][ T424] usb 4-1: config 1 has an invalid descriptor of length 116, skipping remainder of the config [ 41.055343][ T424] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 37, changing to 7 [ 41.066295][ T424] usb 4-1: config 1 interface 2 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 41.080747][ T424] usb 4-1: New USB device found, idVendor=07fd, idProduct=0004, bcdDevice= 0.40 [ 41.089832][ T424] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 41.098078][ T424] usb 4-1: Product: syz [ 41.102260][ T424] usb 4-1: Manufacturer: syz [ 41.106944][ T424] usb 4-1: SerialNumber: syz [ 41.223713][ T10] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 41.312817][ T388] wacom 0003:056A:009A.0004: hidraw0: USB HID v20.00 Joystick [HID 056a:009a] on usb-dummy_hcd.0-1/input0 [ 41.325890][ T654] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 41.335054][ T654] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 41.346659][ T424] usb 4-1: Can't get UAC3 power state for id 10 [ 41.353969][ T424] usb 4-1: BAAD MICROPHONE c_chmask mismatch [ 41.363307][ T424] snd-usb-audio 4-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 41.374411][ T10] usb 3-1: Using ep0 maxpacket: 32 [ 41.380840][ T424] usb 4-1: USB disconnect, device number 7 [ 41.387841][ T10] usb 3-1: config 2 has an invalid interface number: 88 but max is 0 [ 41.397257][ T10] usb 3-1: config 2 has no interface number 0 [ 41.401442][ T464] udevd[464]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 41.404018][ T10] usb 3-1: config 2 interface 88 altsetting 25 bulk endpoint 0x6 has invalid maxpacket 256 [ 41.430156][ T10] usb 3-1: config 2 interface 88 has no altsetting 0 [ 41.439158][ T10] usb 3-1: New USB device found, idVendor=0557, idProduct=2009, bcdDevice=c7.06 [ 41.448324][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=1 [ 41.456455][ T10] usb 3-1: Product: syz [ 41.460675][ T10] usb 3-1: Manufacturer: syz [ 41.465518][ T10] usb 3-1: SerialNumber: syz [ 41.471299][ T677] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 41.509600][ T679] usb 1-1: USB disconnect, device number 5 [ 41.646014][ T689] dummy_hcd dummy_hcd.0: remove, state 1 [ 41.651738][ T689] usb usb1: USB disconnect, device number 1 [ 41.682119][ T677] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 41.692212][ T689] dummy_hcd dummy_hcd.0: stopped [ 41.697263][ T689] dummy_hcd dummy_hcd.0: USB bus 1 deregistered [ 41.697687][ T690] netlink: 'syz.1.150': attribute type 4 has an invalid length. [ 41.714734][ T689] netlink: 'syz.1.150': attribute type 4 has an invalid length. [ 41.725118][ T689] netlink: 'syz.1.150': attribute type 4 has an invalid length. [ 41.769399][ T543] Bluetooth: hci0: Frame reassembly failed (-84) [ 41.877587][ T700] FAULT_INJECTION: forcing a failure. [ 41.877587][ T700] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 41.890713][ T700] CPU: 1 UID: 0 PID: 700 Comm: syz.3.154 Not tainted syzkaller #0 f2f9be0cb5819eb91f3cdfab905957d5e4b40d7b [ 41.890744][ T700] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 41.890757][ T700] Call Trace: [ 41.890765][ T700] [ 41.890772][ T700] __dump_stack+0x21/0x30 [ 41.890804][ T700] dump_stack_lvl+0x140/0x1c0 [ 41.890841][ T700] ? __cfi_dump_stack_lvl+0x10/0x10 [ 41.890872][ T700] ? __sys_recvmsg_sock+0x60/0x60 [ 41.890900][ T700] dump_stack+0x19/0x20 [ 41.890925][ T700] should_fail_ex+0x3c2/0x510 [ 41.890943][ T700] should_fail+0xf/0x20 [ 41.890959][ T700] should_fail_usercopy+0x1e/0x30 [ 41.890994][ T700] _copy_from_user+0x20/0xa0 [ 41.891024][ T700] ___sys_recvmsg+0x174/0x590 [ 41.891055][ T700] ? __sys_recvmsg+0x2a0/0x2a0 [ 41.891074][ T700] ? __cfi_kstrtouint_from_user+0x10/0x10 [ 41.891091][ T700] ? selinux_file_permission+0x318/0xb60 [ 41.891110][ T700] do_recvmmsg+0x36d/0x7f0 [ 41.891167][ T700] ? __sys_recvmmsg+0x2a0/0x2a0 [ 41.891195][ T700] ? __cfi_vfs_write+0x10/0x10 [ 41.891219][ T700] ? fput+0x1a4/0x230 [ 41.891240][ T700] __x64_sys_recvmmsg+0x199/0x250 [ 41.891272][ T700] ? __cfi___x64_sys_recvmmsg+0x10/0x10 [ 41.891302][ T700] ? __kasan_check_read+0x15/0x20 [ 41.891325][ T700] x64_sys_call+0x292c/0x2ee0 [ 41.891349][ T700] do_syscall_64+0x57/0xf0 [ 41.891370][ T700] ? clear_bhb_loop+0x50/0xa0 [ 41.891386][ T700] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 41.891425][ T700] RIP: 0033:0x7f409319e0d9 [ 41.891444][ T700] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 41.891461][ T700] RSP: 002b:00007f40940b9028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 41.891484][ T700] RAX: ffffffffffffffda RBX: 00007f4093425fa0 RCX: 00007f409319e0d9 [ 41.891503][ T700] RDX: 0000000000000007 RSI: 0000200000006480 RDI: 0000000000000003 [ 41.891513][ T700] RBP: 00007f40940b9090 R08: 0000000000000000 R09: 0000000000000000 [ 41.891523][ T700] R10: 0000000000000040 R11: 0000000000000246 R12: 0000000000000002 [ 41.891532][ T700] R13: 00007f4093426038 R14: 00007f4093425fa0 R15: 00007ffd2842c818 [ 41.891545][ T700] [ 42.149241][ T705] FAULT_INJECTION: forcing a failure. [ 42.149241][ T705] name failslab, interval 1, probability 0, space 0, times 0 [ 42.161935][ T705] CPU: 1 UID: 0 PID: 705 Comm: syz.3.156 Not tainted syzkaller #0 f2f9be0cb5819eb91f3cdfab905957d5e4b40d7b [ 42.161968][ T705] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 42.161982][ T705] Call Trace: [ 42.161990][ T705] [ 42.161999][ T705] __dump_stack+0x21/0x30 [ 42.162035][ T705] dump_stack_lvl+0x140/0x1c0 [ 42.162065][ T705] ? __cfi_dump_stack_lvl+0x10/0x10 [ 42.162098][ T705] ? avc_has_perm+0x155/0x240 [ 42.162134][ T705] ? __cfi_avc_has_perm+0x10/0x10 [ 42.162162][ T705] dump_stack+0x19/0x20 [ 42.162190][ T705] should_fail_ex+0x3c2/0x510 [ 42.162220][ T705] should_failslab+0xac/0x100 [ 42.162239][ T705] __kmalloc_cache_noprof+0x41/0x470 [ 42.162256][ T705] ? vhost_task_create+0x12c/0x3f0 [ 42.162291][ T705] ? __cfi_kvm_nx_huge_page_recovery_worker+0x10/0x10 [ 42.162319][ T705] vhost_task_create+0x12c/0x3f0 [ 42.162341][ T705] ? __cfi_kvm_nx_huge_page_recovery_worker_kill+0x10/0x10 [ 42.162371][ T705] ? __cfi_vhost_task_create+0x10/0x10 [ 42.162388][ T705] ? __cfi_vhost_task_fn+0x10/0x10 [ 42.162404][ T705] ? __kasan_check_write+0x18/0x20 [ 42.162433][ T705] ? mutex_lock+0x97/0x1d0 [ 42.162457][ T705] ? __cfi_mutex_lock+0x10/0x10 [ 42.162477][ T705] ? kernel_text_address+0xa9/0xe0 [ 42.162508][ T705] kvm_mmu_post_init_vm+0x161/0x300 [ 42.162550][ T705] kvm_arch_vcpu_ioctl_run+0xf3/0x1bc0 [ 42.162573][ T705] ? _parse_integer_limit+0x195/0x1e0 [ 42.162611][ T705] ? __cfi_kvm_arch_vcpu_ioctl_run+0x10/0x10 [ 42.162641][ T705] ? kstrtoull+0x13b/0x1e0 [ 42.162674][ T705] ? kstrtouint+0x78/0xf0 [ 42.162690][ T705] ? ioctl_has_perm+0x1bc/0x500 [ 42.162706][ T705] ? __asan_memcpy+0x5a/0x80 [ 42.162722][ T705] ? ioctl_has_perm+0x408/0x500 [ 42.162759][ T705] ? has_cap_mac_admin+0xd0/0xd0 [ 42.162781][ T705] ? __kasan_check_write+0x18/0x20 [ 42.162802][ T705] ? mutex_lock_killable+0x97/0x1d0 [ 42.162827][ T705] ? __cfi_mutex_lock_killable+0x10/0x10 [ 42.162843][ T705] ? proc_fail_nth_write+0x184/0x220 [ 42.162868][ T705] kvm_vcpu_ioctl+0xa43/0x1000 [ 42.162904][ T705] ? __cfi_kvm_vcpu_ioctl+0x10/0x10 [ 42.162925][ T705] ? __cfi_vfs_write+0x10/0x10 [ 42.162948][ T705] ? __kasan_check_write+0x18/0x20 [ 42.162987][ T705] ? mutex_unlock+0x90/0x240 [ 42.163009][ T705] ? __cfi_mutex_unlock+0x10/0x10 [ 42.163035][ T705] ? bpf_lsm_file_ioctl+0xd/0x20 [ 42.163064][ T705] ? security_file_ioctl+0x3e/0x110 [ 42.163084][ T705] ? __cfi_kvm_vcpu_ioctl+0x10/0x10 [ 42.163109][ T705] __se_sys_ioctl+0x135/0x1b0 [ 42.163129][ T705] __x64_sys_ioctl+0x7f/0xa0 [ 42.163148][ T705] x64_sys_call+0x1878/0x2ee0 [ 42.163180][ T705] do_syscall_64+0x57/0xf0 [ 42.163210][ T705] ? clear_bhb_loop+0x50/0xa0 [ 42.163232][ T705] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 42.163269][ T705] RIP: 0033:0x7f409319e0d9 [ 42.163282][ T705] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 42.163295][ T705] RSP: 002b:00007f40940b9028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 42.163312][ T705] RAX: ffffffffffffffda RBX: 00007f4093425fa0 RCX: 00007f409319e0d9 [ 42.163344][ T705] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005 [ 42.163357][ T705] RBP: 00007f40940b9090 R08: 0000000000000000 R09: 0000000000000000 [ 42.163370][ T705] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 42.163383][ T705] R13: 00007f4093426038 R14: 00007f4093425fa0 R15: 00007ffd2842c818 [ 42.163407][ T705] [ 42.609169][ T710] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=256 sclass=netlink_route_socket pid=710 comm=syz.3.158 [ 42.898678][ T424] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 42.913276][ T717] netlink: 'syz.0.161': attribute type 49 has an invalid length. [ 42.956501][ T717] team_slave_1: entered promiscuous mode [ 42.962244][ T717] team_slave_1: entered allmulticast mode [ 43.053701][ T424] usb 4-1: Using ep0 maxpacket: 16 [ 43.060023][ T424] usb 4-1: config 0 has an invalid interface number: 34 but max is 0 [ 43.068253][ T424] usb 4-1: config 0 has no interface number 0 [ 43.074423][ T424] usb 4-1: config 0 interface 34 altsetting 0 bulk endpoint 0xA has invalid maxpacket 1023 [ 43.084525][ T424] usb 4-1: config 0 interface 34 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 80 [ 43.095962][ T424] usb 4-1: New USB device found, idVendor=0b95, idProduct=772a, bcdDevice=82.73 [ 43.105683][ T424] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 43.114406][ T677] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 43.122834][ T424] usb 4-1: Product: syz [ 43.130863][ T677] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 43.138700][ T424] usb 4-1: Manufacturer: syz [ 43.143343][ T424] usb 4-1: SerialNumber: syz [ 43.149292][ T10] asix 3-1:2.88 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 43.161923][ T424] usb 4-1: config 0 descriptor?? [ 43.167048][ T10] asix 3-1:2.88 (unnamed net_device) (uninitialized): Error reading PHY_ID register: ffffffb9 [ 43.177444][ T715] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 43.184726][ T715] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 43.191956][ T10] asix 3-1:2.88: probe with driver asix failed with error -71 [ 43.203786][ T10] usb 3-1: USB disconnect, device number 6 [ 43.400982][ T715] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 43.408240][ T715] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 43.531819][ T749] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN PTI [ 43.544492][ T749] KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] [ 43.552922][ T749] CPU: 1 UID: 0 PID: 749 Comm: syz.0.162 Not tainted syzkaller #0 f2f9be0cb5819eb91f3cdfab905957d5e4b40d7b [ 43.564313][ T749] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 43.574395][ T749] RIP: 0010:dummy_udc_start+0xd1/0x1f0 [ 43.579889][ T749] Code: 41 83 ff 03 74 18 41 83 ff 05 0f 85 94 00 00 00 e8 54 c3 cd fd eb 0c e8 4d c3 cd fd eb 05 e8 46 c3 cd fd 4c 89 f0 48 c1 e8 03 <42> 80 3c 20 00 74 08 4c 89 f7 e8 70 9f 26 fe 4d 8b 36 4c 89 f7 e8 [ 43.599531][ T749] RSP: 0018:ffffc9000ef57818 EFLAGS: 00010246 [ 43.605619][ T749] RAX: 0000000000000000 RBX: ffff888104f5e010 RCX: 0000000000080000 [ 43.613607][ T749] RDX: ffffc900015f1000 RSI: 0000000000000925 RDI: 0000000000000926 [ 43.621607][ T749] RBP: ffffc9000ef57840 R08: ffff888137974c00 R09: 0000000000000004 [ 43.629606][ T749] R10: 0000000000000005 R11: 0000000000000002 R12: dffffc0000000000 [ 43.637605][ T749] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000001 [ 43.645603][ T749] FS: 00007ff1a8ee26c0(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 43.654550][ T749] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 43.661339][ T749] CR2: 00007ff1a7f87240 CR3: 0000000120f1a000 CR4: 00000000003526b0 [ 43.669336][ T749] Call Trace: [ 43.672642][ T749] [ 43.675594][ T749] ? __cfi_dummy_udc_start+0x10/0x10 [ 43.680918][ T749] gadget_bind_driver+0x3e4/0x9c0 [ 43.685986][ T749] ? __cfi_gadget_bind_driver+0x10/0x10 [ 43.691569][ T749] really_probe+0x2e1/0x8b0 [ 43.696113][ T749] __driver_probe_device+0x193/0x280 [ 43.701475][ T749] driver_probe_device+0x54/0x3f0 [ 43.706530][ T749] __driver_attach+0x422/0x5e0 [ 43.711332][ T749] bus_for_each_dev+0x249/0x2d0 [ 43.715880][ T751] netlink: 'syz.2.163': attribute type 49 has an invalid length. [ 43.716291][ T749] ? __cfi___driver_attach+0x10/0x10 [ 43.729324][ T749] ? __cfi_bus_for_each_dev+0x10/0x10 [ 43.734753][ T749] ? __kasan_kmalloc+0x96/0xb0 [ 43.739557][ T749] ? _raw_spin_unlock+0x45/0x60 [ 43.744455][ T749] ? klist_add_tail+0x1dd/0x220 [ 43.749336][ T749] driver_attach+0x46/0x50 [ 43.753805][ T749] bus_add_driver+0x393/0x730 [ 43.758511][ T749] driver_register+0x2b7/0x3c0 [ 43.763284][ T749] usb_gadget_register_driver_owner+0xfc/0x270 [ 43.769470][ T749] raw_ioctl+0x144c/0x37a0 [ 43.773923][ T749] ? __cfi_raw_ioctl+0x10/0x10 [ 43.778717][ T749] ? selinux_file_ioctl+0x732/0x1480 [ 43.784033][ T749] ? __cfi_selinux_file_ioctl+0x10/0x10 [ 43.789609][ T749] ? bpf_lsm_file_ioctl+0xd/0x20 [ 43.794576][ T749] ? security_file_ioctl+0x3e/0x110 [ 43.799795][ T749] ? __cfi_raw_ioctl+0x10/0x10 [ 43.804591][ T749] __se_sys_ioctl+0x135/0x1b0 [ 43.809300][ T749] __x64_sys_ioctl+0x7f/0xa0 [ 43.813930][ T749] x64_sys_call+0x1878/0x2ee0 [ 43.818630][ T749] do_syscall_64+0x57/0xf0 [ 43.823095][ T749] ? clear_bhb_loop+0x50/0xa0 [ 43.823881][ T54] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 43.827831][ T749] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 43.827876][ T749] RIP: 0033:0x7ff1a7f9dd6b [ 43.844263][ T749] Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00 [ 43.863899][ T749] RSP: 002b:00007ff1a8edff00 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 43.872353][ T749] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00007ff1a7f9dd6b [ 43.880339][ T749] RDX: 0000000000000000 RSI: 0000000000005501 RDI: 0000000000000004 [ 43.888324][ T749] RBP: 00007ff1a8ee0fd0 R08: 0000000000000001 R09: 00000000ffffffff [ 43.896313][ T749] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 43.904306][ T749] R13: 0000200000000040 R14: 0000000000000001 R15: 0000000000000000 [ 43.912297][ T749] [ 43.915413][ T749] Modules linked in: [ 43.919645][ T749] ---[ end trace 0000000000000000 ]--- [ 43.923211][ T424] asix 4-1:0.34 (unnamed net_device) (uninitialized): invalid hw address, using random [ 43.931077][ T749] RIP: 0010:dummy_udc_start+0xd1/0x1f0 [ 43.940341][ T749] Code: 41 83 ff 03 74 18 41 83 ff 05 0f 85 94 00 00 00 e8 54 c3 cd fd eb 0c e8 4d c3 cd fd eb 05 e8 46 c3 cd fd 4c 89 f0 48 c1 e8 03 <42> 80 3c 20 00 74 08 4c 89 f7 e8 70 9f 26 fe 4d 8b 36 4c 89 f7 e8 [ 43.962906][ T749] RSP: 0018:ffffc9000ef57818 EFLAGS: 00010246 [ 43.969087][ T749] RAX: 0000000000000000 RBX: ffff888104f5e010 RCX: 0000000000080000 [ 43.977417][ T749] RDX: ffffc900015f1000 RSI: 0000000000000925 RDI: 0000000000000926 [ 43.985663][ T749] RBP: ffffc9000ef57840 R08: ffff888137974c00 R09: 0000000000000004 [ 43.994170][ T749] R10: 0000000000000005 R11: 0000000000000002 R12: dffffc0000000000 [ 44.002195][ T749] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000001 [ 44.010654][ T749] FS: 00007ff1a8ee26c0(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 44.019766][ T749] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 44.028434][ T749] CR2: 00007f5441227dac CR3: 0000000120f1a000 CR4: 00000000003526b0 [ 44.036646][ T749] Kernel panic - not syncing: Fatal exception [ 44.043315][ T749] Kernel Offset: disabled [ 44.047686][ T749] Rebooting in 86400 seconds..