last executing test programs: 30.644574238s ago: executing program 1 (id=1558): r0 = socket$netlink(0x10, 0x3, 0x0) (async) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) (async) r1 = syz_ublk_setup_io_uring(0x20, 0x0, &(0x7f0000000000)=0x0, &(0x7f0000000540)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000180)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000000c0)=@new_dev={0x3, 0xf14, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x100}}}, &(0x7f0000000280)=0x0) (async) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) (async) r7 = socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 64) r8 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000100), 0xffffffffffffffff) (rerun: 64) sendmsg$ETHTOOL_MSG_FEATURES_GET(r7, &(0x7f0000000ac0)={0x0, 0x0, &(0x7f0000000a80)={&(0x7f0000000200)=ANY=[@ANYBLOB="14000000", @ANYRES16=r8, @ANYBLOB="8fdf2cbd7000030000000b"], 0x14}, 0x1, 0x0, 0x0, 0x4005}, 0x40000) (async, rerun: 32) recvmmsg(r7, &(0x7f0000007ec0)=[{{0x0, 0x0, &(0x7f00000030c0)=[{&(0x7f0000000c00)=""/169, 0xa9}, {&(0x7f0000000cc0)=""/232, 0xe8}, {&(0x7f0000000e00)=""/88, 0x58}, {&(0x7f00000002c0)=""/245, 0xf5}], 0x4}, 0xe}], 0x1, 0x0, 0x0) (async, rerun: 32) sendmsg$nl_xfrm(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="9402000021000100fcffffff00000000ac1414aae5fffff8b49ed9825133a900fc0100000000000000070000000000000000add500200000000000801aeaaec1", @ANYRES32=r6, @ANYRES32=0x0, @ANYBLOB="0000000000000000700004e6706362632874776f666973682900000000000000000000000480000000000000000000000000000000000000000000000000000000000000000000000000000040010000dc06216ef2c68e9f6da05d886dbc3273ef99796b36698e2bd5179c3eea5474fc78c9720bfc4f90a708001f0001000000cc0111"], 0x294}, 0x1, 0x0, 0x0, 0x24000890}, 0x4000) syz_ublk_setup_queues(r1, r5, &(0x7f0000000200)={0x0, 0x145d, 0x20, 0x0, 0xb0, 0x0, r1}, 0x0, 0x4, 0x0, 0x0) (async) r9 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r10 = ioctl$KVM_CREATE_VM(r9, 0xae01, 0x0) ioctl$KVM_SET_TSC_KHZ_vm(r10, 0xaea2, 0x30000000000) (async) sendmsg$nl_generic(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000840)={0x28, 0x1e, 0x21, 0x0, 0x0, {0xa}, [@typed={0x5, 0x0, 0x0, 0x0, @str='\x00'}, @typed={0xa, 0x4, 0x0, 0x0, @str='w\xa9\xe2\x00\x00\x00'}]}, 0x28}}, 0x0) 30.433060853s ago: executing program 1 (id=1563): unshare(0x24020400) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x40000, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x80102, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) ioctl$KVM_IRQFD(r3, 0x4020ae76, &(0x7f0000000340)={0xffffffffffffffff, 0x82}) ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f0000000480)={0x4, 0xffffffffffffffff}) ioctl$KVM_SET_DEVICE_ATTR(r4, 0x4018aee1, &(0x7f0000000040)=@attr_riscv64=@attr_imsic={0x0, 0x1, 0x2, &(0x7f0000000000)=0x3}) 30.369646205s ago: executing program 1 (id=1564): syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000000)={0x50, 0x0, 0x203, {0x7, 0x29, 0xfffffffb, 0x48000010, 0x1, 0x3, 0xb, 0x2, 0x0, 0x0, 0x80, 0x97}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0xfffffffffffffffd) ioctl$KVM_SET_USER_MEMORY_REGION(r0, 0x4020ae46, &(0x7f0000000400)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x0) capset(0x0, &(0x7f0000000000)={0x9, 0x0, 0x1, 0x4, 0x1}) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) socket$inet6_icmp(0xa, 0x2, 0x3a) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, &(0x7f0000000200)="f7790066baa00066b86b4266ef66ba420066b8e20066ef0f29902cbb0000c4e2b1ba8c88d9000000666666440f38826b410f7842280f07b8010000000f01d9c4033921820f47a753fd", 0x49}], 0x1, 0x43, 0x0, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r3, 0x4400ae8f, &(0x7f0000000140)=@x86={0x40, 0x1, 0xc, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x80, 0x9, 0x0, 0x0, 0x0, 0xfffffff8, 0x0, 0xff, 0xff}) r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0xe, 0x7fff0000}]}) close_range(r4, 0xffffffffffffffff, 0x0) 30.303643536s ago: executing program 1 (id=1565): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mount$incfs(&(0x7f0000000440)='./file0\x00', &(0x7f0000000140)='./file0\x00', &(0x7f0000000200), 0x80, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)}) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_CAP_HYPERV_SYNIC2(r2, 0x4068aea3, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0xc2c02e4d8eb3a414, 0x4) syz_clone3(&(0x7f0000000480)={0x80000, &(0x7f0000000100), &(0x7f0000000180)=0x0, &(0x7f00000001c0), {0x20}, &(0x7f00000002c0)=""/166, 0xa6, &(0x7f0000000380)=""/33, &(0x7f00000003c0)=[0xffffffffffffffff, 0xffffffffffffffff], 0x2, {r3}}, 0x58) getpgid(r4) r5 = syz_clone3(&(0x7f0000001880)={0x20000, 0x0, 0x0, 0x0, {0x1c}, 0x0, 0x0, 0x0, 0x0}, 0x58) tgkill(r5, r5, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mount$incfs(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='./file0\x00', &(0x7f0000000200), 0x80, 0x0) getsockname$packet(r3, &(0x7f0000000540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f0000000580)=0x14) sendmsg$nl_route_sched_retired(r3, &(0x7f00000006c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000680)={&(0x7f00000005c0)=@delqdisc={0x94, 0x25, 0x100, 0x70bd2a, 0x25dfdbfc, {0x0, 0x0, 0x0, r6, {0xffe0, 0xffff}, {0xd, 0xd}, {0x4, 0x6}}, [@q_dsmark={{0xb}, {0x20, 0x2, [@TCA_DSMARK_SET_TC_INDEX={0x4}, @TCA_DSMARK_SET_TC_INDEX={0x4}, @TCA_DSMARK_SET_TC_INDEX={0x4}, @TCA_DSMARK_DEFAULT_INDEX={0x6, 0x2, 0x6}, @TCA_DSMARK_DEFAULT_INDEX={0x6, 0x2, 0x8}]}}, @q_dsmark={{0xb}, {0x14, 0x2, [@TCA_DSMARK_INDICES={0x6, 0x1, 0x4}, @TCA_DSMARK_INDICES={0x6, 0x1, 0x11}]}}, @q_dsmark={{0xb}, {0x18, 0x2, [@TCA_DSMARK_SET_TC_INDEX={0x4}, @TCA_DSMARK_DEFAULT_INDEX={0x6, 0x2, 0x64fa}, @TCA_DSMARK_DEFAULT_INDEX={0x6, 0x2, 0x6}]}}]}, 0x94}, 0x1, 0x0, 0x0, 0x1}, 0x20000080) lchown(&(0x7f00000002c0)='./file0\x00', 0x0, 0xee01) mknodat$loop(0xffffffffffffff9c, &(0x7f0000000180)='./file2\x00', 0x6000, 0x0) capset(&(0x7f0000000500)={0x20080522}, &(0x7f00000000c0)={0x6, 0x200007, 0x801, 0x4, 0xe, 0x8}) r7 = open(&(0x7f00000003c0)='./file2\x00', 0x200, 0x10dd722b6e14c2dd) ioctl$BTRFS_IOC_DEFRAG(r7, 0x4c08, 0x3) syz_open_procfs(r5, &(0x7f0000000240)='task\x00') r8 = openat$incfs(r3, &(0x7f0000000280)='.pending_reads\x00', 0x1, 0x130) ioctl$TIOCL_GETKMSGREDIRECT(r8, 0xc058671e, &(0x7f00000000c0)) 30.213175978s ago: executing program 1 (id=1566): r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x3, 0x3) accept(r0, 0x0, 0x0) (fail_nth: 6) 29.884945816s ago: executing program 1 (id=1569): r0 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) r1 = openat$selinux_policy(0xffffff9c, &(0x7f0000000180), 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x100000a, 0x12, r1, 0x0) write$selinux_load(r0, 0x0, 0x1feff) r2 = syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x8, 0x458, 0x5012, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x80, 0x73, "", [{{0x9, 0x4, 0x0, 0xfe, 0x1, 0x3, 0x0, 0x3, 0x0, {0x9, 0x21, 0x81, 0x3, 0x1, {0x22, 0x28}}, {{{0x9, 0x5, 0x81, 0x3, 0x40, 0x2, 0x8, 0x81}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r2, 0x0, 0x0) syz_usb_control_io(r2, &(0x7f00000000c0)={0x2c, &(0x7f0000000280)=ANY=[@ANYBLOB='@\v(\x00'], 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io(r2, &(0x7f0000000480)={0x2c, &(0x7f0000000100)={0x20, 0x3, 0x68, {0x68, 0x5, "2e5544e9a3fb0589eafe7590f9098a2ec63fe29136342dbdba3b5b2885d632ca81f6a6ae89fb1a16ff760c37fbd9c0861069eb08c2ec31c73a9d60e2588eed6c3cacdcaa99509c49becd9f8ac6a65acd1fa6148902d7156fe53a70ac118a371ba48810445d37"}}, &(0x7f0000000b00)={0x0, 0x3, 0x95, @string={0x95, 0x3, "bcdf2fe9769d79a80109cc619d74c5d8f3d5b352b1e6ea80e553b6c95412cc4f9872d320527b99124cb74bb5c5a87e1cfdb080136b651c8678d010079be736ee7b8c2807cdf624b2217d64e3dcfcf81e70d125486eb8b871ebba3d9e9a06522ce40f585104b1c74aecd2cc1de48dc7cb35d4e560d94f9b376c7c3e6f1b6da55d1469925eba9977c97b632a08b55e84431a15b1"}}, &(0x7f00000002c0)={0x0, 0xf, 0xe4, {0x5, 0xf, 0xe4, 0x5, [@ext_cap={0x7, 0x10, 0x2, 0x14, 0xb, 0x0, 0x7}, @ss_container_id={0x14, 0x10, 0x4, 0x2, "e73617c7c3e067fdb6e615205e3910f7"}, @generic={0xac, 0x10, 0x2, "7e1a57671066fd17bec7e2b23c7986ad84546b37f5d6bb826fa08ae0911ed5faa85e49094046705b845e28f2138b115ab325d61b9595410409e1ecabe7ad2021771f7aa84871860ed1c3bed5bcfdd050f960b24a5f108b85cb89ccc6201f2f3fc569d494b22c009f812c777a854ec93d7b7f4f2768881bddcad60470cd19c7a18d6f1066848a5b384768f23ee37e5272dbc7f343fd2e6b88d381a1cb515a363655dd89aa5d52b9b383"}, @ssp_cap={0xc, 0x10, 0xa, 0x7, 0x0, 0x200, 0xff00, 0xffff}, @ssp_cap={0xc, 0x10, 0xa, 0x10, 0x0, 0x5, 0xf00, 0x6}]}}, &(0x7f0000000400)={0x20, 0x29, 0xf, {0xf, 0x29, 0x2e, 0x3d4dac7da677a4e8, 0x1, 0xc, "57182809", "6ec1ba56"}}, &(0x7f0000000440)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x3, 0x3, 0x0, 0x0, 0x5, 0x6, 0x3}}}, &(0x7f0000000980)={0x84, &(0x7f00000004c0)={0x40, 0xe, 0xc1, "7996f36eb886f1e2c2db32d123d0a72f69ced23eed3626d6cd169535ccd26fdf844ace4cb80ffd53dd50b76735ca487b6eda173e90c49035bb47289e6a3644ee8fd0b5f43d08a2a200962f25b32d69ffb7ffa13c5daf882485798e76b06ad899ca4ab19acc5ad00598408703cf62eb8dff69502c53ecf106f74b07cd3a1588646f083c057234e70056b0b32a08c90c6c015818cbfdd859076cc438c4e0b341e6bd125879b6d27be7901a90cdb5519c5c1e1e45178b94530c37b7e8ea421ec492df"}, &(0x7f00000005c0)={0x0, 0xa, 0x1, 0x6}, &(0x7f0000000600)={0x0, 0x8, 0x1}, &(0x7f0000000640)={0x20, 0x0, 0x4, {0x2, 0x1}}, &(0x7f0000000680)={0x20, 0x0, 0x4, {0x1180, 0x20}}, &(0x7f00000006c0)={0x40, 0x7, 0x2, 0x3}, &(0x7f0000000700)={0x40, 0x9, 0x1, 0x6}, &(0x7f0000000740)={0x40, 0xb, 0x2, "19b0"}, &(0x7f0000000780)={0x40, 0xf, 0x2, 0x1}, &(0x7f00000007c0)={0x40, 0x13, 0x6, @random="27efe9f1a88b"}, &(0x7f0000000800)={0x40, 0x17, 0x6, @remote}, &(0x7f0000000840)={0x40, 0x19, 0x2, "0810"}, &(0x7f0000000880)={0x40, 0x1a, 0x2, 0x3}, &(0x7f00000008c0)={0x40, 0x1c, 0x1, 0x2}, &(0x7f0000000900)={0x40, 0x1e, 0x1, 0x7c}, &(0x7f0000000940)={0x40, 0x21, 0x1, 0x1}}) r3 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x10, 0xb43, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x10, 0x4, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x0, 0x3, 0x0, {0x9, 0x21, 0x81, 0xfe, 0x1, {0x22, 0x28}}, {{{0x9, 0x5, 0x81, 0x3, 0x40, 0x3, 0x81, 0x2}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r3, 0x0, 0x0) openat$binfmt_register(0xffffffffffffff9c, &(0x7f0000000440), 0x1, 0x0) 29.865324387s ago: executing program 32 (id=1569): r0 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) r1 = openat$selinux_policy(0xffffff9c, &(0x7f0000000180), 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x100000a, 0x12, r1, 0x0) write$selinux_load(r0, 0x0, 0x1feff) r2 = syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x8, 0x458, 0x5012, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x80, 0x73, "", [{{0x9, 0x4, 0x0, 0xfe, 0x1, 0x3, 0x0, 0x3, 0x0, {0x9, 0x21, 0x81, 0x3, 0x1, {0x22, 0x28}}, {{{0x9, 0x5, 0x81, 0x3, 0x40, 0x2, 0x8, 0x81}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r2, 0x0, 0x0) syz_usb_control_io(r2, &(0x7f00000000c0)={0x2c, &(0x7f0000000280)=ANY=[@ANYBLOB='@\v(\x00'], 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io(r2, &(0x7f0000000480)={0x2c, &(0x7f0000000100)={0x20, 0x3, 0x68, {0x68, 0x5, "2e5544e9a3fb0589eafe7590f9098a2ec63fe29136342dbdba3b5b2885d632ca81f6a6ae89fb1a16ff760c37fbd9c0861069eb08c2ec31c73a9d60e2588eed6c3cacdcaa99509c49becd9f8ac6a65acd1fa6148902d7156fe53a70ac118a371ba48810445d37"}}, &(0x7f0000000b00)={0x0, 0x3, 0x95, @string={0x95, 0x3, "bcdf2fe9769d79a80109cc619d74c5d8f3d5b352b1e6ea80e553b6c95412cc4f9872d320527b99124cb74bb5c5a87e1cfdb080136b651c8678d010079be736ee7b8c2807cdf624b2217d64e3dcfcf81e70d125486eb8b871ebba3d9e9a06522ce40f585104b1c74aecd2cc1de48dc7cb35d4e560d94f9b376c7c3e6f1b6da55d1469925eba9977c97b632a08b55e84431a15b1"}}, &(0x7f00000002c0)={0x0, 0xf, 0xe4, {0x5, 0xf, 0xe4, 0x5, [@ext_cap={0x7, 0x10, 0x2, 0x14, 0xb, 0x0, 0x7}, @ss_container_id={0x14, 0x10, 0x4, 0x2, "e73617c7c3e067fdb6e615205e3910f7"}, @generic={0xac, 0x10, 0x2, "7e1a57671066fd17bec7e2b23c7986ad84546b37f5d6bb826fa08ae0911ed5faa85e49094046705b845e28f2138b115ab325d61b9595410409e1ecabe7ad2021771f7aa84871860ed1c3bed5bcfdd050f960b24a5f108b85cb89ccc6201f2f3fc569d494b22c009f812c777a854ec93d7b7f4f2768881bddcad60470cd19c7a18d6f1066848a5b384768f23ee37e5272dbc7f343fd2e6b88d381a1cb515a363655dd89aa5d52b9b383"}, @ssp_cap={0xc, 0x10, 0xa, 0x7, 0x0, 0x200, 0xff00, 0xffff}, @ssp_cap={0xc, 0x10, 0xa, 0x10, 0x0, 0x5, 0xf00, 0x6}]}}, &(0x7f0000000400)={0x20, 0x29, 0xf, {0xf, 0x29, 0x2e, 0x3d4dac7da677a4e8, 0x1, 0xc, "57182809", "6ec1ba56"}}, &(0x7f0000000440)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x3, 0x3, 0x0, 0x0, 0x5, 0x6, 0x3}}}, &(0x7f0000000980)={0x84, &(0x7f00000004c0)={0x40, 0xe, 0xc1, "7996f36eb886f1e2c2db32d123d0a72f69ced23eed3626d6cd169535ccd26fdf844ace4cb80ffd53dd50b76735ca487b6eda173e90c49035bb47289e6a3644ee8fd0b5f43d08a2a200962f25b32d69ffb7ffa13c5daf882485798e76b06ad899ca4ab19acc5ad00598408703cf62eb8dff69502c53ecf106f74b07cd3a1588646f083c057234e70056b0b32a08c90c6c015818cbfdd859076cc438c4e0b341e6bd125879b6d27be7901a90cdb5519c5c1e1e45178b94530c37b7e8ea421ec492df"}, &(0x7f00000005c0)={0x0, 0xa, 0x1, 0x6}, &(0x7f0000000600)={0x0, 0x8, 0x1}, &(0x7f0000000640)={0x20, 0x0, 0x4, {0x2, 0x1}}, &(0x7f0000000680)={0x20, 0x0, 0x4, {0x1180, 0x20}}, &(0x7f00000006c0)={0x40, 0x7, 0x2, 0x3}, &(0x7f0000000700)={0x40, 0x9, 0x1, 0x6}, &(0x7f0000000740)={0x40, 0xb, 0x2, "19b0"}, &(0x7f0000000780)={0x40, 0xf, 0x2, 0x1}, &(0x7f00000007c0)={0x40, 0x13, 0x6, @random="27efe9f1a88b"}, &(0x7f0000000800)={0x40, 0x17, 0x6, @remote}, &(0x7f0000000840)={0x40, 0x19, 0x2, "0810"}, &(0x7f0000000880)={0x40, 0x1a, 0x2, 0x3}, &(0x7f00000008c0)={0x40, 0x1c, 0x1, 0x2}, &(0x7f0000000900)={0x40, 0x1e, 0x1, 0x7c}, &(0x7f0000000940)={0x40, 0x21, 0x1, 0x1}}) r3 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x10, 0xb43, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x10, 0x4, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x0, 0x3, 0x0, {0x9, 0x21, 0x81, 0xfe, 0x1, {0x22, 0x28}}, {{{0x9, 0x5, 0x81, 0x3, 0x40, 0x3, 0x81, 0x2}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r3, 0x0, 0x0) openat$binfmt_register(0xffffffffffffff9c, &(0x7f0000000440), 0x1, 0x0) 17.420379693s ago: executing program 3 (id=1726): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) mprotect(&(0x7f00003e4000/0x2000)=nil, 0x2000, 0x2) r0 = syz_open_dev$evdev(&(0x7f0000000200), 0x1, 0x80842) (async) socket$inet6_tcp(0xa, 0x1, 0x0) (async, rerun: 64) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) (rerun: 64) r1 = gettid() (async) r2 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r2, &(0x7f0000000040), 0x400000000000284, 0x2, 0x0) (async) signalfd4(0xffffffffffffffff, &(0x7f0000000180)={[0x9]}, 0x8, 0x0) pselect6(0x40, &(0x7f0000000100)={0x0, 0x3, 0x0, 0x1, 0x800, 0xfffffffffffffffd, 0x2000000000000}, 0x0, &(0x7f0000000080)={0x1f, 0x3, 0x9117}, 0x0, 0x0) (async, rerun: 32) timer_create(0x8, &(0x7f00000000c0)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000bbdffc)) (async, rerun: 32) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0xffff, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) (async) r3 = fsopen(&(0x7f0000000180)='configfs\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) (async, rerun: 32) r4 = fsmount(r3, 0x0, 0x9) (rerun: 32) fchdir(r4) r5 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='.\x00', 0x0, 0x1a1) ioctl$FS_IOC_FSSETXATTR(r5, 0x401c5820, &(0x7f0000000000)={0xd2f0, 0x2000, 0x8, 0xadea, 0xfffffffc}) ioctl$EVIOCGNAME(r0, 0x80404506, &(0x7f0000000000)=""/42) (async) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) (async) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r6, 0x29, 0x3, &(0x7f0000000000)=0x1, 0x4) (async) connect$inet6(r6, &(0x7f0000000140)={0xa, 0x4e22, 0x56202329, @empty, 0x4000005}, 0x1c) (async) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0x4008ae89, &(0x7f00000001c0)={0x1, 0x0, [{0x86c, 0x0, 0xff}]}) 17.354255384s ago: executing program 3 (id=1727): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_CHANNELS_GET(r0, &(0x7f0000000980)={0x0, 0x0, &(0x7f0000000940)={&(0x7f00000001c0)=ANY=[@ANYBLOB="8c000000", @ANYRES16=r1, @ANYBLOB="210727a17000fbdbdf25110000007800018008000100", @ANYRES32, @ANYBLOB="08001500010000000800030002000000080003000300000008000100", @ANYRES32, @ANYBLOB="140002007369743000000000000000000000000008000100", @ANYRES32, @ANYBLOB="140002006261746164765f736c6176655f30000008000100", @ANYRES32, @ANYBLOB="140002"], 0x8c}, 0x1, 0x0, 0x0, 0x4000000}, 0x8004) 17.353820324s ago: executing program 3 (id=1728): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="1c000000140001032dbd7000fcdbdf250c00000008000100197400"], 0x1c}}, 0x40000) (fail_nth: 3) 17.353567774s ago: executing program 3 (id=1729): syz_io_uring_setup(0x63af, &(0x7f0000000180)={0x0, 0x100577, 0x20, 0x2, 0x43}, &(0x7f0000000340), &(0x7f0000011000), &(0x7f0000000000)) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(0x0, &(0x7f0000000140)='./file0/../file0\x00', 0x0, 0x100000, 0x0) pivot_root(&(0x7f0000000100)='./file1\x00', &(0x7f0000000280)='./file0/../file0\x00') mount$bind(&(0x7f0000000080)='./file0/file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b1052, 0x0) mount$bind(0x0, &(0x7f0000000240)='./file0/file0\x00', 0x0, 0x80000, 0x0) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mountinfo\x00') read$FUSE(r0, &(0x7f0000002380)={0x2020}, 0x2020) 17.299251886s ago: executing program 3 (id=1730): openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x40, 0x1) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=']) read$FUSE(r0, &(0x7f00000021c0)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_GETXATTR(r0, &(0x7f00000001c0)={0x18, 0x0, r1, {0x3}}, 0x18) 17.076231571s ago: executing program 3 (id=1732): r0 = add_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000100)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffc) r1 = add_key(&(0x7f0000000040)='asymmetric\x00', 0x0, &(0x7f0000000200)="308205553082033da00302010202147398ea982dd02ea8b1cf57c7f297b3e61afc8c0a300d06092a864886f70d01010b050030343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b65793020170d3232303531383232333234315a180f32313232303432343232333234315a30343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b657a30820222300d06092a864886f70d01010105000382020f003082020a0282020100ccac49dd3bcab0157e846ab20a695f1c0a61823b4f2ca3952c08584bb15d99e0c3c179c2b3ebc01e6d3e541dbdb7927b4db59558b2522ec6244b7163803277a7385edb72ae6e0decfbb66d017fe95566dfbf1d76780231e8e507f8b7825c0dd4bbfba2590d2e3a78953a8b4606474446d7cd066a4113e319f6bb6e38f48301a3bf4a394fd70ae938b3f594144eddf743fd24b2493ca5f77a7cd4453d977568f1ed4c420b70ca85f3dee5882cc5beb69734ba2402cd8b869fa973ca73cf9281ee7555bb18675cff3fb5dd331b0ce978db5ccfaa5c4342df5ea96decd7d7ffe6a13a921adaaef68c6f7bd5b46e06e98fe8de093189ed0e11a1fa8ae9e964596253dad170be11d4999711cf99de0b9d947eaab852ea37db907e35bdd9fe6d0a487028ddd50d7f03809314238fb922cd7c29fef172b55c0b12cf9c15f6114c7a45258c450a34ac2d9a81ca0b1322cdeb1a38881897960881aacc8f0f8a327b7668036843bf11ba5560fd801c0d9b69b60972bc0f412f0782c6e3b21391c46d149531be19bdbcede14c74a2e0780bbb94ec4c533aa2b5841d4b657edcf7db367dbe9e3b366642667635bfbef0c13c7ce9425c24530305a86724500275ff24463b358976e670dac5518c9ae505b00bd02dd47d5775946bf90aad0e410015d04fc07f902d18488f28fe5da7cd999ebd026c8a31f31cc74be693cd42a2e46810479dfc210203010001a35d305b300c0603551d130101ff04023000300b0603551d0f040403020780301d0603551d0e04160414f58703bb33ce1b73ee02eccdee5b8817518fe3db301f0603551d23041830168014f58703bb33ce1b73ee02eccdee5b8817518fe3db300d06092a864886f70d01010b05000382020100c02e12417b738516c8db8679e8f5cd44f4c6e281235e47cbab25f11e583e317f78ad85ebfe148860f77fd226a2f4982afdba050c203312cc4d1461648193d333edc8fff178cc5f519f09d7be0d5c74fd9bdf524ac9a871253304106736d0b30bc9a14072ae417b68e6e47bd028f76de73f50fc917c9156d4dfa6bbe84d1b58aa28fac119eb112f248b7cc5a98626aa6eb79bd5f806fb02527b9c9ea1e0078b5ee4b85529f648521c1b542d46d8e571b960d145b592898a63582ab3c6b276e23c825904ae5ac4997b2e4b4657b82924b2fdee2c0da483fa652a07358b97cfbd962ed17e6cc21e87b66c7665b5b262da8be973e3db33dd133a17636a76de8d8fe04761283a83ff8fe7c7e04aa3e507cfe98c35352ee7806631bf91580ae1253d38d3a4f059344707620fbe30dd818858f028b096e582f805b71301bcfac61f8672ccf9ee8ed9d6048c246cbf0f5d3739cf45c1933ad2ed5c5879748662307e8ebbdd7aa9edca40cb6247f4b49f527f7263a8f02baf452a48196de3fbf9196669c8cc62876c532b2d6e906c543a822541cb186aa422a8a1c447d781001c15510f1aafef9fa6618cbd6b8bede6ac0eb63a4c92e60f910a0f71c7a0b90d3a175a6f35c8e7504f46e870604806828b6658e673919c123d358e46ad5af5b3db692104fdd31cdf949d56b00ad195768dec9edd0b159764ade5f26202fc9e5f56423905b3", 0x559, r0) keyctl$KEYCTL_PKEY_DECRYPT(0x1a, &(0x7f0000000180)={r1}, &(0x7f0000000780)={'enc=', 'oaep', ' hash=', {'blake2s-224-generic\x00'}}, 0x0, 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000180)=ANY=[@ANYBLOB="58000000020605000000000000000000000000000c000780080008"], 0x58}}, 0x24000044) (async, rerun: 32) r2 = socket$packet(0x11, 0x3, 0x300) (rerun: 32) setsockopt$packet_int(r2, 0x107, 0xf, &(0x7f00000000c0)=0xa, 0x4) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'ip6_vti0\x00', 0x0}) sendto$packet(r2, &(0x7f0000000180)="10031200e0ff020002004788aa96a13bb100001100007fca1a00", 0x1000a, 0x0, &(0x7f0000000140)={0x11, 0x0, r3}, 0x14) signalfd(r2, &(0x7f0000000080)={[0x4]}, 0x8) 17.017062793s ago: executing program 33 (id=1732): r0 = add_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000100)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffc) r1 = add_key(&(0x7f0000000040)='asymmetric\x00', 0x0, &(0x7f0000000200)="308205553082033da00302010202147398ea982dd02ea8b1cf57c7f297b3e61afc8c0a300d06092a864886f70d01010b050030343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b65793020170d3232303531383232333234315a180f32313232303432343232333234315a30343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b657a30820222300d06092a864886f70d01010105000382020f003082020a0282020100ccac49dd3bcab0157e846ab20a695f1c0a61823b4f2ca3952c08584bb15d99e0c3c179c2b3ebc01e6d3e541dbdb7927b4db59558b2522ec6244b7163803277a7385edb72ae6e0decfbb66d017fe95566dfbf1d76780231e8e507f8b7825c0dd4bbfba2590d2e3a78953a8b4606474446d7cd066a4113e319f6bb6e38f48301a3bf4a394fd70ae938b3f594144eddf743fd24b2493ca5f77a7cd4453d977568f1ed4c420b70ca85f3dee5882cc5beb69734ba2402cd8b869fa973ca73cf9281ee7555bb18675cff3fb5dd331b0ce978db5ccfaa5c4342df5ea96decd7d7ffe6a13a921adaaef68c6f7bd5b46e06e98fe8de093189ed0e11a1fa8ae9e964596253dad170be11d4999711cf99de0b9d947eaab852ea37db907e35bdd9fe6d0a487028ddd50d7f03809314238fb922cd7c29fef172b55c0b12cf9c15f6114c7a45258c450a34ac2d9a81ca0b1322cdeb1a38881897960881aacc8f0f8a327b7668036843bf11ba5560fd801c0d9b69b60972bc0f412f0782c6e3b21391c46d149531be19bdbcede14c74a2e0780bbb94ec4c533aa2b5841d4b657edcf7db367dbe9e3b366642667635bfbef0c13c7ce9425c24530305a86724500275ff24463b358976e670dac5518c9ae505b00bd02dd47d5775946bf90aad0e410015d04fc07f902d18488f28fe5da7cd999ebd026c8a31f31cc74be693cd42a2e46810479dfc210203010001a35d305b300c0603551d130101ff04023000300b0603551d0f040403020780301d0603551d0e04160414f58703bb33ce1b73ee02eccdee5b8817518fe3db301f0603551d23041830168014f58703bb33ce1b73ee02eccdee5b8817518fe3db300d06092a864886f70d01010b05000382020100c02e12417b738516c8db8679e8f5cd44f4c6e281235e47cbab25f11e583e317f78ad85ebfe148860f77fd226a2f4982afdba050c203312cc4d1461648193d333edc8fff178cc5f519f09d7be0d5c74fd9bdf524ac9a871253304106736d0b30bc9a14072ae417b68e6e47bd028f76de73f50fc917c9156d4dfa6bbe84d1b58aa28fac119eb112f248b7cc5a98626aa6eb79bd5f806fb02527b9c9ea1e0078b5ee4b85529f648521c1b542d46d8e571b960d145b592898a63582ab3c6b276e23c825904ae5ac4997b2e4b4657b82924b2fdee2c0da483fa652a07358b97cfbd962ed17e6cc21e87b66c7665b5b262da8be973e3db33dd133a17636a76de8d8fe04761283a83ff8fe7c7e04aa3e507cfe98c35352ee7806631bf91580ae1253d38d3a4f059344707620fbe30dd818858f028b096e582f805b71301bcfac61f8672ccf9ee8ed9d6048c246cbf0f5d3739cf45c1933ad2ed5c5879748662307e8ebbdd7aa9edca40cb6247f4b49f527f7263a8f02baf452a48196de3fbf9196669c8cc62876c532b2d6e906c543a822541cb186aa422a8a1c447d781001c15510f1aafef9fa6618cbd6b8bede6ac0eb63a4c92e60f910a0f71c7a0b90d3a175a6f35c8e7504f46e870604806828b6658e673919c123d358e46ad5af5b3db692104fdd31cdf949d56b00ad195768dec9edd0b159764ade5f26202fc9e5f56423905b3", 0x559, r0) keyctl$KEYCTL_PKEY_DECRYPT(0x1a, &(0x7f0000000180)={r1}, &(0x7f0000000780)={'enc=', 'oaep', ' hash=', {'blake2s-224-generic\x00'}}, 0x0, 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000180)=ANY=[@ANYBLOB="58000000020605000000000000000000000000000c000780080008"], 0x58}}, 0x24000044) (async, rerun: 32) r2 = socket$packet(0x11, 0x3, 0x300) (rerun: 32) setsockopt$packet_int(r2, 0x107, 0xf, &(0x7f00000000c0)=0xa, 0x4) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'ip6_vti0\x00', 0x0}) sendto$packet(r2, &(0x7f0000000180)="10031200e0ff020002004788aa96a13bb100001100007fca1a00", 0x1000a, 0x0, &(0x7f0000000140)={0x11, 0x0, r3}, 0x14) signalfd(r2, &(0x7f0000000080)={[0x4]}, 0x8) 8.990431819s ago: executing program 4 (id=1819): getsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000100)={@private0, 0x3, 0x1, 0x0, 0x8}, 0x0) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x3) ioctl$FS_IOC_GETFSLABEL(r0, 0x400452c9, &(0x7f0000000100)) 8.95722775s ago: executing program 4 (id=1820): mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='dev\x00', 0x1ff) mount(0x0, &(0x7f0000000500)='dev\x00', &(0x7f0000000600)='devtmpfs\x00', 0x0, 0x0) capset(&(0x7f0000000080)={0x20071026}, &(0x7f0000000040)={0x208004, 0x21fffc, 0x1, 0x0, 0xc, 0xffff0000}) syz_init_net_socket$nfc_llcp(0x27, 0x3, 0x1) syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040f905ffff0001010203010902200001010080fa0904000002ff000000070581024000000705020240"], 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='dev/ttyUSB0\x00', 0x2, 0x0) mlockall(0x2) write(r0, &(0x7f0000000640)="6ec51ae8d114181e1f1ecd9a161ca5da67a6b74ff39637e0fd5ad787affd7aa61ea099cd7c5731f82c971c92077c4a68f2d840b334d6a54c0a", 0x39) 5.929464025s ago: executing program 4 (id=1873): r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000540)=ANY=[@ANYBLOB="120141014813442024040075ee69010203010902240001000010000904b8070259d1ca000905060200020d0006090582020002"], 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000280)={0x84, &(0x7f0000000340)=ANY=[@ANYBLOB="402004000000a0"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000740)={0x44, &(0x7f0000000000)=ANY=[@ANYBLOB="601004"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r2, 0x8933, &(0x7f0000000580)={'batadv_slave_1\x00', 0x0}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000001040)={'gre0\x00', &(0x7f0000000100)={'syztnl2\x00', r3, 0x80, 0x3c30, 0xfffffffe, 0x0, {{0x5, 0x4, 0x0, 0x3d, 0x14, 0x65, 0x0, 0x0, 0x2f, 0x0, @private=0xa010100, @multicast2}}}}) fcntl$addseals(0xffffffffffffffff, 0x409, 0x0) syz_usb_control_io(r0, &(0x7f0000000480)={0x2c, &(0x7f0000000080)={0x40, 0x22, 0x82, {0x82, 0x23, "2859ad41fcb6d948723a85211b4f9082277a1d7c4c03f140f220833dea06cb3f94449d8d30633d5f08bcfb44549d74cbee2367c38c7d00a0f2c56dccb42c9a84c4e4f3ae245a03dab8d75c765b3da47039a9bc4cc6ebb4d4751a81da77ea6838498340b52b4439e98f160eb0c0d60c1951c13c9731fc5a5d0794e3d36ca0c69b"}}, &(0x7f0000000140)={0x0, 0x3, 0xe2, @string={0xe2, 0x3, "028471d07b681ac2ff7e0857c83760e6d838faf0b2d44e17fb935481e4abc6ad844b3b60fc4a7ad526a723f1cefb7645860f4015dd2a014ea52eef294c7949ca85f21d985b2b48bad0d4fe88d3d3d2a481e3f2a246e02668c4f46435835be83349c6acbfb57601c686dba05b9a56ca625b546764dc2498a04fbe7cf2f368e03d7d51242b6689ce8f789622a3282ab891b0b2785adc8b94a73038ad3b2e5a431f40b09fe9182327e506c9f4000dddbb048c5e0e8ba266dc1e1e9682cf7c13a54e23bfd9eb0cc1703458a85800ccfaee012d24ca75281cb406c0044762b9b501f2"}}, 0x0, 0x0, &(0x7f0000000440)={0x20, 0x2a, 0xfffffffffffffcd6, {0xc, 0x2a, 0x7, 0xe2, 0x9, 0x7, 0x7, 0xff10, 0x4}}}, &(0x7f0000000380)={0x84, &(0x7f0000000b40)={0x40, 0x7, 0x44, "26388d8184b217ec3411eacb3220e736060a0587402e07714a0177fe8811a2cab23f3058a1ec0a95ab99139d5bd23570566844658174dcc51016d180786f38d78dc4bce6"}, &(0x7f0000000500)={0x0, 0xa, 0x1, 0x96}, &(0x7f0000000580)={0x0, 0x8, 0x1, 0x4}, &(0x7f00000005c0)={0x20, 0x0, 0x4, {0x0, 0x2}}, &(0x7f0000000600)={0x20, 0x0, 0x4, {0x0, 0x10}}, &(0x7f0000000640)={0x40, 0x7, 0x2, 0xa65c}, &(0x7f0000000680)={0x40, 0x9, 0x1, 0xac}, &(0x7f00000006c0)={0x40, 0xb, 0x2, "80d1"}, &(0x7f0000000040)={0x40, 0xf, 0x2, 0x4}, 0x0, 0x0, 0x0, 0x0, &(0x7f00000008c0)={0x40, 0x1c, 0x1, 0x1}, 0x0, 0x0}) 2.709306284s ago: executing program 4 (id=1885): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x40000) 2.589101036s ago: executing program 4 (id=1887): r0 = socket$inet(0x2, 0x3, 0x6) r1 = socket$inet_tcp(0x2, 0x1, 0x0) connect$vsock_stream(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f0000000080)={'veth0_vlan\x00', &(0x7f0000000000)=@ethtool_coalesce={0x26, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800, 0x0, 0x400000}}) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x12, r2, 0x0) ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f0000000000)={{0x2, 0x4e23, @broadcast}, {0x1, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x18}}, 0x6f631b4376e74f58, {0x2, 0x0, @multicast2}}) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) ioctl$sock_inet_SIOCSARP(r0, 0x8953, &(0x7f0000000000)={{0x2, 0x1000, @local}, {0x7, @local}, 0x42, {0x2, 0x0, @private=0xa010102}, 'syz_tun\x00'}) r3 = socket$inet6(0xa, 0x2, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000100)={'sit0\x00', &(0x7f00000000c0)={@mcast2, @private=0xa010102, 0x15, 0x8}}) mount$tmpfs(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080), 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB='nr_inodes=1']) setxattr$trusted_overlay_origin(&(0x7f0000000180)='./file0\x00', &(0x7f0000000000), 0x0, 0x0, 0x0) syslog(0x2, 0x0, 0x0) sendmmsg$inet(r3, &(0x7f0000000000)=[{{&(0x7f0000000240)={0x2, 0x4e23, @loopback}, 0x10, 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="340000000000000000000000070000000711"], 0x38}}], 0x1, 0x40000) 2.567303527s ago: executing program 4 (id=1889): r0 = syz_usb_connect(0x2, 0x2d, &(0x7f0000000480)={{0x12, 0x1, 0x110, 0x81, 0xac, 0xd8, 0x40, 0xdf6, 0x56, 0xd24b, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x7f, 0x0, 0x50, 0xf, "", [{{0x9, 0x4, 0x39, 0x0, 0x1, 0x7a, 0xfa, 0x71, 0x2c, [], [{{0x9, 0x5, 0xc, 0x2, 0x3ff, 0x3, 0xc, 0x9}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, &(0x7f0000000a00)={0x2c, 0x0, &(0x7f0000000400)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x280a}}, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000340)={0x2c, &(0x7f0000000000)={0x0, 0x22, 0x100, {0x100, 0x6, "85d91c6c71efef5e4959468c413bd9dc80849dc9dcf2b2bd4b977c30cdea332f67447c81b4289a399d94d2ed74b427e21177c1e1e81cb028fa8d42a9cfb5abcf03301883b76af5431cac0601d7a62df265c445f589e206b7c302167143f38129b9034a90ca9c15e77ac855d69980a1d5f1ae44e3ad160b682162953fcab3299ccf56a299c16234b0a5f10753091afc6dcd0d976f7291221185bd16494e8b7cbff01c8c51464d8604a52c66b8329cc521b9be580b6b826a47ee4b58a6487b523a2d5c4e32dfd5b758eb36d6d461c9e2cf85430833572cd0ba80ef51e67bbb412807a2165fe4cb07f75bd164a8d292fe018599e64f1dd006c416ae585dacc9"}}, &(0x7f0000000140)={0x0, 0x3, 0xa0, @string={0xa0, 0x3, "400d5d680300d2088f04c78deee936fb15a94cd41274007a56dcaf8a928e51ee6e265cb3f22d0a7e4f90786a86527aff94f98fa5a2fe4027163381092bc4db8fd785276603ed3551c94f365f58758e6d5e7977c76cf0f14fcbe3229005be42e662cd5d74152ea2516a94e032b07ef2089acd0a03a8f9c948e221cf050e94b212d5e34e74a82dffa4965b4f1d1bf16cf60297b95e3647304b1be850855d87"}}, &(0x7f0000000200)={0x0, 0xf, 0x84, {0x5, 0xf, 0x84, 0x4, [@ext_cap={0x7, 0x10, 0x2, 0x14, 0x2, 0x2, 0x5}, @ptm_cap={0x3}, @wireless={0xb, 0x10, 0x1, 0xc, 0x40, 0x2, 0x3, 0x3, 0x8}, @generic={0x6a, 0x10, 0xb, "8ebe7d9a61d5186c0ed9fc198311e55c2579cbd789d35f76347b8118d5e5f52031e778957c709d91ec10c6f9a25b557bce75fa3e178238dddb2053335e1e1f91f52ebea7d9741b385636fc22482a75a887ae7a4d10717ff9f4cc5305ddb7a58b55f3e1e641cc88"}]}}, &(0x7f00000002c0)={0x20, 0x29, 0xf, {0xf, 0x29, 0x0, 0x8, 0x0, 0x7, "de4d69d6", "7e9007bc"}}, &(0x7f0000000300)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x7, 0x18, 0xfc, 0x4a, 0x7, 0x9, 0x6}}}, &(0x7f0000000840)={0x84, &(0x7f0000000380)={0x0, 0xe, 0x5e, "1f214b0aefad6c8cfd7be34e3223c11543ea22ccb6a24a48e132b5f64dbe8b051ada7029044732eeb2bc1040a8694710a7a679184d648d3ed4a530c3a51c565a90fd65162c3d0fd6f846558872c8ef52062ccdf4ff23a5b0cf0258781f67"}, &(0x7f0000000440)={0x0, 0xa, 0x1, 0x5}, &(0x7f00000004c0)={0x0, 0x8, 0x1, 0x8}, &(0x7f0000000500)={0x20, 0x0, 0x4, {0x1, 0x1}}, &(0x7f0000000540)={0x20, 0x0, 0x8, {0x0, 0x20, [0xff00]}}, &(0x7f0000000580)={0x40, 0x7, 0x2, 0x10}, &(0x7f00000005c0)={0x40, 0x9, 0x1, 0x2}, &(0x7f0000000600)={0x40, 0xb, 0x2, "d99f"}, &(0x7f0000000640)={0x40, 0xf, 0x2, 0x4}, &(0x7f0000000680)={0x40, 0x13, 0x6}, &(0x7f00000006c0)={0x40, 0x17, 0x6, @local}, &(0x7f0000000700)={0x40, 0x19, 0x2, "cd3c"}, &(0x7f0000000740)={0x40, 0x1a, 0x2, 0x7}, &(0x7f0000000780)={0x40, 0x1c, 0x1, 0x1}, &(0x7f00000007c0)={0x40, 0x1e, 0x1, 0xa}, &(0x7f0000000800)={0x40, 0x21, 0x1, 0x7f}}) 2.06148066s ago: executing program 2 (id=1900): r0 = add_key$keyring(&(0x7f0000000280), &(0x7f00000002c0)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$KEYCTL_MOVE(0x1e, r0, r0, 0x0, 0x0) io_setup(0x4, &(0x7f0000002380)) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) r1 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000), 0x8400, 0x0) openat$dir(0xffffffffffffff9c, 0x0, 0xa880, 0x97) r2 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r2, &(0x7f0000000100)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_int(r2, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000140)=0x2, 0x4) connect$inet(r2, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000340)=[@sack_perm, @sack_perm, @window={0x3, 0x9, 0x9}, @mss={0x2, 0x1}, @window={0x3, 0x8, 0x6}, @sack_perm, @sack_perm, @sack_perm], 0x8) sendto$inet(r2, &(0x7f0000000000)="b8", 0x1, 0x2400a044, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r2, 0x6, 0x13, &(0x7f00000001c0), 0x4) r3 = syz_open_dev$loop(&(0x7f0000000700), 0x6, 0x101000) ioctl$BLKPG(r3, 0x1269, &(0x7f0000000840)={0x1, 0x0, 0x98, &(0x7f0000000780)={0x5, 0xffffffffffffa530, 0x7}}) r4 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x800) recvfrom$inet_nvme(r4, 0x0, 0x0, 0x12020, 0x0, 0x0) shutdown(r2, 0x1) openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/timers\x00', 0x0, 0x0) setsockopt$inet6_udp_int(r1, 0x11, 0x1, &(0x7f0000000080)=0xe, 0x4) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) add_key(&(0x7f0000000040)='asymmetric\x00', 0x0, &(0x7f0000000400)="308201d43082017ba00302010202142eea648d7f17e62e9e5869c887c68e1bd0f86fde300a06082a8648ce3d040302303a3138303606035504030c2f436572746966696361746520766572696669636174696f6e2045434453412073656c662d74657374696e67206b65793020170d3234c218ce4c3232313632365a180f32313234303332303232313632365a303a3138303606035504030c3f436572746966696361746520766572696669636174696f6e2045434453412073656c662d74657374696e67206b65793059301306072a8648ce3d020106082a8648ce3d0301070342000407e56b51affc19412c88926b775771039ee2fe6e6a714ec7299f90e177189fc2e70a82d08ae181a9717c5a73fb25b95b1e248c739ff838f848b4ad1619c022c6a35d305b301d0603551d0e041604142900bcea1deb7bc8479a84a23d758efdfdd2b2d3301f0603551d230418301680142900bcea1deb7bc8479a84a23d758efdfdd2b2d330800603551d130101ff04023000300b0603551d0f040403020780300a06082a8648ce3d040302034700304402201ad7ac07c89738f489437ec7666ea5007c121db409760c996b8c265de9705cb4022073b7c77a5adb670a964219cf4f674f356aee2925f24fc810149d79691c7ad75d07", 0x1d9, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x7, 0x1) 1.869106564s ago: executing program 2 (id=1902): prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f00000001c0)={0x2, &(0x7f0000000000)=[{0x3c, 0x6}, {0x6}]}) mkdirat(0xffffffffffffffff, &(0x7f0000000080)='./debug\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./debug\x00', &(0x7f0000000100)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./debug\x00', 0x0, 0x20) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x109181, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f00000000c0)={0x1, 0x2, 0xdddd0000, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_GET_DIRTY_LOG(r2, 0x4010ae42, &(0x7f0000000340)={0x1, 0x0, &(0x7f0000d05000/0x1000)=nil}) read$char_usb(r0, &(0x7f0000000200)=""/136, 0x88) r3 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000280)={'veth0_virt_wifi\x00', 0x0}) ioctl$LOOP_SET_STATUS64(0xffffffffffffffff, 0x4c04, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x1, 0x2, 0x0, 0x0, 0x19, 0xd, "ef359f413bb93852f7d6a4ae6dddfbd1ce5d29c2ee5e5ca9000ff8ee09e737ff0edf110ff4117639c2eb4b78c660e677df701905b9aafab4afaaf755a3f6a004", "036c47c6780800d1cbf7966d61f53dc17769048b0000fd0c000000000000000000000000000000000200000000000000000000000000008000", "f28359738e229a4c66810000000000d300e6d602000000000000000000000001", [0x8]}) sendmsg$can_raw(r3, &(0x7f0000000000)={&(0x7f0000000580)={0x1d, r4}, 0x10, &(0x7f00000003c0)={&(0x7f0000000400)=@canfd={{0x4, 0x1, 0x1, 0x1}, 0x41, 0x3, 0x0, 0x0, "cca6f1e10194fd9304e8689818861d84be21875faed70061c5322a4ca48de2c8afc31232034c834cdc4586231d4cd7fcc6c6ad00"}, 0x48}, 0x2}, 0x8010) read$FUSE(r0, 0x0, 0x0) ioctl$PPPIOCATTCHAN(r0, 0x40047438, &(0x7f0000000000)=0x4) 1.814665986s ago: executing program 5 (id=1905): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x60001, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) write$tun(r0, &(0x7f0000000380)=ANY=[], 0xfdef) 1.773460417s ago: executing program 5 (id=1909): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r1, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) setsockopt$inet6_MCAST_JOIN_GROUP(r1, 0x29, 0x2a, &(0x7f0000000000)={0x7, {{0xa, 0x4e21, 0x2, @mcast2, 0x400}}}, 0x88) setsockopt$inet6_MCAST_MSFILTER(r1, 0x29, 0x30, &(0x7f00000000c0)={0x1, {{0xa, 0x4e20, 0xc000000, @mcast1}}, 0x1, 0x1, [{{0xa, 0x4e22, 0xe, @mcast1, 0x81}}]}, 0x110) chdir(&(0x7f0000000000)='./file0/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/file0\x00') mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r3 = syz_kvm_setup_syzos_vm$x86(0xffffffffffffffff, &(0x7f0000c00000/0x400000)=nil) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0x67) mount$binderfs(0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='max=', @ANYRESOCT=r3]) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000000)='devpts\x00', 0x0, &(0x7f0000000100)) io_setup(0x7, &(0x7f0000000080)=0x0) io_pgetevents(r4, 0x7, 0x0, 0x0, 0x0, 0x0) signalfd4(r0, &(0x7f0000001000)={[0x7]}, 0x8, 0x80800) r5 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r8, 0xc008ae88, &(0x7f0000000100)={0x1, 0x0, [{0x400000f4, 0x0, 0x7ff}]}) ioctl$KVM_GET_MSRS_cpu(r5, 0xc008ae88, &(0x7f0000000140)) 1.716504618s ago: executing program 5 (id=1910): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={0x0, 0x1c}}, 0x40000) 1.716128008s ago: executing program 5 (id=1912): capset(&(0x7f0000000080)={0x20071026}, &(0x7f0000000040)={0x200000, 0x200000, 0x4, 0x0, 0x0, 0xfffffffe}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$unix(r0, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="14000000000000000100000001"], 0x18}, 0x0) prlimit64(0x0, 0x7, &(0x7f0000000140), 0x0) sendmmsg$unix(r1, &(0x7f0000005400)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="140000000000fe000100000001"], 0x18, 0x40000}}], 0x1, 0x4004080) 1.645088s ago: executing program 5 (id=1913): mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x0, 0x0}}, &(0x7f0000000300)) pipe(&(0x7f0000000640)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r0, &(0x7f0000000000), 0xfffffecc) getsockopt$CAN_RAW_LOOPBACK(r0, 0x65, 0x3, &(0x7f0000000000), &(0x7f0000000040)=0x4) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) ioctl$KVM_GET_MSR_FEATURE_INDEX_LIST(r1, 0x4018aee2, 0x0) 1.028558645s ago: executing program 2 (id=1925): r0 = userfaultfd(0x80801) mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x2000009, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000002c0)={0xaa, 0x100}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, 0x0) syz_open_dev$ublk_chdev(&(0x7f0000002000), 0x0, 0x2) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x9, 0x4, 0x6, 0xfffa}, 0x1d, [0x1, 0xc95a, 0xfffffff3, 0x9, 0x80, 0x2, 0x3, 0x7f, 0x6, 0x4d, 0x39cc191a, 0x5c, 0x9, 0x5, 0x2, 0xffffffff, 0x6, 0x3, 0x0, 0x2ab, 0x4, 0x7, 0x4, 0x3c5b, 0x1, 0x2, 0x9, 0x1, 0x1f461e2c, 0x7, 0xe661, 0x7fff, 0xb, 0x3, 0x7fff, 0x4c74, 0x80000000, 0x800242, 0xffffffff, 0xe, 0x0, 0x71, 0x2, 0x406, 0x3, 0x2, 0x5, 0x3e, 0x8f, 0x6, 0x6, 0x3, 0x80092a6, 0x1004, 0x1, 0x20000000, 0x82, 0x0, 0x7, 0x6, 0x8, 0x4, 0x1, 0x40], [0x10000007, 0xffff, 0x12f, 0x6, 0x10, 0xfffffff3, 0x129432e6, 0xcb, 0xf9, 0xd, 0x8, 0x5, 0x1000, 0x6, 0x43, 0x0, 0x7, 0x5, 0x2f, 0xe, 0x312, 0x1, 0x0, 0x1, 0x51, 0x4, 0x8000, 0x9, 0x3fe, 0x401, 0x6, 0x4, 0xfb, 0x5, 0x8000, 0x5f31, 0xbcf5, 0x1, 0x2, 0x2, 0x9, 0x4, 0x9, 0x8, 0x9, 0x6, 0xb, 0xa, 0x1, 0x9, 0xfffffffb, 0x2, 0x7f, 0x9, 0x1, 0x3, 0x9, 0xffffffff, 0x14000, 0x3, 0x9, 0x48c93690, 0x42, 0x400004], [0x6, 0x6, 0x80000001, 0x2, 0xff, 0x100, 0x8d2, 0x9, 0x5, 0x7fff, 0x6, 0x1, 0xd, 0x4, 0x5, 0x7fff, 0x0, 0x1f0, 0xfffffffd, 0x6, 0x86, 0x1, 0x9, 0x3e7, 0x9, 0x5, 0x2, 0x2, 0x808, 0x8, 0x5, 0x8001, 0x7, 0x38, 0x800003, 0x200, 0x80, 0x2, 0xcc52, 0x950bfb1, 0x1000, 0xa2, 0x7, 0x53cf697b, 0xfffffff9, 0x6, 0xac8, 0xbf, 0x10002, 0x403, 0x7ff, 0x3, 0x0, 0x1, 0xffff, 0x2, 0x6, 0x1c, 0x80000000, 0x3, 0x6, 0xaaed, 0x4, 0xff], [0x9, 0xbb31, 0x1ff, 0xb, 0x5, 0x1, 0x6, 0x5, 0x5102fac, 0x3, 0x80ce7, 0x1ff, 0x3, 0x7, 0x5, 0x1003, 0x101, 0x10000, 0x6, 0x7fff, 0xffff, 0xe620, 0x2, 0x2, 0x1, 0x2, 0x14c, 0x60a7, 0x6, 0x4, 0xffffffff, 0x80000000, 0x7, 0x8, 0xc8, 0xee1, 0x0, 0xffff, 0x3, 0x7f, 0x100, 0x9602, 0x4, 0x3, 0x1, 0x6, 0x1, 0x10080, 0x6, 0x8, 0x30b1d693, 0x5a2b, 0xc, 0x7, 0x5, 0x6c1b, 0x0, 0x4, 0x5, 0xb1c, 0x1, 0x200, 0xffff3441, 0xfff]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) 986.261926ms ago: executing program 0 (id=1926): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="b8000000190001000000000000000000e00000020000000000000000000000e50000000000000000002191274a00000000000000000000000a"], 0xb8}}, 0x2c000010) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in=@multicast1=0xe0000002, @in=@rand_addr=0x4000, 0x0, 0x0, 0x0, 0x4000, 0xa, 0x0, 0x0, 0x87}, {0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x5, 0xfffffffffffffffb}, {0x0, 0x40000000000000, 0x200000000000000}, 0x2}}, 0xb8}, 0x1, 0x0, 0x0, 0x4000015}, 0x2c000010) 985.902936ms ago: executing program 2 (id=1927): openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x40, 0x1) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB, @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r0, &(0x7f00000021c0)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_GETXATTR(r0, &(0x7f00000001c0)={0x18, 0x0, r1, {0x3}}, 0x18) 885.049349ms ago: executing program 2 (id=1928): keyctl$join(0x1, &(0x7f0000000280)={'syz', 0x1}) r0 = request_key(&(0x7f0000000040)='keyring\x00', &(0x7f0000000100)={'syz', 0x1}, 0x0, 0xfffffffffffffffe) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0) r1 = getpid() prctl$PR_SCHED_CORE(0x3e, 0x1200001, r1, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) ioctl$sock_FIOGETOWN(r2, 0x8903, &(0x7f0000001100)) keyctl$join(0x1, &(0x7f0000000080)={'syz', 0x0}) r3 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x82) ioctl$USBDEVFS_REAPURBNDELAY(r3, 0x4008550d, 0x0) openat$ttyS3(0xffffffffffffff9c, 0x0, 0x0, 0x0) keyctl$restrict_keyring(0x3, r0, 0x0, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) request_key(&(0x7f0000000480)='user\x00', &(0x7f0000000180)={'syz', 0x1}, 0x0, 0x0) r4 = socket$igmp(0x2, 0x3, 0x2) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r2, 0x89f1, &(0x7f0000000340)={'ip6_vti0\x00', &(0x7f00000002c0)={'ip6gre0\x00', 0x0, 0x2f, 0x5, 0x2, 0x8001, 0x12, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @remote, 0x10, 0x7800, 0x7, 0xed}}) setsockopt$MRT_ADD_VIF(r4, 0x0, 0xca, &(0x7f0000000380)={0xffffffffffffffff, 0x1, 0x8, 0x0, @vifc_lcl_ifindex=r5, @dev={0xac, 0x14, 0x14, 0x22}}, 0x10) r6 = inotify_init1(0x0) inotify_add_watch(r6, &(0x7f0000000000)='.\x00', 0x5000723) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) r7 = open$dir(&(0x7f0000000040)='./file0\x00', 0x20, 0x80) preadv2(r7, 0x0, 0x0, 0x2, 0x7, 0x1f) r8 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r8, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="1c000000140001032dbd7000fcdbdf250c00000008000100197400"], 0x1c}, 0x1, 0x0, 0x0, 0x8810}, 0x48) 884.943158ms ago: executing program 0 (id=1929): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000500)=ANY=[@ANYBLOB="bc000000000105060100000000000000020000003400018014000180080001007f000001080002007f0000011c000280050001002100000006000200303900000600030006bb00003400028014000180080001007f000001080002007f0000011c00028005000100060000000600020006bb00000600030030390000080003000000000e08000700000000780d000580090001007070747000000000200004801c0001"], 0xbc}}, 0x0) 884.724738ms ago: executing program 0 (id=1930): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[], 0x1c}}, 0x40000) 884.614709ms ago: executing program 2 (id=1931): pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x2, &(0x7f00000001c0)=0x7ff, 0x4) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x8000002, 0x2004}, 0x1c) sendto$inet6(r1, 0x0, 0x0, 0x220080c1, &(0x7f0000000040)={0xa, 0x2, 0x2, @loopback, 0xfffffffd}, 0x1c) sendto$inet6(r1, &(0x7f0000000080)="44f9b108b1cdc885c9c533d21f474bec8bfef1df1e2da71e578dc6b91d09f7ab15378571d8e27546090000006e75436914ab717528ee4b7a9beaf908d11137c11903064e83b4951f4d433a5404970c85d92d7083fd38844cbb0c6c5eb508ddc2dc7a590aa7941b1e9eeb5a688138dea09b776cbfa784cbf550bf3074fb0d775da4df5a3f48bbdf452eeb6b923da9d0e25b80f76a873664b5753444fe05f33e5f91045540836c3cd6af10f0cd018f0c6f57f926ac959a5628c45088fbe0c87fbe6cbcda4662d2a12f6d00"/215, 0xd0d0c2ac, 0x1, 0x0, 0x0) splice(r1, 0x0, r0, 0x0, 0x406f413, 0x0) r2 = syz_usb_connect(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="1201000001018610f4205ae06d6c011703010902240001010000000904690202ff5aa30009050402100000fa000905820240"], 0x0) syz_usb_control_io$hid(r2, 0x0, 0x0) syz_usb_control_io(r2, 0x0, 0x0) syz_usb_control_io(r2, 0x0, &(0x7f0000000b40)={0x44, &(0x7f0000000700)=ANY=[@ANYBLOB="000e50"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r2, 0x0, &(0x7f00000005c0)={0x34, &(0x7f00000003c0)={0x0, 0x11, 0x6, "89ff5892b538"}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(r2, 0x0, &(0x7f0000000500)={0x44, &(0x7f0000000a40)={0x20, 0x5, 0x3, "2fec71"}, &(0x7f0000000280)={0x0, 0xa, 0x1, 0x6}, &(0x7f00000002c0)={0x0, 0x8, 0x1, 0xff}, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$sock_SIOCGIFVLAN_GET_VLAN_INGRESS_PRIORITY_CMD(r1, 0x8982, &(0x7f0000000180)) 875.612069ms ago: executing program 0 (id=1932): r0 = fsopen(&(0x7f0000000140)='ext3\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000100)='test_dummy_encryption', &(0x7f0000000240)='v2\x00ul\x00\x00\x00\x00\x00loc\x8d\x8b#\xe0\xb9\xbd\"\xeb.\xc7]\xa67\x97 \xc9\xfc|\x85o\x1cZ\xdc}U\x8c\xdd\n\xaa?4\xafq\x1d\xf6(\xe6\x9em_\x1a\xbfDi\x15\x81\xd47\x8e\x86\xa2u~FC\x9c\xe3\x98\x87\x98\xf7\xa2\xb5\x12\x8cv\xe4_\x91\xa8G!mm\f\xcf\xfb[\xd5Qf\x15\xfe\xc80\xad\xaa\xe9', 0x0) 866.092739ms ago: executing program 0 (id=1933): mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0x1c1) pipe2$9p(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$inet(0x2, 0x2, 0x1) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_xfrm(0x10, 0x3, 0x6) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000b80), 0x8, &(0x7f0000000180)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) rename(&(0x7f00000003c0)='./file1\x00', &(0x7f0000000440)='./bus\x00') mount$incfs(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='./file0\x00', &(0x7f0000000200), 0x80, 0x0) r2 = open_tree(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mkdirat(r2, &(0x7f0000000100)='./file0\x00', 0x88) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r4, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r3, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[@cred={{0x1c}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x10}}, @rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x88}, 0x80) socketpair$unix(0x1, 0x2, 0x0, 0x0) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_SET(r7, &(0x7f0000000380)={&(0x7f0000000080), 0xc, &(0x7f0000000340)={&(0x7f00000000c0)={0x20, 0x3, 0x8, 0x3, 0x0, 0x0, {0x5, 0x0, 0x5}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x20000000}, 0x1) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000001c0)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r9 = socket$inet6_tcp(0xa, 0x1, 0x0) r10 = dup(r9) syz_ublk_setup_queues(r10, r8, &(0x7f00000004c0)={0x0, 0xbd, 0x10, 0x1, 0x7f}, &(0x7f0000000540)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe708, 0x42, 0x1000002, 0x91, 0x0, r5}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3b00, 0x2, 0x1, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x93ea, 0x2000, 0x4003bfff, 0x2b9, 0x0, r6}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5, 0x800, 0x1, 0x26d}}], 0x1, 0x0, 0x0) r11 = dup(r1) mount$9p_fd(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000000), 0x2004402, &(0x7f0000000140)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r11}, 0x2c, {[{@noxattr}]}}) sendmsg$AUDIT_TTY_GET(r11, 0x0, 0x14) 797.099591ms ago: executing program 5 (id=1934): r0 = openat$procfs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/slabinfo\x00', 0x0, 0x0) preadv(r0, &(0x7f0000000000)=[{&(0x7f0000000100)=""/4147, 0x1033}], 0x1, 0x8b3, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) keyctl$KEYCTL_MOVE(0x1e, 0x0, 0x0, 0x0, 0x2000000) r1 = socket$packet(0x11, 0x2, 0x300) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./trace\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./trace\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='trace/events/sched/sched_switch/filter\x00', 0x1, 0x8b) write(r2, &(0x7f0000000180)="9cdcc15cb02832d64387a4b719cebda12bd41ab5a9adfe9dffc495181744c735dba4dd7c73f6833bd1833d0e6cc892ffa3a7cc53ba047f873dde5fa44eab92f556c7f89567c0883ed50e1aef452d77223e295b6fdf88b4c9c67dd6e9f845d58cf04dd977cea87b8aa304d214583a1d22b49bced06e3dbb609be0d80842dad4db04e700000d38713624b5c929b79d9d78dd79a50dd7fc168db45377da21a01def24d2310f278de97dfb040ead939ca5860195ee33a3eb3501086c4841", 0xbc) read(r1, &(0x7f0000000000)=""/149, 0xaa) r3 = socket(0x8, 0x1, 0x85) setsockopt$inet6_MCAST_MSFILTER(r3, 0x10f, 0x30, 0x0, 0x610) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_CAP_MANUAL_DIRTY_LOG_PROTECT2(r5, 0x4068aea3, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x200000, &(0x7f0000200000/0x200000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000100)={0x0, 0x1, 0x26000, 0x200000, &(0x7f0000200000/0x200000)=nil}) r6 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r6, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000001d80)=[{&(0x7f0000001380)=ANY=[@ANYRESHEX=r1, @ANYRES64=r6, @ANYBLOB="2400000026000305", @ANYBLOB="a0abc700d5dacda5cb372b01bc19297f638a50feebfc24a2ba817b148238206cb613b7ad27652ed0375e7e067fe19c2b769a61a44bd8aa5658ddc7ea6dfc3d8688bdcbe6e6e469a17781cda0564dabff2f7084f91ff974276d2d6414c0bdbbc6768de07af3a9c1d75c212b72d443129bb75dc2c89ace286626faf231522f3d6b4f7d51a19c0745af27fe69a8354701bbcf4fccb6ff14d9c9aa0150f9931f7dd38d0fcc1ab2301836e11a0628013cbcfdc0d5ec584c614fe3afe3cc8167a2ade28e86f2ad7a0600a2c6f012c56c065bc9c721d755c69c012629aca8877746387d7001eb8600"/239], 0x24}], 0x1, 0x0, 0x0, 0xc005}, 0x20004e0) r7 = socket$pppl2tp(0x18, 0x1, 0x1) r8 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r7, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r8, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x3}}, 0x26) r9 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r9, &(0x7f0000000040)=@pppol2tpv3={0x18, 0x1, {0x3, r7, {0x2, 0x4e22, @broadcast}, 0x2, 0x9800}}, 0x2e) ioctl$PPPIOCGL2TPSTATS(r7, 0x80487436, &(0x7f0000000540)="43210098") syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), r6) pwritev2(0xffffffffffffffff, &(0x7f00000005c0)=[{&(0x7f0000000340)="94c0bb455a7fa228d31092cea7b91ab86e", 0x11}], 0x1, 0x6, 0x1, 0x18) r10 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r10, 0xae60) 0s ago: executing program 0 (id=1935): r0 = userfaultfd(0x80801) mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x2000009, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000002c0)={0xaa, 0x100}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, 0x0) syz_open_dev$ublk_chdev(&(0x7f0000002000), 0x0, 0x2) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x9, 0x4, 0x6, 0xfffa}, 0x1d, [0x1, 0xc95a, 0xfffffff3, 0x9, 0x80, 0x2, 0x3, 0x7f, 0x6, 0x4d, 0x39cc191a, 0x5c, 0x9, 0x5, 0x2, 0xffffffff, 0x6, 0x3, 0x0, 0x2ab, 0x4, 0x7, 0x4, 0x3c5b, 0x1, 0x2, 0x9, 0x1, 0x1f461e2c, 0x7, 0xe661, 0x7fff, 0xb, 0x3, 0x7fff, 0x4c74, 0x80000000, 0x800242, 0xffffffff, 0xe, 0x0, 0x71, 0x2, 0x406, 0x3, 0x2, 0x5, 0x3e, 0x8f, 0x6, 0x6, 0x3, 0x80092a6, 0x1004, 0x1, 0x20000000, 0x82, 0x0, 0x7, 0x6, 0x8, 0x4, 0x1, 0x40], [0x10000007, 0xffff, 0x12f, 0x6, 0x10, 0xfffffff3, 0x129432e6, 0xcb, 0xf9, 0xd, 0x8, 0x5, 0x1000, 0x6, 0x43, 0x0, 0x7, 0x5, 0x2f, 0xe, 0x312, 0x1, 0x0, 0x1, 0x51, 0x4, 0x8000, 0x9, 0x3fe, 0x401, 0x6, 0x4, 0xfb, 0x5, 0x8000, 0x5f31, 0xbcf5, 0x1, 0x2, 0x2, 0x9, 0x4, 0x9, 0x8, 0x9, 0x6, 0xb, 0xa, 0x1, 0x9, 0xfffffffb, 0x2, 0x7f, 0x9, 0x1, 0x3, 0x9, 0xffffffff, 0x14000, 0x3, 0x9, 0x48c93690, 0x42, 0x400004], [0x6, 0x6, 0x80000001, 0x2, 0xff, 0x100, 0x8d2, 0x9, 0x5, 0x7fff, 0x6, 0x1, 0xd, 0x4, 0x5, 0x7fff, 0x0, 0x1f0, 0xfffffffd, 0x6, 0x86, 0x1, 0x9, 0x3e7, 0x9, 0x5, 0x2, 0x2, 0x808, 0x8, 0x5, 0x8001, 0x7, 0x38, 0x800003, 0x200, 0x80, 0x2, 0xcc52, 0x950bfb1, 0x1000, 0xa2, 0x7, 0x53cf697b, 0xfffffff9, 0x6, 0xac8, 0xbf, 0x10002, 0x403, 0x7ff, 0x3, 0x0, 0x1, 0xffff, 0x2, 0x6, 0x1c, 0x80000000, 0x3, 0x6, 0xaaed, 0x4, 0xff], [0x9, 0xbb31, 0x1ff, 0xb, 0x5, 0x1, 0x6, 0x5, 0x5102fac, 0x3, 0x80ce7, 0x1ff, 0x3, 0x7, 0x5, 0x1003, 0x101, 0x10000, 0x6, 0x7fff, 0xffff, 0xe620, 0x2, 0x2, 0x1, 0x2, 0x14c, 0x60a7, 0x6, 0x4, 0xffffffff, 0x80000000, 0x7, 0x8, 0xc8, 0xee1, 0x0, 0xffff, 0x3, 0x7f, 0x100, 0x9602, 0x4, 0x3, 0x1, 0x6, 0x1, 0x10080, 0x6, 0x8, 0x30b1d693, 0x5a2b, 0xc, 0x7, 0x5, 0x6c1b, 0x0, 0x4, 0x5, 0xb1c, 0x1, 0x200, 0xffff3441, 0xfff]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) kernel console output (not intermixed with test programs): 0x100 [ 121.006848][ T3332] kmem_cache_alloc_noprof+0x42/0x410 [ 121.006897][ T3332] ? security_inode_alloc+0x51/0x230 [ 121.006943][ T3332] security_inode_alloc+0x51/0x230 [ 121.006972][ T3332] inode_init_always_gfp+0x756/0x9e0 [ 121.007002][ T3332] ? __cfi_sock_alloc_inode+0x10/0x10 [ 121.007031][ T3332] alloc_inode+0xc5/0x270 [ 121.007061][ T3332] new_inode_pseudo+0x19/0x40 [ 121.007091][ T3332] do_accept+0x199/0x6e0 [ 121.007123][ T3332] ? _raw_spin_lock+0x92/0x120 [ 121.007150][ T3332] ? __cfi_do_accept+0x10/0x10 [ 121.007187][ T3332] __sys_accept4+0x130/0x1f0 [ 121.007221][ T3332] ? __cfi___sys_accept4+0x10/0x10 [ 121.007255][ T3332] ? __kasan_check_read+0x15/0x20 [ 121.007279][ T3332] __x64_sys_accept+0x81/0xa0 [ 121.007312][ T3332] x64_sys_call+0x2bcc/0x2ee0 [ 121.007335][ T3332] do_syscall_64+0x57/0xf0 [ 121.007361][ T3332] ? clear_bhb_loop+0x50/0xa0 [ 121.007394][ T3332] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 121.007424][ T3332] RIP: 0033:0x7fbb7099e0d9 [ 121.007444][ T3332] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 121.007465][ T3332] RSP: 002b:00007fbb71873028 EFLAGS: 00000246 ORIG_RAX: 000000000000002b [ 121.007491][ T3332] RAX: ffffffffffffffda RBX: 00007fbb70c25fa0 RCX: 00007fbb7099e0d9 [ 121.007517][ T3332] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004 [ 121.007532][ T3332] RBP: 00007fbb71873090 R08: 0000000000000000 R09: 0000000000000000 [ 121.007548][ T3332] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 121.007563][ T3332] R13: 00007fbb70c26038 R14: 00007fbb70c25fa0 R15: 00007ffff9b01198 [ 121.007585][ T3332] [ 121.281479][ T3338] tipc: Started in network mode [ 121.286413][ T3338] tipc: Node identity ac14140f, cluster identity 4711 [ 121.293352][ T3338] tipc: New replicast peer: 255.255.255.255 [ 121.299527][ T3338] tipc: Enabled bearer , priority 10 [ 121.308294][ T3338] tipc: New replicast peer: fc02:0000:0000:0000:0000:0000:0000:0001 [ 121.481501][ T3344] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3722248192 (7444496384 ns) > initial count (200000 ns). Using initial count to start timer. [ 121.500403][ T3350] overlay: ./file1 is not a directory [ 121.635991][ T36] audit: type=1326 audit(1786154240.800:604): auid=4294967295 uid=60929 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3343 comm="syz.2.1204" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbb7099e0d9 code=0x7ffc0000 [ 121.661743][ T36] audit: type=1326 audit(1786154240.800:605): auid=4294967295 uid=60929 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3343 comm="syz.2.1204" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7fbb7095e90e code=0x7ffc0000 [ 121.694245][ T36] audit: type=1326 audit(1786154240.800:606): auid=4294967295 uid=60929 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3343 comm="syz.2.1204" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7fbb7095e90e code=0x7ffc0000 [ 121.721117][ T36] audit: type=1326 audit(1786154240.800:607): auid=4294967295 uid=60929 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3343 comm="syz.2.1204" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbb7099e0d9 code=0x7ffc0000 [ 121.747007][ T36] audit: type=1326 audit(1786154240.800:608): auid=4294967295 uid=60929 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3343 comm="syz.2.1204" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbb7099e0d9 code=0x7ffc0000 [ 121.773717][ T36] audit: type=1326 audit(1786154240.810:609): auid=4294967295 uid=60929 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3343 comm="syz.2.1204" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=267 compat=0 ip=0x7fbb7099e0d9 code=0x7ffc0000 [ 121.799397][ T36] audit: type=1326 audit(1786154240.810:610): auid=4294967295 uid=60929 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3343 comm="syz.2.1204" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbb7099e0d9 code=0x7ffc0000 [ 121.825439][ T36] audit: type=1326 audit(1786154240.810:611): auid=4294967295 uid=60929 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3343 comm="syz.2.1204" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=126 compat=0 ip=0x7fbb7099e0d9 code=0x7ffc0000 [ 121.859673][ T36] audit: type=1326 audit(1786154240.810:612): auid=4294967295 uid=60929 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3343 comm="syz.2.1204" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbb7099e0d9 code=0x7ffc0000 [ 121.887243][ T36] audit: type=1326 audit(1786154240.810:613): auid=4294967295 uid=60929 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3343 comm="syz.2.1204" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=319 compat=0 ip=0x7fbb7099e0d9 code=0x7ffc0000 [ 122.080188][ T3384] incfs: Error accessing: ./debug/kvm/halt_successful_poll. [ 122.087557][ T3384] incfs: mount failed -2 [ 122.420235][ T363] tipc: Node number set to 2886997007 [ 122.548100][ T3415] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 122.556802][ T3415] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 122.575500][ T3415] input: syz0 as /devices/virtual/input/input23 [ 122.668183][ T49] usb 3-1: new full-speed USB device number 46 using dummy_hcd [ 122.719438][ T3422] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3722248192 (7444496384 ns) > initial count (200000 ns). Using initial count to start timer. [ 122.819180][ T49] usb 3-1: config 127 has an invalid interface number: 57 but max is 0 [ 122.827479][ T49] usb 3-1: config 127 has no interface number 0 [ 122.833847][ T49] usb 3-1: config 127 interface 57 altsetting 0 endpoint 0xC has invalid maxpacket 1023, setting to 64 [ 122.846387][ T49] usb 3-1: New USB device found, idVendor=0df6, idProduct=0056, bcdDevice=d2.4b [ 122.855686][ T49] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 122.864127][ T49] usb 3-1: Product: syz [ 122.868432][ T49] usb 3-1: Manufacturer: syz [ 122.873088][ T49] usb 3-1: SerialNumber: syz [ 122.879062][ T3391] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 122.888161][ T322] usb 4-1: new high-speed USB device number 54 using dummy_hcd [ 123.038078][ T322] usb 4-1: Using ep0 maxpacket: 8 [ 123.047903][ T322] usb 4-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 123.061911][ T322] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 123.071278][ T322] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 123.080681][ T322] usb 4-1: SerialNumber: ⇀埼묋ᡚԉᲰⷼÊㄒ땿䦣ꨈ勨㣑퉿⪈é±í‚﬑çƒâ›¿ä¢¶Ã»ê­½ë½§á¿™ë«•ë¤µá›ç€…î‘–é—–ç„•êžãº±Ù©ï¿ºìˆœç˜€íš¾ì®¹äµ‰ì’™å£›Ê²í™šäšÄ‰çµ ç»ºá¦¹ï–œé¶¼ì»¬á¶ ì‰ªá™²î¿Ÿé—³â¶­â’ƒï¹œäŽç­í€·ã¤³íœ´ç…„ì¾ä€˜î”‡ä£•얧鱆렸㈮苣췸頋μ넚ꭑ䄎ã¶ì¦‘㵂鵦緪â¤è§‰ã†™à³·X [ 123.113789][ T3435] incfs: Error accessing: ./debug/kvm/halt_successful_poll. [ 123.128131][ T3435] incfs: mount failed -2 [ 123.338181][ T3391] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 123.358284][ T3456] incfs: Error accessing: ./debug/kvm/halt_successful_poll. [ 123.365712][ T3456] incfs: mount failed -2 [ 123.524911][ T3420] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 123.534161][ T3463] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 123.540946][ T3420] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 123.544642][ T3463] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 123.556476][ T49] asix 3-1:127.57 (unnamed net_device) (uninitialized): invalid hw address, using random [ 123.576353][ T3420] netlink: 'syz.3.1238': attribute type 4 has an invalid length. [ 123.586555][ T3463] netlink: 'syz.3.1238': attribute type 4 has an invalid length. [ 123.597505][ T322] cdc_ether 4-1:1.0: probe with driver cdc_ether failed with error -71 [ 123.612466][ T322] usb 4-1: USB disconnect, device number 54 [ 123.628592][ T3467] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 123.637693][ T3467] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 123.753574][ T49] asix 3-1:127.57 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 123.763867][ T49] asix 3-1:127.57 (unnamed net_device) (uninitialized): Error reading PHY_ID register: ffffffb9 [ 123.774395][ T49] asix 3-1:127.57: probe with driver asix failed with error -71 [ 123.783067][ T49] usb 3-1: USB disconnect, device number 46 [ 124.371845][ T3526] netlink: 140 bytes leftover after parsing attributes in process `syz.2.1281'. [ 124.438100][ T3534] FAULT_INJECTION: forcing a failure. [ 124.438100][ T3534] name failslab, interval 1, probability 0, space 0, times 0 [ 124.451485][ T3534] CPU: 0 UID: 0 PID: 3534 Comm: syz.1.1287 Not tainted syzkaller #0 4d4a838cf2fc485b043991145ccf8426a0241c16 [ 124.451517][ T3534] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 124.451531][ T3534] Call Trace: [ 124.451538][ T3534] [ 124.451547][ T3534] __dump_stack+0x21/0x30 [ 124.451599][ T3534] dump_stack_lvl+0x140/0x1c0 [ 124.451627][ T3534] ? __cfi_dump_stack_lvl+0x10/0x10 [ 124.451655][ T3534] ? xfrm_user_rcv_msg+0x5b0/0x900 [ 124.451677][ T3534] dump_stack+0x19/0x20 [ 124.451703][ T3534] should_fail_ex+0x3c2/0x510 [ 124.451726][ T3534] should_failslab+0xac/0x100 [ 124.451751][ T3534] kmem_cache_alloc_node_noprof+0x45/0x420 [ 124.451773][ T3534] ? __alloc_skb+0x10c/0x360 [ 124.451800][ T3534] __alloc_skb+0x10c/0x360 [ 124.451827][ T3534] netlink_ack+0x155/0xa50 [ 124.451846][ T3534] ? avc_has_perm_noaudit+0x289/0x360 [ 124.451871][ T3534] ? avc_has_perm+0x155/0x240 [ 124.451894][ T3534] netlink_rcv_skb+0x2cb/0x4e0 [ 124.451913][ T3534] ? __cfi_xfrm_user_rcv_msg+0x10/0x10 [ 124.451934][ T3534] ? __cfi_netlink_rcv_skb+0x10/0x10 [ 124.451954][ T3534] ? __kasan_check_write+0x18/0x20 [ 124.451972][ T3534] ? mutex_lock+0x97/0x1d0 [ 124.451998][ T3534] ? __cfi_mutex_lock+0x10/0x10 [ 124.452025][ T3534] ? netlink_autobind+0x1c0/0x1c0 [ 124.452047][ T3534] xfrm_netlink_rcv+0x76/0x90 [ 124.452067][ T3534] netlink_unicast+0x8bc/0xa70 [ 124.452098][ T3534] netlink_sendmsg+0x7d1/0xad0 [ 124.452119][ T3534] ? __cfi_netlink_sendmsg+0x10/0x10 [ 124.452140][ T3534] ? bpf_lsm_socket_sendmsg+0xd/0x20 [ 124.452163][ T3534] ? security_socket_sendmsg+0x3d/0x100 [ 124.452190][ T3534] ____sys_sendmsg+0x9a1/0xa00 [ 124.452211][ T3534] ? __import_iovec+0x5b9/0x7d0 [ 124.452241][ T3534] ? __sys_sendmsg_sock+0x50/0x50 [ 124.452263][ T3534] ? import_iovec+0x80/0xb0 [ 124.452290][ T3534] ___sys_sendmsg+0x2a6/0x370 [ 124.452312][ T3534] ? __sys_sendmsg+0x2a0/0x2a0 [ 124.452332][ T3534] ? proc_fail_nth_write+0x184/0x220 [ 124.452361][ T3534] ? __cfi_proc_fail_nth_write+0x10/0x10 [ 124.452394][ T3534] ? __fget_files+0x2bc/0x330 [ 124.452420][ T3534] __x64_sys_sendmsg+0x206/0x2e0 [ 124.452441][ T3534] ? fput+0x1a4/0x230 [ 124.452466][ T3534] ? __cfi___x64_sys_sendmsg+0x10/0x10 [ 124.452487][ T3534] ? ksys_write+0x1f3/0x260 [ 124.452510][ T3534] ? __kasan_check_read+0x15/0x20 [ 124.452530][ T3534] x64_sys_call+0x2a4c/0x2ee0 [ 124.452549][ T3534] do_syscall_64+0x57/0xf0 [ 124.452601][ T3534] ? clear_bhb_loop+0x50/0xa0 [ 124.452627][ T3534] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 124.452652][ T3534] RIP: 0033:0x7fd28199e0d9 [ 124.452669][ T3534] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 124.452685][ T3534] RSP: 002b:00007fd2827a2028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 124.452706][ T3534] RAX: ffffffffffffffda RBX: 00007fd281c25fa0 RCX: 00007fd28199e0d9 [ 124.452721][ T3534] RDX: 0000000020040880 RSI: 0000200000000180 RDI: 0000000000000004 [ 124.452736][ T3534] RBP: 00007fd2827a2090 R08: 0000000000000000 R09: 0000000000000000 [ 124.452749][ T3534] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 124.452762][ T3534] R13: 00007fd281c26038 R14: 00007fd281c25fa0 R15: 00007ffc7d6154a8 [ 124.452779][ T3534] [ 124.885137][ T3554] netlink: 'syz.3.1296': attribute type 16 has an invalid length. [ 124.900140][ T3554] netlink: 104 bytes leftover after parsing attributes in process `syz.3.1296'. [ 124.910997][ T3557] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3722248192 (7444496384 ns) > initial count (200000 ns). Using initial count to start timer. [ 125.060719][ T322] usb 3-1: new high-speed USB device number 47 using dummy_hcd [ 125.086464][ T3579] FAULT_INJECTION: forcing a failure. [ 125.086464][ T3579] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 125.100035][ T3579] CPU: 1 UID: 0 PID: 3579 Comm: syz.0.1309 Not tainted syzkaller #0 4d4a838cf2fc485b043991145ccf8426a0241c16 [ 125.100068][ T3579] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 125.100083][ T3579] Call Trace: [ 125.100092][ T3579] [ 125.100101][ T3579] __dump_stack+0x21/0x30 [ 125.100137][ T3579] dump_stack_lvl+0x140/0x1c0 [ 125.100169][ T3579] ? __cfi_dump_stack_lvl+0x10/0x10 [ 125.100201][ T3579] ? _parse_integer+0x2e/0x40 [ 125.100225][ T3579] ? kstrtoull+0x13b/0x1e0 [ 125.100248][ T3579] dump_stack+0x19/0x20 [ 125.100278][ T3579] should_fail_ex+0x3c2/0x510 [ 125.100305][ T3579] should_fail+0xf/0x20 [ 125.100328][ T3579] should_fail_usercopy+0x1e/0x30 [ 125.100355][ T3579] _copy_from_user+0x20/0xa0 [ 125.100398][ T3579] ___sys_sendmsg+0x1c7/0x370 [ 125.100422][ T3579] ? __sys_sendmsg+0x2a0/0x2a0 [ 125.100445][ T3579] ? proc_fail_nth_write+0x184/0x220 [ 125.100478][ T3579] ? __cfi_proc_fail_nth_write+0x10/0x10 [ 125.100513][ T3579] ? __fget_files+0x2bc/0x330 [ 125.100550][ T3579] __x64_sys_sendmsg+0x206/0x2e0 [ 125.100573][ T3579] ? fput+0x1a4/0x230 [ 125.100602][ T3579] ? __cfi___x64_sys_sendmsg+0x10/0x10 [ 125.100625][ T3579] ? ksys_write+0x1f3/0x260 [ 125.100650][ T3579] ? __kasan_check_read+0x15/0x20 [ 125.100674][ T3579] x64_sys_call+0x2a4c/0x2ee0 [ 125.100695][ T3579] do_syscall_64+0x57/0xf0 [ 125.100720][ T3579] ? clear_bhb_loop+0x50/0xa0 [ 125.100751][ T3579] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 125.100781][ T3579] RIP: 0033:0x7f2815b9e0d9 [ 125.100799][ T3579] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 125.100819][ T3579] RSP: 002b:00007f2816aca028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 125.100843][ T3579] RAX: ffffffffffffffda RBX: 00007f2815e25fa0 RCX: 00007f2815b9e0d9 [ 125.100861][ T3579] RDX: 0000000000008004 RSI: 0000200000000980 RDI: 0000000000000003 [ 125.100876][ T3579] RBP: 00007f2816aca090 R08: 0000000000000000 R09: 0000000000000000 [ 125.100891][ T3579] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 125.100906][ T3579] R13: 00007f2815e26038 R14: 00007f2815e25fa0 R15: 00007ffed5583748 [ 125.100926][ T3579] [ 125.359305][ T3588] support for the xor transformation has been removed. [ 125.408081][ T322] usb 3-1: Using ep0 maxpacket: 8 [ 125.414355][ T322] usb 3-1: config 1 interface 2 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 125.430004][ T322] usb 3-1: New USB device found, idVendor=1235, idProduct=8213, bcdDevice= 0.40 [ 125.439452][ T322] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 125.447649][ T322] usb 3-1: Product: syz [ 125.451860][ T322] usb 3-1: Manufacturer: syz [ 125.452165][ T3600] rust_binder: Failed to allocate buffer. len:8, is_oneway:false [ 125.456472][ T322] usb 3-1: SerialNumber: syz [ 125.470713][ T363] rust_binder: 3599: undelivered TRANSACTION_ERROR: 29189 [ 125.663601][ T322] usb 3-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 125.670938][ T322] usb 3-1: Focusrite Scarlett Gen 3 Mixer Driver enabled (pid=0x8213); report any issues to https://github.com/geoffreybennett/scarlett-gen2/issues [ 125.686197][ T322] usb 3-1: Error initialising Scarlett Gen 3 Mixer Driver: -22 [ 125.696417][ T322] snd-usb-audio 3-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 125.708194][ T322] usb 3-1: USB disconnect, device number 47 [ 125.722156][ T567] udevd[567]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 126.022124][ T3638] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 126.032443][ T3638] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 126.211009][ T3642] incfs_lookup_dentry err:-13 [ 126.587689][ T3671] incfs: Error accessing: ./debug/kvm/halt_successful_poll. [ 126.595070][ T3671] incfs: mount failed -2 [ 126.641119][ T3674] incfs_lookup_dentry err:-13 [ 126.665433][ T36] kauditd_printk_skb: 8 callbacks suppressed [ 126.665463][ T36] audit: type=1400 audit(1786154245.830:622): avc: denied { read } for pid=3677 comm="syz.1.1352" lport=58 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 126.801285][ T3697] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 126.817962][ T3697] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 126.859518][ T3701] futex_wake_op: syz.3.1362 tries to shift op by 144; fix this program [ 126.907081][ T3704] incfs_lookup_dentry err:-13 [ 126.951015][ T3706] FAULT_INJECTION: forcing a failure. [ 126.951015][ T3706] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 126.964390][ T3706] CPU: 0 UID: 0 PID: 3706 Comm: syz.3.1364 Not tainted syzkaller #0 4d4a838cf2fc485b043991145ccf8426a0241c16 [ 126.964421][ T3706] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 126.964432][ T3706] Call Trace: [ 126.964438][ T3706] [ 126.964445][ T3706] __dump_stack+0x21/0x30 [ 126.964471][ T3706] dump_stack_lvl+0x140/0x1c0 [ 126.964494][ T3706] ? __cfi_dump_stack_lvl+0x10/0x10 [ 126.964517][ T3706] ? inode_init_always_gfp+0x756/0x9e0 [ 126.964538][ T3706] ? proc_pident_instantiate+0x6d/0x2c0 [ 126.964558][ T3706] ? proc_tid_base_lookup+0x2f/0x40 [ 126.964583][ T3706] ? path_openat+0x1124/0x35a0 [ 126.964604][ T3706] ? do_filp_open+0x1f2/0x440 [ 126.964637][ T3706] ? __x64_sys_openat+0x13a/0x170 [ 126.964659][ T3706] dump_stack+0x19/0x20 [ 126.964678][ T3706] should_fail_ex+0x3c2/0x510 [ 126.964695][ T3706] should_fail_alloc_page+0xec/0x110 [ 126.964714][ T3706] __alloc_pages_noprof+0x1c0/0x7e0 [ 126.964736][ T3706] ? __asan_memcpy+0x5a/0x80 [ 126.964750][ T3706] ? __cfi___alloc_pages_noprof+0x10/0x10 [ 126.964771][ T3706] ? avc_has_perm_noaudit+0x289/0x360 [ 126.964790][ T3706] ? __cfi_avc_has_perm+0x10/0x10 [ 126.964807][ T3706] __pud_alloc+0xb0/0x8f0 [ 126.964824][ T3706] ? selinux_file_open+0x46c/0x630 [ 126.964845][ T3706] ? __cfi___pud_alloc+0x10/0x10 [ 126.964862][ T3706] ? __cfi_selinux_file_open+0x10/0x10 [ 126.964878][ T3706] handle_mm_fault+0x18ea/0x1ba0 [ 126.964897][ T3706] ? __cfi_handle_mm_fault+0x10/0x10 [ 126.964914][ T3706] ? find_vma+0xd3/0x120 [ 126.964930][ T3706] ? lock_mm_and_find_vma+0xb8/0x390 [ 126.964948][ T3706] do_user_addr_fault+0x4ee/0x1230 [ 126.964972][ T3706] exc_page_fault+0x58/0xc0 [ 126.964994][ T3706] asm_exc_page_fault+0x2b/0x30 [ 126.965014][ T3706] RIP: 0010:__put_user_4+0x11/0x30 [ 126.965032][ T3706] Code: 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 48 89 cb 48 c1 fb 3f 48 09 d9 0f 01 cb <89> 01 31 c9 0f 01 ca c3 cc cc cc cc 90 90 90 90 90 90 90 90 90 90 [ 126.965044][ T3706] RSP: 0018:ffffc9000ef77c30 EFLAGS: 00050206 [ 126.965058][ T3706] RAX: 000000000000c670 RBX: 0000000000000000 RCX: 0000200000000100 [ 126.965069][ T3706] RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffff8881381a717c [ 126.965079][ T3706] RBP: ffffc9000ef77c60 R08: ffff8881381a717f R09: 1ffff11027034e2f [ 126.965090][ T3706] R10: dffffc0000000000 R11: ffffed1027034e30 R12: ffff888110feb840 [ 126.965102][ T3706] R13: dffffc0000000000 R14: ffff8881381a717c R15: 000000000000c670 [ 126.965115][ T3706] ? bt_sock_ioctl+0x1c4/0x290 [ 126.965137][ T3706] rfcomm_sock_ioctl+0x51/0xa0 [ 126.965155][ T3706] sock_do_ioctl+0x115/0x330 [ 126.965174][ T3706] ? sock_show_fdinfo+0xd0/0xd0 [ 126.965192][ T3706] ? __cfi_vfs_write+0x10/0x10 [ 126.965207][ T3706] ? __kasan_check_write+0x18/0x20 [ 126.965221][ T3706] ? mutex_unlock+0x90/0x240 [ 126.965242][ T3706] sock_ioctl+0x568/0x7e0 [ 126.965258][ T3706] ? __cfi_sock_ioctl+0x10/0x10 [ 126.965276][ T3706] ? bpf_lsm_file_ioctl+0xd/0x20 [ 126.965296][ T3706] ? security_file_ioctl+0x3e/0x110 [ 126.965319][ T3706] ? __cfi_sock_ioctl+0x10/0x10 [ 126.965335][ T3706] __se_sys_ioctl+0x135/0x1b0 [ 126.965356][ T3706] __x64_sys_ioctl+0x7f/0xa0 [ 126.965373][ T3706] x64_sys_call+0x1878/0x2ee0 [ 126.965386][ T3706] do_syscall_64+0x57/0xf0 [ 126.965402][ T3706] ? clear_bhb_loop+0x50/0xa0 [ 126.965422][ T3706] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 126.965462][ T3706] RIP: 0033:0x7f1a7219e0d9 [ 126.965481][ T3706] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 126.965498][ T3706] RSP: 002b:00007f1a72ffb028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 126.965513][ T3706] RAX: ffffffffffffffda RBX: 00007f1a72425fa0 RCX: 00007f1a7219e0d9 [ 126.965524][ T3706] RDX: 0000200000000100 RSI: 0000000000005411 RDI: 0000000000000004 [ 126.965534][ T3706] RBP: 00007f1a72ffb090 R08: 0000000000000000 R09: 0000000000000000 [ 126.965544][ T3706] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 126.965553][ T3706] R13: 00007f1a72426038 R14: 00007f1a72425fa0 R15: 00007ffe82fc8418 [ 126.965566][ T3706] [ 127.419987][ T3708] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3722248192 (7444496384 ns) > initial count (200000 ns). Using initial count to start timer. [ 127.448074][ T363] usb 2-1: new full-speed USB device number 47 using dummy_hcd [ 127.568405][ T3749] SELinux: policydb magic number 0x0 does not match expected magic number 0xf97cff8c [ 127.578121][ T3749] SELinux: failed to load policy [ 127.609231][ T363] usb 2-1: config 127 has an invalid interface number: 57 but max is 0 [ 127.617513][ T363] usb 2-1: config 127 has no interface number 0 [ 127.623836][ T363] usb 2-1: config 127 interface 57 altsetting 0 endpoint 0xC has invalid maxpacket 1023, setting to 64 [ 127.636860][ T363] usb 2-1: New USB device found, idVendor=0df6, idProduct=0056, bcdDevice=d2.4b [ 127.646001][ T363] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 127.654092][ T363] usb 2-1: Product: syz [ 127.658403][ T363] usb 2-1: Manufacturer: syz [ 127.663021][ T363] usb 2-1: SerialNumber: syz [ 127.669441][ T3696] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 127.818072][ T375] usb 4-1: new low-speed USB device number 55 using dummy_hcd [ 127.974447][ T375] usb 4-1: config 0 interface 0 altsetting 254 endpoint 0x81 has invalid maxpacket 64, setting to 8 [ 127.988245][ T375] usb 4-1: config 0 interface 0 has no altsetting 0 [ 127.994954][ T375] usb 4-1: New USB device found, idVendor=0458, idProduct=5012, bcdDevice= 0.00 [ 128.004162][ T375] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 128.014341][ T375] usb 4-1: config 0 descriptor?? [ 128.019726][ T3749] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 128.081832][ T3696] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 128.238662][ T3774] netlink: 'syz.2.1382': attribute type 12 has an invalid length. [ 128.247622][ T36] audit: type=1400 audit(1786154247.410:623): avc: denied { mounton } for pid=3772 comm="syz.2.1382" path="/proc/712/task" dev="proc" ino=33861 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=dir permissive=1 [ 128.290297][ T363] asix 2-1:127.57 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 128.301087][ T363] asix 2-1:127.57: probe with driver asix failed with error -71 [ 128.311139][ T363] usb 2-1: USB disconnect, device number 47 [ 128.431390][ T375] kye 0003:0458:5012.001C: tablet report size too small, or kye_tablet_rdesc unexpectedly large [ 128.442497][ T375] kye 0003:0458:5012.001C: unknown main item tag 0x0 [ 128.449299][ T375] kye 0003:0458:5012.001C: unknown main item tag 0x0 [ 128.453454][ T36] audit: type=1326 audit(1786154247.620:624): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3772 comm="syz.2.1382" exe="/root/ci2-android-6-12-rust/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fbb7099e0d9 code=0x0 [ 128.456341][ T375] kye 0003:0458:5012.001C: unknown main item tag 0x0 [ 128.487598][ T375] kye 0003:0458:5012.001C: unknown main item tag 0x0 [ 128.494402][ T375] kye 0003:0458:5012.001C: unknown main item tag 0x0 [ 128.501244][ T375] kye 0003:0458:5012.001C: unknown main item tag 0x0 [ 128.507978][ T375] kye 0003:0458:5012.001C: unknown main item tag 0x0 [ 128.514829][ T375] kye 0003:0458:5012.001C: unknown main item tag 0x0 [ 128.521540][ T375] kye 0003:0458:5012.001C: unknown main item tag 0x0 [ 128.528316][ T375] kye 0003:0458:5012.001C: unknown main item tag 0x0 [ 128.535024][ T375] kye 0003:0458:5012.001C: unknown main item tag 0x0 [ 128.541831][ T375] kye 0003:0458:5012.001C: unknown main item tag 0x0 [ 128.548569][ T375] kye 0003:0458:5012.001C: unknown main item tag 0x0 [ 128.555350][ T375] kye 0003:0458:5012.001C: unknown main item tag 0x0 [ 128.564692][ T375] kye 0003:0458:5012.001C: unknown main item tag 0x0 [ 128.571525][ T375] kye 0003:0458:5012.001C: unknown main item tag 0x0 [ 128.578392][ T375] kye 0003:0458:5012.001C: unknown main item tag 0x0 [ 128.585170][ T375] kye 0003:0458:5012.001C: unknown main item tag 0x0 [ 128.591905][ T375] kye 0003:0458:5012.001C: unknown main item tag 0x0 [ 128.598723][ T375] kye 0003:0458:5012.001C: unknown main item tag 0x0 [ 128.605499][ T375] kye 0003:0458:5012.001C: unknown main item tag 0x0 [ 128.612273][ T375] kye 0003:0458:5012.001C: unknown main item tag 0x0 [ 128.619005][ T375] kye 0003:0458:5012.001C: unknown main item tag 0x0 [ 128.625776][ T375] kye 0003:0458:5012.001C: unknown main item tag 0x0 [ 128.632538][ T375] kye 0003:0458:5012.001C: unknown main item tag 0x0 [ 128.639379][ T375] kye 0003:0458:5012.001C: unknown main item tag 0x0 [ 128.646213][ T375] kye 0003:0458:5012.001C: unknown main item tag 0x0 [ 128.652977][ T375] kye 0003:0458:5012.001C: unknown main item tag 0x0 [ 128.659750][ T375] kye 0003:0458:5012.001C: unknown main item tag 0x0 [ 128.666505][ T375] kye 0003:0458:5012.001C: unknown main item tag 0x0 [ 128.673388][ T375] kye 0003:0458:5012.001C: unknown main item tag 0x0 [ 128.680185][ T375] kye 0003:0458:5012.001C: unknown main item tag 0x0 [ 128.686885][ T375] kye 0003:0458:5012.001C: unknown main item tag 0x0 [ 128.693624][ T375] kye 0003:0458:5012.001C: unknown main item tag 0x0 [ 128.700426][ T375] kye 0003:0458:5012.001C: unknown main item tag 0x0 [ 128.709556][ T375] kye 0003:0458:5012.001C: unknown main item tag 0x0 [ 128.716280][ T375] kye 0003:0458:5012.001C: unknown main item tag 0x0 [ 128.723041][ T375] kye 0003:0458:5012.001C: unknown main item tag 0x0 [ 128.729770][ T375] kye 0003:0458:5012.001C: unknown main item tag 0x0 [ 128.736474][ T375] kye 0003:0458:5012.001C: unknown main item tag 0x0 [ 128.745322][ T375] kye 0003:0458:5012.001C: hidraw0: USB HID v0.81 Device [HID 0458:5012] on usb-dummy_hcd.3-1/input0 [ 128.756278][ T375] kye 0003:0458:5012.001C: tablet-enabling feature report not found [ 128.778079][ T375] kye 0003:0458:5012.001C: tablet enabling failed [ 128.895219][ T3806] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 128.903902][ T3806] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 128.997858][ T3808] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 129.006426][ T3808] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 129.328072][ T375] usb 3-1: new high-speed USB device number 48 using dummy_hcd [ 129.479075][ T375] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 129.493423][ T375] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 129.503960][ T375] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 129.516990][ T375] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 129.526340][ T375] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 129.535523][ T36] audit: type=1400 audit(1786154248.700:625): avc: denied { listen } for pid=3820 comm="syz.0.1401" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 129.538776][ T375] usb 3-1: config 0 descriptor?? [ 129.635755][ T3824] netlink: 132 bytes leftover after parsing attributes in process `syz.0.1402'. [ 129.958060][ T559] usb 2-1: new full-speed USB device number 48 using dummy_hcd [ 129.966876][ T375] plantronics 0003:047F:FFFF.001D: unknown main item tag 0xd [ 129.979488][ T375] plantronics 0003:047F:FFFF.001D: No inputs registered, leaving [ 129.993220][ T375] plantronics 0003:047F:FFFF.001D: hiddev96,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.2-1/input0 [ 130.129159][ T559] usb 2-1: config 127 has an invalid interface number: 57 but max is 0 [ 130.137522][ T559] usb 2-1: config 127 has no interface number 0 [ 130.143861][ T559] usb 2-1: config 127 interface 57 altsetting 0 endpoint 0xC has invalid maxpacket 1023, setting to 64 [ 130.156821][ T559] usb 2-1: New USB device found, idVendor=0df6, idProduct=0056, bcdDevice=d2.4b [ 130.169154][ T559] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 130.177244][ T559] usb 2-1: Product: syz [ 130.181769][ T559] usb 2-1: Manufacturer: syz [ 130.186446][ T559] usb 2-1: SerialNumber: syz [ 130.193924][ T3830] raw-gadget.4 gadget.1: fail, usb_ep_enable returned -22 [ 130.229751][ T49] usb 3-1: USB disconnect, device number 48 [ 130.541161][ T3835] netlink: 132 bytes leftover after parsing attributes in process `syz.0.1406'. [ 130.564680][ T3837] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 130.573281][ T3837] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 130.583551][ T375] usb 4-1: USB disconnect, device number 55 [ 130.602958][ T3830] raw-gadget.4 gadget.1: fail, usb_ep_enable returned -22 [ 130.708224][ T3841] incfs: Error accessing: ./debug/kvm/halt_successful_poll. [ 130.715554][ T3841] incfs: mount failed -2 [ 130.787208][ T3848] netlink: 132 bytes leftover after parsing attributes in process `syz.3.1411'. [ 130.814761][ T559] asix 2-1:127.57 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 130.825150][ T559] asix 2-1:127.57: probe with driver asix failed with error -71 [ 130.835373][ T559] usb 2-1: USB disconnect, device number 48 [ 131.140085][ T3863] incfs: Error accessing: ./debug/kvm/halt_successful_poll. [ 131.147489][ T3863] incfs: mount failed -2 [ 131.213973][ T3872] rust_binder: 3871:3872 got reply transaction with no transaction stack [ 131.222574][ T3872] rust_binder: 3871:3872 transaction reply to 0:0 failed EINVAL, code 0 size 0-0 [ 131.315306][ T3886] rust_binder: 3885:3886 BC_REQUEST_DEATH_NOTIFICATION invalid ref 1 [ 131.324804][ T3886] rust_binder: 3885:3886 no such ref 0 [ 131.331207][ T3886] rust_binder: 3885:3886 no such ref 0 [ 131.336850][ T3886] rust_binder: 3885:3886 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 131.346691][ T3886] rust_binder: 3885:3886 got reply transaction with no transaction stack [ 131.362137][ T3886] rust_binder: 3885:3886 transaction reply to 0:0 failed EINVAL, code 0 size 80-24 [ 131.444672][ T3890] incfs: Error accessing: ./debug/kvm/halt_successful_poll. [ 131.452077][ T3890] incfs: mount failed -2 [ 131.501422][ T3901] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3722248192 (7444496384 ns) > initial count (200000 ns). Using initial count to start timer. [ 131.546125][ T349] Bluetooth: hci0: Frame reassembly failed (-84) [ 131.553709][ T3903] Bluetooth: hci0: Frame reassembly failed (-84) [ 131.594537][ T3905] incfs_lookup_dentry err:-13 [ 131.649976][ T3909] rust_binder: 3908:3909 error while translating object: EINVAL [ 131.658090][ T3909] rust_binder: Failure in copy_transaction_data: EINVAL [ 131.658118][ T3909] rust_binder: 3908:3909 transaction call to 3908:0 failed EINVAL, code 22 size 80-24 [ 131.675067][ T559] rust_binder: 3908: undelivered TRANSACTION_ERROR: 29201 [ 131.712900][ T3919] SELinux: policydb magic number 0x0 does not match expected magic number 0xf97cff8c [ 131.722613][ T3919] SELinux: failed to load policy [ 131.968091][ T559] usb 3-1: new low-speed USB device number 49 using dummy_hcd [ 132.129160][ T559] usb 3-1: config 0 interface 0 altsetting 254 endpoint 0x81 has invalid maxpacket 64, setting to 8 [ 132.140074][ T559] usb 3-1: config 0 interface 0 has no altsetting 0 [ 132.146676][ T559] usb 3-1: New USB device found, idVendor=0458, idProduct=5012, bcdDevice= 0.00 [ 132.155745][ T559] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 132.164719][ T559] usb 3-1: config 0 descriptor?? [ 132.169988][ T3919] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 132.277445][ T3935] incfs_lookup_dentry err:-13 [ 132.580644][ T559] kye 0003:0458:5012.001E: tablet report size too small, or kye_tablet_rdesc unexpectedly large [ 132.591371][ T559] kye 0003:0458:5012.001E: unknown main item tag 0x0 [ 132.598984][ T559] kye 0003:0458:5012.001E: unknown main item tag 0x0 [ 132.605722][ T559] kye 0003:0458:5012.001E: unknown main item tag 0x0 [ 132.612471][ T559] kye 0003:0458:5012.001E: unknown main item tag 0x0 [ 132.619214][ T559] kye 0003:0458:5012.001E: unknown main item tag 0x0 [ 132.625901][ T559] kye 0003:0458:5012.001E: unknown main item tag 0x0 [ 132.632673][ T559] kye 0003:0458:5012.001E: unknown main item tag 0x0 [ 132.639398][ T559] kye 0003:0458:5012.001E: unknown main item tag 0x0 [ 132.646088][ T559] kye 0003:0458:5012.001E: unknown main item tag 0x0 [ 132.652796][ T559] kye 0003:0458:5012.001E: unknown main item tag 0x0 [ 132.659504][ T559] kye 0003:0458:5012.001E: unknown main item tag 0x0 [ 132.666178][ T559] kye 0003:0458:5012.001E: unknown main item tag 0x0 [ 132.672890][ T559] kye 0003:0458:5012.001E: unknown main item tag 0x0 [ 132.679663][ T559] kye 0003:0458:5012.001E: unknown main item tag 0x0 [ 132.686637][ T559] kye 0003:0458:5012.001E: unknown main item tag 0x0 [ 132.693393][ T559] kye 0003:0458:5012.001E: unknown main item tag 0x0 [ 132.700127][ T559] kye 0003:0458:5012.001E: unknown main item tag 0x0 [ 132.706830][ T559] kye 0003:0458:5012.001E: unknown main item tag 0x0 [ 132.713610][ T559] kye 0003:0458:5012.001E: unknown main item tag 0x0 [ 132.720356][ T559] kye 0003:0458:5012.001E: unknown main item tag 0x0 [ 132.727314][ T559] kye 0003:0458:5012.001E: unknown main item tag 0x0 [ 132.734076][ T559] kye 0003:0458:5012.001E: unknown main item tag 0x0 [ 132.740812][ T559] kye 0003:0458:5012.001E: unknown main item tag 0x0 [ 132.747534][ T559] kye 0003:0458:5012.001E: unknown main item tag 0x0 [ 132.754277][ T559] kye 0003:0458:5012.001E: unknown main item tag 0x0 [ 132.761046][ T559] kye 0003:0458:5012.001E: unknown main item tag 0x0 [ 132.767745][ T559] kye 0003:0458:5012.001E: unknown main item tag 0x0 [ 132.774712][ T559] kye 0003:0458:5012.001E: unknown main item tag 0x0 [ 132.781894][ T559] kye 0003:0458:5012.001E: unknown main item tag 0x0 [ 132.788721][ T559] kye 0003:0458:5012.001E: unknown main item tag 0x0 [ 132.795442][ T559] kye 0003:0458:5012.001E: unknown main item tag 0x0 [ 132.802163][ T559] kye 0003:0458:5012.001E: unknown main item tag 0x0 [ 132.808890][ T559] kye 0003:0458:5012.001E: unknown main item tag 0x0 [ 132.815598][ T559] kye 0003:0458:5012.001E: unknown main item tag 0x0 [ 132.822342][ T559] kye 0003:0458:5012.001E: unknown main item tag 0x0 [ 132.829089][ T559] kye 0003:0458:5012.001E: unknown main item tag 0x0 [ 132.835804][ T559] kye 0003:0458:5012.001E: unknown main item tag 0x0 [ 132.842526][ T559] kye 0003:0458:5012.001E: unknown main item tag 0x0 [ 132.849250][ T559] kye 0003:0458:5012.001E: unknown main item tag 0x0 [ 132.855967][ T559] kye 0003:0458:5012.001E: unknown main item tag 0x0 [ 132.866848][ T559] kye 0003:0458:5012.001E: hidraw0: USB HID v0.81 Device [HID 0458:5012] on usb-dummy_hcd.2-1/input0 [ 132.877758][ T559] kye 0003:0458:5012.001E: tablet-enabling feature report not found [ 132.885818][ T559] kye 0003:0458:5012.001E: tablet enabling failed [ 132.960956][ T3941] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3722248192 (7444496384 ns) > initial count (200000 ns). Using initial count to start timer. [ 133.093692][ T3958] incfs_lookup_dentry err:-13 [ 133.132594][ T3963] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 133.151026][ T3963] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 133.343211][ T36] audit: type=1400 audit(1786154252.510:626): avc: denied { write } for pid=3978 comm="syz.0.1466" path="socket:[35786]" dev="sockfs" ino=35786 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 133.558073][ T651] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 133.558099][ T1850] Bluetooth: hci0: command 0x1003 tx timeout [ 133.885298][ T36] audit: type=1326 audit(1786154253.050:627): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3996 comm="syz.3.1470" exe="/root/ci2-android-6-12-rust/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f1a7219e0d9 code=0x0 [ 133.970685][ T36] audit: type=1400 audit(1786154253.140:628): avc: denied { mounton } for pid=4003 comm="syz.0.1473" path="/proc/1188/cgroup" dev="proc" ino=34717 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=file permissive=1 [ 134.008162][ T4006] rust_binder: Failed to allocate buffer. len:8, is_oneway:false [ 134.008550][ T375] rust_binder: 4005: undelivered TRANSACTION_ERROR: 29189 [ 134.065321][ T4014] input: syz1 as /devices/virtual/input/input27 [ 134.134097][ T36] audit: type=1400 audit(1786154253.300:629): avc: denied { append } for pid=4013 comm="syz.1.1478" name="loop1" dev="devtmpfs" ino=50 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 134.177130][ T36] audit: type=1400 audit(1786154253.340:630): avc: denied { mounton } for pid=4024 comm="syz.1.1483" path="/359/file0" dev="devtmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=dir permissive=1 [ 134.179640][ T4025] incfs: ino conflict with backing FS 1 [ 134.205710][ T4026] incfs: ino conflict with backing FS 1 [ 134.213924][ T4023] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3722248192 (7444496384 ns) > initial count (200000 ns). Using initial count to start timer. [ 134.280278][ T4034] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 134.288850][ T4034] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 134.434853][ T4058] syzkaller0: entered promiscuous mode [ 134.440483][ T4058] syzkaller0: entered allmulticast mode [ 134.698080][ T363] usb 2-1: new high-speed USB device number 49 using dummy_hcd [ 134.713525][ T36] audit: type=1400 audit(1786154253.880:631): avc: denied { view } for pid=4071 comm="syz.0.1502" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=key permissive=1 [ 134.746025][ T375] usb 3-1: USB disconnect, device number 49 [ 134.828067][ T363] usb 2-1: device descriptor read/64, error -71 [ 134.883665][ T4082] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3722248192 (7444496384 ns) > initial count (200000 ns). Using initial count to start timer. [ 134.992379][ T559] usb 4-1: new high-speed USB device number 56 using dummy_hcd [ 135.078193][ T363] usb 2-1: device descriptor read/64, error -71 [ 135.094400][ T4105] rust_binder: 4104:4105 error while translating object: EINVAL [ 135.108085][ T4105] rust_binder: Failure in copy_transaction_data: EINVAL [ 135.108116][ T4105] rust_binder: 4104:4105 transaction call to 4104:0 failed EINVAL, code 32 size 80-24 [ 135.127522][ T398] rust_binder: 4104: undelivered TRANSACTION_ERROR: 29201 [ 135.148080][ T559] usb 4-1: Using ep0 maxpacket: 16 [ 135.154444][ T559] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 64, changing to 7 [ 135.172034][ T559] usb 4-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 250, changing to 7 [ 135.186642][ T559] usb 4-1: New USB device found, idVendor=0644, idProduct=800e, bcdDevice= 0.40 [ 135.195907][ T559] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 135.205174][ T559] usb 4-1: Product: syz [ 135.209484][ T559] usb 4-1: Manufacturer: syz [ 135.214105][ T559] usb 4-1: SerialNumber: syz [ 135.338070][ T363] usb 2-1: new high-speed USB device number 50 using dummy_hcd [ 135.435452][ T4150] netlink: 'syz.0.1521': attribute type 16 has an invalid length. [ 135.446127][ T4150] netlink: 64138 bytes leftover after parsing attributes in process `syz.0.1521'. [ 135.459699][ T4155] netlink: 296 bytes leftover after parsing attributes in process `syz.2.1522'. [ 135.478192][ T363] usb 2-1: device descriptor read/64, error -71 [ 135.489006][ T559] usb 4-1: USB disconnect, device number 56 [ 135.605152][ T4164] netlink: 140 bytes leftover after parsing attributes in process `syz.2.1525'. [ 135.705333][ T4172] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 135.705355][ T4172] rust_binder: Read failure Err(EFAULT) in pid:776 [ 135.714354][ T4172] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 135.721041][ T4172] rust_binder: Read failure Err(EFAULT) in pid:776 [ 135.729233][ T363] usb 2-1: device descriptor read/64, error -71 [ 135.848174][ T363] usb usb2-port1: attempt power cycle [ 136.188082][ T363] usb 2-1: new high-speed USB device number 51 using dummy_hcd [ 136.209080][ T363] usb 2-1: device descriptor read/8, error -71 [ 136.339084][ T363] usb 2-1: device descriptor read/8, error -71 [ 136.373006][ T36] audit: type=1326 audit(1786154255.540:632): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4185 comm="syz.3.1534" exe="/root/ci2-android-6-12-rust/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f1a7219e0d9 code=0x0 [ 136.450400][ T4189] 9pnet: p9_errstr2errno: server reported unknown error 0x000000000 [ 136.578321][ T363] usb 2-1: new high-speed USB device number 52 using dummy_hcd [ 136.615375][ T363] usb 2-1: device descriptor read/8, error -71 [ 136.717067][ T4217] FAULT_INJECTION: forcing a failure. [ 136.717067][ T4217] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 136.738144][ T4217] CPU: 1 UID: 0 PID: 4217 Comm: syz.0.1544 Not tainted syzkaller #0 4d4a838cf2fc485b043991145ccf8426a0241c16 [ 136.738177][ T4217] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 136.738192][ T4217] Call Trace: [ 136.738199][ T4217] [ 136.738209][ T4217] __dump_stack+0x21/0x30 [ 136.738246][ T4217] dump_stack_lvl+0x140/0x1c0 [ 136.738277][ T4217] ? __cfi_dump_stack_lvl+0x10/0x10 [ 136.738310][ T4217] ? _parse_integer+0x2e/0x40 [ 136.738334][ T4217] ? kstrtoull+0x13b/0x1e0 [ 136.738358][ T4217] dump_stack+0x19/0x20 [ 136.738388][ T4217] should_fail_ex+0x3c2/0x510 [ 136.738414][ T4217] should_fail+0xf/0x20 [ 136.738437][ T4217] should_fail_usercopy+0x1e/0x30 [ 136.738464][ T4217] _copy_from_user+0x20/0xa0 [ 136.738494][ T4217] ___sys_sendmsg+0x1c7/0x370 [ 136.738518][ T4217] ? __sys_sendmsg+0x2a0/0x2a0 [ 136.738542][ T4217] ? proc_fail_nth_write+0x184/0x220 [ 136.738575][ T4217] ? __cfi_proc_fail_nth_write+0x10/0x10 [ 136.738614][ T4217] ? __fget_files+0x2bc/0x330 [ 136.738644][ T4217] __x64_sys_sendmsg+0x206/0x2e0 [ 136.738667][ T4217] ? fput+0x1a4/0x230 [ 136.738696][ T4217] ? __cfi___x64_sys_sendmsg+0x10/0x10 [ 136.738719][ T4217] ? ksys_write+0x1f3/0x260 [ 136.738745][ T4217] ? __kasan_check_read+0x15/0x20 [ 136.738770][ T4217] x64_sys_call+0x2a4c/0x2ee0 [ 136.738792][ T4217] do_syscall_64+0x57/0xf0 [ 136.738818][ T4217] ? clear_bhb_loop+0x50/0xa0 [ 136.738858][ T4217] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 136.738887][ T4217] RIP: 0033:0x7f2815b9e0d9 [ 136.738906][ T4217] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 136.738926][ T4217] RSP: 002b:00007f2816aca028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 136.738949][ T4217] RAX: ffffffffffffffda RBX: 00007f2815e25fa0 RCX: 00007f2815b9e0d9 [ 136.738968][ T4217] RDX: 0000000004000894 RSI: 0000200000000180 RDI: 0000000000000003 [ 136.738983][ T4217] RBP: 00007f2816aca090 R08: 0000000000000000 R09: 0000000000000000 [ 136.738998][ T4217] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 136.739013][ T4217] R13: 00007f2815e26038 R14: 00007f2815e25fa0 R15: 00007ffed5583748 [ 136.739033][ T4217] [ 136.800019][ T363] usb 2-1: device descriptor read/8, error -71 [ 136.903809][ T4226] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 136.981184][ T4226] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 136.991495][ T4226] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 137.000065][ T4226] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 137.020093][ T363] usb usb2-port1: unable to enumerate USB device [ 137.147025][ T36] audit: type=1400 audit(1786154256.310:633): avc: denied { ioctl } for pid=4231 comm="syz.3.1550" path="socket:[36510]" dev="sockfs" ino=36510 ioctlcmd=0x6615 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 137.214004][ T4234] overlayfs: conflicting lowerdir path [ 137.458082][ T363] usb 4-1: new high-speed USB device number 57 using dummy_hcd [ 137.476940][ T4236] FAULT_INJECTION: forcing a failure. [ 137.476940][ T4236] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 137.490086][ T4236] CPU: 1 UID: 0 PID: 4236 Comm: syz.1.1552 Not tainted syzkaller #0 4d4a838cf2fc485b043991145ccf8426a0241c16 [ 137.490125][ T4236] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 137.490137][ T4236] Call Trace: [ 137.490143][ T4236] [ 137.490149][ T4236] __dump_stack+0x21/0x30 [ 137.490175][ T4236] dump_stack_lvl+0x140/0x1c0 [ 137.490196][ T4236] ? __cfi_dump_stack_lvl+0x10/0x10 [ 137.490218][ T4236] ? vsnprintf+0x7b4/0x1ad0 [ 137.490235][ T4236] ? check_stack_object+0x10f/0x150 [ 137.490253][ T4236] dump_stack+0x19/0x20 [ 137.490280][ T4236] should_fail_ex+0x3c2/0x510 [ 137.490298][ T4236] should_fail+0xf/0x20 [ 137.490315][ T4236] should_fail_usercopy+0x1e/0x30 [ 137.490333][ T4236] _copy_from_user+0x20/0xa0 [ 137.490354][ T4236] kstrtouint_from_user+0xde/0x170 [ 137.490372][ T4236] ? __cfi_kstrtouint_from_user+0x10/0x10 [ 137.490389][ T4236] ? selinux_file_permission+0x318/0xb60 [ 137.490406][ T4236] ? __cfi_selinux_file_permission+0x10/0x10 [ 137.490421][ T4236] proc_fail_nth_write+0x8f/0x220 [ 137.490455][ T4236] ? __cfi_proc_fail_nth_write+0x10/0x10 [ 137.490476][ T4236] ? bt_sock_ioctl+0xf0/0x290 [ 137.490497][ T4236] ? bpf_lsm_file_permission+0xd/0x20 [ 137.490517][ T4236] ? __cfi_proc_fail_nth_write+0x10/0x10 [ 137.490538][ T4236] vfs_write+0x3c1/0xfd0 [ 137.490553][ T4236] ? __cfi_vfs_write+0x10/0x10 [ 137.490567][ T4236] ? __kasan_check_write+0x18/0x20 [ 137.490582][ T4236] ? mutex_lock+0x97/0x1d0 [ 137.490601][ T4236] ? __cfi_mutex_lock+0x10/0x10 [ 137.490623][ T4236] ksys_write+0x145/0x260 [ 137.490637][ T4236] ? __cfi_ksys_write+0x10/0x10 [ 137.490653][ T4236] ? __kasan_check_read+0x15/0x20 [ 137.490667][ T4236] __x64_sys_write+0x7f/0x90 [ 137.490682][ T4236] x64_sys_call+0x271c/0x2ee0 [ 137.490696][ T4236] do_syscall_64+0x57/0xf0 [ 137.490712][ T4236] ? clear_bhb_loop+0x50/0xa0 [ 137.490732][ T4236] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 137.490751][ T4236] RIP: 0033:0x7fd28195e90e [ 137.490766][ T4236] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 137.490779][ T4236] RSP: 002b:00007fd2827a1fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 137.490795][ T4236] RAX: ffffffffffffffda RBX: 00007fd2827a26c0 RCX: 00007fd28195e90e [ 137.490807][ T4236] RDX: 0000000000000001 RSI: 00007fd2827a20a0 RDI: 0000000000000003 [ 137.490817][ T4236] RBP: 00007fd2827a2090 R08: 0000000000000000 R09: 0000000000000000 [ 137.490826][ T4236] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 137.490835][ T4236] R13: 00007fd281c26038 R14: 00007fd281c25fa0 R15: 00007ffc7d6154a8 [ 137.490848][ T4236] [ 137.516236][ T4238] netlink: 'syz.1.1553': attribute type 14 has an invalid length. [ 137.698215][ T36] audit: type=1400 audit(1786154256.850:634): avc: denied { ioctl } for pid=4240 comm="syz.2.1554" path="socket:[36534]" dev="sockfs" ino=36534 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 137.792636][ T36] audit: type=1400 audit(1786154256.850:635): avc: denied { create } for pid=4240 comm="syz.2.1554" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=caif_socket permissive=1 [ 137.828088][ T363] usb 4-1: unable to get BOS descriptor or descriptor too short [ 137.904487][ T4253] netlink: 'syz.1.1558': attribute type 4 has an invalid length. [ 138.041942][ T4261] incfs_lookup_dentry err:-13 [ 138.432105][ T4119] bridge_slave_1: left allmulticast mode [ 138.437805][ T4119] bridge_slave_1: left promiscuous mode [ 138.458378][ T4119] bridge0: port 2(bridge_slave_1) entered disabled state [ 138.476113][ T4119] bridge_slave_0: left allmulticast mode [ 138.481799][ T4119] bridge_slave_0: left promiscuous mode [ 138.497756][ T4119] bridge0: port 1(bridge_slave_0) entered disabled state [ 138.630939][ T4119] tipc: Left network mode [ 138.640265][ T4119] veth1_macvtap: left promiscuous mode [ 138.645799][ T4119] veth0_vlan: left promiscuous mode [ 138.733605][ T4282] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 138.742476][ T4282] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 138.751743][ T36] kauditd_printk_skb: 22 callbacks suppressed [ 138.751759][ T36] audit: type=1400 audit(1786154257.920:658): avc: denied { validate_trans } for pid=4281 comm="syz.0.1573" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=security permissive=1 [ 138.778736][ T4282] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 138.787809][ T4282] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 138.798547][ T4282] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 138.808446][ T4282] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 138.818293][ T36] audit: type=1400 audit(1786154257.990:659): avc: denied { listen } for pid=4281 comm="syz.0.1573" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 138.843922][ T4282] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 138.852373][ T36] audit: type=1400 audit(1786154258.010:660): avc: denied { mounton } for pid=4283 comm="syz-executor" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 138.873989][ T4282] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 138.907667][ T4283] bridge0: port 1(bridge_slave_0) entered blocking state [ 138.914796][ T4283] bridge0: port 1(bridge_slave_0) entered disabled state [ 138.922006][ T4283] bridge_slave_0: entered allmulticast mode [ 138.928592][ T4283] bridge_slave_0: entered promiscuous mode [ 138.935325][ T4283] bridge0: port 2(bridge_slave_1) entered blocking state [ 138.942518][ T4283] bridge0: port 2(bridge_slave_1) entered disabled state [ 138.949636][ T4283] bridge_slave_1: entered allmulticast mode [ 138.955900][ T4283] bridge_slave_1: entered promiscuous mode [ 139.008962][ T4283] bridge0: port 2(bridge_slave_1) entered blocking state [ 139.016009][ T4283] bridge0: port 2(bridge_slave_1) entered forwarding state [ 139.023303][ T4283] bridge0: port 1(bridge_slave_0) entered blocking state [ 139.030379][ T4283] bridge0: port 1(bridge_slave_0) entered forwarding state [ 139.052085][ T4119] bridge0: port 1(bridge_slave_0) entered disabled state [ 139.059426][ T4119] bridge0: port 2(bridge_slave_1) entered disabled state [ 139.069546][ T4098] bridge0: port 1(bridge_slave_0) entered blocking state [ 139.076592][ T4098] bridge0: port 1(bridge_slave_0) entered forwarding state [ 139.085883][ T4119] bridge0: port 2(bridge_slave_1) entered blocking state [ 139.092945][ T4119] bridge0: port 2(bridge_slave_1) entered forwarding state [ 139.120018][ T4283] veth0_vlan: entered promiscuous mode [ 139.131298][ T4283] veth1_macvtap: entered promiscuous mode [ 139.150431][ T36] audit: type=1400 audit(1786154258.320:661): avc: denied { mounton } for pid=4283 comm="syz-executor" path="/root/syzkaller.3kKZNX/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 139.456750][ T4311] netlink: 132 bytes leftover after parsing attributes in process `syz.0.1582'. [ 139.709134][ T4319] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 139.717678][ T4319] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 140.198116][ T363] usb 4-1: unable to read config index 0 descriptor/all [ 140.206218][ T363] usb 4-1: can't read configurations, error -71 [ 140.243280][ T36] audit: type=1400 audit(1786154259.410:662): avc: denied { setopt } for pid=4320 comm="syz.0.1588" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 140.275657][ T4327] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 140.284257][ T4327] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 140.548261][ T363] usb 4-1: new high-speed USB device number 58 using dummy_hcd [ 140.698139][ T363] usb 4-1: Using ep0 maxpacket: 8 [ 140.704443][ T363] usb 4-1: config 0 interface 0 has no altsetting 0 [ 140.711124][ T363] usb 4-1: New USB device found, idVendor=0416, idProduct=c168, bcdDevice= 0.00 [ 140.720218][ T363] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 140.728927][ T363] usb 4-1: config 0 descriptor?? [ 140.855286][ T4334] netlink: 132 bytes leftover after parsing attributes in process `syz.0.1592'. [ 140.937225][ T363] hid-generic 0003:0416:C168.001F: unknown main item tag 0x1 [ 140.953899][ T363] hid-generic 0003:0416:C168.001F: unknown main item tag 0xd [ 140.962386][ T363] hid-generic 0003:0416:C168.001F: unknown main item tag 0xd [ 140.970097][ T363] hid-generic 0003:0416:C168.001F: unknown main item tag 0x7 [ 140.979153][ T363] hid-generic 0003:0416:C168.001F: unknown main item tag 0x0 [ 140.987293][ T363] hid-generic 0003:0416:C168.001F: unknown main item tag 0x0 [ 140.998372][ T363] hid-generic 0003:0416:C168.001F: unknown main item tag 0x0 [ 141.007011][ T363] hid-generic 0003:0416:C168.001F: unknown main item tag 0x0 [ 141.014508][ T363] hid-generic 0003:0416:C168.001F: unknown main item tag 0x0 [ 141.022247][ T363] hid-generic 0003:0416:C168.001F: unknown main item tag 0x0 [ 141.030727][ T363] hid-generic 0003:0416:C168.001F: unknown main item tag 0x0 [ 141.038245][ T363] hid-generic 0003:0416:C168.001F: unknown main item tag 0x0 [ 141.047598][ T363] hid-generic 0003:0416:C168.001F: unknown main item tag 0x0 [ 141.055125][ T363] hid-generic 0003:0416:C168.001F: unknown main item tag 0x0 [ 141.062783][ T363] hid-generic 0003:0416:C168.001F: unknown main item tag 0x0 [ 141.070212][ T363] hid-generic 0003:0416:C168.001F: unknown main item tag 0x0 [ 141.077694][ T363] hid-generic 0003:0416:C168.001F: unknown main item tag 0x0 [ 141.088809][ T363] hid-generic 0003:0416:C168.001F: unbalanced collection at end of report description [ 141.098630][ T363] hid-generic 0003:0416:C168.001F: probe with driver hid-generic failed with error -22 [ 141.119604][ T363] usb 4-1: USB disconnect, device number 58 [ 141.163912][ T4355] FAULT_INJECTION: forcing a failure. [ 141.163912][ T4355] name failslab, interval 1, probability 0, space 0, times 0 [ 141.177075][ T4355] CPU: 1 UID: 0 PID: 4355 Comm: syz.0.1601 Not tainted syzkaller #0 4d4a838cf2fc485b043991145ccf8426a0241c16 [ 141.177106][ T4355] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 141.177120][ T4355] Call Trace: [ 141.177126][ T4355] [ 141.177135][ T4355] __dump_stack+0x21/0x30 [ 141.177165][ T4355] dump_stack_lvl+0x140/0x1c0 [ 141.177192][ T4355] ? __cfi_dump_stack_lvl+0x10/0x10 [ 141.177221][ T4355] dump_stack+0x19/0x20 [ 141.177247][ T4355] should_fail_ex+0x3c2/0x510 [ 141.177269][ T4355] ? genl_family_rcv_msg_attrs_parse+0xc6/0x380 [ 141.177295][ T4355] should_failslab+0xac/0x100 [ 141.177320][ T4355] __kmalloc_noprof+0x69/0x510 [ 141.177341][ T4355] ? genl_family_rcv_msg_attrs_parse+0xc6/0x380 [ 141.177368][ T4355] ? __asan_memset+0x39/0x50 [ 141.177389][ T4355] genl_family_rcv_msg_attrs_parse+0xc6/0x380 [ 141.177419][ T4355] genl_start+0x179/0x830 [ 141.177445][ T4355] __netlink_dump_start+0x583/0x970 [ 141.177467][ T4355] genl_family_rcv_msg_dumpit+0x214/0x320 [ 141.177494][ T4355] ? __asan_memcpy+0x5a/0x80 [ 141.177516][ T4355] ? genl_rcv_msg+0x7b0/0x7b0 [ 141.177541][ T4355] ? genl_get_cmd+0x699/0x950 [ 141.177580][ T4355] ? __cfi_genl_start+0x10/0x10 [ 141.177604][ T4355] ? __cfi_genl_dumpit+0x10/0x10 [ 141.177628][ T4355] ? __cfi_genl_done+0x10/0x10 [ 141.177654][ T4355] ? kasan_save_alloc_info+0x3a/0x50 [ 141.177686][ T4355] ? __kasan_slab_alloc+0x73/0x90 [ 141.177711][ T4355] ? radix_tree_lookup+0x250/0x2a0 [ 141.177739][ T4355] genl_rcv_msg+0x5dc/0x7b0 [ 141.177765][ T4355] ? __cfi_genl_rcv_msg+0x10/0x10 [ 141.177789][ T4355] ? __cfi_ethnl_default_start+0x10/0x10 [ 141.177817][ T4355] ? __cfi_ethnl_default_dumpit+0x10/0x10 [ 141.177843][ T4355] ? __cfi_ethnl_default_done+0x10/0x10 [ 141.177883][ T4355] netlink_rcv_skb+0x24d/0x4e0 [ 141.177905][ T4355] ? __cfi_genl_rcv_msg+0x10/0x10 [ 141.177930][ T4355] ? __cfi_netlink_rcv_skb+0x10/0x10 [ 141.177951][ T4355] ? down_read+0x7f/0xe0 [ 141.177980][ T4355] ? __cfi_down_read+0x10/0x10 [ 141.178014][ T4355] genl_rcv+0x2c/0x40 [ 141.178037][ T4355] netlink_unicast+0x8bc/0xa70 [ 141.178068][ T4355] netlink_sendmsg+0x7d1/0xad0 [ 141.178090][ T4355] ? __cfi_netlink_sendmsg+0x10/0x10 [ 141.178112][ T4355] ? bpf_lsm_socket_sendmsg+0xd/0x20 [ 141.178136][ T4355] ? security_socket_sendmsg+0x3d/0x100 [ 141.178166][ T4355] ____sys_sendmsg+0x9a1/0xa00 [ 141.178188][ T4355] ? __import_iovec+0x5b9/0x7d0 [ 141.178219][ T4355] ? __sys_sendmsg_sock+0x50/0x50 [ 141.178242][ T4355] ? import_iovec+0x80/0xb0 [ 141.178272][ T4355] ___sys_sendmsg+0x2a6/0x370 [ 141.178295][ T4355] ? __sys_sendmsg+0x2a0/0x2a0 [ 141.178318][ T4355] ? proc_fail_nth_write+0x184/0x220 [ 141.178348][ T4355] ? __cfi_proc_fail_nth_write+0x10/0x10 [ 141.178382][ T4355] ? __fget_files+0x2bc/0x330 [ 141.178409][ T4355] __x64_sys_sendmsg+0x206/0x2e0 [ 141.178431][ T4355] ? fput+0x1a4/0x230 [ 141.178457][ T4355] ? __cfi___x64_sys_sendmsg+0x10/0x10 [ 141.178479][ T4355] ? ksys_write+0x1f3/0x260 [ 141.178502][ T4355] ? __kasan_check_read+0x15/0x20 [ 141.178524][ T4355] x64_sys_call+0x2a4c/0x2ee0 [ 141.178543][ T4355] do_syscall_64+0x57/0xf0 [ 141.178567][ T4355] ? clear_bhb_loop+0x50/0xa0 [ 141.178596][ T4355] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 141.178623][ T4355] RIP: 0033:0x7f2815b9e0d9 [ 141.178642][ T4355] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 141.178661][ T4355] RSP: 002b:00007f2816aca028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 141.178683][ T4355] RAX: ffffffffffffffda RBX: 00007f2815e25fa0 RCX: 00007f2815b9e0d9 [ 141.178698][ T4355] RDX: 0000000000008004 RSI: 0000200000000980 RDI: 0000000000000003 [ 141.178713][ T4355] RBP: 00007f2816aca090 R08: 0000000000000000 R09: 0000000000000000 [ 141.178727][ T4355] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 141.178739][ T4355] R13: 00007f2815e26038 R14: 00007f2815e25fa0 R15: 00007ffed5583748 [ 141.178775][ T4355] [ 141.662172][ T4372] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 141.670784][ T4372] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 141.691285][ T559] usb 3-1: new full-speed USB device number 50 using dummy_hcd [ 141.849238][ T559] usb 3-1: config 127 has an invalid interface number: 57 but max is 0 [ 141.857651][ T559] usb 3-1: config 127 has no interface number 0 [ 141.863992][ T559] usb 3-1: config 127 interface 57 altsetting 0 endpoint 0xC has invalid maxpacket 1023, setting to 64 [ 141.876563][ T559] usb 3-1: New USB device found, idVendor=0df6, idProduct=0056, bcdDevice=d2.4b [ 141.885681][ T559] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 141.893735][ T559] usb 3-1: Product: syz [ 141.897919][ T559] usb 3-1: Manufacturer: syz [ 141.902570][ T559] usb 3-1: SerialNumber: syz [ 141.908260][ T4351] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 142.317844][ T559] asix 3-1:127.57: probe with driver asix failed with error -71 [ 142.326812][ T559] usb 3-1: USB disconnect, device number 50 [ 142.971500][ T4402] rust_binder: 4401:4402 error while translating object: EINVAL [ 142.979314][ T4402] rust_binder: Failure in copy_transaction_data: EINVAL [ 142.979345][ T4402] rust_binder: 4401:4402 transaction call to 4401:0 failed EINVAL, code 68 size 80-24 [ 142.996264][ T363] rust_binder: 4401: undelivered TRANSACTION_ERROR: 29201 [ 143.017299][ T36] audit: type=1400 audit(1786154262.180:663): avc: denied { accept } for pid=4403 comm="syz.2.1621" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 143.037828][ T36] audit: type=1400 audit(1786154262.200:664): avc: denied { map } for pid=4403 comm="syz.2.1621" path="socket:[39595]" dev="sockfs" ino=39595 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 143.771114][ T4425] netlink: 140 bytes leftover after parsing attributes in process `syz.2.1631'. [ 144.737648][ T36] audit: type=1400 audit(1786154263.900:665): avc: denied { sys_module } for pid=4435 comm="syz.3.1635" capability=16 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 145.018076][ T363] usb 4-1: new high-speed USB device number 59 using dummy_hcd [ 145.169499][ T363] usb 4-1: unable to get BOS descriptor or descriptor too short [ 145.177309][ T363] usb 4-1: too many configurations: 145, using maximum allowed: 8 [ 145.186257][ T363] usb 4-1: unable to read config index 0 descriptor/start: -61 [ 145.193923][ T363] usb 4-1: can't read configurations, error -61 [ 145.236858][ T4439] fuse: Unknown parameter '¢j‚O¹ýÁÇ…øïàD @Ýüà«á² Ô²F¹º‹äâ–¹ÝM‰…>*³Ë' [ 145.279607][ T4439] batadv_slave_0: entered promiscuous mode [ 145.285699][ T4439] batadv_slave_0: left promiscuous mode [ 145.328086][ T363] usb 4-1: new high-speed USB device number 60 using dummy_hcd [ 145.479721][ T363] usb 4-1: unable to get BOS descriptor or descriptor too short [ 145.487467][ T363] usb 4-1: too many configurations: 145, using maximum allowed: 8 [ 145.496624][ T363] usb 4-1: unable to read config index 0 descriptor/start: -61 [ 145.504649][ T363] usb 4-1: can't read configurations, error -61 [ 145.511356][ T363] usb usb4-port1: attempt power cycle [ 145.528068][ T375] usb 3-1: new high-speed USB device number 51 using dummy_hcd [ 145.649028][ T4448] netlink: 37 bytes leftover after parsing attributes in process `syz.0.1640'. [ 145.659125][ T36] audit: type=1400 audit(1786154264.830:666): avc: denied { setattr } for pid=4447 comm="syz.0.1640" name="ptmx" dev="devtmpfs" ino=24 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ptmx_t tclass=chr_file permissive=1 [ 145.687939][ T375] usb 3-1: Using ep0 maxpacket: 8 [ 145.694198][ T375] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 145.705920][ T375] usb 3-1: New USB device found, idVendor=1235, idProduct=8002, bcdDevice= 0.40 [ 145.715081][ T375] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 145.723123][ T375] usb 3-1: Product: syz [ 145.727342][ T375] usb 3-1: Manufacturer: syz [ 145.730987][ T4454] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 145.732021][ T375] usb 3-1: SerialNumber: syz [ 145.741643][ T4454] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 145.848077][ T363] usb 4-1: new high-speed USB device number 61 using dummy_hcd [ 145.869810][ T363] usb 4-1: unable to get BOS descriptor or descriptor too short [ 145.877562][ T363] usb 4-1: too many configurations: 145, using maximum allowed: 8 [ 145.886518][ T363] usb 4-1: unable to read config index 0 descriptor/start: -61 [ 145.894178][ T363] usb 4-1: can't read configurations, error -61 [ 146.028071][ T363] usb 4-1: new high-speed USB device number 62 using dummy_hcd [ 146.049820][ T363] usb 4-1: unable to get BOS descriptor or descriptor too short [ 146.057525][ T363] usb 4-1: too many configurations: 145, using maximum allowed: 8 [ 146.066521][ T363] usb 4-1: unable to read config index 0 descriptor/start: -61 [ 146.074149][ T363] usb 4-1: can't read configurations, error -61 [ 146.080548][ T363] usb usb4-port1: unable to enumerate USB device [ 146.462500][ T375] usb 3-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 146.470758][ T375] usb 3-1: unit 2 not found! [ 146.475769][ T375] usb 3-1: 6:0: failed to get current value for ch 0 (-71) [ 146.503197][ T36] audit: type=1400 audit(1786154265.670:667): avc: denied { read append } for pid=4462 comm="syz.2.1647" name="rnullb0" dev="devtmpfs" ino=31 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 146.520730][ T375] snd-usb-audio 3-1:1.0: probe with driver snd-usb-audio failed with error -71 [ 146.529529][ T36] audit: type=1400 audit(1786154265.670:668): avc: denied { open } for pid=4462 comm="syz.2.1647" path="/dev/rnullb0" dev="devtmpfs" ino=31 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 146.548345][ T375] usb 3-1: USB disconnect, device number 51 [ 146.569771][ T36] audit: type=1400 audit(1786154265.670:669): avc: denied { map } for pid=4462 comm="syz.2.1647" path="/dev/rnullb0" dev="devtmpfs" ino=31 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 146.582541][ T567] udevd[567]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 146.595488][ T36] audit: type=1400 audit(1786154265.670:670): avc: denied { execute } for pid=4462 comm="syz.2.1647" path="/dev/rnullb0" dev="devtmpfs" ino=31 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 146.624198][ T4463] netlink: 'syz.2.1647': attribute type 1 has an invalid length. [ 146.638353][ T36] audit: type=1400 audit(1786154265.670:671): avc: denied { ioctl } for pid=4462 comm="syz.2.1647" path="/dev/rnullb0" dev="devtmpfs" ino=31 ioctlcmd=0x1261 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 146.669109][ T4465] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1648'. [ 146.804165][ T4477] FAULT_INJECTION: forcing a failure. [ 146.804165][ T4477] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 146.817416][ T4477] CPU: 1 UID: 0 PID: 4477 Comm: syz.2.1652 Not tainted syzkaller #0 4d4a838cf2fc485b043991145ccf8426a0241c16 [ 146.817449][ T4477] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 146.817464][ T4477] Call Trace: [ 146.817471][ T4477] [ 146.817481][ T4477] __dump_stack+0x21/0x30 [ 146.817516][ T4477] dump_stack_lvl+0x140/0x1c0 [ 146.817547][ T4477] ? __cfi_dump_stack_lvl+0x10/0x10 [ 146.817579][ T4477] ? check_stack_object+0x138/0x150 [ 146.817603][ T4477] dump_stack+0x19/0x20 [ 146.817632][ T4477] should_fail_ex+0x3c2/0x510 [ 146.817658][ T4477] should_fail+0xf/0x20 [ 146.817681][ T4477] should_fail_usercopy+0x1e/0x30 [ 146.817707][ T4477] _copy_to_user+0x24/0xa0 [ 146.817737][ T4477] simple_read_from_buffer+0xed/0x160 [ 146.817769][ T4477] proc_fail_nth_read+0x1aa/0x220 [ 146.817809][ T4477] ? __cfi_proc_fail_nth_read+0x10/0x10 [ 146.817840][ T4477] ? kvm_arch_dev_ioctl+0x22f/0x990 [ 146.817862][ T4477] ? __cfi_kvm_arch_dev_ioctl+0x10/0x10 [ 146.817884][ T4477] ? bpf_lsm_file_permission+0xd/0x20 [ 146.817914][ T4477] ? __cfi_proc_fail_nth_read+0x10/0x10 [ 146.817945][ T4477] vfs_read+0x288/0xc70 [ 146.817967][ T4477] ? __cfi_selinux_file_ioctl+0x10/0x10 [ 146.817991][ T4477] ? __cfi_vfs_read+0x10/0x10 [ 146.818015][ T4477] ? __kasan_check_write+0x18/0x20 [ 146.818038][ T4477] ? mutex_lock+0x97/0x1d0 [ 146.818069][ T4477] ? __cfi_mutex_lock+0x10/0x10 [ 146.818103][ T4477] ksys_read+0x145/0x260 [ 146.818125][ T4477] ? __cfi_ksys_read+0x10/0x10 [ 146.818160][ T4477] ? __kasan_check_read+0x15/0x20 [ 146.818181][ T4477] __x64_sys_read+0x7f/0x90 [ 146.818203][ T4477] x64_sys_call+0x2638/0x2ee0 [ 146.818239][ T4477] do_syscall_64+0x57/0xf0 [ 146.818262][ T4477] ? clear_bhb_loop+0x50/0xa0 [ 146.818289][ T4477] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 146.818315][ T4477] RIP: 0033:0x7fbb7095e90e [ 146.818350][ T4477] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 146.818369][ T4477] RSP: 002b:00007fbb71872fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 146.818392][ T4477] RAX: ffffffffffffffda RBX: 00007fbb718736c0 RCX: 00007fbb7095e90e [ 146.818409][ T4477] RDX: 000000000000000f RSI: 00007fbb718730a0 RDI: 0000000000000004 [ 146.818424][ T4477] RBP: 00007fbb71873090 R08: 0000000000000000 R09: 0000000000000000 [ 146.818449][ T4477] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 146.818463][ T4477] R13: 00007fbb70c26038 R14: 00007fbb70c25fa0 R15: 00007ffff9b01198 [ 146.818481][ T4477] [ 147.087397][ T36] audit: type=1400 audit(1786154266.250:672): avc: denied { create } for pid=4478 comm="syz.2.1653" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ax25_socket permissive=1 [ 147.141958][ T4485] option changes via remount are deprecated (pid=4484 comm=syz.0.1656) [ 147.150288][ T4485] cgroup: option or name mismatch, new: 0x10 "noprefix", old: 0x0 "" [ 147.158442][ T36] audit: type=1400 audit(1786154266.310:673): avc: denied { remount } for pid=4484 comm="syz.0.1656" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 147.702280][ T36] audit: type=1400 audit(1786154266.870:674): avc: denied { ioctl } for pid=4531 comm="syz.2.1677" path="socket:[40208]" dev="sockfs" ino=40208 ioctlcmd=0x8904 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 147.849965][ T4547] netlink: 140 bytes leftover after parsing attributes in process `syz.3.1684'. [ 148.178107][ T559] usb 3-1: new high-speed USB device number 52 using dummy_hcd [ 148.329151][ T559] usb 3-1: config index 0 descriptor too short (expected 45, got 36) [ 148.337281][ T559] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 148.348180][ T559] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 148.357941][ T559] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 148.370846][ T559] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 148.379926][ T559] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 148.388608][ T559] usb 3-1: config 0 descriptor?? [ 148.430539][ T4559] FAULT_INJECTION: forcing a failure. [ 148.430539][ T4559] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 148.444012][ T4559] CPU: 0 UID: 0 PID: 4559 Comm: syz.0.1689 Not tainted syzkaller #0 4d4a838cf2fc485b043991145ccf8426a0241c16 [ 148.444045][ T4559] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 148.444059][ T4559] Call Trace: [ 148.444067][ T4559] [ 148.444075][ T4559] __dump_stack+0x21/0x30 [ 148.444108][ T4559] dump_stack_lvl+0x140/0x1c0 [ 148.444144][ T4559] ? __cfi_dump_stack_lvl+0x10/0x10 [ 148.444176][ T4559] ? do_syscall_64+0x57/0xf0 [ 148.444202][ T4559] dump_stack+0x19/0x20 [ 148.444228][ T4559] should_fail_ex+0x3c2/0x510 [ 148.444252][ T4559] should_fail_alloc_page+0xec/0x110 [ 148.444278][ T4559] __alloc_pages_noprof+0x1c0/0x7e0 [ 148.444310][ T4559] ? __cfi___alloc_pages_noprof+0x10/0x10 [ 148.444343][ T4559] ? __kasan_check_write+0x18/0x20 [ 148.444363][ T4559] __folio_alloc_noprof+0x14/0x80 [ 148.444392][ T4559] folio_prealloc+0x46/0x220 [ 148.444418][ T4559] do_pte_missing+0x16af/0x4440 [ 148.444447][ T4559] ? __kasan_check_write+0x18/0x20 [ 148.444466][ T4559] ? _raw_spin_lock+0x92/0x120 [ 148.444491][ T4559] ? pte_marker_clear+0x1b0/0x1b0 [ 148.444515][ T4559] ? __pmd_alloc+0x5a6/0x9a0 [ 148.444542][ T4559] handle_mm_fault+0x1189/0x1ba0 [ 148.444571][ T4559] ? __cfi_handle_mm_fault+0x10/0x10 [ 148.444596][ T4559] ? find_vma+0xd3/0x120 [ 148.444618][ T4559] ? lock_mm_and_find_vma+0xb8/0x390 [ 148.444643][ T4559] do_user_addr_fault+0x4ee/0x1230 [ 148.444678][ T4559] exc_page_fault+0x58/0xc0 [ 148.444710][ T4559] asm_exc_page_fault+0x2b/0x30 [ 148.444746][ T4559] RIP: 0010:__put_user_4+0x11/0x30 [ 148.444780][ T4559] Code: 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 48 89 cb 48 c1 fb 3f 48 09 d9 0f 01 cb <89> 01 31 c9 0f 01 ca c3 cc cc cc cc 90 90 90 90 90 90 90 90 90 90 [ 148.444795][ T4559] RSP: 0018:ffffc9001121fc30 EFLAGS: 00050206 [ 148.444812][ T4559] RAX: 000000000000c670 RBX: 0000000000000000 RCX: 0000200000000100 [ 148.444825][ T4559] RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffff88811e25f17c [ 148.444838][ T4559] RBP: ffffc9001121fc60 R08: ffff88811e25f17f R09: 1ffff11023c4be2f [ 148.444852][ T4559] R10: dffffc0000000000 R11: ffffed1023c4be30 R12: ffff88811c739e00 [ 148.444870][ T4559] R13: dffffc0000000000 R14: ffff88811e25f17c R15: 000000000000c670 [ 148.444886][ T4559] ? bt_sock_ioctl+0x1c4/0x290 [ 148.444914][ T4559] rfcomm_sock_ioctl+0x51/0xa0 [ 148.444935][ T4559] sock_do_ioctl+0x115/0x330 [ 148.444959][ T4559] ? sock_show_fdinfo+0xd0/0xd0 [ 148.444980][ T4559] ? __cfi_vfs_write+0x10/0x10 [ 148.445002][ T4559] ? __kasan_check_write+0x18/0x20 [ 148.445020][ T4559] ? mutex_unlock+0x90/0x240 [ 148.445045][ T4559] sock_ioctl+0x568/0x7e0 [ 148.445065][ T4559] ? __cfi_sock_ioctl+0x10/0x10 [ 148.445087][ T4559] ? bpf_lsm_file_ioctl+0xd/0x20 [ 148.445110][ T4559] ? security_file_ioctl+0x3e/0x110 [ 148.445146][ T4559] ? __cfi_sock_ioctl+0x10/0x10 [ 148.445167][ T4559] __se_sys_ioctl+0x135/0x1b0 [ 148.445189][ T4559] __x64_sys_ioctl+0x7f/0xa0 [ 148.445211][ T4559] x64_sys_call+0x1878/0x2ee0 [ 148.445227][ T4559] do_syscall_64+0x57/0xf0 [ 148.445247][ T4559] ? clear_bhb_loop+0x50/0xa0 [ 148.445274][ T4559] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 148.445297][ T4559] RIP: 0033:0x7f2815b9e0d9 [ 148.445312][ T4559] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 148.445326][ T4559] RSP: 002b:00007f2816aca028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 148.445344][ T4559] RAX: ffffffffffffffda RBX: 00007f2815e25fa0 RCX: 00007f2815b9e0d9 [ 148.445358][ T4559] RDX: 0000200000000100 RSI: 0000000000005411 RDI: 0000000000000004 [ 148.445370][ T4559] RBP: 00007f2816aca090 R08: 0000000000000000 R09: 0000000000000000 [ 148.445381][ T4559] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 148.445396][ T4559] R13: 00007f2815e26038 R14: 00007f2815e25fa0 R15: 00007ffed5583748 [ 148.445412][ T4559] [ 149.026944][ T4545] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=60442 sclass=netlink_route_socket pid=4545 comm=syz.2.1683 [ 149.487687][ T559] usbhid 3-1:0.0: can't add hid device: -71 [ 149.503321][ T559] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 149.518520][ T559] usb 3-1: USB disconnect, device number 52 [ 149.758081][ T363] usb 4-1: new high-speed USB device number 63 using dummy_hcd [ 149.830153][ T4615] FAULT_INJECTION: forcing a failure. [ 149.830153][ T4615] name failslab, interval 1, probability 0, space 0, times 0 [ 149.842847][ T4615] CPU: 1 UID: 0 PID: 4615 Comm: syz.0.1714 Not tainted syzkaller #0 4d4a838cf2fc485b043991145ccf8426a0241c16 [ 149.842905][ T4615] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 149.842920][ T4615] Call Trace: [ 149.842933][ T4615] [ 149.842940][ T4615] __dump_stack+0x21/0x30 [ 149.842968][ T4615] dump_stack_lvl+0x140/0x1c0 [ 149.842990][ T4615] ? __cfi_dump_stack_lvl+0x10/0x10 [ 149.843013][ T4615] dump_stack+0x19/0x20 [ 149.843033][ T4615] should_fail_ex+0x3c2/0x510 [ 149.843052][ T4615] should_failslab+0xac/0x100 [ 149.843072][ T4615] kmem_cache_alloc_noprof+0x42/0x410 [ 149.843088][ T4615] ? __cfi_stack_trace_consume_entry+0x10/0x10 [ 149.843107][ T4615] ? alloc_empty_file+0xbf/0x270 [ 149.843127][ T4615] ? arch_stack_walk+0x10a/0x170 [ 149.843143][ T4615] alloc_empty_file+0xbf/0x270 [ 149.843164][ T4615] path_openat+0xf4/0x35a0 [ 149.843184][ T4615] ? stack_depot_save_flags+0x38/0x800 [ 149.843204][ T4615] ? kasan_save_track+0x4f/0x80 [ 149.843229][ T4615] ? kasan_save_track+0x3e/0x80 [ 149.843246][ T4615] ? kasan_save_alloc_info+0x3a/0x50 [ 149.843269][ T4615] ? __kasan_slab_alloc+0x73/0x90 [ 149.843288][ T4615] ? getname+0x1b/0x30 [ 149.843304][ T4615] ? do_sys_openat2+0xda/0x1d0 [ 149.843325][ T4615] ? __x64_sys_creat+0x92/0xc0 [ 149.843347][ T4615] ? x64_sys_call+0x2710/0x2ee0 [ 149.843361][ T4615] ? do_syscall_64+0x57/0xf0 [ 149.843380][ T4615] ? do_filp_open+0x440/0x440 [ 149.843402][ T4615] do_filp_open+0x1f2/0x440 [ 149.843422][ T4615] ? __cfi_do_filp_open+0x10/0x10 [ 149.843445][ T4615] ? alloc_fd+0x4c1/0x570 [ 149.843475][ T4615] do_sys_openat2+0x134/0x1d0 [ 149.843497][ T4615] ? do_sys_open+0x100/0x100 [ 149.843538][ T4615] __x64_sys_creat+0x92/0xc0 [ 149.843562][ T4615] x64_sys_call+0x2710/0x2ee0 [ 149.843576][ T4615] do_syscall_64+0x57/0xf0 [ 149.843594][ T4615] ? clear_bhb_loop+0x50/0xa0 [ 149.843616][ T4615] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 149.843637][ T4615] RIP: 0033:0x7f2815b9e0d9 [ 149.843651][ T4615] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 149.843666][ T4615] RSP: 002b:00007f2816aca028 EFLAGS: 00000246 ORIG_RAX: 0000000000000055 [ 149.843684][ T4615] RAX: ffffffffffffffda RBX: 00007f2815e25fa0 RCX: 00007f2815b9e0d9 [ 149.843697][ T4615] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000080 [ 149.843708][ T4615] RBP: 00007f2816aca090 R08: 0000000000000000 R09: 0000000000000000 [ 149.843718][ T4615] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 149.843728][ T4615] R13: 00007f2815e26038 R14: 00007f2815e25fa0 R15: 00007ffed5583748 [ 149.843743][ T4615] [ 149.908133][ T363] usb 4-1: Using ep0 maxpacket: 16 [ 150.116697][ T363] usb 4-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 176, changing to 7 [ 150.137226][ T363] usb 4-1: New USB device found, idVendor=0763, idProduct=2081, bcdDevice= 0.40 [ 150.146378][ T363] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 150.154456][ T363] usb 4-1: Product: syz [ 150.162515][ T363] usb 4-1: Manufacturer: syz [ 150.167204][ T363] usb 4-1: SerialNumber: syz [ 150.180208][ T4621] FAULT_INJECTION: forcing a failure. [ 150.180208][ T4621] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 150.193368][ T4621] CPU: 0 UID: 0 PID: 4621 Comm: syz.0.1717 Not tainted syzkaller #0 4d4a838cf2fc485b043991145ccf8426a0241c16 [ 150.193397][ T4621] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 150.193410][ T4621] Call Trace: [ 150.193417][ T4621] [ 150.193428][ T4621] __dump_stack+0x21/0x30 [ 150.193460][ T4621] dump_stack_lvl+0x140/0x1c0 [ 150.193492][ T4621] ? __cfi_dump_stack_lvl+0x10/0x10 [ 150.193539][ T4621] dump_stack+0x19/0x20 [ 150.193566][ T4621] should_fail_ex+0x3c2/0x510 [ 150.193593][ T4621] should_fail+0xf/0x20 [ 150.193617][ T4621] should_fail_usercopy+0x1e/0x30 [ 150.193645][ T4621] _copy_from_iter+0x1a6/0x1520 [ 150.193676][ T4621] ? __virt_addr_valid+0x2a1/0x370 [ 150.193706][ T4621] ? __cfi__copy_from_iter+0x10/0x10 [ 150.193736][ T4621] ? __check_object_size+0x54c/0x870 [ 150.193761][ T4621] ? __cfi___check_object_size+0x10/0x10 [ 150.193785][ T4621] ? skb_put+0x10e/0x200 [ 150.193817][ T4621] netlink_sendmsg+0x66d/0xad0 [ 150.193842][ T4621] ? __cfi_netlink_sendmsg+0x10/0x10 [ 150.193866][ T4621] ? bpf_lsm_socket_sendmsg+0xd/0x20 [ 150.193903][ T4621] ? security_socket_sendmsg+0x3d/0x100 [ 150.193935][ T4621] ____sys_sendmsg+0x9a1/0xa00 [ 150.193960][ T4621] ? __import_iovec+0x5b9/0x7d0 [ 150.193994][ T4621] ? __sys_sendmsg_sock+0x50/0x50 [ 150.194020][ T4621] ? import_iovec+0x80/0xb0 [ 150.194052][ T4621] ___sys_sendmsg+0x2a6/0x370 [ 150.194078][ T4621] ? __sys_sendmsg+0x2a0/0x2a0 [ 150.194100][ T4621] ? proc_fail_nth_write+0x184/0x220 [ 150.194135][ T4621] ? __cfi_proc_fail_nth_write+0x10/0x10 [ 150.194174][ T4621] ? __fget_files+0x2bc/0x330 [ 150.194201][ T4621] __x64_sys_sendmsg+0x206/0x2e0 [ 150.194221][ T4621] ? fput+0x1a4/0x230 [ 150.194246][ T4621] ? __cfi___x64_sys_sendmsg+0x10/0x10 [ 150.194265][ T4621] ? ksys_write+0x1f3/0x260 [ 150.194290][ T4621] ? __kasan_check_read+0x15/0x20 [ 150.194316][ T4621] x64_sys_call+0x2a4c/0x2ee0 [ 150.194337][ T4621] do_syscall_64+0x57/0xf0 [ 150.194364][ T4621] ? clear_bhb_loop+0x50/0xa0 [ 150.194397][ T4621] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 150.194427][ T4621] RIP: 0033:0x7f2815b9e0d9 [ 150.194447][ T4621] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 150.194468][ T4621] RSP: 002b:00007f2816aca028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 150.194492][ T4621] RAX: ffffffffffffffda RBX: 00007f2815e25fa0 RCX: 00007f2815b9e0d9 [ 150.194510][ T4621] RDX: 0000000004000894 RSI: 0000200000000180 RDI: 0000000000000003 [ 150.194526][ T4621] RBP: 00007f2816aca090 R08: 0000000000000000 R09: 0000000000000000 [ 150.194542][ T4621] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 150.194557][ T4621] R13: 00007f2815e26038 R14: 00007f2815e25fa0 R15: 00007ffed5583748 [ 150.194577][ T4621] [ 150.473729][ T363] usb 4-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 150.480700][ T363] usb 4-1: unit 1 not found! [ 150.485340][ T363] usb 4-1: unit 9 not found! [ 150.523022][ T559] usb 3-1: new low-speed USB device number 53 using dummy_hcd [ 150.529048][ T363] usb 4-1: USB disconnect, device number 63 [ 150.580447][ T4629] fuse: Bad value for 'group_id' [ 150.585468][ T4629] fuse: Bad value for 'group_id' [ 150.689116][ T559] usb 3-1: too many endpoints for config 0 interface 0 altsetting 0: 254, using maximum allowed: 30 [ 150.700030][ T559] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1056, setting to 8 [ 150.711001][ T559] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 254 [ 150.724049][ T559] usb 3-1: New USB device found, idVendor=04d9, idProduct=a070, bcdDevice= 0.00 [ 150.733109][ T559] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 150.741843][ T559] usb 3-1: config 0 descriptor?? [ 150.747062][ T4623] raw-gadget.3 gadget.2: fail, usb_ep_enable returned -22 [ 151.159741][ T559] holtek_mouse 0003:04D9:A070.0020: unknown main item tag 0x2 [ 151.167294][ T559] holtek_mouse 0003:04D9:A070.0020: unknown main item tag 0x0 [ 151.179689][ T559] holtek_mouse 0003:04D9:A070.0020: unknown main item tag 0x0 [ 151.187236][ T559] holtek_mouse 0003:04D9:A070.0020: unknown main item tag 0x0 [ 151.195020][ T559] holtek_mouse 0003:04D9:A070.0020: unknown main item tag 0x0 [ 151.202866][ T559] holtek_mouse 0003:04D9:A070.0020: unknown main item tag 0x0 [ 151.210506][ T559] holtek_mouse 0003:04D9:A070.0020: unknown main item tag 0x0 [ 151.218176][ T559] holtek_mouse 0003:04D9:A070.0020: unknown main item tag 0x0 [ 151.225738][ T559] holtek_mouse 0003:04D9:A070.0020: unknown main item tag 0x0 [ 151.233332][ T559] holtek_mouse 0003:04D9:A070.0020: unknown main item tag 0x0 [ 151.241112][ T559] holtek_mouse 0003:04D9:A070.0020: unknown main item tag 0x0 [ 151.251361][ T559] holtek_mouse 0003:04D9:A070.0020: unknown main item tag 0x0 [ 151.259884][ T559] holtek_mouse 0003:04D9:A070.0020: unknown main item tag 0x0 [ 151.267525][ T559] holtek_mouse 0003:04D9:A070.0020: unknown main item tag 0x0 [ 151.275084][ T559] holtek_mouse 0003:04D9:A070.0020: unknown main item tag 0x0 [ 151.282647][ T559] holtek_mouse 0003:04D9:A070.0020: unknown main item tag 0x0 [ 151.290189][ T559] holtek_mouse 0003:04D9:A070.0020: unknown main item tag 0x0 [ 151.297759][ T559] holtek_mouse 0003:04D9:A070.0020: unknown main item tag 0x0 [ 151.305421][ T559] holtek_mouse 0003:04D9:A070.0020: unknown main item tag 0x0 [ 151.313011][ T559] holtek_mouse 0003:04D9:A070.0020: unknown main item tag 0x0 [ 151.320851][ T559] holtek_mouse 0003:04D9:A070.0020: unknown main item tag 0x0 [ 151.328452][ T559] holtek_mouse 0003:04D9:A070.0020: unknown main item tag 0x0 [ 151.336047][ T559] holtek_mouse 0003:04D9:A070.0020: unknown main item tag 0x0 [ 151.343762][ T559] holtek_mouse 0003:04D9:A070.0020: unknown main item tag 0x0 [ 151.351349][ T559] holtek_mouse 0003:04D9:A070.0020: unknown main item tag 0x0 [ 151.359394][ T559] holtek_mouse 0003:04D9:A070.0020: unknown main item tag 0x0 [ 151.366886][ T559] holtek_mouse 0003:04D9:A070.0020: unknown main item tag 0x0 [ 151.374622][ T559] holtek_mouse 0003:04D9:A070.0020: unknown main item tag 0x0 [ 151.384040][ T559] holtek_mouse 0003:04D9:A070.0020: hidraw0: USB HID v0.01 Device [HID 04d9:a070] on usb-dummy_hcd.2-1/input0 [ 151.397212][ T559] usb 3-1: USB disconnect, device number 53 [ 151.416259][ T4650] fido_id[4650]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.2/usb3/report_descriptor': No such file or directory [ 151.450221][ T4098] bridge_slave_1: left allmulticast mode [ 151.455910][ T4098] bridge_slave_1: left promiscuous mode [ 151.463502][ T4098] bridge0: port 2(bridge_slave_1) entered disabled state [ 151.471655][ T4098] bridge_slave_0: left allmulticast mode [ 151.481347][ T4098] bridge_slave_0: left promiscuous mode [ 151.486980][ T4098] bridge0: port 1(bridge_slave_0) entered disabled state [ 151.631879][ T4098] veth1_macvtap: left promiscuous mode [ 151.637429][ T4098] veth0_vlan: left promiscuous mode [ 151.714486][ T4664] PF_CAN: dropped non conform CAN FD skbuff: dev type 65534, len 64993 [ 151.747404][ T4656] bridge0: port 1(bridge_slave_0) entered blocking state [ 151.771591][ T4656] bridge0: port 1(bridge_slave_0) entered disabled state [ 151.778913][ T4656] bridge_slave_0: entered allmulticast mode [ 151.785266][ T4656] bridge_slave_0: entered promiscuous mode [ 151.792292][ T4656] bridge0: port 2(bridge_slave_1) entered blocking state [ 151.799521][ T4656] bridge0: port 2(bridge_slave_1) entered disabled state [ 151.806583][ T4656] bridge_slave_1: entered allmulticast mode [ 151.816668][ T4656] bridge_slave_1: entered promiscuous mode [ 151.880948][ T4656] bridge0: port 2(bridge_slave_1) entered blocking state [ 151.888053][ T4656] bridge0: port 2(bridge_slave_1) entered forwarding state [ 151.895336][ T4656] bridge0: port 1(bridge_slave_0) entered blocking state [ 151.902426][ T4656] bridge0: port 1(bridge_slave_0) entered forwarding state [ 151.931879][ T4687] netlink: 'syz.2.1736': attribute type 16 has an invalid length. [ 151.947637][ T53] bridge0: port 1(bridge_slave_0) entered disabled state [ 151.955562][ T4687] netlink: 'syz.2.1736': attribute type 3 has an invalid length. [ 151.963818][ T4687] netlink: 31362 bytes leftover after parsing attributes in process `syz.2.1736'. [ 151.973321][ T53] bridge0: port 2(bridge_slave_1) entered disabled state [ 151.981880][ T36] kauditd_printk_skb: 3 callbacks suppressed [ 151.981894][ T36] audit: type=1401 audit(1786154271.150:678): op=setxattr invalid_context=73797374656D5F753A6F626A6563745F723A7573626D6F6E5F6465766963655F743A73300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000022000100000000000000000017000000500006804C00040067636D2861657329000000000000000000000000000000000000000000000000240000002E000D334455667788990800000000000000223346DB2064611314189DF05A74A76860DB000000000000000000000000004500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073656375726974792E73656C696E7578000200000020000001000000000000000000000000000000000000000000000000000000A235A2A441F900000000000080010000002000006400000000000000000000000000000000000 [ 151.998579][ T4097] bridge0: port 1(bridge_slave_0) entered blocking state [ 152.096636][ T4097] bridge0: port 1(bridge_slave_0) entered forwarding state [ 152.125798][ T53] bridge0: port 2(bridge_slave_1) entered blocking state [ 152.132896][ T53] bridge0: port 2(bridge_slave_1) entered forwarding state [ 152.152497][ T4697] netlink: 132 bytes leftover after parsing attributes in process `syz.4.1738'. [ 152.190434][ T4656] veth0_vlan: entered promiscuous mode [ 152.197697][ T4701] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=44577 sclass=netlink_route_socket pid=4701 comm=syz.4.1740 [ 152.218896][ T4656] veth1_macvtap: entered promiscuous mode [ 152.317514][ T4720] netlink: 'syz.5.1743': attribute type 22 has an invalid length. [ 152.449920][ T4740] netlink: 132 bytes leftover after parsing attributes in process `syz.5.1748'. [ 152.483166][ T4745] netlink: 28 bytes leftover after parsing attributes in process `syz.5.1749'. [ 152.510634][ T4748] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 152.522078][ T4748] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 152.728074][ T363] usb 6-1: new low-speed USB device number 2 using dummy_hcd [ 152.878117][ T363] usb 6-1: Invalid ep0 maxpacket: 16 [ 153.008117][ T363] usb 6-1: new low-speed USB device number 3 using dummy_hcd [ 153.158236][ T363] usb 6-1: Invalid ep0 maxpacket: 16 [ 153.163686][ T363] usb usb6-port1: attempt power cycle [ 153.170723][ T4755] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3722248192 (7444496384 ns) > initial count (200000 ns). Using initial count to start timer. [ 153.331877][ T4763] netlink: 'syz.2.1755': attribute type 32 has an invalid length. [ 153.508135][ T363] usb 6-1: new low-speed USB device number 4 using dummy_hcd [ 153.528443][ T363] usb 6-1: Invalid ep0 maxpacket: 16 [ 153.658096][ T363] usb 6-1: new low-speed USB device number 5 using dummy_hcd [ 153.678445][ T363] usb 6-1: Invalid ep0 maxpacket: 16 [ 153.683924][ T363] usb usb6-port1: unable to enumerate USB device [ 154.177719][ T4769] netlink: 132 bytes leftover after parsing attributes in process `syz.2.1757'. [ 155.228613][ T4788] netlink: 124 bytes leftover after parsing attributes in process `syz.2.1764'. [ 155.497011][ T4803] netlink: 'syz.5.1771': attribute type 16 has an invalid length. [ 155.507060][ T4803] netlink: 104 bytes leftover after parsing attributes in process `syz.5.1771'. [ 155.698088][ T363] usb 3-1: new high-speed USB device number 54 using dummy_hcd [ 155.788163][ T4833] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3722248192 (7444496384 ns) > initial count (200000 ns). Using initial count to start timer. [ 155.838487][ T363] usb 3-1: device descriptor read/64, error -71 [ 155.896034][ T4840] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 155.905337][ T4834] bridge0: port 1(bridge_slave_0) entered blocking state [ 155.912536][ T559] usb 6-1: new low-speed USB device number 6 using dummy_hcd [ 155.920477][ T4840] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 155.920639][ T4834] bridge0: port 1(bridge_slave_0) entered disabled state [ 155.935471][ T4834] bridge_slave_0: entered allmulticast mode [ 155.942017][ T4834] bridge_slave_0: entered promiscuous mode [ 155.948746][ T4834] bridge0: port 2(bridge_slave_1) entered blocking state [ 155.955921][ T4834] bridge0: port 2(bridge_slave_1) entered disabled state [ 155.963210][ T4834] bridge_slave_1: entered allmulticast mode [ 155.970181][ T4834] bridge_slave_1: entered promiscuous mode [ 156.046362][ T4834] bridge0: port 2(bridge_slave_1) entered blocking state [ 156.053470][ T4834] bridge0: port 2(bridge_slave_1) entered forwarding state [ 156.060771][ T4834] bridge0: port 1(bridge_slave_0) entered blocking state [ 156.067790][ T4834] bridge0: port 1(bridge_slave_0) entered forwarding state [ 156.089017][ T2146] raw-gadget.2 gadget.0: failed to queue disconnect event [ 156.096933][ T4098] bridge0: port 2(bridge_slave_1) entered disabled state [ 156.098419][ T363] usb 3-1: device descriptor read/64, error -71 [ 156.109889][ T559] usb 6-1: too many endpoints for config 0 interface 0 altsetting 0: 254, using maximum allowed: 30 [ 156.123829][ T559] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1056, setting to 8 [ 156.134704][ T559] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 254 [ 156.147786][ T559] usb 6-1: New USB device found, idVendor=050d, idProduct=3201, bcdDevice= 0.00 [ 156.150562][ T4098] bridge0: port 2(bridge_slave_1) entered blocking state [ 156.156879][ T559] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 156.163922][ T4098] bridge0: port 2(bridge_slave_1) entered forwarding state [ 156.179945][ T559] usb 6-1: config 0 descriptor?? [ 156.188393][ T4822] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 156.203784][ T4834] veth0_vlan: entered promiscuous mode [ 156.216330][ T4834] veth1_macvtap: entered promiscuous mode [ 156.348333][ T363] usb 3-1: new high-speed USB device number 55 using dummy_hcd [ 156.401446][ T559] belkin 0003:050D:3201.0021: unknown main item tag 0x2 [ 156.408916][ T559] belkin 0003:050D:3201.0021: unknown main item tag 0x0 [ 156.415957][ T559] belkin 0003:050D:3201.0021: unknown main item tag 0x0 [ 156.423359][ T559] belkin 0003:050D:3201.0021: unknown main item tag 0x0 [ 156.434489][ T559] belkin 0003:050D:3201.0021: unknown main item tag 0x0 [ 156.445777][ T559] belkin 0003:050D:3201.0021: unknown main item tag 0x0 [ 156.453106][ T559] belkin 0003:050D:3201.0021: unknown main item tag 0x0 [ 156.460395][ T559] belkin 0003:050D:3201.0021: unknown main item tag 0x0 [ 156.467425][ T559] belkin 0003:050D:3201.0021: unknown main item tag 0x0 [ 156.477257][ T559] belkin 0003:050D:3201.0021: unknown main item tag 0x0 [ 156.478664][ T363] usb 3-1: device descriptor read/64, error -71 [ 156.484495][ T559] belkin 0003:050D:3201.0021: unknown main item tag 0x0 [ 156.497552][ T559] belkin 0003:050D:3201.0021: unknown main item tag 0x0 [ 156.504587][ T559] belkin 0003:050D:3201.0021: unknown main item tag 0x0 [ 156.511585][ T559] belkin 0003:050D:3201.0021: unknown main item tag 0x0 [ 156.518664][ T559] belkin 0003:050D:3201.0021: unknown main item tag 0x0 [ 156.525628][ T559] belkin 0003:050D:3201.0021: unknown main item tag 0x0 [ 156.532683][ T559] belkin 0003:050D:3201.0021: unknown main item tag 0x0 [ 156.539661][ T559] belkin 0003:050D:3201.0021: unknown main item tag 0x0 [ 156.546597][ T559] belkin 0003:050D:3201.0021: unknown main item tag 0x0 [ 156.553606][ T559] belkin 0003:050D:3201.0021: unknown main item tag 0x0 [ 156.560592][ T559] belkin 0003:050D:3201.0021: unknown main item tag 0x0 [ 156.567639][ T559] belkin 0003:050D:3201.0021: unknown main item tag 0x0 [ 156.574810][ T559] belkin 0003:050D:3201.0021: unknown main item tag 0x0 [ 156.591914][ T559] belkin 0003:050D:3201.0021: hiddev96,hidraw0: USB HID v0.01 Device [HID 050d:3201] on usb-dummy_hcd.5-1/input0 [ 156.610567][ T559] usb 6-1: USB disconnect, device number 6 [ 156.629961][ T4857] fido_id[4857]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.5/usb6/report_descriptor': No such file or directory [ 156.728100][ T363] usb 3-1: device descriptor read/64, error -71 [ 156.838191][ T363] usb usb3-port1: attempt power cycle [ 156.928268][ T559] usb 6-1: new high-speed USB device number 7 using dummy_hcd [ 156.935873][ T398] usb 1-1: new high-speed USB device number 35 using dummy_hcd [ 157.089252][ T398] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 157.099480][ T398] usb 1-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 157.112618][ T559] usb 6-1: unable to get BOS descriptor or descriptor too short [ 157.121176][ T559] usb 6-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 64, changing to 7 [ 157.132550][ T398] usb 1-1: New USB device found, idVendor=133e, idProduct=0815, bcdDevice= 0.40 [ 157.141704][ T398] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 157.149786][ T398] usb 1-1: Product: syz [ 157.154058][ T398] usb 1-1: Manufacturer: syz [ 157.159122][ T398] usb 1-1: SerialNumber: syz [ 157.163805][ T559] usb 6-1: New USB device found, idVendor=0582, idProduct=004c, bcdDevice= 0.40 [ 157.173209][ T559] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 157.181562][ T559] usb 6-1: Product: syz [ 157.185789][ T559] usb 6-1: Manufacturer: syz [ 157.188148][ T363] usb 3-1: new high-speed USB device number 56 using dummy_hcd [ 157.190768][ T559] usb 6-1: SerialNumber: syz [ 157.209168][ T363] usb 3-1: device descriptor read/8, error -71 [ 157.339212][ T363] usb 3-1: device descriptor read/8, error -71 [ 157.405104][ T559] usb 6-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 157.412343][ T559] usb 6-1: 2:1 : unknown format tag 0x4 is detected. processed as MPEG. [ 157.420860][ T559] usb 6-1: found format II with max.bitrate = 4, frame size=7372 [ 157.428734][ T559] usb 6-1: parse_audio_format_rates_v2v3(): unable to find clock source (clock -22) [ 157.438285][ T559] usb 6-1: 2:1 : unknown format tag 0x4 is detected. processed as MPEG. [ 157.448068][ T559] usb 6-1: found format II with max.bitrate = 4, frame size=7372 [ 157.455936][ T559] usb 6-1: parse_audio_format_rates_v2v3(): unable to find clock source (clock -22) [ 157.481294][ T398] snd-usb-audio 1-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 157.493490][ T398] usb 1-1: USB disconnect, device number 35 [ 157.578414][ T363] usb 3-1: new high-speed USB device number 57 using dummy_hcd [ 157.599307][ T363] usb 3-1: device descriptor read/8, error -71 [ 157.612823][ T559] usb 6-1: failed to enable PITCH for EP 0x82 [ 157.623065][ T559] usb 6-1: USB disconnect, device number 7 [ 157.636401][ T873] udevd[873]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 157.729853][ T363] usb 3-1: device descriptor read/8, error -71 [ 157.838187][ T363] usb usb3-port1: unable to enumerate USB device [ 158.448073][ T363] usb 6-1: new full-speed USB device number 8 using dummy_hcd [ 158.490219][ T4883] FAULT_INJECTION: forcing a failure. [ 158.490219][ T4883] name failslab, interval 1, probability 0, space 0, times 0 [ 158.503012][ T4883] CPU: 0 UID: 0 PID: 4883 Comm: syz.2.1801 Not tainted syzkaller #0 4d4a838cf2fc485b043991145ccf8426a0241c16 [ 158.503043][ T4883] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 158.503053][ T4883] Call Trace: [ 158.503058][ T4883] [ 158.503065][ T4883] __dump_stack+0x21/0x30 [ 158.503090][ T4883] dump_stack_lvl+0x140/0x1c0 [ 158.503110][ T4883] ? __cfi_dump_stack_lvl+0x10/0x10 [ 158.503132][ T4883] dump_stack+0x19/0x20 [ 158.503152][ T4883] should_fail_ex+0x3c2/0x510 [ 158.503169][ T4883] ? genl_family_rcv_msg_attrs_parse+0xc6/0x380 [ 158.503189][ T4883] should_failslab+0xac/0x100 [ 158.503209][ T4883] __kmalloc_noprof+0x69/0x510 [ 158.503223][ T4883] ? genl_family_rcv_msg_attrs_parse+0xc6/0x380 [ 158.503243][ T4883] ? cred_has_capability+0x296/0x3a0 [ 158.503257][ T4883] ? __cfi_stack_trace_consume_entry+0x10/0x10 [ 158.503276][ T4883] genl_family_rcv_msg_attrs_parse+0xc6/0x380 [ 158.503296][ T4883] genl_family_rcv_msg_doit+0xe3/0x360 [ 158.503316][ T4883] ? genl_family_rcv_msg_dumpit+0x320/0x320 [ 158.503335][ T4883] ? selinux_capable+0x38/0x50 [ 158.503353][ T4883] ? bpf_lsm_capable+0xd/0x20 [ 158.503375][ T4883] ? security_capable+0x44/0x130 [ 158.503391][ T4883] ? ns_capable+0x90/0xf0 [ 158.503414][ T4883] genl_rcv_msg+0x60f/0x7b0 [ 158.503449][ T4883] ? __cfi_genl_rcv_msg+0x10/0x10 [ 158.503497][ T4883] ? __cfi_nl80211_pre_doit+0x10/0x10 [ 158.503527][ T4883] ? __cfi_nl80211_set_wiphy+0x10/0x10 [ 158.503569][ T4883] ? __cfi_nl80211_post_doit+0x10/0x10 [ 158.503593][ T4883] netlink_rcv_skb+0x24d/0x4e0 [ 158.503608][ T4883] ? __cfi_genl_rcv_msg+0x10/0x10 [ 158.503628][ T4883] ? __cfi_netlink_rcv_skb+0x10/0x10 [ 158.503645][ T4883] ? down_read+0x7f/0xe0 [ 158.503668][ T4883] ? __cfi_down_read+0x10/0x10 [ 158.503693][ T4883] genl_rcv+0x2c/0x40 [ 158.503710][ T4883] netlink_unicast+0x8bc/0xa70 [ 158.503736][ T4883] netlink_sendmsg+0x7d1/0xad0 [ 158.503752][ T4883] ? __cfi_netlink_sendmsg+0x10/0x10 [ 158.503769][ T4883] ? bpf_lsm_socket_sendmsg+0xd/0x20 [ 158.503787][ T4883] ? security_socket_sendmsg+0x3d/0x100 [ 158.503809][ T4883] ____sys_sendmsg+0x9a1/0xa00 [ 158.503827][ T4883] ? __import_iovec+0x5b9/0x7d0 [ 158.503850][ T4883] ? __sys_sendmsg_sock+0x50/0x50 [ 158.503868][ T4883] ? import_iovec+0x80/0xb0 [ 158.503891][ T4883] ___sys_sendmsg+0x2a6/0x370 [ 158.503907][ T4883] ? __sys_sendmsg+0x2a0/0x2a0 [ 158.503924][ T4883] ? proc_fail_nth_write+0x184/0x220 [ 158.503947][ T4883] ? __cfi_proc_fail_nth_write+0x10/0x10 [ 158.503974][ T4883] ? __fget_files+0x2bc/0x330 [ 158.503995][ T4883] __x64_sys_sendmsg+0x206/0x2e0 [ 158.504033][ T4883] ? fput+0x1a4/0x230 [ 158.504070][ T4883] ? __cfi___x64_sys_sendmsg+0x10/0x10 [ 158.504087][ T4883] ? ksys_write+0x1f3/0x260 [ 158.504105][ T4883] ? __kasan_check_read+0x15/0x20 [ 158.504121][ T4883] x64_sys_call+0x2a4c/0x2ee0 [ 158.504136][ T4883] do_syscall_64+0x57/0xf0 [ 158.504154][ T4883] ? clear_bhb_loop+0x50/0xa0 [ 158.504177][ T4883] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 158.504198][ T4883] RIP: 0033:0x7fbb7099e0d9 [ 158.504212][ T4883] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 158.504227][ T4883] RSP: 002b:00007fbb71873028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 158.504244][ T4883] RAX: ffffffffffffffda RBX: 00007fbb70c25fa0 RCX: 00007fbb7099e0d9 [ 158.504257][ T4883] RDX: 0000000004000894 RSI: 0000200000000180 RDI: 0000000000000003 [ 158.504269][ T4883] RBP: 00007fbb71873090 R08: 0000000000000000 R09: 0000000000000000 [ 158.504280][ T4883] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 158.504290][ T4883] R13: 00007fbb70c26038 R14: 00007fbb70c25fa0 R15: 00007ffff9b01198 [ 158.504305][ T4883] [ 158.889499][ T4887] netlink: 132 bytes leftover after parsing attributes in process `syz.0.1803'. [ 158.956596][ T363] usb 6-1: config 127 has an invalid interface number: 57 but max is 0 [ 158.957727][ T4898] netlink: 132 bytes leftover after parsing attributes in process `syz.0.1808'. [ 158.965197][ T363] usb 6-1: config 127 has no interface number 0 [ 158.981826][ T363] usb 6-1: New USB device found, idVendor=0df6, idProduct=0056, bcdDevice=d2.4b [ 158.990929][ T363] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 158.998965][ T363] usb 6-1: Product: syz [ 159.003223][ T363] usb 6-1: Manufacturer: syz [ 159.007828][ T363] usb 6-1: SerialNumber: syz [ 159.221837][ T363] asix 6-1:127.57: probe with driver asix failed with error -22 [ 159.245512][ T4911] tipc: Started in network mode [ 159.250453][ T4911] tipc: Node identity 7e8471b8add8, cluster identity 4711 [ 159.257623][ T4911] tipc: Enabled bearer , priority 0 [ 159.265950][ T4911] tipc: Disabling bearer [ 159.308052][ T398] usb 1-1: new high-speed USB device number 36 using dummy_hcd [ 159.462620][ T398] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 159.477736][ T398] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 159.487956][ T398] usb 1-1: New USB device found, idVendor=044f, idProduct=b65d, bcdDevice= 0.00 [ 159.497174][ T398] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 159.509977][ T398] usb 1-1: config 0 descriptor?? [ 159.716243][ T4904] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 159.726699][ T4904] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 160.147239][ T398] usbhid 1-1:0.0: can't add hid device: -71 [ 160.153482][ T398] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 160.164122][ T398] usb 1-1: USB disconnect, device number 36 [ 160.518051][ T398] usb 1-1: new high-speed USB device number 37 using dummy_hcd [ 160.668088][ T398] usb 1-1: Using ep0 maxpacket: 8 [ 160.676030][ T398] usb 1-1: New USB device found, idVendor=200c, idProduct=1018, bcdDevice= 0.40 [ 160.685323][ T398] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 160.693594][ T398] usb 1-1: Product: syz [ 160.697807][ T398] usb 1-1: Manufacturer: syz [ 160.702519][ T398] usb 1-1: SerialNumber: syz [ 160.860828][ T4953] netlink: 124 bytes leftover after parsing attributes in process `syz.2.1830'. [ 160.911417][ T36] audit: type=1400 audit(1786154280.080:679): avc: denied { cmd } for pid=4942 comm="iou-wrk-4943" path="socket:[43756]" dev="sockfs" ino=43756 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 161.025549][ T398] usb 1-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 161.032868][ T398] usb 1-1: unit 3 not found! [ 161.042990][ T398] usb 1-1: USB disconnect, device number 37 [ 161.241868][ T363] usb 6-1: USB disconnect, device number 8 [ 161.297414][ T4994] netlink: 'syz.0.1843': attribute type 16 has an invalid length. [ 161.306890][ T4994] netlink: 104 bytes leftover after parsing attributes in process `syz.0.1843'. [ 161.568065][ T398] usb 1-1: new high-speed USB device number 38 using dummy_hcd [ 161.588164][ T363] usb 6-1: new high-speed USB device number 9 using dummy_hcd [ 161.629946][ T5015] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3722248192 (7444496384 ns) > initial count (200000 ns). Using initial count to start timer. [ 161.718345][ T363] usb 6-1: device descriptor read/64, error -71 [ 161.729077][ T398] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 161.739850][ T398] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 161.750083][ T398] usb 1-1: New USB device found, idVendor=0dba, idProduct=1000, bcdDevice= 0.40 [ 161.759302][ T398] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 161.767344][ T398] usb 1-1: Product: syz [ 161.776746][ T398] usb 1-1: Manufacturer: syz [ 161.781749][ T398] usb 1-1: SerialNumber: syz [ 161.928958][ T5032] netlink: 124 bytes leftover after parsing attributes in process `syz.2.1861'. [ 161.950089][ T5034] fuse: Unknown parameter 'group_id00000000000000000000' [ 161.958518][ T363] usb 6-1: device descriptor read/64, error -71 [ 161.974535][ T5036] incfs_lookup_dentry err:-13 [ 162.198231][ T363] usb 6-1: new high-speed USB device number 10 using dummy_hcd [ 162.328053][ T363] usb 6-1: device descriptor read/64, error -71 [ 162.368051][ T559] usb 3-1: new high-speed USB device number 58 using dummy_hcd [ 162.498064][ T559] usb 3-1: device descriptor read/64, error -71 [ 162.568085][ T363] usb 6-1: device descriptor read/64, error -71 [ 162.678292][ T363] usb usb6-port1: attempt power cycle [ 162.738091][ T559] usb 3-1: device descriptor read/64, error -71 [ 162.978061][ T559] usb 3-1: new high-speed USB device number 59 using dummy_hcd [ 163.018084][ T363] usb 6-1: new high-speed USB device number 11 using dummy_hcd [ 163.039149][ T363] usb 6-1: device descriptor read/8, error -71 [ 163.108058][ T559] usb 3-1: device descriptor read/64, error -71 [ 163.169139][ T363] usb 6-1: device descriptor read/8, error -71 [ 163.348075][ T559] usb 3-1: device descriptor read/64, error -71 [ 163.408059][ T363] usb 6-1: new high-speed USB device number 12 using dummy_hcd [ 163.429230][ T363] usb 6-1: device descriptor read/8, error -71 [ 163.458147][ T559] usb usb3-port1: attempt power cycle [ 163.559119][ T363] usb 6-1: device descriptor read/8, error -71 [ 163.668339][ T363] usb usb6-port1: unable to enumerate USB device [ 163.798372][ T559] usb 3-1: new high-speed USB device number 60 using dummy_hcd [ 163.819085][ T559] usb 3-1: device descriptor read/8, error -71 [ 163.949164][ T559] usb 3-1: device descriptor read/8, error -71 [ 164.188057][ T559] usb 3-1: new high-speed USB device number 61 using dummy_hcd [ 164.209109][ T559] usb 3-1: device descriptor read/8, error -71 [ 164.347459][ T5062] FAULT_INJECTION: forcing a failure. [ 164.347459][ T5062] name failslab, interval 1, probability 0, space 0, times 0 [ 164.360191][ T5062] CPU: 1 UID: 0 PID: 5062 Comm: syz.5.1875 Not tainted syzkaller #0 4d4a838cf2fc485b043991145ccf8426a0241c16 [ 164.360235][ T5062] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 164.360248][ T5062] Call Trace: [ 164.360255][ T5062] [ 164.360266][ T5062] __dump_stack+0x21/0x30 [ 164.360297][ T5062] dump_stack_lvl+0x140/0x1c0 [ 164.360325][ T5062] ? __cfi_dump_stack_lvl+0x10/0x10 [ 164.360353][ T5062] ? __asan_memset+0x39/0x50 [ 164.360373][ T5062] dump_stack+0x19/0x20 [ 164.360398][ T5062] should_fail_ex+0x3c2/0x510 [ 164.360420][ T5062] should_failslab+0xac/0x100 [ 164.360445][ T5062] kmem_cache_alloc_node_noprof+0x45/0x420 [ 164.360467][ T5062] ? __alloc_skb+0x10c/0x360 [ 164.360492][ T5062] ? __kasan_check_write+0x18/0x20 [ 164.360512][ T5062] ? mutex_unlock+0x90/0x240 [ 164.360539][ T5062] __alloc_skb+0x10c/0x360 [ 164.360565][ T5062] pfkey_sendmsg+0xdd9/0x1190 [ 164.360591][ T5062] ? __cfi_pfkey_sendmsg+0x10/0x10 [ 164.360616][ T5062] ? selinux_socket_sendmsg+0x281/0x380 [ 164.360645][ T5062] ? bpf_lsm_socket_sendmsg+0xd/0x20 [ 164.360677][ T5062] ? security_socket_sendmsg+0x3d/0x100 [ 164.360702][ T5062] ____sys_sendmsg+0x9a1/0xa00 [ 164.360721][ T5062] ? __import_iovec+0x5b9/0x7d0 [ 164.360747][ T5062] ? __sys_sendmsg_sock+0x50/0x50 [ 164.360767][ T5062] ? import_iovec+0x80/0xb0 [ 164.360792][ T5062] ___sys_sendmsg+0x2a6/0x370 [ 164.360811][ T5062] ? __sys_sendmsg+0x2a0/0x2a0 [ 164.360830][ T5062] ? proc_fail_nth_write+0x184/0x220 [ 164.360856][ T5062] ? __cfi_proc_fail_nth_write+0x10/0x10 [ 164.360886][ T5062] ? __fget_files+0x2bc/0x330 [ 164.360909][ T5062] __x64_sys_sendmsg+0x206/0x2e0 [ 164.360928][ T5062] ? fput+0x1a4/0x230 [ 164.360951][ T5062] ? __cfi___x64_sys_sendmsg+0x10/0x10 [ 164.360975][ T5062] ? ksys_write+0x1f3/0x260 [ 164.360995][ T5062] ? __kasan_check_read+0x15/0x20 [ 164.361013][ T5062] x64_sys_call+0x2a4c/0x2ee0 [ 164.361030][ T5062] do_syscall_64+0x57/0xf0 [ 164.361051][ T5062] ? clear_bhb_loop+0x50/0xa0 [ 164.361075][ T5062] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 164.361099][ T5062] RIP: 0033:0x7f5d9219e0d9 [ 164.361114][ T5062] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 164.361130][ T5062] RSP: 002b:00007f5d93010028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 164.361149][ T5062] RAX: ffffffffffffffda RBX: 00007f5d92425fa0 RCX: 00007f5d9219e0d9 [ 164.361164][ T5062] RDX: 0000000004008000 RSI: 0000200000000000 RDI: 0000000000000003 [ 164.361176][ T5062] RBP: 00007f5d93010090 R08: 0000000000000000 R09: 0000000000000000 [ 164.361199][ T5062] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 164.361210][ T5062] R13: 00007f5d92426038 R14: 00007f5d92425fa0 R15: 00007fff0f616a98 [ 164.361225][ T5062] [ 164.366667][ T559] usb 3-1: device descriptor read/8, error -71 [ 164.650357][ T398] usb 1-1: unit 4 not found! [ 164.657657][ T398] usb 1-1: USB disconnect, device number 38 [ 164.667243][ T567] udevd[567]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 164.758662][ T559] usb usb3-port1: unable to enumerate USB device [ 165.558262][ T375] usb 3-1: new high-speed USB device number 62 using dummy_hcd [ 165.567614][ T5088] FAULT_INJECTION: forcing a failure. [ 165.567614][ T5088] name failslab, interval 1, probability 0, space 0, times 0 [ 165.580342][ T5088] CPU: 1 UID: 0 PID: 5088 Comm: syz.0.1883 Not tainted syzkaller #0 4d4a838cf2fc485b043991145ccf8426a0241c16 [ 165.580363][ T5088] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 165.580372][ T5088] Call Trace: [ 165.580378][ T5088] [ 165.580384][ T5088] __dump_stack+0x21/0x30 [ 165.580406][ T5088] dump_stack_lvl+0x140/0x1c0 [ 165.580426][ T5088] ? __cfi_dump_stack_lvl+0x10/0x10 [ 165.580446][ T5088] ? genl_family_rcv_msg_dumpit+0x251/0x320 [ 165.580465][ T5088] ? __asan_memcpy+0x5a/0x80 [ 165.580480][ T5088] dump_stack+0x19/0x20 [ 165.580498][ T5088] should_fail_ex+0x3c2/0x510 [ 165.580514][ T5088] should_failslab+0xac/0x100 [ 165.580531][ T5088] kmem_cache_alloc_node_noprof+0x45/0x420 [ 165.580546][ T5088] ? kasan_save_alloc_info+0x3a/0x50 [ 165.580567][ T5088] ? __kasan_slab_alloc+0x73/0x90 [ 165.580584][ T5088] ? __alloc_skb+0x10c/0x360 [ 165.580603][ T5088] __alloc_skb+0x10c/0x360 [ 165.580622][ T5088] netlink_ack+0x155/0xa50 [ 165.580634][ T5088] ? __cfi_genl_rcv_msg+0x10/0x10 [ 165.580651][ T5088] ? __cfi_ethnl_default_start+0x10/0x10 [ 165.580672][ T5088] netlink_rcv_skb+0x2cb/0x4e0 [ 165.580685][ T5088] ? __cfi_genl_rcv_msg+0x10/0x10 [ 165.580701][ T5088] ? __cfi_netlink_rcv_skb+0x10/0x10 [ 165.580716][ T5088] ? down_read+0x7f/0xe0 [ 165.580736][ T5088] ? __cfi_down_read+0x10/0x10 [ 165.580757][ T5088] genl_rcv+0x2c/0x40 [ 165.580779][ T5088] netlink_unicast+0x8bc/0xa70 [ 165.580800][ T5088] netlink_sendmsg+0x7d1/0xad0 [ 165.580814][ T5088] ? __cfi_netlink_sendmsg+0x10/0x10 [ 165.580829][ T5088] ? bpf_lsm_socket_sendmsg+0xd/0x20 [ 165.580845][ T5088] ? security_socket_sendmsg+0x3d/0x100 [ 165.580864][ T5088] ____sys_sendmsg+0x9a1/0xa00 [ 165.580879][ T5088] ? __import_iovec+0x5b9/0x7d0 [ 165.580899][ T5088] ? __sys_sendmsg_sock+0x50/0x50 [ 165.580913][ T5088] ? import_iovec+0x80/0xb0 [ 165.580933][ T5088] ___sys_sendmsg+0x2a6/0x370 [ 165.580947][ T5088] ? __sys_sendmsg+0x2a0/0x2a0 [ 165.580961][ T5088] ? proc_fail_nth_write+0x184/0x220 [ 165.580981][ T5088] ? __cfi_proc_fail_nth_write+0x10/0x10 [ 165.581004][ T5088] ? __fget_files+0x2bc/0x330 [ 165.581022][ T5088] __x64_sys_sendmsg+0x206/0x2e0 [ 165.581036][ T5088] ? fput+0x1a4/0x230 [ 165.581053][ T5088] ? __cfi___x64_sys_sendmsg+0x10/0x10 [ 165.581067][ T5088] ? ksys_write+0x1f3/0x260 [ 165.581082][ T5088] ? __kasan_check_read+0x15/0x20 [ 165.581096][ T5088] x64_sys_call+0x2a4c/0x2ee0 [ 165.581109][ T5088] do_syscall_64+0x57/0xf0 [ 165.581124][ T5088] ? clear_bhb_loop+0x50/0xa0 [ 165.581144][ T5088] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 165.581162][ T5088] RIP: 0033:0x7fa40639e0d9 [ 165.581174][ T5088] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 165.581186][ T5088] RSP: 002b:00007fa404df7028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 165.581202][ T5088] RAX: ffffffffffffffda RBX: 00007fa406625fa0 RCX: 00007fa40639e0d9 [ 165.581213][ T5088] RDX: 0000000000008004 RSI: 0000200000000980 RDI: 0000000000000003 [ 165.581223][ T5088] RBP: 00007fa404df7090 R08: 0000000000000000 R09: 0000000000000000 [ 165.581232][ T5088] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 165.581240][ T5088] R13: 00007fa406626038 R14: 00007fa406625fa0 R15: 00007fffa82bc958 [ 165.581253][ T5088] [ 165.839913][ T375] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 165.840003][ T375] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 165.879580][ T5093] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1884'. [ 165.892553][ T375] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 165.989950][ T5099] FAULT_INJECTION: forcing a failure. [ 165.989950][ T5099] name failslab, interval 1, probability 0, space 0, times 0 [ 166.005749][ T5099] CPU: 0 UID: 0 PID: 5099 Comm: syz.0.1886 Not tainted syzkaller #0 4d4a838cf2fc485b043991145ccf8426a0241c16 [ 166.005782][ T5099] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 166.005796][ T5099] Call Trace: [ 166.005804][ T5099] [ 166.005813][ T5099] __dump_stack+0x21/0x30 [ 166.005847][ T5099] dump_stack_lvl+0x140/0x1c0 [ 166.005876][ T5099] ? __cfi_dump_stack_lvl+0x10/0x10 [ 166.005906][ T5099] ? genl_family_rcv_msg_doit+0x2a4/0x360 [ 166.005936][ T5099] ? __cfi_nl80211_post_doit+0x10/0x10 [ 166.005968][ T5099] dump_stack+0x19/0x20 [ 166.005997][ T5099] should_fail_ex+0x3c2/0x510 [ 166.006022][ T5099] should_failslab+0xac/0x100 [ 166.006049][ T5099] kmem_cache_alloc_node_noprof+0x45/0x420 [ 166.006074][ T5099] ? __alloc_skb+0x10c/0x360 [ 166.006105][ T5099] __alloc_skb+0x10c/0x360 [ 166.006135][ T5099] netlink_ack+0x155/0xa50 [ 166.006155][ T5099] ? __cfi_genl_rcv_msg+0x10/0x10 [ 166.006181][ T5099] ? __cfi_nl80211_pre_doit+0x10/0x10 [ 166.006214][ T5099] netlink_rcv_skb+0x2cb/0x4e0 [ 166.006236][ T5099] ? __cfi_genl_rcv_msg+0x10/0x10 [ 166.006271][ T5099] ? __cfi_netlink_rcv_skb+0x10/0x10 [ 166.006295][ T5099] ? down_read+0x7f/0xe0 [ 166.006327][ T5099] ? __cfi_down_read+0x10/0x10 [ 166.006359][ T5099] genl_rcv+0x2c/0x40 [ 166.006383][ T5099] netlink_unicast+0x8bc/0xa70 [ 166.006417][ T5099] netlink_sendmsg+0x7d1/0xad0 [ 166.006440][ T5099] ? __cfi_netlink_sendmsg+0x10/0x10 [ 166.006463][ T5099] ? bpf_lsm_socket_sendmsg+0xd/0x20 [ 166.006488][ T5099] ? security_socket_sendmsg+0x3d/0x100 [ 166.006519][ T5099] ____sys_sendmsg+0x9a1/0xa00 [ 166.006542][ T5099] ? __import_iovec+0x5b9/0x7d0 [ 166.006573][ T5099] ? __sys_sendmsg_sock+0x50/0x50 [ 166.006597][ T5099] ? import_iovec+0x80/0xb0 [ 166.006628][ T5099] ___sys_sendmsg+0x2a6/0x370 [ 166.006651][ T5099] ? __sys_sendmsg+0x2a0/0x2a0 [ 166.006673][ T5099] ? proc_fail_nth_write+0x184/0x220 [ 166.006704][ T5099] ? __cfi_proc_fail_nth_write+0x10/0x10 [ 166.006740][ T5099] ? __fget_files+0x2bc/0x330 [ 166.006767][ T5099] __x64_sys_sendmsg+0x206/0x2e0 [ 166.006790][ T5099] ? fput+0x1a4/0x230 [ 166.006818][ T5099] ? __cfi___x64_sys_sendmsg+0x10/0x10 [ 166.006840][ T5099] ? ksys_write+0x1f3/0x260 [ 166.006864][ T5099] ? __kasan_check_read+0x15/0x20 [ 166.006886][ T5099] x64_sys_call+0x2a4c/0x2ee0 [ 166.006906][ T5099] do_syscall_64+0x57/0xf0 [ 166.006930][ T5099] ? clear_bhb_loop+0x50/0xa0 [ 166.006960][ T5099] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 166.006988][ T5099] RIP: 0033:0x7fa40639e0d9 [ 166.007006][ T5099] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 166.007025][ T5099] RSP: 002b:00007fa404df7028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 166.007047][ T5099] RAX: ffffffffffffffda RBX: 00007fa406625fa0 RCX: 00007fa40639e0d9 [ 166.007065][ T5099] RDX: 0000000004000894 RSI: 0000200000000180 RDI: 0000000000000003 [ 166.007080][ T5099] RBP: 00007fa404df7090 R08: 0000000000000000 R09: 0000000000000000 [ 166.007094][ T5099] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 166.007108][ T5099] R13: 00007fa406626038 R14: 00007fa406625fa0 R15: 00007fffa82bc958 [ 166.007128][ T5099] [ 166.072158][ T5103] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 166.076667][ T375] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 166.081430][ T5103] rust_binder: 5102:5103 got transaction to invalid handle 1 [ 166.085158][ T375] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 166.089602][ T5103] rust_binder: 5102:5103 transaction call to 0:0 failed ENOENT, code 8448 size 80-24 [ 166.105149][ T375] usb 3-1: config 0 descriptor?? [ 166.125711][ T559] rust_binder: 5102: undelivered TRANSACTION_ERROR: 29201 [ 166.381591][ T375] usbhid 3-1:0.0: can't add hid device: -71 [ 166.387597][ T375] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 166.408963][ T375] usb 3-1: USB disconnect, device number 62 [ 166.451027][ T5123] netlink: 140 bytes leftover after parsing attributes in process `syz.5.1899'. [ 166.642179][ T36] audit: type=1326 audit(1786154285.810:680): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5134 comm="syz.2.1902" exe="/root/ci2-android-6-12-rust/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fbb7099e0d9 code=0x0 [ 166.832336][ T5155] netlink: 'syz.0.1911': attribute type 16 has an invalid length. [ 166.841785][ T5155] netlink: 104 bytes leftover after parsing attributes in process `syz.0.1911'. [ 167.419593][ T5185] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3722248192 (7444496384 ns) > initial count (200000 ns). Using initial count to start timer. [ 167.468968][ T36] audit: type=1400 audit(1786154286.640:681): avc: denied { bind } for pid=5186 comm="syz.0.1924" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 167.488861][ T36] audit: type=1400 audit(1786154286.640:682): avc: denied { getopt } for pid=5186 comm="syz.0.1924" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 167.523030][ T36] audit: type=1400 audit(1786154286.680:683): avc: denied { read write } for pid=5186 comm="syz.0.1924" name="loop-control" dev="devtmpfs" ino=48 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:loop_control_device_t tclass=chr_file permissive=1 [ 167.548098][ T36] audit: type=1400 audit(1786154286.680:684): avc: denied { open } for pid=5186 comm="syz.0.1924" path="/dev/loop-control" dev="devtmpfs" ino=48 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:loop_control_device_t tclass=chr_file permissive=1 [ 167.575234][ T36] audit: type=1400 audit(1786154286.680:685): avc: denied { ioctl } for pid=5186 comm="syz.0.1924" path="/dev/loop-control" dev="devtmpfs" ino=48 ioctlcmd=0x4c82 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:loop_control_device_t tclass=chr_file permissive=1 [ 167.576923][ T5196] fuse: Bad value for 'fd' [ 167.605978][ T5195] netlink: 104 bytes leftover after parsing attributes in process `syz.0.1926'. [ 167.631005][ T36] audit: type=1400 audit(1786154286.800:686): avc: denied { watch_reads } for pid=5197 comm="syz.2.1928" path="/464" dev="tmpfs" ino=2474 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 167.688467][ T5208] incfs_lookup_dentry err:-40 [ 167.771444][ T5213] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1934'. [ 167.774758][ T36] audit: type=1400 audit(1786154286.940:687): avc: denied { create } for pid=5210 comm="syz.5.1934" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=atmpvc_socket permissive=1 [ 167.928054][ T375] usb 3-1: new high-speed USB device number 63 using dummy_hcd [ 168.088058][ T375] usb 3-1: Using ep0 maxpacket: 16 [ 168.094487][ T375] usb 3-1: config 1 has an invalid interface number: 105 but max is 0 [ 168.103012][ T375] usb 3-1: config 1 has no interface number 0 [ 168.109313][ T375] usb 3-1: config 1 interface 105 altsetting 2 bulk endpoint 0x4 has invalid maxpacket 16 [ 168.119453][ T375] usb 3-1: config 1 interface 105 altsetting 2 endpoint 0x82 has invalid maxpacket 28992, setting to 1024 [ 168.130992][ T375] usb 3-1: config 1 interface 105 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 1024 [ 168.141416][ T375] usb 3-1: config 1 interface 105 has no altsetting 0 [ 168.149934][ T375] usb 3-1: New USB device found, idVendor=20f4, idProduct=e05a, bcdDevice=6c.6d [ 168.159227][ T375] usb 3-1: New USB device strings: Mfr=1, Product=23, SerialNumber=3 [ 168.167371][ T375] usb 3-1: Product: syz [ 168.171804][ T375] usb 3-1: Manufacturer: syz [ 168.176469][ T375] usb 3-1: SerialNumber: syz [ 168.182348][ T5204] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 168.189747][ T5204] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 168.548354][ T4834] ------------[ cut here ]------------ [ 168.553919][ T4834] WARNING: CPU: 0 PID: 4834 at fs/overlayfs/util.c:605 ovl_dir_modified+0x15a/0x190 [ 168.563387][ T4834] Modules linked in: [ 168.567305][ T4834] CPU: 0 UID: 0 PID: 4834 Comm: syz-executor Not tainted syzkaller #0 4d4a838cf2fc485b043991145ccf8426a0241c16 [ 168.579146][ T4834] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 168.589292][ T4834] RIP: 0010:ovl_dir_modified+0x15a/0x190 [ 168.594956][ T4834] Code: c1 e8 03 42 80 3c 28 00 74 08 4c 89 f7 e8 ae 82 97 ff 49 ff 06 5b 41 5c 41 5d 41 5e 41 5f 5d e9 4c eb 5d 03 cc e8 26 be 3e ff <0f> 0b e9 3e ff ff ff e8 1a be 3e ff 0f 0b e9 6e ff ff ff 44 89 f9 [ 168.615013][ T4834] RSP: 0018:ffffc9000febfb88 EFLAGS: 00010293 [ 168.621248][ T4834] RAX: ffffffff8248b39a RBX: 0000000000000000 RCX: ffff88813bf98000 [ 168.628559][ T5204] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 168.629289][ T4834] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 168.636887][ T5204] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 168.644364][ T4834] RBP: ffffc9000febfbb0 R08: ffff888121cb8f3f R09: 1ffff110243971e7 [ 168.659472][ T4834] R10: dffffc0000000000 R11: ffffed10243971e8 R12: 0000000000000000 [ 168.667454][ T4834] R13: dffffc0000000000 R14: ffff888121cb8ea0 R15: ffff8881106abdd0 [ 168.675510][ T4834] FS: 000055557ab29500(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 168.684571][ T4834] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 168.691318][ T4834] CR2: 000055557ab54998 CR3: 0000000144fe2000 CR4: 00000000003526b0 [ 168.699330][ T4834] Call Trace: [ 168.702617][ T4834] [ 168.705552][ T4834] ovl_do_remove+0x824/0xd10 [ 168.710205][ T4834] ? ovl_set_redirect+0x780/0x780 [ 168.715271][ T4834] ? __cfi_down_write+0x10/0x10 [ 168.720162][ T4834] ovl_rmdir+0x1e/0x30 [ 168.724257][ T4834] vfs_rmdir+0x3de/0x560 [ 168.728625][ T4834] incfs_kill_sb+0x102/0x220 [ 168.733238][ T4834] deactivate_locked_super+0xd5/0x270 [ 168.738710][ T4834] deactivate_super+0xb8/0xe0 [ 168.743447][ T4834] cleanup_mnt+0x438/0x4d0 [ 168.747903][ T4834] __cleanup_mnt+0x1d/0x40 [ 168.752377][ T4834] task_work_run+0x1e8/0x260 [ 168.757018][ T4834] ? __cfi_task_work_run+0x10/0x10 [ 168.762192][ T4834] ? __x64_sys_umount+0x12e/0x180 [ 168.767263][ T4834] ? __cfi___x64_sys_umount+0x10/0x10 [ 168.772660][ T4834] ? fpregs_assert_state_consistent+0xb6/0xe0 [ 168.778778][ T4834] resume_user_mode_work+0x35/0x50 [ 168.783916][ T4834] syscall_exit_to_user_mode+0x63/0xb0 [ 168.789439][ T4834] do_syscall_64+0x63/0xf0 [ 168.793887][ T4834] ? clear_bhb_loop+0x50/0xa0 [ 168.798615][ T4834] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 168.804538][ T4834] RIP: 0033:0x7fa40639f317 [ 168.808989][ T4834] Code: a2 c7 05 dc 43 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 168.828624][ T4834] RSP: 002b:00007fffa82bbbc8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 168.837043][ T4834] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007fa40639f317 [ 168.845043][ T4834] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007fffa82bbc80 [ 168.853053][ T4834] RBP: 00007fffa82bbc80 R08: 00007fffa82bcc80 R09: 00000000ffffffff [ 168.861054][ T4834] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fffa82bcd10 [ 168.869062][ T4834] R13: 00007fa406434474 R14: 0000000000029240 R15: 00007fffa82bcd50 [ 168.877032][ T4834] [ 168.880091][ T4834] ---[ end trace 0000000000000000 ]--- [ 168.888270][ T4834] ------------[ cut here ]------------ [ 168.893741][ T4834] WARNING: CPU: 1 PID: 4834 at fs/overlayfs/util.c:605 ovl_dir_modified+0x15a/0x190 [ 168.903212][ T4834] Modules linked in: [ 168.907137][ T4834] CPU: 1 UID: 0 PID: 4834 Comm: syz-executor Tainted: G W syzkaller #0 4d4a838cf2fc485b043991145ccf8426a0241c16 [ 168.920415][ T4834] Tainted: [W]=WARN [ 168.924333][ T4834] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 168.934528][ T4834] RIP: 0010:ovl_dir_modified+0x15a/0x190 [ 168.940242][ T4834] Code: c1 e8 03 42 80 3c 28 00 74 08 4c 89 f7 e8 ae 82 97 ff 49 ff 06 5b 41 5c 41 5d 41 5e 41 5f 5d e9 4c eb 5d 03 cc e8 26 be 3e ff <0f> 0b e9 3e ff ff ff e8 1a be 3e ff 0f 0b e9 6e ff ff ff 44 89 f9 [ 168.959927][ T4834] RSP: 0018:ffffc9000febfb88 EFLAGS: 00010293 [ 168.966020][ T4834] RAX: ffffffff8248b39a RBX: 0000000000000000 RCX: ffff88813bf98000 [ 168.974032][ T4834] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 168.982078][ T4834] RBP: ffffc9000febfbb0 R08: ffff888121cb8f3f R09: 1ffff110243971e7 [ 168.990102][ T4834] R10: dffffc0000000000 R11: ffffed10243971e8 R12: 0000000000000000 [ 168.998172][ T4834] R13: dffffc0000000000 R14: ffff888121cb8ea0 R15: ffff8881106abdd0 [ 169.006167][ T4834] FS: 000055557ab29500(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 169.015154][ T4834] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 169.021815][ T4834] CR2: 0000200000002008 CR3: 0000000144fe2000 CR4: 00000000003526b0 [ 169.029860][ T4834] DR0: ffffffffffffffff DR1: 00000000000001f8 DR2: 0000000000000083 [ 169.037856][ T4834] DR3: ffffffffefffff15 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 169.045882][ T4834] Call Trace: [ 169.049227][ T4834] [ 169.052198][ T4834] ovl_do_remove+0x824/0xd10 [ 169.056819][ T4834] ? ovl_set_redirect+0x780/0x780 [ 169.061903][ T4834] ? __cfi_down_write+0x10/0x10 [ 169.066791][ T4834] ovl_rmdir+0x1e/0x30 [ 169.070947][ T4834] vfs_rmdir+0x3de/0x560 [ 169.075246][ T4834] incfs_kill_sb+0x197/0x220 [ 169.079922][ T4834] deactivate_locked_super+0xd5/0x270 [ 169.085362][ T4834] deactivate_super+0xb8/0xe0 [ 169.090124][ T4834] cleanup_mnt+0x438/0x4d0 [ 169.094587][ T4834] __cleanup_mnt+0x1d/0x40 [ 169.099087][ T4834] task_work_run+0x1e8/0x260 [ 169.103717][ T4834] ? __cfi_task_work_run+0x10/0x10 [ 169.108902][ T4834] ? __x64_sys_umount+0x12e/0x180 [ 169.113948][ T4834] ? __cfi___x64_sys_umount+0x10/0x10 [ 169.119369][ T4834] ? fpregs_assert_state_consistent+0xb6/0xe0 [ 169.125468][ T4834] resume_user_mode_work+0x35/0x50 [ 169.130612][ T4834] syscall_exit_to_user_mode+0x63/0xb0 [ 169.136118][ T4834] do_syscall_64+0x63/0xf0 [ 169.140587][ T4834] ? clear_bhb_loop+0x50/0xa0 [ 169.145295][ T4834] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 169.151240][ T4834] RIP: 0033:0x7fa40639f317 [ 169.155712][ T4834] Code: a2 c7 05 dc 43 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 169.175405][ T4834] RSP: 002b:00007fffa82bbbc8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 169.183886][ T4834] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007fa40639f317 [ 169.191915][ T4834] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007fffa82bbc80 [ 169.199947][ T4834] RBP: 00007fffa82bbc80 R08: 00007fffa82bcc80 R09: 00000000ffffffff [ 169.207940][ T4834] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fffa82bcd10 [ 169.216068][ T4834] R13: 00007fa406434474 R14: 0000000000029240 R15: 00007fffa82bcd50 [ 169.224123][ T4834] [ 169.227162][ T4834] ---[ end trace 0000000000000000 ]--- [ 169.501895][ T375] aqc111 3-1:1.105 (unnamed net_device) (uninitialized): Failed to read(0x1) reg index 0x0001: -71 [ 169.514954][ T375] aqc111 3-1:1.105 eth1: register 'aqc111' at usb-dummy_hcd.2-1, USB-C 3.1 to 5GBASE-T Ethernet Adapter, 62:b3:c2:cd:c3:3c [ 169.528895][ T375] usb 3-1: USB disconnect, device number 63 [ 169.535490][ T375] aqc111 3-1:1.105 eth1: unregister 'aqc111' usb-dummy_hcd.2-1, USB-C 3.1 to 5GBASE-T Ethernet Adapter [ 169.569000][ T375] aqc111 3-1:1.105 eth1 (unregistered): Failed to write(0x1) reg index 0x0002: -19 [ 169.578378][ T375] aqc111 3-1:1.105 eth1 (unregistered): Failed to write(0x1) reg index 0x0002: -19 [ 169.587708][ T375] aqc111 3-1:1.105 eth1 (unregistered): Failed to write(0x61) reg index 0x0000: -19