last executing test programs: 3.615334031s ago: executing program 1 (id=14): syz_usb_connect$midi(0x0, 0x3e, &(0x7f0000000000)=ANY=[@ANYBLOB="120110010000004035120e0040000102031d09022c0001010500f809040000020103000809050403ff0303000204250100090503034000050100042501005c3561"], 0x0) 2.523660468s ago: executing program 2 (id=17): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000200)={0x2, 0x4e20, @multicast2}, 0x10) connect$inet(r0, &(0x7f00000001c0)={0x2, 0x4e20, @loopback}, 0x10) write$cgroup_subtree(r0, &(0x7f0000000040)={[{0x2d, 'cpuset'}]}, 0x8) sendmsg$inet(r0, &(0x7f00000015c0)={0x0, 0x32, &(0x7f0000000080)=[{&(0x7f0000000240)=' ', 0x1}], 0x1}, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0xc, &(0x7f0000000000)=0xa, 0x4) 2.473007899s ago: executing program 2 (id=18): close(0xffffffffffffffff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x41, 0x0) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000002900)={0x9, 0xc, 0xfff5, 0x3, 0xa}) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x41, 0x4, 0x5, 0x1b, "b0bf2ebb48c849ac4000"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) read$FUSE(r2, &(0x7f00000008c0)={0x2020}, 0x2020) r3 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd/3\x00') ioctl$FS_IOC_ADD_ENCRYPTION_KEY(r3, 0x541b, 0x0) 2.334625263s ago: executing program 1 (id=22): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000004200)=ANY=[@ANYBLOB="12010000e2793b10d1050120000701020301090212000100001a000904"], 0x0) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, 0x0) r1 = syz_usb_connect(0x3, 0xc7, &(0x7f0000000000)=ANY=[@ANYBLOB="12011002000000408680d20a0000010200010902b5000201008030080b00020e03000009040000010e0100000d2401000134000000000001011224020101020000000000000000030000000924030201010003000c24050301000002000000000705810310000609040100000e0200000e240101470082000200000001001b240401015955593200001000800000aa00389b711001000000001e24050100a000780000c0e00000c0e0000096000015160500011516050009"], &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r1, 0x0, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000600)={'pim6reg1\x00', @link_local}) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r4 = openat$cgroup_procs(r3, &(0x7f00000003c0)='tasks\x00', 0x2, 0x0) write$cgroup_pid(r4, &(0x7f00000002c0), 0x12) sendfile(r4, r4, 0x0, 0x10001) syz_usb_control_io$rtl8150(r1, 0x0, 0x0) syz_usb_control_io$lan78xx(r1, &(0x7f0000000080)={0x14, &(0x7f0000000000)={0x40, 0x6, 0x6, {0x6, 0x4, "a7c39f4e"}}, &(0x7f0000000040)={0x0, 0x3, 0x39, @string={0x39, 0x3, "8609458043258eef311b8e1bcdb864e743f2fa06674f844e9664e8d66a3b4fae0a57d07d38ce03c8688d9d66f51e1956721f1cdb4bd67a"}}}, &(0x7f0000000280)={0x34, &(0x7f00000000c0)={0x20, 0x15, 0x57, "8dd4f94fb729e7eb7d77c42e68c813e9f0375b3b5ee2a03071efb34dfcea3ce64fcce3eb7c67e6468f20d1991f3b1a40e9b752e05cfbaba80e84170f8728433d0ac40f0191f95248fda72f89fa0f3b5d406cb1978faf58"}, &(0x7f0000000140)={0x0, 0xa, 0x1, 0x6}, &(0x7f0000000180)={0x0, 0x8, 0x1, 0x6}, &(0x7f00000001c0)={0xc0, 0xa1, 0x4, 0x8d}, &(0x7f0000000200)={0x40, 0xa0, 0x4, 0x7}, &(0x7f0000000240)={0xc0, 0xa2, 0x2f, "5dbfe56d988a62ba42e788a839f443ef8e90037e3beb71942c5fccef39d3f201c6a327d9a1c365d9fc062c9529e465"}}) syz_usb_control_io(r0, 0x0, 0x0) 1.606595241s ago: executing program 2 (id=40): openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x8041, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000240)='attr/prev\x00') r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') mount$9p_fd(0x0, &(0x7f0000000300)='.\x00', &(0x7f0000000180), 0x2204490, &(0x7f0000000280)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r0}}) 1.505047773s ago: executing program 2 (id=42): syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000180)='ns/pid_for_children\x00') r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f00000000c0), 0x80900, 0x0) ioctl$TCSBRKP(r0, 0x5425, 0x0) ioctl$TIOCGICOUNT(r0, 0x5409, 0x0) 1.503279853s ago: executing program 0 (id=43): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x40a00, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4138ae84, &(0x7f00000004c0)=@x86={0x7b, 0x40, 0x27, 0x0, 0x2, 0x5, 0x4, 0x7f, 0x8, 0x9, 0x2, 0x7, 0x0, 0x96a7, 0x8, 0x6, 0x27, 0xfa, 0x3, '\x00', 0x8, 0x5}) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x2000, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r4, 0xae60) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r5, 0x4400ae8f, &(0x7f0000000140)=@arm64={0x10, 0x2, 0xb6, '\x00', 0x3}) ioctl$KVM_RUN(r5, 0xae80, 0x0) 1.354085697s ago: executing program 0 (id=44): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x203, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000c27000/0x18000)=nil, &(0x7f0000000140)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_SET_GUEST_DEBUG_x86(r2, 0x4048ae9b, &(0x7f00000000c0)={0x100003, 0x0, {[0x10400001, 0x100000000, 0x1, 0x6, 0x6, 0x0, 0x7, 0xfffffffffffffffe]}}) 1.258946299s ago: executing program 0 (id=48): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x8000, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_SET_GUEST_DEBUG_x86(r2, 0x4048ae9b, &(0x7f0000000240)={0xc0003, 0x0, {[0x9, 0x64ac, 0xfffffffffffffffd, 0xffffffffffffffff, 0x9, 0x80000000000006, 0x6, 0x1]}}) 1.258824849s ago: executing program 3 (id=49): r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r0, 0xaf01, 0x0) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x1, 0x0, 0x0, &(0x7f0000001600)=""/78, 0x0}) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000001680)) r1 = eventfd2(0x1, 0x80001) ioctl$VHOST_SET_VRING_ERR(r0, 0x4008af22, &(0x7f00000001c0)={0x0, r1}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000240)={0x0, 0x0, 0x0, &(0x7f0000001d00)=""/176, 0x0, 0xffff1000}) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r2 = signalfd4(0xffffffffffffffff, 0x0, 0x0, 0x80800) socket$nl_route(0x10, 0x3, 0x0) ioctl$NS_GET_USERNS(r2, 0x8004b709, 0x0) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f00000000c0)=0x1) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000000140)={@my=0x1}) r3 = socket$vsock_stream(0x28, 0x1, 0x0) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, 0x0) connect$vsock_stream(r3, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x1}, 0x10) 1.222313039s ago: executing program 0 (id=50): r0 = socket(0x10, 0x3, 0x0) bind$netlink(r0, &(0x7f0000177ff4)={0x10, 0x0, 0x1}, 0xc) write(r0, &(0x7f0000000140)="2600000022004701050000070000000000000020002b1f000a4a51f1ee839cd53400b017ca5b", 0x26) connect$netlink(r0, &(0x7f00000005c0)=@proc={0x10, 0x0, 0x1}, 0xc) setsockopt$sock_int(r0, 0x1, 0x21, &(0x7f0000b4bffc)=0x10, 0x4) write(r0, &(0x7f0000000040)='\"', 0x1) recvmmsg(r0, &(0x7f0000000780), 0x3ffffffffffff81, 0x2, 0x0) 1.088370383s ago: executing program 1 (id=51): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000800)=@newsa={0x140, 0x10, 0x405, 0x0, 0x0, {{@in=@loopback, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x2, 0x20, 0x20}, {@in=@loopback, 0x1234, 0x32}, @in=@loopback, {0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, {0x0, 0x0, 0x1}, {}, 0x0, 0x0, 0x2}, [@algo_aead={0x50, 0x12, {{'rfc4106(gcm(aes))\x00'}, 0x20, 0x80, "11223344"}}]}, 0x140}}, 0x0) 973.074716ms ago: executing program 2 (id=52): syz_clone3(&(0x7f000000dd80)={0xa00400, 0x0, 0x0, 0x0, {0x13}, 0x0, 0x0, 0x0, 0x0}, 0x58) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000240)=[{0x6, 0x0, 0x0, 0x7fff0006}]}) nanosleep(&(0x7f0000000000)={0x77359400}, 0x0) syz_clone3(&(0x7f000000dd80)={0xa04400, 0x0, 0x0, 0x0, {0x12}, 0x0, 0x0, 0x0, 0x0}, 0x58) 972.907836ms ago: executing program 1 (id=53): setrlimit(0x2, &(0x7f00000000c0)={0x5, 0xfffffffffffffffa}) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x1000403, 0x2000000000032, 0xffffffffffffffff, 0x0) 897.122138ms ago: executing program 1 (id=54): close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) tkill(0x0, 0x7) r0 = syz_open_procfs(0x0, &(0x7f0000000280)='cpuset\x00') write$cgroup_subtree(r0, 0x0, 0x0) 896.985727ms ago: executing program 1 (id=55): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921000000012201000905810308"], 0x0) syz_usb_disconnect(r0) r1 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120110010000004058040350"], 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x6) syz_clone3(&(0x7f00000005c0)={0x40000800, 0x0, 0x0, 0x0, {0x1a}, &(0x7f0000001a40)=""/4102, 0x1006, 0x0, 0x0}, 0x58) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0xffffffffffffff6d, &(0x7f0000000100)="019a18370cfb661ba08c228ce6ca19b6a99a071ca34c72c891f8a260fa00000080977dae8d64a30e92cd51117c4a71e26518e804c00058e6c7c0c363027251668bb650d90000000000") 419.30009ms ago: executing program 3 (id=56): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000600), 0x40182, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000040)={0x0, 0x0, 0x1}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 318.082012ms ago: executing program 3 (id=57): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000740)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a3c000000090a0104000000000073797a310000000008000540000000020900020073797a310000000108000a40fffffffc8800"/84, @ANYRES8], 0xec}, 0x1, 0x0, 0x0, 0x880}, 0x40) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000780)=ANY=[@ANYBLOB="1c0000005e0001"], 0x1c}], 0x1}, 0x0) 258.991863ms ago: executing program 3 (id=58): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) r1 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r1, 0x29, 0x2e, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0xfffffffe, @mcast1={0xff, 0x7}, 0x2}}, {{0xa, 0x0, 0xfe, @remote}}}, 0x108) r2 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r2, 0x29, 0x2a, &(0x7f0000000080)={0x20, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @remote}}}, 0x108) setsockopt$inet6_group_source_req(r2, 0x29, 0x2b, &(0x7f0000000200)={0x0, {{0xa, 0xffff, 0x0, @mcast1={0xff, 0x7}, 0x10000}}, {{0xa, 0x0, 0x0, @mcast1}}}, 0x108) setsockopt$inet6_group_source_req(r2, 0x29, 0x2b, &(0x7f0000000200)={0x0, {{0xa, 0x4e24, 0x8000000, @mcast1={0xff, 0x7}}}, {{0xa, 0x4e22, 0x0, @ipv4={'\x00', '\xff\xff', @local}}}}, 0x108) r3 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r3, 0x29, 0x2a, &(0x7f0000000200)={0x0, {{0xa, 0x1000, 0xfffffffe, @mcast1={0xff, 0x7}, 0x2}}, {{0xa, 0x0, 0xfe, @mcast1}}}, 0x108) close_range(r0, 0xffffffffffffffff, 0x0) 258.812503ms ago: executing program 3 (id=59): mkdir(&(0x7f0000000000)='dir0\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='dir0\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./trace\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./trace\x00', &(0x7f0000000040)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./trace/trace\x00', 0x0, 0x0) read(r0, &(0x7f0000000180), 0x1000) 258.719983ms ago: executing program 3 (id=60): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000003c0)=ANY=[@ANYBLOB="12010000000000407d1ef62c00000000000109022400010000000009040000010300020009210000000122070009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000400)={0x18, &(0x7f0000000940)=ANY=[@ANYBLOB='\x000\b'], 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000001480)={0x84, &(0x7f0000001040)={0x40, 0x1, 0x3, "6a75a9"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, &(0x7f0000000000)={0x40, 0x3, 0xf3, {0xf3, 0x4, "d39b167bdf72befb21081ce12cee49600eaa1dd68de504c610505ca9b4e17dda5d99c86123a65d3260fc980ec19e193981a55e05a9f7e6bd25ee9c6a8480ad7e2f24af82cf905d22adff79c44d9bec57c1702fa8d6717bb4c0713a8c1cfb1694a8642823431d4281e4d99c315962efa704a62e410e3de248ae7ff5ce4c640522821ba7b1ccab7dffb0478d58783783e03a248d5010327b962c3d904b6a4c831e9aa1cea2036b781604bec3e1612f9850aa2b35d2ae8967917d537cc043eaab7bfcae0228cd32f881cddf84810ff9e8fc1afc88c1a2750a47d0a6c7abc67e89406a0685bb2b685015ef16f5e2e9e71f6ca3"}}, &(0x7f0000000100)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x411}}, &(0x7f0000000140)={0x0, 0x22, 0x9, {[@global=@item_012={0x0, 0x1, 0x3}, @global=@item_012={0x0, 0x1, 0xa}, @global=@item_012={0x0, 0x1, 0x5}, @local=@item_012={0x0, 0x2, 0x3}, @global=@item_4={0x3, 0x1, 0x7, "622fc3d9"}]}}, &(0x7f0000000180)={0x0, 0x21, 0x9, {0x9, 0x21, 0x9, 0x8, 0x1, {0x22, 0xe27}}}}, &(0x7f0000000440)={0x2c, 0x0, &(0x7f0000000280)={0x0, 0xa, 0x1, 0x3}, 0x0, &(0x7f0000000300)={0x20, 0x1, 0xd, "d0250caa041449fe9c32cd74f9"}, 0x0}) 136.437257ms ago: executing program 2 (id=61): r0 = syz_usb_connect$cdc_ecm(0x0, 0x4d, &(0x7f00000000c0)={{0x12, 0x1, 0x0, 0x2, 0x0, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x0, 0x0, 0xffffffffffff8001, 0x1, [{{0x9, 0x2, 0x3b, 0x1, 0x1, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x12, 0x2, 0x6, 0x0, 0x0, {{0x5}, {0x5}, {0xd, 0x24, 0xf, 0x1, 0x1, 0x3}}, {[], {{0x9, 0x5, 0x82, 0x2, 0x200}}, {{0x9, 0x5, 0x3, 0x2, 0x200, 0xfd}}}}}]}}]}}, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) 68.228108ms ago: executing program 0 (id=62): r0 = socket(0xa, 0x3, 0x3a) sendmsg$nl_generic(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={0x0, 0x20}, 0x1, 0x0, 0x0, 0x20040041}, 0x8081) 0s ago: executing program 0 (id=63): socket$tipc(0x1e, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./proc_mnt\x00', 0x1ed) mount(0x0, &(0x7f0000000080)='./proc_mnt\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc_mnt/irq/1/smp_affinity\x00', 0x1, 0x0) write$P9_RLERRORu(r0, 0x0, 0xfffffcf0) kernel console output (not intermixed with test programs): syzkaller syzkaller login: [ 21.693348][ T36] kauditd_printk_skb: 31 callbacks suppressed [ 21.693367][ T36] audit: type=1400 audit(1789092504.720:59): avc: denied { transition } for pid=274 comm="sshd-session" path="/bin/sh" dev="sda1" ino=90 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 21.698352][ T36] audit: type=1400 audit(1789092504.720:60): avc: denied { noatsecure } for pid=274 comm="sshd-session" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 21.703148][ T36] audit: type=1400 audit(1789092504.730:61): avc: denied { write } for pid=274 comm="sh" path="pipe:[1767]" dev="pipefs" ino=1767 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 21.707170][ T36] audit: type=1400 audit(1789092504.730:62): avc: denied { rlimitinh } for pid=274 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 21.710541][ T36] audit: type=1400 audit(1789092504.730:63): avc: denied { siginh } for pid=274 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 Warning: Permanently added '10.128.0.165' (ED25519) to the list of known hosts. [ 30.019279][ T36] audit: type=1400 audit(1789092513.050:64): avc: denied { mounton } for pid=286 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 30.022649][ T286] cgroup: Unknown subsys name 'net' [ 30.041996][ T36] audit: type=1400 audit(1789092513.050:65): avc: denied { mount } for pid=286 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 30.069449][ T36] audit: type=1400 audit(1789092513.070:66): avc: denied { unmount } for pid=286 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 30.069952][ T286] cgroup: Unknown subsys name 'devices' [ 30.191574][ T286] cgroup: Unknown subsys name 'hugetlb' [ 30.197483][ T286] cgroup: Unknown subsys name 'rlimit' [ 30.293112][ T36] audit: type=1400 audit(1789092513.320:67): avc: denied { setattr } for pid=286 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 30.316443][ T36] audit: type=1400 audit(1789092513.320:68): avc: denied { mounton } for pid=286 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 30.341343][ T36] audit: type=1400 audit(1789092513.320:69): avc: denied { mount } for pid=286 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 30.364974][ T288] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 30.373820][ T36] audit: type=1400 audit(1789092513.400:70): avc: denied { relabelto } for pid=288 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 30.399249][ T36] audit: type=1400 audit(1789092513.400:71): avc: denied { write } for pid=288 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 30.427414][ T36] audit: type=1400 audit(1789092513.450:72): avc: denied { read } for pid=286 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 30.453127][ T36] audit: type=1400 audit(1789092513.450:73): avc: denied { open } for pid=286 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 30.453827][ T286] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 31.221386][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.228507][ T293] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.246144][ T293] bridge_slave_0: entered allmulticast mode [ 31.252704][ T293] bridge_slave_0: entered promiscuous mode [ 31.259497][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.266583][ T293] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.273719][ T293] bridge_slave_1: entered allmulticast mode [ 31.280135][ T293] bridge_slave_1: entered promiscuous mode [ 31.427927][ T298] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.435107][ T298] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.442507][ T298] bridge_slave_0: entered allmulticast mode [ 31.448779][ T298] bridge_slave_0: entered promiscuous mode [ 31.458538][ T298] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.465637][ T298] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.473229][ T298] bridge_slave_1: entered allmulticast mode [ 31.479685][ T298] bridge_slave_1: entered promiscuous mode [ 31.489675][ T297] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.496755][ T297] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.504079][ T297] bridge_slave_0: entered allmulticast mode [ 31.510472][ T297] bridge_slave_0: entered promiscuous mode [ 31.532727][ T297] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.539834][ T297] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.546915][ T297] bridge_slave_1: entered allmulticast mode [ 31.553313][ T297] bridge_slave_1: entered promiscuous mode [ 31.581237][ T299] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.588371][ T299] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.595499][ T299] bridge_slave_0: entered allmulticast mode [ 31.601870][ T299] bridge_slave_0: entered promiscuous mode [ 31.620552][ T299] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.627635][ T299] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.634790][ T299] bridge_slave_1: entered allmulticast mode [ 31.641276][ T299] bridge_slave_1: entered promiscuous mode [ 31.667581][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.674689][ T293] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.682049][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.689113][ T293] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.788430][ T297] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.795560][ T297] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.802881][ T297] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.809991][ T297] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.828184][ T299] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.835309][ T299] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.842651][ T299] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.849729][ T299] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.858381][ T298] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.865586][ T298] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.872917][ T298] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.879986][ T298] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.911434][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.918772][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.927128][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.934551][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.942239][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.949500][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.956765][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.964328][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.981193][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.988283][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.998983][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.006091][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 32.024734][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.031854][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 32.039583][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.046676][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 32.071746][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.078814][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 32.086671][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.093734][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 32.122455][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.129564][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 32.138501][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.145604][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 32.168646][ T297] veth0_vlan: entered promiscuous mode [ 32.195415][ T299] veth0_vlan: entered promiscuous mode [ 32.207052][ T293] veth0_vlan: entered promiscuous mode [ 32.223244][ T297] veth1_macvtap: entered promiscuous mode [ 32.238420][ T299] veth1_macvtap: entered promiscuous mode [ 32.248548][ T298] veth0_vlan: entered promiscuous mode [ 32.255647][ T293] veth1_macvtap: entered promiscuous mode [ 32.301902][ T298] veth1_macvtap: entered promiscuous mode [ 32.311161][ T297] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 32.411460][ T319] UDC core: g_uac2: couldn't find an available UDC or it's busy [ 32.425750][ T323] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 32.451997][ T325] EXT4-fs warning (device sda1): ext4_group_extend:1862: can't shrink FS - resize aborted [ 32.649343][ T10] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 32.672146][ T333] netlink: 'syz.0.9': attribute type 15 has an invalid length. [ 32.823615][ T10] usb 3-1: Using ep0 maxpacket: 32 [ 32.863493][ T10] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 32.874709][ T10] usb 3-1: config 0 has no interface number 0 [ 32.881371][ T10] usb 3-1: config 0 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 32.892536][ T10] usb 3-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 32.902576][ T10] usb 3-1: New USB device found, idVendor=28bd, idProduct=0094, bcdDevice= 0.00 [ 32.911885][ T10] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 32.976503][ T344] rust_binder: 341:344 got reply transaction with no transaction stack [ 32.985754][ T344] rust_binder: 341:344 transaction reply to 0:0 failed EINVAL, code 0 size 0-0 [ 33.919704][ T10] usb 3-1: config 0 descriptor?? [ 33.929118][ T310] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 33.939056][ T31] rust_binder: 341: undelivered TRANSACTION_ERROR: 29201 [ 33.948173][ T311] usb 1-1: new full-speed USB device number 2 using dummy_hcd [ 34.080509][ T310] usb 4-1: too many endpoints for config 0 interface 0 altsetting 0: 254, using maximum allowed: 30 [ 34.091389][ T310] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 254 [ 34.110416][ T311] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 34.120720][ T311] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 34.129232][ T310] usb 4-1: New USB device found, idVendor=056a, idProduct=0319, bcdDevice= 0.00 [ 34.138885][ T310] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 34.149878][ T310] usb 4-1: config 0 descriptor?? [ 34.158764][ T311] usb 1-1: config 1 has no interface number 0 [ 34.170434][ T311] usb 1-1: config 1 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 34.181755][ T311] usb 1-1: config 1 interface 1 altsetting 0 endpoint 0x81 has invalid maxpacket 512, setting to 64 [ 34.193213][ T311] usb 1-1: Duplicate descriptor for config 1 interface 1 altsetting 0, skipping [ 34.203847][ T311] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 34.213019][ T311] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 34.222028][ T311] usb 1-1: Product: syz [ 34.226385][ T311] usb 1-1: Manufacturer: syz [ 34.231114][ T311] usb 1-1: SerialNumber: syz [ 34.237141][ T346] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22 [ 34.429193][ T9] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 34.565154][ T310] wacom 0003:056A:0319.0002: item fetching failed at offset 39/40 [ 34.573769][ T10] uclogic 0003:28BD:0094.0001: failed retrieving string descriptor #100: -71 [ 34.582839][ T310] wacom 0003:056A:0319.0002: parse failed [ 34.588814][ T310] wacom 0003:056A:0319.0002: probe with driver wacom failed with error -22 [ 34.597547][ T10] uclogic 0003:28BD:0094.0001: failed retrieving pen parameters: -71 [ 34.607086][ T10] uclogic 0003:28BD:0094.0001: pen probing failed: -71 [ 34.614238][ T10] uclogic 0003:28BD:0094.0001: failed probing parameters: -71 [ 34.622247][ T9] usb 2-1: too many configurations: 29, using maximum allowed: 8 [ 34.630363][ T10] uclogic 0003:28BD:0094.0001: probe with driver uclogic failed with error -71 [ 34.641101][ T10] usb 3-1: USB disconnect, device number 2 [ 34.647813][ T346] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22 [ 34.661095][ T9] usb 2-1: New USB device found, idVendor=1235, idProduct=000e, bcdDevice= 0.40 [ 34.670379][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 34.678433][ T9] usb 2-1: Product: syz [ 34.682884][ T9] usb 2-1: Manufacturer: syz [ 34.687528][ T9] usb 2-1: SerialNumber: syz [ 34.774162][ T31] usb 4-1: USB disconnect, device number 2 [ 34.903501][ T9] usb 2-1: USB disconnect, device number 2 [ 34.915686][ T313] udevd[313]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 35.057408][ T311] cdc_ncm 1-1:1.1: bind() failure [ 35.113410][ T36] kauditd_printk_skb: 56 callbacks suppressed [ 35.113429][ T36] audit: type=1400 audit(1789092518.140:130): avc: denied { create } for pid=352 comm="syz.2.15" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 35.145486][ T36] audit: type=1400 audit(1789092518.140:131): avc: denied { setopt } for pid=352 comm="syz.2.15" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 35.233139][ T36] audit: type=1400 audit(1789092518.260:132): avc: denied { name_bind } for pid=357 comm="syz.2.17" src=20000 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=tcp_socket permissive=1 [ 35.254638][ T36] audit: type=1400 audit(1789092518.260:133): avc: denied { node_bind } for pid=357 comm="syz.2.17" saddr=224.0.0.2 src=20000 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 35.284554][ T9] usb 1-1: USB disconnect, device number 2 [ 35.305007][ T36] audit: type=1400 audit(1789092518.330:134): avc: denied { create } for pid=361 comm="syz.3.19" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 35.324224][ T36] audit: type=1400 audit(1789092518.330:135): avc: denied { write } for pid=361 comm="syz.3.19" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 35.350822][ T36] audit: type=1400 audit(1789092518.380:136): avc: denied { create } for pid=364 comm="syz.3.20" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 35.371800][ T36] audit: type=1400 audit(1789092518.380:137): avc: denied { getopt } for pid=364 comm="syz.3.20" lport=1 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 35.398484][ T367] capability: warning: `syz.3.21' uses deprecated v2 capabilities in a way that may be insecure [ 35.439872][ T36] audit: type=1400 audit(1789092518.470:138): avc: denied { unmount } for pid=299 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 35.464071][ T36] audit: type=1400 audit(1789092518.490:139): avc: denied { read write } for pid=372 comm="syz.3.24" name="event1" dev="devtmpfs" ino=193 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 35.501805][ T375] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 35.669213][ T31] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 35.829079][ T31] usb 2-1: Using ep0 maxpacket: 16 [ 35.837087][ T386] syz.0.30 uses obsolete (PF_INET,SOCK_PACKET) [ 35.844688][ T31] usb 2-1: New USB device found, idVendor=05d1, idProduct=2001, bcdDevice= 7.00 [ 35.854002][ T31] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 35.862202][ T31] usb 2-1: Product: syz [ 35.866454][ T31] usb 2-1: Manufacturer: syz [ 35.871312][ T31] usb 2-1: SerialNumber: syz [ 35.882140][ T31] usb 2-1: config 0 descriptor?? [ 35.897216][ T31] ftdi_sio 2-1:0.0: FTDI USB Serial Device converter detected [ 35.911675][ T31] usb 2-1: Detected FT2232H [ 36.094870][ T370] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 36.103058][ T405] tipc: Started in network mode [ 36.104777][ T370] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 36.108484][ T405] tipc: Node identity 4, cluster identity 4711 [ 36.126756][ T405] tipc: Node number set to 4 [ 36.135004][ T31] ftdi_sio ttyUSB0: Unable to read latency timer: -32 [ 36.156094][ T31] ftdi_sio ttyUSB0: Unable to write latency timer: -71 [ 36.165872][ T347] kernel write not supported for file /14/attr/prev (pid: 347 comm: kworker/1:3) [ 36.176342][ T31] usb 2-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 36.193582][ T31] usb 2-1: USB disconnect, device number 3 [ 36.214733][ T31] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 36.225320][ T31] ftdi_sio 2-1:0.0: device disconnected [ 36.784833][ T443] mmap: syz.1.53 (443): VmData 29073408 exceed data ulimit 5. Update limits or use boot option ignore_rlimit_data. [ 37.109080][ T9] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 37.270168][ T9] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 37.281532][ T9] usb 2-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 37.290728][ T9] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 37.305569][ T9] usb 2-1: config 0 descriptor?? [ 37.517678][ T9] usbhid 2-1:0.0: can't add hid device: -71 [ 37.524080][ T9] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 37.534811][ T9] usb 2-1: USB disconnect, device number 4 [ 37.702238][ T466] ------------[ cut here ]------------ [ 37.707805][ T466] WARNING: CPU: 1 PID: 466 at mm/page_alloc.c:5285 __alloc_pages_noprof+0x109/0x7e0 [ 37.717535][ T466] Modules linked in: [ 37.721616][ T466] CPU: 1 UID: 0 PID: 466 Comm: syz.0.63 Not tainted syzkaller #0 053bc84e93bdef9c6c9615cbace6655003d8d143 [ 37.733014][ T466] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 37.743627][ T466] RIP: 0010:__alloc_pages_noprof+0x109/0x7e0 [ 37.750519][ T466] Code: 00 0f 1f 44 00 00 83 fb 0b 72 28 b8 00 20 00 00 23 44 24 40 75 1d 80 3d c5 d2 0b 06 00 0f 85 c2 00 00 00 c6 05 b8 d2 0b 06 01 <0f> 0b 31 c0 e9 b4 00 00 00 83 fb 0a 0f 87 a9 00 00 00 44 8b 64 24 [ 37.770328][ T466] RSP: 0018:ffffc9000d8bf8c0 EFLAGS: 00010246 [ 37.776449][ T466] RAX: 0000000000000000 RBX: 0000000000000013 RCX: 0000000000000000 [ 37.784571][ T466] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffc9000d8bf978 [ 37.792730][ T466] RBP: ffffc9000d8bf9f0 R08: ffffc9000d8bf977 R09: 0000000000000000 [ 37.801150][ T466] R10: ffffc9000d8bf960 R11: fffff52001b17f2f R12: ffffc9000d8bf900 [ 37.809242][ T466] R13: dffffc0000000000 R14: 1ffff92001b17f1c R15: 0000000000000000 [ 37.817258][ T466] FS: 00007f1e1f4e06c0(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 37.826259][ T466] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 37.832927][ T466] CR2: 000000110c30656e CR3: 0000000133a7e000 CR4: 00000000003526b0 [ 37.841014][ T466] Call Trace: [ 37.844340][ T466] [ 37.847305][ T466] ? __cfi___alloc_pages_noprof+0x10/0x10 [ 37.853168][ T466] ? plist_add+0x4d4/0x570 [ 37.857645][ T466] ? __futex_queue+0x19f/0x350 [ 37.862489][ T466] ___kmalloc_large_node+0x81/0x220 [ 37.867733][ T466] __kmalloc_large_node_noprof+0x1e/0xd0 [ 37.873456][ T466] __kmalloc_node_track_caller_noprof+0x30d/0x4f0 [ 37.879956][ T466] ? bitmap_parse_user+0x29/0x80 [ 37.884928][ T466] memdup_user_nul+0x40/0x1a0 [ 37.889668][ T466] ? bitmap_parse_user+0x1f/0x80 [ 37.894645][ T466] bitmap_parse_user+0x29/0x80 [ 37.899819][ T466] irq_affinity_proc_write+0x139/0x230 [ 37.905314][ T466] ? __cfi_irq_affinity_proc_write+0x10/0x10 [ 37.911510][ T466] ? futex_wait+0x2b8/0x7c0 [ 37.916060][ T466] ? __cfi_irq_affinity_proc_write+0x10/0x10 [ 37.922186][ T466] proc_reg_write+0x1fa/0x2f0 [ 37.927014][ T466] ? __cfi_proc_reg_write+0x10/0x10 [ 37.932274][ T466] vfs_write+0x3c4/0xfd0 [ 37.936569][ T466] ? __cfi_vfs_write+0x10/0x10 [ 37.941390][ T466] ? __kasan_check_write+0x18/0x20 [ 37.946550][ T466] ? mutex_lock+0x97/0x1d0 [ 37.951048][ T466] ? __cfi_mutex_lock+0x10/0x10 [ 37.955963][ T466] ksys_write+0x145/0x260 [ 37.960373][ T466] ? xfd_validate_state+0x68/0x140 [ 37.965533][ T466] ? __cfi_ksys_write+0x10/0x10 [ 37.969204][ T10] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 37.970467][ T466] ? __kasan_check_write+0x18/0x20 [ 37.983138][ T466] ? fpregs_restore_userregs+0x11c/0x260 [ 37.988864][ T466] __x64_sys_write+0x7f/0x90 [ 37.993686][ T466] x64_sys_call+0x271c/0x2ee0 [ 37.998439][ T466] do_syscall_64+0x57/0xf0 [ 38.003211][ T466] ? clear_bhb_loop+0x50/0xa0 [ 38.007977][ T466] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 38.013967][ T466] RIP: 0033:0x7f1e1e59e159 [ 38.018446][ T466] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 38.038150][ T466] RSP: 002b:00007f1e1f4e0028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 38.046669][ T466] RAX: ffffffffffffffda RBX: 00007f1e1e825fa0 RCX: 00007f1e1e59e159 [ 38.054823][ T466] RDX: 00000000fffffcf0 RSI: 0000000000000000 RDI: 0000000000000004 [ 38.063072][ T466] RBP: 00007f1e1e63503b R08: 0000000000000000 R09: 0000000000000000 [ 38.071184][ T466] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 38.079253][ T466] R13: 00007f1e1e826038 R14: 00007f1e1e825fa0 R15: 00007ffd4787ae48 [ 38.087283][ T466] [ 38.090384][ T466] ---[ end trace 0000000000000000 ]--- [ 38.097159][ T347] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 38.140568][ T10] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 38.151631][ T10] usb 2-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.40 [ 38.160805][ T10] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 38.169958][ T10] usb 2-1: config 0 descriptor?? [ 38.219339][ T311] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 38.250301][ T347] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 38.261304][ T347] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 38.271119][ T347] usb 4-1: New USB device found, idVendor=1e7d, idProduct=2cf6, bcdDevice= 0.00 [ 38.280240][ T347] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 38.289198][ T347] usb 4-1: config 0 descriptor?? [ 38.370172][ T311] usb 3-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 38.384505][ T311] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 38.393762][ T311] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 38.401866][ T311] usb 3-1: SerialNumber: syz [ 38.697773][ T347] pyra 0003:1E7D:2CF6.0003: unknown main item tag 0x0 [ 38.704951][ T347] pyra 0003:1E7D:2CF6.0003: unknown main item tag 0x0 [ 38.711834][ T347] pyra 0003:1E7D:2CF6.0003: unknown main item tag 0x0 [ 38.718657][ T347] pyra 0003:1E7D:2CF6.0003: unknown main item tag 0x0 [ 38.725538][ T347] pyra 0003:1E7D:2CF6.0003: unknown main item tag 0x0 [ 38.732426][ T347] pyra 0003:1E7D:2CF6.0003: unknown main item tag 0x0 [ 38.739321][ T347] pyra 0003:1E7D:2CF6.0003: unknown main item tag 0x0 [ 38.747067][ T347] pyra 0003:1E7D:2CF6.0003: hidraw0: USB HID v0.00 Device [HID 1e7d:2cf6] on usb-dummy_hcd.3-1/input0 [ 38.811264][ T311] cdc_ether 3-1:1.0: probe with driver cdc_ether failed with error -71 [ 38.820762][ T311] usb 3-1: USB disconnect, device number 3 [ 38.989554][ T10] aiptek 2-1:0.0: Aiptek using 400 ms programming speed [ 38.997422][ T10] input: Aiptek as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/input/input4 [ 39.284023][ T10] usb 2-1: USB disconnect, device number 5 [ 39.284148][ C1] aiptek 2-1:0.0: aiptek_irq - usb_submit_urb failed with result -19 [ 39.502971][ T347] pyra 0003:1E7D:2CF6.0003: couldn't init struct pyra_device [ 39.510465][ T347] pyra 0003:1E7D:2CF6.0003: couldn't install mouse [ 39.517727][ T347] pyra 0003:1E7D:2CF6.0003: probe with driver pyra failed with error -71 [ 39.528472][ T347] usb 4-1: USB disconnect, device number 3