last executing test programs: 961.369172ms ago: executing program 1 (id=2): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CAP_VM_MOVE_ENC_CONTEXT_FROM(r1, 0x4068aea3, &(0x7f0000000080)={0xce, 0x0, r1}) (async) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID2(r2, 0x4008ae90, &(0x7f0000000040)={0x1, 0x0, [{0x1, 0x0, 0x0, 0x0, 0x0, 0x20}]}) (async) ioctl$KVM_SET_NESTED_STATE(r2, 0x4080aebf, &(0x7f0000000180)=@vmx={0x100, 0x0, 0x2080, {0xdddd1000, 0xffffffff00000000}, {"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006e1c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000009000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ef000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f9a09b09000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200"}}) syz_usb_connect$cdc_ncm(0x5, 0x6e, &(0x7f0000000100)=ANY=[@ANYBLOB="12010000060000402505a1a440000102030109025c0002010000000901000100020d0000052406000105240000000d240f0100000000000000000006241a0000000905810300020000000904010000020d00000904010120ee0e"], 0x0) 960.742462ms ago: executing program 3 (id=4): r0 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup.cpu/memory.force_empty\x00', 0x2, 0x4) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x17) (async, rerun: 32) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) (async, rerun: 32) write(r0, &(0x7f0000000400)='0', 0x1) 940.545424ms ago: executing program 2 (id=3): unshare(0x22020600) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='mountinfo\x00') pipe(&(0x7f0000000040)={0xffffffffffffffff}) vmsplice(r1, &(0x7f0000000080)=[{&(0x7f0000000140)="c3", 0x1}], 0x1, 0x0) writev(r0, &(0x7f0000003580)=[{&(0x7f0000000280)="8e638eb1a7f9d7f18bd453554dbd35cacc60eafd4068283672e32df28c60fa65efe68227ad421e15d35841d5470268e5d2fb94e9958c4d9700020cb1237c2f0516d5e352b44fca658f1b97a75b5c840df5f8fbdde856af419ffe08b01cfd792c1e4b16b9f7e91e6dd567dab4279d0a3b3a80fd89e2531f4a68e3ba09532f0ee07786403289b09530f86dc1f24daa71f4ad23e0474aff7acaaedf2a658342a057cd6b", 0xa2}, {&(0x7f0000000340)="9ea66427c3876f98588d7d64b65b381b7c7bce96e63da4e1a0948868d4953f1ddf7ad14c0ce1cd07c4efdb5565b854b30fbc737183413c6aaf968d31be20332eff33938f0ee8969eebe5c26717e8cf380e197900b2aa81bc38b9e5cd2206bdcf27b141c25af3315351e8849f45100df9aaa94119c1d434fe5065e593f52fb9b39f6122a9b66b87869a7ace0497bbfa4958e4b5366dec90f92d12db266c054e11278c6c879f634445037589dba3558fc36a735c5bb3285d04db935e1b937038ec5618caec8bcd1993f63690da35f8d1188be074effc72f34689ece0e000c84b27a888c49c8391c16f0b14a64da8912791f24429fce8ede6770e95780aa6290811521bb2d353469c36b1e8bb961b7669c295f836aa6385f1d253184424266a58478d4e43fb89408255bffacb48d4ae5a171cc3de94fe7cc0f85777d34c0f66fb290811593f5cc6cc978ed6f51cd04d9b0d124bec60167f6217c6c028c14c4db5ffdd4f1ed56147e130f4c50bb5df72173bcc86eb4435c003e45b90f9c480cf74464b68fa38f5735e6c32a1e1d4ab6bbcef36b22433534a01274351ce2690a1e3dcdab247c4981f1981368d2c9d9dd155bd2d260283e285471f1da603ed6954fc889b5bfe31ae09761b39a560bf0691b0a1148c8bae1a7e59798e5c25775d5da61437a1b3cc31d1baf6ae6ebedb75ea5ed8754089c6a935b53d9f102a7c30fb46765c58d445938f4842fc1c8b710584125fc193bbb0db04629aafdd0707acd56d52e103ce9e8418ac8edd8e53c521b04dab66d8b626b69293b163a071528907380aac4dbc4c55f0c96a694b25f62c56b0faa3d2bf386ac2490e37e5a360060afc3ab37772afe88517bba54425de1d8569327aabe60413062882c57c2ddf4a1e8ff7b59ed2f72503c7c7d436e65e7dd5838303bfda7d7a32de0e02c0d2a0f4de9abc23c941331be9e9ec0d05b8e60f5fdaf1f654b2f96f19dc523a1b5b4ea35aa07c6e6ee95c7714d99808a14548fd764ea731dc74c006e307c6801f3955efc044500236354119a104f3f45d60bd3257a6fff8edd821b9c1cae8088a952ae0c3fb8565e2c7282aee7ab8b229eccdd1c0beb0eab9b4886df19424d65b381fe23e7068778c80477ef59858d040b83c007eeef93356f3ca11785f357abe6f538e6cd7f6332b753ab877029fc509ed19e4b0982a4fd549a4393c68d700e255cb203568031655a5137e07f9fbf7f37bbfd66fcd9233ea21d535d9586bd4ea694b4975ccf680bea76f44955be87c90c5028ea536abba9332d174e5fb1e3fa783f5c578fe8b955cfe374446c96ce4f7dca2ed90ecad070f2958b27d01b0ac35c60533c45eb741142a1440514ad01746d13ac1bb956d0359b31e1d7af934290166c51871bd99102c146a34644f396761f3e4c1abaf7a022769898b1bc94845c284f05f153481b140b17040d3420076352732fc358129ac6765a9ae710d975eb6165522cd495a0ce9eb6291e40ccdca371b3eb092e084f5033a9ac5d76f27b5f5b8159aa793269ae722249bcb6e0ea43999e43dec454d36bcf21e6f6db5a2aff0851e152a27f583241add34827e64f38c535b5032942996d2068117e1a1a9d9fffa289544c2af950188a6eee26836f927af8afc962033cf37e55e02d847be88eee24f09c6b0e2f976df88c13d50656a649db04c7673a15e559569f98d5501518758e3adeacaa0247abf12deca39a7f4d214e48a9cf6d96327193e1a69d40f4c45251c5950b24a0bd551d821e442cd6b0f60e39a9bf5c058eaaa8e9d127252f93901e7c35c67d344445b85727507d74dfea8935039062ad6643921891c257d1cd184cb8d9db2ef9895c4dcbe870a1539a4ff14cc70747b3781aaf14698aa8cec038c0afef5e3e2bb2b44543cc9cb638415b3ea6d41a68b137208dce566b3779839647aa83972aa2ffde51d0cea2668cb9cbd57ded3db12ae38ac88cfc8a655c02cab3599c09b0cb516198477af3a71e9913cfaa7833df50588cc991f4d18e3f4697b3df7d38c545f44719dd605770dc87608c600a2f1ffb8421b19c42a155147c030bde5b4798af704691470f3894cf4cd462f537b7cfd8a4650f4eb37350d915e1d5d59579377970a975ed47551509f1247b3c18ffc6dde3ea6c6be1d038174ee04265b99278b1d5721eed5667e5649d6dcef78af096fe26e9d0d027425b40c1404dc57aef0473e01787a73d3ec3cc3ed0c4587220bb5494bb4e256b7bb33179f691785890a84a74cecdf5696d212eedfe84eb5ae70e60a25b4d06f06111126080612ffa1c258cbc5e349af286629acc06b61b029621e1294a7948e1a82851ee1f1df25272ee7fb999a3e6cdb95708cdb6a5cc87a45910ff0b1de5ce6d6ef67a2a7d6a13aaad8dd28ad67648e5bbc1d8e4eb92a3c21c3105163e00a8ba727fd4e941df128987524d3204f9b438e09dd9b1b80f079de105cfd8680f6119c624ceff6db73152b12ff12ed3ed6546e2f3441e819f47a8a62ae7c689a361b34da3f8261517a7172f5e3bdc668030f826ee6119e519ccf3a85e1b3c01b7c2a67d0dea2b98ad9424f2ee9a2807cd83b1b198621f88e794e88536f583f93e447e33981e90a6695396d178b9b24d5c698842642778204b37b49636f51db89f2c8e8cc4cf0c7acab1d81b42b65aa274576dd5f0fcf9b564b06cc99bd05e66c65d4a583fb318bf8fe6319fbb4d771651b992fbb291df5be5099a26569a68ae1d61768827419e56952ac5c01bc5344eea827495b041a8c151748c6bd4be50493cd1805f3f58109f6f29ce750c1f66e70cb31f373c3bba573f1cc3a46add05cef1742984f3589d0b5418c8594277582fd30308286f488ea9e5fb10b309bcbac0c8bee376298af7ee0ed81cee9a71f1a3ea0ad28fc50474861f46b712a38ffd78b921960c92e16cf83061659328a4ac8310e05775c9e24d10c065640d97539966cb40e48ad78a47f52e60cc5205e07b614083698834bc99dccf592a64b553262e2f2ca1af915479dde9ddb0766ba9140b0ef711f32a229e0405bb58d6423c872ad9c6a2bea7313abf3053c4e0a9b36805940521169700776121b0a18634668b9c81dd7cc465b93357b475a1e4ab25585e077a92957625d679b18c29266267123b3f4b93870640b2d8cb6daa191822e2fb4bb3442b2b361e2b92055bbfae5688afd8a4db61254b59bca9b1fb436e0480ec8cbadb2252aa0e6992f861d9484d954dee4071fea289b5e8cd80989e8594832109ae6ab54f1e668a91d0e44df3b0a0025ca48d5264ae5643a898ce095fd584e72cf21223e654997c0fde427b63010cabe42ab68c34c94ff452231683fec62776dc0223d7dee60be73cc706e749dc6a1ec303c10d705ac1a173e68878a091c9a65f27539000bb3983aaed861e81a7badbcda5741fdd45cb3ba83abe37606a3454be8b784b20b6ca224428d90bd62dbc965a0248c93527b6e0c4c8821a4ff6a3e8060a1fe0ebede98e9f691bd8e9b8dde77a95f7676472a0912b89977bdcbd199692ad119483f0061799382745e97699a948861b73de33f5ae11d39506fd257cea596ba09e0304a73eb643d851ddc6b29e5e0332f273e0f0938458c87dae8c8c7fc062d622404b4b076d59fc7d4ce5edb0029a0daa0d5fadd5b45055f05d6aa7acb56bebb98e1f0585507c3d38d665a4866b4687057c835ffd84c82784e2bb20efbeec5315c4b36335ff62e62030a986e035bf784d62d6d41acf59b5a1693b705419a5839611e4e0e0f82af92bf89e0a72d7e533f6717da379e51070aeb32e2adbbc152b4e022a669b910c38458b09c0ff9593164fc568bbe883008adeec519efd19b38a7d75cef47639ef2d477d6614d304b7b9a13555cbc36c4fdf8781fdc3dcde8c992189f276a65c745fd9a863e7e35d355bb8c5ceaf366b5e18d0f9518c2dbe79aca28455a5276eb369d96d88b1feb7d6300647366c5ba4683873773614ca18f0a8a9285a6aa21fbd7f2ae4b0c7cbbb63f9dc62f3241675076304a02fd1296356b528e02b8b4fdb100ff456e60a704190dd0104e7cbaf375bbfab3d675221313678d9af7aecf2e5e6917fd278091f2020eaf59f7aac20b688017bb4c3da909e9074c76bd96165eba397a962094dcd0896f7f83468388979b63459018d853764fa191a4b1ae9a348278bd3bfcfda0ef672915007522ec8beb780371ba270acf1b97af525d15fe8af99f7c4bb566051f0eab10ac84770785cc267dde9371c73fa6847ba5c7ee966a0e25e612f4cd9818252ac7677553e2ed10abbc033dcc8a67ed5807c7f9fe0e36f4459ff0ea5e7d63ff732d1da3b3669efe0cda9c01160c808d7b72bf430c4fbc4b031123c451d9f6010580d2bc8eb863bb7295be7fe575a68ccf87dcc690abd4eac4d5c8b39d929bf8eda936ce5d99d1370170d19c3c063ebf23ed015ac1671f31fad9d61eff5a0347438fcbaa01e714bae643ffc6ee7c97206432b40ea82097aa3055e51a273ed2a9c4a822709af25c631a3f51409b60338e450860749fd88f5b6ef1abea613e07dec0f85ad9b086e7b7fbc6e9ed0af88eb598866136a881e2ba4d7c0e09292a66c7a06eddc09ec1f32654b51002bba8a078470d2efb92868a345ee606be3a9e4692e5ec9280fe8ce772191118f4a1895a6ad90ae90ddf0df2b195036ca04dc5e39951545e52b7873f3ea2346409d930189ca74b8a0dea170591d383b0fe4e4758fb288ec81bff4214ba437c3100021fc2bf931e20fa27f480a9b80d1cfdfe1a49fc485ce3c7baf760b678d36ae076797a36c315ee9020d38407d498495dbb2883a2c0886167207bada2b9324c386ba0e90dd2d514715522e3ecad948f0c42aa32d6be2b62e6500f700edb7a57e32dbe743efc52aada2498a35c625fadb1e8a079405f5556dc2f924d4b5521c7210d75526f6c5bf009a8dfe550cff9ee697efdfa9c64f17e0bf9b4ea63d108c84cb332146d14162b73d6fc7c2da1ead6a4df8b3210f7cb53b2832921ed7aefffdf12b1eee724899d411b330f6030540d159491f08480da800cf96bf86bb406be94aa1de17a49a4b273514280dfbbede9cb0ff93ec4ac53cf01146fe32b0eb11621c58eeddc76ce56b6b26a513aa05670fe981b44ed86fa9373dc14042c66bc4be8876507a1040f55e2d6f1eba65568bec85dda78ee63e0b9a2f7bfd291e27199606a3bb6ff147fcb6db7ddc7b1b4ddf79e1261a1ef8ea592a32ab9dd56816c147482e936025e9af2f39124fa35e3a42ef576c8b661e733210774f6cfa4cd34fbeab7265f9d2e61b018444ec448252c40c77b11bd96fe3705f1f0bd9acc94cebfdce6161d5fcf1900262b915f1ab8b622f08b86dcd9153686c665325f966cf22a7204121a7719573ff28a138590df26da601d1990aee07f624ec702eb0b261942180d2346880ae111288ddc2545e7c310e7bf10e581e8266450344468d595cbefa573af7186d1db4f61889ea44211157051c00c21d2c9094f54429add6a4bb94a1288f3861ef870087380cec69930d25c98ad6bff59f662610d69162f8ddbba7298f976761f39ededa3b9fd50a514936fe8a7c236de8ddc9bcbb0cc980b2de6ddfabdd420350dae9fb997ab6396639d6a128fcbe57f5e4262aceaf2db72084d84a46ef0ff7a77d5c441dbf8fda43d1792b7133bc91f258fc9d093f2f17d7b7265ab68651e8f6b12a95b13d4a9486123db028618eddb8a31ff50369b9f3a95109a50aeffc4d82cbf11ab5f098fc2f61aa312127e5279cc70346e85d85fdab2a747", 0x1000}, {&(0x7f0000001340)="89fc09d0880b2ead53ba041483c11508c0ab7a88ec0bdc7840f64db00fc31ad47df99814993b4db1720abf6c6fce30a5bf6952258dd38ba98b1f3210f58203aef4465c674a6a8851fa0dbf59cedfa3787706f9787c02de783a7a9fee6707b68ee648fea8d6b250eaf5ea7ac586819138", 0x70}, {&(0x7f00000013c0)="08ef01139d285f572bb53577959fadade3934e35010638619ee5751502c2a72fa1217cce9bd7c952ae86f278966dea57b325389d625a3078bb00ad8ae016d777fdf2c93add9ef0fd80ae5ba3a55a7210770d0a54ad34feb5d414f12a2bb575985decbd1a4c767c259100"/115, 0x73}, {&(0x7f0000001440)="83dec30510186561ab0c4dc785a12fad5df7f2045b39711b80db7d8879bd49218407f26ec3f9920687340ec179c9c879e889c4f169d833678fc47aaf179c3b93f8ad70a09a49f6ad92301fdbff6dad47dffce9de74e04a1dd8c1911818e6103a6b450c71129c935dd4c5bfb5116d735c21270271dc02ea0082e70aa00ade03bd223db0d626179b10cf6e63f90bf7b8bf8bb56a6af93103be0cffc26a779fb8e03a75c77d7542986868b6fc38d5e8136c52f2acb06d689b20ba183814a24a9434079caf47335d77f0644df0c18e4ecd64", 0xd0}, {&(0x7f0000002580)="5f0f58f507185048d431b851529e7386bf1fbf29a8c8ba3abbad4d4667d18c386ccd4c2e3f615bd4b74c7f77878dc91f872728d23d798ed8290f8350a3d9d06367740018dfd881d08ea27e9fd3eb748aa9179702914010a44d1c6baec79cf66c9ed6281722729add6ad54d7311da0c64c77882c50ef2c1c4cbe5b33c76280947c04e9a0ecfd95241ca3a08fd703df99ffcf0f233c4ea49f6009df145eaec128df44783259066a44ecbe4bfc02e6136aac387e5c3957b0ad4157d831ffa0bd24d74f1fa9595a9e3089f46bc6ac37ff725389a9ff16c10328c96f5212bd7124b6a4a802436dfc4cf0066c127e3202cabc08b54e5e0a21932953af21a850fd4f603b6fdc243bfef0c23a3117944b8de3971cff14893197a203f49e8cfe1b1aaca28bb37b55ed655ac4d88f1af537fc87072ad81cf0ed56f037d5086e85741da3c4f12ffbe96bccc2db311c7e61d817ea0e745e65bdf7a3a09f98c8f50087feac2ec879ce0d2e030300d25fc770f54220e06e4abe07dc457704fb17ec6779ec650a4c1b3369c11856ee655401683bf55eb0f58d9b4fbb9db271ac76c69b65a6730fdfb35620db39f67d16fbee712caf2de8150eeda89adc47566c794ac39a8b72528139bba4c535af6baebb2b91618a77c72e7bde7a827c5c8be070df30449bf69d59919e5bdca2ea24aa57d055b961c1fbc7de614810aa4838512d3358404472e1d9d8e3ee6628924d3a019f6d8a74d84cc2acd99d3132d53062f9bca39cf6d48a36b00f406a0183d8bb6e9a0af1c2672479dfed01dc78c51e52371041ca6717421df161df0c8eea7171f9b1a1c5ede8983837077affa09bdee4260944a916ccb00f79edc62f7cb82dd2b45e1a3a7f270810b46c5889a9a6aecbb7242dee1e15a7ad430d920df202b289c31f64e0568e6d8cbea857415a05d97f6d991ba5d90b8538359f194d33aabb6bd450c3da1cff2d9159238f34ec444b5eddb6daeaec05e7d587805fcfb47a1df3c1407bd14b41ceca19561c93e151ec1a09eee2f3f21ef3dc182cbb7827a0693f9100a6342425f65c68b4daaa71324a3e896c2f047a9a91404000ca4e8aff24e69d19463e53bf2f2a58251d4616c5d39502338f0e4799af8bd25622e7cf635f24cec058db8c693813e0bf16117d2a5d381d81577c26790bcc8c234afe2968db8a74a55254851320075c5f6bf0afb84e20a3a2029f154e13f8146b4369e072d60ffbca44c29cbde9af13f32f5dd180bccc6fa26924d711b2cb9c0a59bde47e8f3dd6bc6c2a7515308fca43faf8fe29d7cae8488382941b7f8d88a81414042546f5eddf61238fe78fe3adf386ccedc3338450d4e8c2763bb7975f56518247fd169b164eac2d1bdc7422939f6ca536c96535e038ca6846459dea0d732724eadfc7402b622ae852a304717767d8593a995ceff63c765cb72405a9b2999004a0ee49461cfa88de2262afa02de89b9685d16bae3160b3d1b0b63058e5fcfa52f572749ec093a509760ec82b6a5cd8af344b53dff40f04f4c229c2c9b24c8bb90ba1c4a518633ab94e1240ea3dd443e54661c9f8cdccf5a6d776fcf8fb4ab59492ece24fb0012c77675210c0d1a19c763f20d5cfccaf574ba726f499ae646d20e1ba4c2b666aa42b8bfb9b92a89de6d282f2d0b64e2876c331c72331e1a95079e37fabc17c8a1e616b2c53a694f397b4bfd3196cff327877f03ff6f9d1642303851ba5f7d27b0f57f98e5c6c03a7e00b38e6b8ddbf443cba32b389b730359d5eb7f9433845451920e6a3d24c9254c4813ac45f24d9370803f3d7eb4a0090a51c03e5f52130ca06834bd4b55edd41de8c58ec3d16fcf7e574d41a4837208da85000a3c52cfead41ff137f8049bef280dba4e19c7e8db397971879ead04825d5005fad8ae4e09a43292ab8762b8e8ce6fceb45d05e013777a553ef6280eaf822cee47b585712040b5955f691452e1890dc6a7681e4833f0f641116edf31704895bd99e45a480257ae3a4df3ad558c485da4b4ef259acbde6caa497b827b5e38c104b5e8d456b908d0bd651de8f815d99f02221904f638f2923bf8f246811d85d782785e3153743f50535d9ef1aecf0c2048431e8059a3b9fe679ac49e8766d65c479b8249f8a1b6ea1df633343fb2b3e9b788fb43b70c8d7ad4c66315ae4a678c8a671ba4cf44a5a97fb73cb893d876d82df477a5606298c8ccef37c14b53ed416796f7753659914f141483cdbc69d32ef1975d9b555b9158844b1698dccd6276bbb6c21b7e0b89bea4a2ceb5238107f0f99ac8d811156f6fa4d206238b52e9187eb348bfd489a15aa18038f8069869ea890401989b7c5e5cc0f965f8732186b865edf15528828488572d942485fffb3cda73d6e49a3951a4d0d77a8fd11d48d817c1fe40accd77734ecf571e5fbf9d8d28205474b0251475472d35ac9da46f23ced1461404090069075d0400609ae4e8c990d55afb48e8fac2c2a739d7f4a11b3bec05d4e703e671bd2153ee2866d3ff8c74a6e62c800dea079029524ed4ba5120b245130c58f3a32d9901cc64e8c5b289bcfeeb97f7cc24ac7e26d9cfd609ae2ae853f4cc10581760b2b6f7fcca53a0cfd324d3697925347b4cb0f6d1153ebeae86cbe2f0a7ee9fc2c26fdfbd2815762300a910afee8bc9fc22576ebe2dd2c72f59ecdce4b27ea32df028f4f8a83aaea64284b78f53e0ee9b4503ab01e11d6af5c657d0836f9c5093b8fe00e89c2f40067eb4d93061fcf60ff5db98a7e24f0037b32224ee3f6ce350583a3278a08d178d75c6df542348ccb244f766cee1ec8bd4dda6c695f1daa9d4b141878d26b135ca37ef8f48f4ff417b763d3670a930a281aeea1e5d53f72348b670fcc5205246cf2b129f9fc56f91bb39a4cf4c6027d7b47548fca03450cb50247922682874bd743ab63b4bfeea2f9b1fdf82e9eabf482ae7ed515fd7471f824b6fd5a9dcf652f24869ac98860ebfb124513e5ed3279a3c511d1d752064422bae81f0a984fff646aaca82ee7d22c26526d71e2924b5a0dd3ea4795454980a8039dbea47340600bca6ff4c3e7c7b4b9364b17347e5eaa2459eb7bb1120a3f5031f12bf14d4100f025361ad2c15c8219baa51dbce4b13eaf6c99a32e4ba20a099ddaaff1aafd2499aff8b333a5dae11b6577cc68561b80bcad6359b69f57ee94deb3dfefe37cc7590d6764143f44d9ba239a9b5a913df1722bb8c1812cd7d576f0f9bc3366ce50b1558928557aef8c8fac245421a0df86a07ce6bbe6d1739be601358048feaed4ff709eaf922b4aa97f885d016c6d74b438ebb4fba444b68f28da020401cced389d9ff42e89948d10ae2298446ca4af7313ef71c50b07ff7cce1051379a431d2b40fe3384a9d820a6cd25400d0c563d61fa88bbdd6dbe2204f5b66f23c06efd73e5cdb2a3c7020794488a713aac050e331e90f9acc5d9694dbfd4a5cae3e9a86b9766971203436541e41b416e4d55393be96cd3551541ab48be30b890e03e3c136eba0d9492170831cc3f04c692ded7702a387db6fe6b800dc01de4c746ebf105f4e4f8ec4ef49e41a2e50963fe01ca2c23ce8a7fab1df44e054a03a9252d853e695d695bd7a0ec38c4c4aa842a5866c1cbe377d80c4c392492034f5bde2a72486e0ceadbfe1b5e4eb02587927e57b75c22d9ed080eafc5e7e483a0d5d3d780c167a7e4a97af448de369cad691ea4d705538c41d9f3c916b1ac0522649671c91c75c5097bc162010b30685d45fd9cc09872958dfd97fee4e5a904b7769f839204a5a5ec709d5c611bb6f3be8dc26c6380126492c8914b83ffb8ff87cbc87b7a3d57953bb32526c5646004e88ba816535c20b9387e640997980ccc2a4bf68d449da68605023ce76dd1ab1bb29b233b9849e7590192e9eb97a04559eda949d34ee33a8a3d41aec61039441b352935a596255fd050a9fe4923ee839410fab13f02ca4159d95d30f7a01df8ba57b08dd65c34aaf300979779aaf5c69f74ac3f178d0071c496bb7dd73d449a09dfa7a1f9bb3ef5c156a17b5609f31d64057785eb2f00698a3e01374379701b8f2f0b7711d8f2fd107965c652c9cfcf3048d0dfdcf5886adca49754e345965dc0694405760869995c80f05d44fde70c65e8a6349c71c01911351018e298547e061623d40447caf05a9190c553db99f5c8f7c05aafa5011016932c6d2e5c22125143f47077ee8e1cc96a36bb14a39384b13c72dec531944a544dd24694b054bd5cd9369233ff4f26626372c06efc63881a3f830a10af8e17a9fcc8a4e17fe03ab68499be58065d842426f31b0803d01de9d61902ee012d8bf6f263fd639b0809c5026e5fea7afc3714aefe9eec305e5ea14b47fec9e9caeeb89792ae9fbb6734cb66177b1697a738ef8b95270de50d628ec12693a30fa013eebda59609a7ace816d7f379501742cef3f9e91f3b818eca2f284428fc503250666c4106b28b9e9479b46339369ec17be2b4b0e38e17d7a9ad2c477e87ce667674388f0bbb83be1c940856fdebf894a9f61943bfeeca8ce82eebfa0b64d5bf72d5040c951e2212269332066521b4f89d51f086e573d0083744b5da663984645326453ba8bc2fe3fbd1f73a1faf5db439d851e5c12b8a596974c368ca3448a4e512d2f0cf318aa36746a7f1ef7da0c1f2ba729e0428e138efb2824d0528856de2bfd75c29e07c73e506758e3f564a31e6c475666d84fb97d4340108fb948811724c26ebd60ccdeb6a014c7e839703d113e04b717e464ff0b12274afeab9f9c23176312a6b4747391897a806cc29c86f707488abfeb9f82b31091199328c2a589ca8413ad0cf497a3911efa62a85310b2550fe03baa1b8522e0915e38ac637109602ae229820d2a1e17944de4129b6b437cd15a3d515aea112120b9e422cfc622ee7f75087396ee60c172a530bd457c2cfec4ada6f6eddf1426f7401e36aaa1fd531f9457a3b0a3dc89098bb506ea31db0d416927096933c49d4882bd6917f66c57ee87ac8698ff86f7f98977d01ff38ff76b3a844aacb707c6f06f2a1948eb0e885d6dfbc605b038a23a702b4f3b6a2375cf69270dd73f1252179544360fa94863496cbfb2de9b8e4bd6aa33cead3be73e5bee74ac27045f5a984569f33152b8b00b8e062ee268ab745cc32f7f1078de668794c327f275522feb0baf4dd57546672d8761f99b201e043677183ad78617d4b96e027111da82b7469ee7014401fb3ccf3aca37618fd2d941090fa127d700011a7c5208d2e3520b29fe87140c9da92e572abbd7cb296c7ea0574fe597fcb6618c1168c08b82905346b535f5c06b8293c2d419ceafd626af6d2ad48723c160289f2ecd38202b3daf4d807431ec51991e953225e0444bfc0523b8617df36195ceeb2a85992e678174b69940c42b1620e038348b676bcf213ae757c14568d1c12d91ccc539c688258300e0d3c495809c87c889f5ea0b16fd31c6b9903a125246ce81a67f77577432db82624d7858fb8c156e68e18d575d79c9dab73d43ff507d5fdaecd195427064d4982c16b7d5efa3dcdb4932cbee30c5ba87ce0113f0f4e18dbd9460b1b319635f14c53060bceeaada4277cfce4fc77b967f2ed7573e5640fff4e61e2f366ca1fa2340b4af3d4aee6314c131c67b636dcd8c96c0249a04a4f2b916165a5a7f39fd97347f128b21c63a74391d5d582f14ae4ea85d880573c09274fe7f3454d2b7b80ea6d638f92c228a0ac8b0da623f42d2fc3193109c2fce6a79d3837fca566c1cbf08da3044154f1543f39e1c878f29f419e756", 0x1000}], 0x6) r2 = socket$netlink(0x10, 0x3, 0x4) r3 = socket(0xa, 0x2400000001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r3, 0x29, 0x2a, &(0x7f00000022c0)={0x3, {{0xa, 0x4e23, 0x3, @mcast2, 0x10000000}}}, 0x88) setsockopt$inet6_MCAST_JOIN_GROUP(r3, 0x29, 0x2a, &(0x7f0000002380)={0x3, {{0xa, 0x0, 0x1, @mcast1}}}, 0x88) r4 = socket(0x10, 0x3, 0x0) setsockopt$sock_int(r4, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x2) ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x2) setsockopt$inet6_group_source_req(r3, 0x29, 0x2e, &(0x7f0000002440)={0x1, {{0xa, 0x4e24, 0xfffffffc, @mcast2, 0x5}}, {{0xa, 0x4e21, 0x8b5f, @private1={0xfc, 0x1, '\x00', 0x1}, 0x800}}}, 0x108) writev(r2, &(0x7f0000000000)=[{&(0x7f0000000200)="58000000140019234083060900008c5602117436c379000000000000000058000b4824ca945f0325010ebc000001000000008000f0fffeffe809005300fff5dd000000100001000b0c1000000022a441045c609436af378d51cf114e220e0000", 0x60}], 0x1) 928.905965ms ago: executing program 0 (id=1): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae03, 0x26) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f00000002c0)={0x1, &(0x7f0000000300)=[{0x6, 0x0, 0x0, 0x7fff0006}]}) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./dev_mnt\x00', 0x1ff) socket$packet(0x11, 0x3, 0x300) mount(0x0, &(0x7f00000001c0)='./dev_mnt\x00', &(0x7f0000000200)='devtmpfs\x00', 0x0, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)={0x48, 0x41, 0x107, 0xfffffffe, 0xfffffffe, {0x1, 0x7c}, [@nested={0x4, 0x142}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x6, 0x6, 0x0, 0x0, @str='\x80\n'}]}, @nested={0xfffffff6, 0x2, 0x0, 0x1, [@nested={0x1f, 0x14, 0x0, 0x1, [@generic="1e0013ac58eccc52a6179d4896ee29a9355bf31e841904efec71a5"]}]}]}, 0x48}, 0x1, 0x0, 0x0, 0x4048011}, 0x4000000) r2 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000240)=ANY=[@ANYBLOB="12010000000000407d1e5a2d00000000000109022400010000000009040000010301020009210000000122220009058103"], 0x0) syz_usb_control_io$hid(r2, 0x0, 0x0) r3 = openat$kvm(0x0, &(0x7f0000000140), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = syz_kvm_setup_syzos_vm$x86(r4, &(0x7f0000c00000/0x400000)=nil) syz_kvm_add_vcpu$x86(r5, &(0x7f0000000340)={0x0, &(0x7f0000002480)=[@enable_nested={0x12c, 0x18}, @nested_create_vm={0x12d, 0x18}, @nested_vmlaunch={0x12f, 0x18}], 0x48}) syz_usb_control_io$hid(r2, &(0x7f0000000280)={0x24, 0x0, 0x0, &(0x7f0000000380)={0x0, 0x22, 0x22, {[@global=@item_012={0x2, 0x1, 0x9, "2313"}, @global=@item_012={0x2, 0x1, 0x0, "e53f"}, @global=@item_4={0x3, 0x1, 0x0, '\f\x00'}, @local=@item_012={0x2, 0x2, 0x2, "9000"}, @global=@item_4={0x3, 0x1, 0x0, "0900be00"}, @main=@item_4={0x3, 0x0, 0x8}, @local=@item_4={0x3, 0x2, 0x0, "09007a15"}, @local=@item_4={0x3, 0x2, 0x0, "5d8c3dda"}]}}, 0x0}, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev_mnt/roccatsavu0\x00', 0x2, 0x0) close_range(r1, 0xffffffffffffffff, 0x0) 845.339914ms ago: executing program 3 (id=5): r0 = syz_kvm_setup_syzos_vm$x86(0xffffffffffffffff, &(0x7f0000c00000/0x400000)=nil) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) syz_kvm_setup_syzos_vm$x86(r2, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu$x86(r0, &(0x7f00000000c0)={0x0, &(0x7f0000000100)=[@code={0xa, 0x50, {"48c7c00000000148c7000000000048c740080000000048c740100000000048c740180100000048c740200100000048c7c11300020048c7c2000000010f01c1"}}], 0x50}) ioctl$KVM_SET_CPUID2(r3, 0x4008ae90, &(0x7f0000000180)) ioctl$KVM_RUN(r3, 0xae80, 0x0) 777.571271ms ago: executing program 3 (id=6): ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x83) mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) write(r0, &(0x7f00000003c0)='dum', 0x3) 762.739042ms ago: executing program 3 (id=7): r0 = socket$inet6(0xa, 0x800000000000002, 0x0) setsockopt$inet6_mtu(r0, 0x29, 0x17, &(0x7f0000000440), 0x4) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) sendmmsg$inet(r1, &(0x7f0000000040)=[{{0x0, 0xfffffffffffffda1, 0x0}}], 0x40001b6, 0xf5) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) close(0x3) sendto$inet6(r0, 0x0, 0x0, 0x400ad80, &(0x7f0000000480)={0xa, 0x4621, 0x0, @local}, 0x1c) 701.399099ms ago: executing program 3 (id=8): r0 = syz_usb_connect(0x5, 0x36, &(0x7f0000000280)=ANY=[@ANYBLOB="12010000772904202404019957c2010203010902240001000010000904430002317d5500090502"], 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000680)={0x44, &(0x7f0000000400)={0x0, 0x15, 0x4, "06f18e2e"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 51.067415ms ago: executing program 2 (id=9): r0 = syz_open_dev$usbfs(&(0x7f00000007c0), 0x75, 0x109301) ioctl$USBDEVFS_SUBMITURB(r0, 0x802c550a, &(0x7f0000000800)=@urb_type_control={0x2, {0x0, 0x1}, 0x6, 0xe1, &(0x7f0000000840)={0x0, 0x3, 0xf801, 0x224}, 0x8, 0x1, 0x10000007, 0x0, 0x7, 0x7fffffff, 0x0}) r1 = socket$nl_route(0x10, 0x3, 0x0) sendto(r1, &(0x7f0000000280)="300000002400050400000000000000000000000004000000000000fffff1ffffff000000000b000100636c7369637400", 0x30, 0x0, 0x0, 0xb) sendto(r1, &(0x7f00000002c0)="6c0000002c0005040000ea0000000000000000000100000000000000f2ffffff78476f4f0d6ed37ff28ec959e6030000000a000100626173690000003c0002003800020008000100010000002c000200280001000000050000006b6d7000"/107, 0x6c, 0x0, 0x0, 0x3e) r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/power/pm_test', 0x3e9802, 0x139) ioctl$BTRFS_IOC_QGROUP_ASSIGN(0xffffffffffffffff, 0x40189429, &(0x7f0000000400)={0x1, 0xff, 0xc1c}) r3 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000480), 0x800000) ioctl$SNDRV_TIMER_IOCTL_GINFO(r3, 0xc0f85403, &(0x7f0000000bc0)={{0xffffffffffffffff, 0x3, 0x5, 0x1, 0xe}, 0x6, 0x9, 'id1\x00', 'timer1\x00', 0x0, 0x7, 0x9, 0x1, 0xd09}) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./proc\x00', 0x1ff) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) getsockopt$bt_BT_FLUSHABLE(r5, 0x112, 0x8, &(0x7f00000009c0)=0x3ff, &(0x7f0000000a00)=0x4) mount(0x0, &(0x7f0000000140)='./proc\x00', &(0x7f0000000180)='proc\x00', 0x0, 0x0) r6 = openat$dm_control(0xffffffffffffff9c, &(0x7f0000000540), 0x883, 0x0) ioctl$DM_DEV_CREATE(r6, 0xc138fd03, &(0x7f0000000680)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, {'syz', 0x0, '1\x00'}}}) r7 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc/sys/net/ipv6/conf/syz_tun/addr_gen_mode\x00', 0x1, 0x0) r8 = socket$nl_generic(0x10, 0x3, 0x10) mknodat$loop(r7, &(0x7f0000000980)='./proc/sys/net/ipv6/conf/syz_tun/addr_gen_mode\x00', 0x4, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f00000004c0), r7) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000500)={'wlan0\x00'}) r9 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000a80), r2) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r8, &(0x7f0000000b80)={&(0x7f0000000a40)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000b40)={&(0x7f0000000880)=ANY=[@ANYBLOB="30b49fe4c3fd32a754fb43a071860a754e57249053f2a52aa07fa454e0b14f5a64245af21e59d0e3d8add1f4358b7e94131db7e0866d44b6a390c1b4d3c715c17e100cd8d214941424", @ANYRES16=r9, @ANYBLOB="00022dbd7000fcdbdf250600000014000180060005004e210000060001000a00000008000200080000001c0006800500020000000000060001000a0000000800060003000000"], 0x4c}, 0x1, 0x0, 0x0, 0x4}, 0x0) sendmsg$NL80211_CMD_GET_MESH_CONFIG(r8, &(0x7f00000005c0)={&(0x7f0000000600)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000580)={&(0x7f0000000600)=ANY=[], 0x28}}, 0x20004048) write$rnull_attr(r7, &(0x7f0000000200)='1', 0x1) fsconfig$FSCONFIG_SET_PATH(r7, 0x3, &(0x7f0000000080)='fscrypt:', &(0x7f00000000c0)='./file1\x00', r2) pivot_root(&(0x7f0000000340)='./proc/sys/net/ipv6/conf/syz_tun/addr_gen_mode\x00', &(0x7f0000000380)='./proc\x00') write$P9_RXATTRWALK(0xffffffffffffffff, &(0x7f0000000240)={0xf, 0x1f, 0x1, 0x100000001}, 0xf) keyctl$search(0xa, 0x0, &(0x7f00000003c0)='pkcs7_test\x00', &(0x7f0000000000)={'syz', 0x1}, 0x0) 0s ago: executing program 2 (id=10): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140), 0x482, 0x0) ioctl$TCSETS(r0, 0x5402, &(0x7f0000000180)={0x3, 0xd, 0x0, 0xffdffffc, 0x6, "00001000"}) write$binfmt_aout(r0, &(0x7f00000001c0)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000200)={0x0, 0x400, 0x2, 0x2, 0x7f, "00000000000000000000ffff00000000000002"}) r1 = syz_open_pts(r0, 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000240)={{0x10b, 0xff, 0xb, 0x24b, 0x375, 0x2, 0x338}, "1e7438e5f33fc15fce07a60dc3f5bd32b4f3541fc2bb6c570bd0983d37784b4e137b5e8046224fb9c46055a041f017ec51", ['\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00']}, 0xa51) r2 = dup3(r1, r0, 0x0) read$FUSE(r2, 0x0, 0x0) r3 = gettid() timer_create(0x0, &(0x7f0000000000)={0x0, 0x21, 0x800000000004, @tid=r3}, &(0x7f0000000040)) timer_create(0x0, 0x0, 0x0) r4 = getpid() syz_pidfd_open(r4, 0x0) syz_pidfd_open(r4, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x40002000, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000ec0), 0x40, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = eventfd2(0x6, 0x80800) ioctl$KVM_HYPERV_EVENTFD(r6, 0x4018aebd, &(0x7f0000000f00)={0x1, r7}) ioctl$KVM_HYPERV_EVENTFD(r6, 0x4018aebd, &(0x7f0000000f40)={0x400002, 0xffffffffffffffff, 0x1}) mount(0x0, &(0x7f00000001c0)='./dev\x00', &(0x7f0000000cc0)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000d00)='./mnt\x00', 0x1ff) mount(&(0x7f0000000d40)=@filename='./dev/sda1\x00', &(0x7f0000000d80)='./mnt\x00', &(0x7f0000000dc0)='ext4\x00', 0x8410, 0x0) setxattr$security_selinux(&(0x7f0000000e00)='./mnt\x00', &(0x7f0000000e40), &(0x7f0000000e80)='system_u:object_r:inetd_exec_t:s0\x00', 0x7d, 0x2) timer_create(0x7, &(0x7f0000000080)={0x0, 0x4, 0x0, @tid=r3}, &(0x7f00000000c0)) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.234' (ED25519) to the list of known hosts. [ 24.078091][ T36] audit: type=1400 audit(1793824600.990:64): avc: denied { mounton } for pid=287 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 24.101217][ T36] audit: type=1400 audit(1793824601.020:65): avc: denied { mount } for pid=287 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 24.104092][ T287] cgroup: Unknown subsys name 'net' [ 24.129135][ T36] audit: type=1400 audit(1793824601.040:66): avc: denied { unmount } for pid=287 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 24.129657][ T287] cgroup: Unknown subsys name 'devices' [ 24.276712][ T287] cgroup: Unknown subsys name 'hugetlb' [ 24.282365][ T287] cgroup: Unknown subsys name 'rlimit' [ 24.438053][ T36] audit: type=1400 audit(1793824601.350:67): avc: denied { setattr } for pid=287 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 24.461329][ T36] audit: type=1400 audit(1793824601.350:68): avc: denied { mounton } for pid=287 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 24.486240][ T36] audit: type=1400 audit(1793824601.350:69): avc: denied { mount } for pid=287 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 24.555281][ T289] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 24.564123][ T36] audit: type=1400 audit(1793824601.470:70): avc: denied { relabelto } for pid=289 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" Setting up swapspace version 1, size = 127995904 bytes [ 24.589648][ T36] audit: type=1400 audit(1793824601.470:71): avc: denied { write } for pid=289 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 24.616060][ T36] audit: type=1400 audit(1793824601.530:72): avc: denied { read } for pid=287 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 24.617383][ T287] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 24.641787][ T36] audit: type=1400 audit(1793824601.530:73): avc: denied { open } for pid=287 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 25.430993][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.438165][ T294] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.445926][ T294] bridge_slave_0: entered allmulticast mode [ 25.454558][ T294] bridge_slave_0: entered promiscuous mode [ 25.468949][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.476047][ T294] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.483166][ T294] bridge_slave_1: entered allmulticast mode [ 25.489555][ T294] bridge_slave_1: entered promiscuous mode [ 25.635627][ T298] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.642826][ T298] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.649981][ T298] bridge_slave_0: entered allmulticast mode [ 25.656255][ T298] bridge_slave_0: entered promiscuous mode [ 25.663004][ T298] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.670092][ T298] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.677213][ T298] bridge_slave_1: entered allmulticast mode [ 25.683422][ T298] bridge_slave_1: entered promiscuous mode [ 25.701664][ T300] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.708887][ T300] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.715998][ T300] bridge_slave_0: entered allmulticast mode [ 25.722225][ T300] bridge_slave_0: entered promiscuous mode [ 25.728564][ T299] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.735702][ T299] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.742785][ T299] bridge_slave_0: entered allmulticast mode [ 25.749117][ T299] bridge_slave_0: entered promiscuous mode [ 25.758189][ T299] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.765370][ T299] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.772831][ T299] bridge_slave_1: entered allmulticast mode [ 25.779192][ T299] bridge_slave_1: entered promiscuous mode [ 25.788794][ T300] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.796058][ T300] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.803129][ T300] bridge_slave_1: entered allmulticast mode [ 25.809895][ T300] bridge_slave_1: entered promiscuous mode [ 25.858130][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.865255][ T294] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.872595][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.879720][ T294] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.977422][ T298] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.984540][ T298] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.991841][ T298] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.998915][ T298] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.015155][ T299] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.022241][ T299] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.029551][ T299] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.036606][ T299] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.046799][ T300] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.053868][ T300] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.061193][ T300] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.068263][ T300] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.092432][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.100005][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.107720][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.115700][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.122974][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.130323][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.137712][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.145057][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.160399][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.167486][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.193568][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.200675][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.222072][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.229172][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.236899][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.243955][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.256246][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.263396][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.271060][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.278127][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.298466][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.305591][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.313169][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.320260][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.362660][ T294] veth0_vlan: entered promiscuous mode [ 26.381452][ T298] veth0_vlan: entered promiscuous mode [ 26.400855][ T294] veth1_macvtap: entered promiscuous mode [ 26.408919][ T299] veth0_vlan: entered promiscuous mode [ 26.426286][ T298] veth1_macvtap: entered promiscuous mode [ 26.444832][ T300] veth0_vlan: entered promiscuous mode [ 26.459887][ T299] veth1_macvtap: entered promiscuous mode [ 26.482621][ T300] veth1_macvtap: entered promiscuous mode [ 26.499777][ T294] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 26.560948][ T316] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 26.834672][ T31] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 26.874641][ T45] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 26.985884][ T31] usb 2-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 26.994650][ T9] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 27.002261][ T31] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 27.012755][ T31] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 27.021946][ T31] usb 2-1: config 1 has no interface number 0 [ 27.028203][ T31] usb 2-1: too many endpoints for config 1 interface 1 altsetting 1: 32, using maximum allowed: 30 [ 27.039031][ T31] usb 2-1: config 1 interface 1 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 32 [ 27.052957][ T45] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 27.064440][ T45] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 27.074352][ T45] usb 1-1: New USB device found, idVendor=1e7d, idProduct=2d5a, bcdDevice= 0.00 [ 27.083545][ T45] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 27.091683][ T31] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 27.101119][ T31] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 27.109663][ T31] usb 2-1: Product: syz [ 27.114123][ T45] usb 1-1: config 0 descriptor?? [ 27.119243][ T31] usb 2-1: Manufacturer: syz [ 27.123947][ T31] usb 2-1: SerialNumber: syz [ 27.154643][ T9] usb 4-1: Using ep0 maxpacket: 32 [ 27.161066][ T9] usb 4-1: config 0 has an invalid interface number: 67 but max is 0 [ 27.169434][ T9] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 27.179814][ T9] usb 4-1: config 0 has no interface number 0 [ 27.185965][ T9] usb 4-1: config 0 interface 67 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 27.195866][ T9] usb 4-1: config 0 interface 67 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 27.210203][ T9] usb 4-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 27.220090][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 27.228277][ T9] usb 4-1: Product: syz [ 27.232469][ T9] usb 4-1: Manufacturer: syz [ 27.237345][ T9] usb 4-1: SerialNumber: syz [ 27.243011][ T9] usb 4-1: config 0 descriptor?? [ 27.249048][ T9] smsc95xx v2.0.0 [ 27.252756][ T9] smsc95xx 4-1:0.67 (unnamed net_device) (uninitialized): usbnet_get_endpoints failed: -22 [ 27.263117][ T9] smsc95xx 4-1:0.67: probe with driver smsc95xx failed with error -22 [ 27.333766][ T31] cdc_mbim 2-1:1.1: probe with driver cdc_mbim failed with error -71 [ 27.344292][ T31] usb 2-1: USB disconnect, device number 2 [ 27.439429][ T338] netlink: 12 bytes leftover after parsing attributes in process `syz.2.9'. [ 27.451564][ T338] netlink: 72 bytes leftover after parsing attributes in process `syz.2.9'. [ 27.546098][ T343] SELinux: Context system_u:object_r:inetd_exec_t:s0 is not valid (left unmapped). [ 27.558075][ T45] savu 0003:1E7D:2D5A.0001: hidraw0: USB HID v0.00 Device [HID 1e7d:2d5a] on usb-dummy_hcd.0-1/input0 [ 27.835721][ T10] usb 1-1: USB disconnect, device number 2 [ 27.844908][ T10] ================================================================== [ 27.853031][ T10] BUG: KASAN: slab-use-after-free in roccat_disconnect+0x236/0x240 [ 27.860961][ T10] Read of size 4 at addr ffff88810ebb7c08 by task kworker/0:1/10 [ 27.868686][ T10] [ 27.871026][ T10] CPU: 0 UID: 0 PID: 10 Comm: kworker/0:1 Not tainted syzkaller #0 6d6f333215c564de92c741644a4b57c848379815 [ 27.871056][ T10] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 27.871068][ T10] Workqueue: usb_hub_wq hub_event [ 27.871102][ T10] Call Trace: [ 27.871108][ T10] [ 27.871115][ T10] __dump_stack+0x21/0x30 [ 27.871133][ T10] dump_stack_lvl+0x140/0x1c0 [ 27.871149][ T10] ? __cfi_dump_stack_lvl+0x10/0x10 [ 27.871166][ T10] print_address_description+0x71/0x210 [ 27.871183][ T10] print_report+0x4a/0x70 [ 27.871197][ T10] kasan_report+0x162/0x1a0 [ 27.871217][ T10] ? roccat_disconnect+0x236/0x240 [ 27.871244][ T10] ? roccat_disconnect+0x236/0x240 [ 27.871269][ T10] __asan_report_load4_noabort+0x18/0x20 [ 27.871293][ T10] roccat_disconnect+0x236/0x240 [ 27.871319][ T10] savu_remove+0xf0/0x170 [ 27.871336][ T10] ? __cfi_savu_remove+0x10/0x10 [ 27.871355][ T10] hid_device_remove+0x293/0x400 [ 27.871379][ T10] ? __cfi_hid_device_remove+0x10/0x10 [ 27.871403][ T10] device_release_driver_internal+0x4ad/0x830 [ 27.871427][ T10] device_release_driver+0x1d/0x30 [ 27.871448][ T10] bus_remove_device+0x34f/0x370 [ 27.871465][ T10] device_del+0x583/0xcf0 [ 27.871484][ T10] ? __cfi__raw_spin_lock_irq+0x10/0x10 [ 27.871503][ T10] ? __pm_runtime_resume+0xa0/0xa0 [ 27.871519][ T10] ? __cfi_device_del+0x10/0x10 [ 27.871539][ T10] ? __kasan_check_write+0x18/0x20 [ 27.871565][ T10] ? _raw_spin_lock_irq+0x93/0x120 [ 27.871582][ T10] ? __cfi__raw_spin_lock_irq+0x10/0x10 [ 27.871600][ T10] hid_destroy_device+0x6e/0x110 [ 27.871625][ T10] usbhid_disconnect+0xa3/0xc0 [ 27.871647][ T10] usb_unbind_interface+0x2b0/0xa40 [ 27.871669][ T10] ? __cfi_usb_unbind_interface+0x10/0x10 [ 27.871689][ T10] device_release_driver_internal+0x525/0x830 [ 27.871712][ T10] device_release_driver+0x1d/0x30 [ 27.871733][ T10] bus_remove_device+0x34f/0x370 [ 27.871749][ T10] device_del+0x583/0xcf0 [ 27.871769][ T10] ? kfree_const+0x3d/0x50 [ 27.871815][ T10] ? __cfi_device_release+0x10/0x10 [ 27.871852][ T10] ? __cfi_device_del+0x10/0x10 [ 27.871879][ T10] ? kobject_put+0x238/0x2a0 [ 27.871896][ T10] ? device_unregister+0x2b/0x40 [ 27.871916][ T10] usb_disable_device+0x3af/0x770 [ 27.871937][ T10] usb_disconnect+0x331/0x950 [ 27.871954][ T10] hub_event+0x1ad5/0x4360 [ 27.871973][ T10] ? hub_event+0x1170/0x4360 [ 27.871999][ T10] ? __cfi_hub_event+0x10/0x10 [ 27.872019][ T10] ? kick_pool+0xb9/0x540 [ 27.872047][ T10] process_scheduled_works+0x7f7/0x1060 [ 27.872072][ T10] worker_thread+0xc99/0x13f0 [ 27.872093][ T10] ? __cfi_set_cpus_allowed_ptr+0x10/0x10 [ 27.872116][ T10] ? __kasan_check_read+0x15/0x20 [ 27.872141][ T10] kthread+0x2c7/0x360 [ 27.872163][ T10] ? __cfi_worker_thread+0x10/0x10 [ 27.872183][ T10] ? __cfi_kthread+0x10/0x10 [ 27.872205][ T10] ret_from_fork+0x64/0xa0 [ 27.872222][ T10] ? __cfi_kthread+0x10/0x10 [ 27.872244][ T10] ret_from_fork_asm+0x1a/0x30 [ 27.872264][ T10] [ 27.872270][ T10] [ 28.172207][ T10] Allocated by task 45: [ 28.176390][ T10] kasan_save_track+0x3e/0x80 [ 28.181132][ T10] kasan_save_alloc_info+0x3a/0x50 [ 28.186253][ T10] __kasan_kmalloc+0x96/0xb0 [ 28.190845][ T10] __kmalloc_cache_noprof+0x23c/0x470 [ 28.196224][ T10] roccat_connect+0x6a/0x540 [ 28.200856][ T10] savu_probe+0x1a7/0x3f0 [ 28.205201][ T10] hid_device_probe+0x2c8/0x690 [ 28.210090][ T10] really_probe+0x2e1/0x8b0 [ 28.214639][ T10] __driver_probe_device+0x193/0x280 [ 28.219961][ T10] driver_probe_device+0x54/0x3f0 [ 28.225019][ T10] __device_attach_driver+0x2f1/0x4b0 [ 28.230416][ T10] bus_for_each_drv+0x264/0x300 [ 28.235299][ T10] __device_attach+0x2c4/0x3c0 [ 28.240123][ T10] device_initial_probe+0x1e/0x30 [ 28.245198][ T10] bus_probe_device+0x18b/0x270 [ 28.250176][ T10] device_add+0x7fd/0xbf0 [ 28.254528][ T10] hid_add_device+0x3c4/0x5a0 [ 28.259270][ T10] usbhid_probe+0xdca/0x1310 [ 28.263926][ T10] usb_probe_interface+0x6a8/0xbf0 [ 28.269097][ T10] really_probe+0x2e1/0x8b0 [ 28.273625][ T10] __driver_probe_device+0x193/0x280 [ 28.279020][ T10] driver_probe_device+0x54/0x3f0 [ 28.284080][ T10] __device_attach_driver+0x2f1/0x4b0 [ 28.289468][ T10] bus_for_each_drv+0x264/0x300 [ 28.294326][ T10] __device_attach+0x2c4/0x3c0 [ 28.299134][ T10] device_initial_probe+0x1e/0x30 [ 28.304173][ T10] bus_probe_device+0x18b/0x270 [ 28.309033][ T10] device_add+0x7fd/0xbf0 [ 28.313380][ T10] usb_set_configuration+0x1aad/0x2080 [ 28.318854][ T10] usb_generic_driver_probe+0x95/0x160 [ 28.324340][ T10] usb_probe_device+0x1f2/0x3b0 [ 28.329505][ T10] really_probe+0x2e1/0x8b0 [ 28.334057][ T10] __driver_probe_device+0x193/0x280 [ 28.339457][ T10] driver_probe_device+0x54/0x3f0 [ 28.344554][ T10] __device_attach_driver+0x2f1/0x4b0 [ 28.349976][ T10] bus_for_each_drv+0x264/0x300 [ 28.354856][ T10] __device_attach+0x2c4/0x3c0 [ 28.359636][ T10] device_initial_probe+0x1e/0x30 [ 28.364672][ T10] bus_probe_device+0x18b/0x270 [ 28.369591][ T10] device_add+0x7fd/0xbf0 [ 28.373965][ T10] usb_new_device+0x98d/0x1500 [ 28.378770][ T10] hub_event+0x2dbd/0x4360 [ 28.383251][ T10] process_scheduled_works+0x7f7/0x1060 [ 28.388839][ T10] worker_thread+0xc99/0x13f0 [ 28.393547][ T10] kthread+0x2c7/0x360 [ 28.397648][ T10] ret_from_fork+0x64/0xa0 [ 28.402071][ T10] ret_from_fork_asm+0x1a/0x30 [ 28.406837][ T10] [ 28.409163][ T10] Freed by task 319: [ 28.413055][ T10] kasan_save_track+0x3e/0x80 [ 28.417743][ T10] kasan_save_free_info+0x44/0x50 [ 28.422779][ T10] __kasan_slab_free+0x5f/0x80 [ 28.427561][ T10] kfree+0x158/0x440 [ 28.431485][ T10] roccat_release+0x2c3/0x390 [ 28.436175][ T10] __fput+0x20b/0xa30 [ 28.440210][ T10] ____fput+0x20/0x30 [ 28.444225][ T10] task_work_run+0x1e8/0x260 [ 28.448833][ T10] resume_user_mode_work+0x35/0x50 [ 28.453955][ T10] syscall_exit_to_user_mode+0x63/0xb0 [ 28.459467][ T10] do_syscall_64+0x63/0xf0 [ 28.463933][ T10] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 28.469838][ T10] [ 28.472162][ T10] The buggy address belongs to the object at ffff88810ebb7c00 [ 28.472162][ T10] which belongs to the cache kmalloc-512 of size 512 [ 28.486246][ T10] The buggy address is located 8 bytes inside of [ 28.486246][ T10] freed 512-byte region [ffff88810ebb7c00, ffff88810ebb7e00) [ 28.499916][ T10] [ 28.502277][ T10] The buggy address belongs to the physical page: [ 28.508700][ T10] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10ebb4 [ 28.517568][ T10] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 28.526087][ T10] anon flags: 0x4000000000000040(head|zone=1) [ 28.532187][ T10] page_type: f5(slab) [ 28.536210][ T10] raw: 4000000000000040 ffff888100041c80 ffffea000439d000 0000000000000003 [ 28.544810][ T10] raw: 0000000000000000 0000000000100010 00000001f5000000 0000000000000000 [ 28.553509][ T10] head: 4000000000000040 ffff888100041c80 ffffea000439d000 0000000000000003 [ 28.562190][ T10] head: 0000000000000000 0000000000100010 00000001f5000000 0000000000000000 [ 28.570899][ T10] head: 4000000000000002 ffffea00043aed01 ffffffffffffffff 0000000000000000 [ 28.579613][ T10] head: 0000000000000004 0000000000000000 00000000ffffffff 0000000000000000 [ 28.588286][ T10] page dumped because: kasan: bad access detected [ 28.594737][ T10] page_owner tracks the page as allocated [ 28.600469][ T10] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 114, tgid 114 (udevd), ts 6119721842, free_ts 0 [ 28.620127][ T10] post_alloc_hook+0x37d/0x3b0 [ 28.624918][ T10] prep_new_page+0x2d/0x180 [ 28.629468][ T10] get_page_from_freelist+0x4aea/0x4ba0 [ 28.635027][ T10] __alloc_pages_noprof+0x35a/0x7e0 [ 28.640324][ T10] alloc_slab_page+0x6b/0x1e0 [ 28.645017][ T10] allocate_slab+0x69/0x430 [ 28.649546][ T10] ___slab_alloc+0x591/0x8c0 [ 28.654141][ T10] __kmalloc_node_track_caller_noprof+0x2e3/0x4f0 [ 28.660565][ T10] kmalloc_reserve+0x144/0x4f0 [ 28.665339][ T10] __alloc_skb+0x13f/0x360 [ 28.669762][ T10] alloc_skb_with_frags+0xd0/0x8b0 [ 28.674877][ T10] sock_alloc_send_pskb+0x883/0x9a0 [ 28.680106][ T10] unix_dgram_sendmsg+0x63a/0x1a90 [ 28.685227][ T10] sock_write_iter+0x445/0x490 [ 28.689991][ T10] vfs_write+0x765/0xfd0 [ 28.694241][ T10] ksys_write+0x145/0x260 [ 28.698582][ T10] page_owner free stack trace missing [ 28.703948][ T10] [ 28.706272][ T10] Memory state around the buggy address: [ 28.711912][ T10] ffff88810ebb7b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 28.720004][ T10] ffff88810ebb7b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 28.728067][ T10] >ffff88810ebb7c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 28.736125][ T10] ^ [ 28.740453][ T10] ffff88810ebb7c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 28.748512][ T10] ffff88810ebb7d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 28.756570][ T10] ================================================================== [ 28.768835][ T10] Disabling lock debugging due to kernel taint [ 29.755246][ T10] usb 4-1: USB disconnect, device number 2