last executing test programs: 7.544118346s ago: executing program 3 (id=194): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./dev/sda\x00', 0x800, 0xd1493dfef03ceedc) r1 = fsmount(r0, 0x0, 0x4) read$FUSE(r1, &(0x7f0000002200)={0x2020}, 0x2020) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0), 0x2200, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r3, r4, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, &(0x7f0000000240)="d8df7e23b3b9ce000000b807000000ba000000000f301b8154fea900b9b60a000080321100c4e28ddc8dcd000000c182fd3f0000c850220000b801000000b9a6080000b9800000c00f3235000800000f30ba000000000f300f300fc79d53bf0000c4b9e16dc301012202", 0x6a}], 0x1, 0x10, 0x0, 0x0) ioctl$KVM_SET_CPUID2(r4, 0x4008ae90, &(0x7f00000002c0)={0x3, 0x0, [{0x80000008, 0x0, 0x3, 0x9, 0x9, 0x1, 0x7f}, {0x7, 0x0, 0x2, 0x2, 0xa, 0x8, 0x3}, {0x1, 0xcac, 0x3, 0xa5b0, 0x6, 0x4, 0x4}]}) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000340)={[0x7, 0x3, 0xd, 0x2, 0xb, 0x0, 0xf20, 0xc, 0x5, 0x10, 0x5, 0x8, 0x6, 0x0, 0x80000002, 0x5], 0x100000, 0xc00}) ioctl$KVM_RUN(r4, 0xae80, 0x0) r5 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x1, 0x0, 0x0, 0x0, 0x20, 0x757, 0xa00, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x30, 0x20, "", [{{0x9, 0x4, 0x0, 0x44, 0x3, 0x3, 0x0, 0x3, 0x0, {0x9, 0x21, 0x1001, 0xff, 0x1, {0x22, 0x6}}, {{{0x9, 0x5, 0x81, 0x3, 0x10, 0x3, 0x1, 0x8}}}}}]}}]}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_NO_ENOBUFS(r6, 0x10e, 0xc, &(0x7f0000000400)=0x7f, 0x4) sendmsg$netlink(r6, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)=[{&(0x7f00000004c0)=ANY=[@ANYBLOB="1c0000005a000101000000000000000004000080080002"], 0x1c}], 0x1}, 0x0) prctl$PR_CAP_AMBIENT(0x2f, 0x2, 0x0) syz_usb_control_io$hid(r5, 0x0, 0x0) syz_usb_control_io(r5, &(0x7f00000000c0)={0x2c, &(0x7f0000000040)=ANY=[@ANYBLOB="00110600000006059e560ed1"], 0x0, 0x0, 0x0, 0x0}, 0x0) 5.595559533s ago: executing program 3 (id=201): mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) r0 = socket(0x28, 0x5, 0x0) bind$vsock_stream(r0, 0x0, 0x0) listen(r0, 0x0) openat2$dir(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000340)={0x2adc0, 0x1c1, 0x6}, 0x18) r1 = openat$binfmt_register(0xffffffffffffff9c, &(0x7f0000000380), 0x1, 0x0) syz_open_procfs(0x0, &(0x7f00000026c0)='task\x00') r2 = syz_clone(0x0, 0x0, 0x1d, 0x0, 0x0, 0x0) mount(0x0, &(0x7f0000002700)='.\x00', &(0x7f0000002740)='proc\x00', 0x5024431, 0x0) r3 = syz_open_procfs(r2, &(0x7f0000002780)='stat\x00') pread64(r3, &(0x7f00000027c0)=""/1, 0x1, 0x10008) write$binfmt_register(r1, &(0x7f00000003c0)={0x3a, 'syz2', 0x3a, 'E', 0x3a, 0xfffffffffffffff7, 0x3a, '\xe2\xbf\xd9\xafk\xd3~a3\xd0\x94', 0x3a, 'u', 0x3a, './file0', 0x3a, [0x46, 0x43, 0x50, 0x4f]}, 0x37) r4 = open(&(0x7f0000000200)='./file0\x00', 0x40a40, 0x6d53eb8e39d5e75c) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x8000, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r7, &(0x7f0000fd7000/0x18000)=nil, &(0x7f0000000540)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_SET_NESTED_STATE(r7, 0x4080aebf, &(0x7f0000000580)=@vmx={0x0, 0x0, 0x2080, {0x0, 0x0, {}, 0x0, 0x2}}) syz_kvm_setup_cpu$x86(r6, r7, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000002600)=[@text16={0x10, &(0x7f0000002640)="660f388084000072ba64660f6adb0c66b860b4498c66efbafc0c66b80e0000002ebe660f38049f9e0064f30fc7b000100f01c820f30fc7b1030066b9800000c00f326635000400005de57fb47fb40a000f23c80f21f86635040040000f08b8f4008ee0", 0x63}], 0x1, 0x48, 0x0, 0x0) ioctl$KVM_RUN(r7, 0xae80, 0x0) r8 = getpgrp(0x0) r9 = gettid() rt_tgsigqueueinfo(r8, r9, 0x1f, &(0x7f0000002800)={0x26, 0x1, 0x10004}) ioctl$F2FS_IOC_GARBAGE_COLLECT_RANGE(r4, 0x4018f50b, 0x0) inotify_add_watch(0xffffffffffffffff, 0x0, 0x20000000) truncate(&(0x7f0000000480)='./file0\x00', 0x4) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000140)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000001c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10020, r9, 0x0, 0x4d}}}, &(0x7f0000000280)) 5.32577403s ago: executing program 3 (id=203): socket$nl_netfilter(0x10, 0x3, 0xc) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fsmount(0xffffffffffffffff, 0x0, 0x79) syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), r2) syz_open_procfs(0x0, &(0x7f0000000080)='fd/3\x00') mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000180)='smaps_rollup\x00') fchdir(r3) openat2$dir(0xffffffffffffff9c, &(0x7f00000001c0)='.\x00', &(0x7f0000000200)={0x5750c0}, 0x18) close(0x3) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./trace\x00', 0x1ff) setsockopt$inet6_tcp_int(r1, 0x6, 0x2000000000000022, &(0x7f0000000000)=0x8, 0x4) ioctl$UFFDIO_WAKE(r2, 0x8010aa02, &(0x7f0000000280)={&(0x7f0000ffb000/0x4000)=nil, 0x4000}) r4 = syz_genetlink_get_family_id$wireguard(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$WG_CMD_SET_DEVICE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)={0xf8, r4, 0x1, 0x0, 0x0, {}, [@WGDEVICE_A_FLAGS={0x8, 0x5, 0x1}, @WGDEVICE_A_IFNAME={0x14, 0x2, 'wg0\x00'}, @WGDEVICE_A_PEERS={0xc8, 0x8, 0x0, 0x1, [{0xc4, 0x0, 0x0, 0x1, [@WGPEER_A_ENDPOINT6={0x20, 0x4, {0xa, 0x4e23, 0x7, @empty, 0x8}}, @WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL={0x6, 0x5, 0x1}, @WGPEER_A_PUBLIC_KEY={0x24, 0x1, @neg}, @WGPEER_A_ALLOWEDIPS={0x6c, 0x9, 0x0, 0x1, [{0x28, 0x0, 0x0, 0x1, [@ipv6={{0x6}, {0x14, 0x2, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010100}}, {0x5, 0x3, 0x2}}]}, {0x40, 0x0, 0x0, 0x1, [@ipv4={{0x6}, {0x8, 0x2, @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x5}}, @ipv6={{0x6}, {0x14, 0x2, @empty}, {0x5, 0x3, 0x2}}]}]}, @WGPEER_A_FLAGS={0x8}]}]}]}, 0xf8}, 0x1, 0x0, 0x0, 0x4044851}, 0x40000) socket$nl_netfilter(0x10, 0x3, 0xc) (async) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) socket$inet6_tcp(0xa, 0x1, 0x0) (async) fsmount(0xffffffffffffffff, 0x0, 0x79) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), r2) (async) syz_open_procfs(0x0, &(0x7f0000000080)='fd/3\x00') (async) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) (async) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000180)='smaps_rollup\x00') (async) fchdir(r3) (async) openat2$dir(0xffffffffffffff9c, &(0x7f00000001c0)='.\x00', &(0x7f0000000200)={0x5750c0}, 0x18) (async) close(0x3) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./trace\x00', 0x1ff) (async) setsockopt$inet6_tcp_int(r1, 0x6, 0x2000000000000022, &(0x7f0000000000)=0x8, 0x4) (async) ioctl$UFFDIO_WAKE(r2, 0x8010aa02, &(0x7f0000000280)={&(0x7f0000ffb000/0x4000)=nil, 0x4000}) (async) syz_genetlink_get_family_id$wireguard(&(0x7f00000000c0), 0xffffffffffffffff) (async) sendmsg$WG_CMD_SET_DEVICE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)={0xf8, r4, 0x1, 0x0, 0x0, {}, [@WGDEVICE_A_FLAGS={0x8, 0x5, 0x1}, @WGDEVICE_A_IFNAME={0x14, 0x2, 'wg0\x00'}, @WGDEVICE_A_PEERS={0xc8, 0x8, 0x0, 0x1, [{0xc4, 0x0, 0x0, 0x1, [@WGPEER_A_ENDPOINT6={0x20, 0x4, {0xa, 0x4e23, 0x7, @empty, 0x8}}, @WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL={0x6, 0x5, 0x1}, @WGPEER_A_PUBLIC_KEY={0x24, 0x1, @neg}, @WGPEER_A_ALLOWEDIPS={0x6c, 0x9, 0x0, 0x1, [{0x28, 0x0, 0x0, 0x1, [@ipv6={{0x6}, {0x14, 0x2, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010100}}, {0x5, 0x3, 0x2}}]}, {0x40, 0x0, 0x0, 0x1, [@ipv4={{0x6}, {0x8, 0x2, @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x5}}, @ipv6={{0x6}, {0x14, 0x2, @empty}, {0x5, 0x3, 0x2}}]}]}, @WGPEER_A_FLAGS={0x8}]}]}]}, 0xf8}, 0x1, 0x0, 0x0, 0x4044851}, 0x40000) (async) 5.29822671s ago: executing program 3 (id=204): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) close(r0) syz_kvm_setup_syzos_vm$x86(0xffffffffffffffff, &(0x7f0000bff000/0x400000)=nil) r1 = syz_open_procfs$pagemap(0x0, &(0x7f0000000380)) ioctl$PAGEMAP_SCAN(r1, 0xc0606610, &(0x7f0000000480)={0x60, 0x0, &(0x7f0000001000/0x3000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x4, &(0x7f0000000540)=[{0x800000000}], 0x1, 0xbff, 0x1e, 0x0, 0xc, 0x6e}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000280)) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'syzkaller0\x00', 0x1}) ioctl$SIOCSIFHWADDR(r0, 0x8922, &(0x7f0000000340)={'syzkaller0\x00', @random="2b0100004ec6"}) ioctl$TUNSETLINK(r2, 0x400454cd, 0x308) r3 = syz_usb_connect$cdc_ecm(0x0, 0x56, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000090000102505a1a4400000000101090244000101000000090400001202060000052406000005240000000d240f010000000000000000000905810340000000000905820260000000000905030208"], 0x0) syz_usb_control_io(r3, 0x0, 0x0) syz_usb_control_io(r3, 0x0, 0x0) syz_usb_connect(0x0, 0x98, &(0x7f00000000c0)=ANY=[@ANYBLOB="12015002f3cb5fffdd0888093c4e0102030109028600020bf8fffe09041504005e24834a0904000006422035020624060001af052400e0000d240f0104000000060095000106241a0002390424131d052415050009050f00ff0301090509050003100005050309050300000205020a090500080004ff00840725010c02800009050d002000f3088e072501000a00000905030010000806c0c04a6cb9c506f1a8ec49687ce658de73f7ed0a7ed8a6054d184342babe6615ba01dd108052"], 0x0) r4 = add_key$fscrypt_provisioning(&(0x7f0000000180), &(0x7f00000001c0)={'syz', 0x2}, &(0x7f0000000200)={0x0, 0x0, @auto=[0x19, 0x1a, 0x30, 0x25, 0x28, 0x30, 0x18, 0x2a]}, 0x10, 0xfffffffffffffffc) keyctl$setperm(0x5, r4, 0x20040000) syz_usb_control_io$cdc_ecm(r3, &(0x7f0000000080)={0x14, 0x0, &(0x7f0000000500)={0x0, 0x3, 0x1a, {0xfffffffffffffea4}}}, 0x0) syz_usb_ep_write(r3, 0x82, 0xfffffcc6, &(0x7f0000000400)="16688a4a3f1cd2db03000007000000000d7c36e51e67f08f961d2fc0c37d7c8c2136536697a794f470c5f44c560dedb1b190fa63c35a3c256fb8b4e2542f15f331") 3.566841193s ago: executing program 2 (id=217): r0 = socket$inet_udp(0x2, 0x2, 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, &(0x7f0000000080)={0x18, 0x0, 0x0, 0x0, 0x0, 0x0}) bind$inet(r0, &(0x7f0000000240)={0x2, 0x0, @local}, 0x6f) syz_open_dev$tty1(0xc, 0x4, 0x1) socket$inet_udp(0x2, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000280)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc\x00', 0x1ff) mount(0x0, 0x0, &(0x7f0000000200)='proc\x00', 0x4000, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r2, &(0x7f0000000300)='27', 0x2) mkdirat(r2, 0x0, 0x20) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000340), 0x121301, 0x0) 3.095124574s ago: executing program 2 (id=220): timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) timer_settime(r0, 0x1, &(0x7f0000000040)={{0x0, 0x3938700}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec775000) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./dev/sda\x00', 0x2, 0x0) ioctl$BLKZEROOUT(r1, 0x127f, &(0x7f00000001c0)={0x3002000, 0x40001000}) 2.957610228s ago: executing program 3 (id=221): mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) r0 = socket(0x28, 0x5, 0x0) bind$vsock_stream(r0, 0x0, 0x0) listen(r0, 0x0) openat2$dir(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000340)={0x2adc0, 0x1c1, 0x6}, 0x18) r1 = openat$binfmt_register(0xffffffffffffff9c, &(0x7f0000000380), 0x1, 0x0) syz_open_procfs(0x0, &(0x7f00000026c0)='task\x00') r2 = syz_clone(0x0, 0x0, 0x1d, 0x0, 0x0, 0x0) mount(0x0, &(0x7f0000002700)='.\x00', &(0x7f0000002740)='proc\x00', 0x5024431, 0x0) r3 = syz_open_procfs(r2, &(0x7f0000002780)='stat\x00') pread64(r3, &(0x7f00000027c0)=""/1, 0x1, 0x10008) write$binfmt_register(r1, &(0x7f00000003c0)={0x3a, 'syz2', 0x3a, 'E', 0x3a, 0xfffffffffffffff7, 0x3a, '\xe2\xbf\xd9\xafk\xd3~a3\xd0\x94', 0x3a, 'u', 0x3a, './file0', 0x3a, [0x46, 0x43, 0x50, 0x4f]}, 0x37) r4 = open(&(0x7f0000000200)='./file0\x00', 0x40a40, 0x6d53eb8e39d5e75c) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x8000, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r7, &(0x7f0000fd7000/0x18000)=nil, &(0x7f0000000540)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_SET_NESTED_STATE(r7, 0x4080aebf, &(0x7f0000000580)=@vmx={0x0, 0x0, 0x2080, {0x0, 0x0, {}, 0x0, 0x2}}) syz_kvm_setup_cpu$x86(r6, r7, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000002600)=[@text16={0x10, &(0x7f0000002640)="660f388084000072ba64660f6adb0c66b860b4498c66efbafc0c66b80e0000002ebe660f38049f9e0064f30fc7b000100f01c820f30fc7b1030066b9800000c00f326635000400005de57fb47fb40a000f23c80f21f86635040040000f08b8f4008ee0", 0x63}], 0x1, 0x48, 0x0, 0x0) ioctl$KVM_RUN(r7, 0xae80, 0x0) r8 = getpgrp(0x0) r9 = gettid() rt_tgsigqueueinfo(r8, r9, 0x1f, &(0x7f0000002800)={0x26, 0x1, 0x10004}) ioctl$F2FS_IOC_GARBAGE_COLLECT_RANGE(r4, 0x4018f50b, 0x0) inotify_add_watch(0xffffffffffffffff, 0x0, 0x20000000) r10 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000400)={0x0, 0x30b5, 0x1, 0x1, 0x158, 0x0, r3}, &(0x7f0000000080)=0x0, &(0x7f00000000c0)=0x0, &(0x7f0000000100)) syz_ublk_add_dev(r10, r11, r12, 0x0, &(0x7f0000000140)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000001c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10020, r9, 0x0, 0x4d}}}, &(0x7f0000000280)) 2.355620642s ago: executing program 3 (id=222): r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$input_event(r0, &(0x7f0000000040)={{}, 0x1f, 0x83b, 0x1b}, 0x18) r1 = syz_usb_connect$uac2(0x2, 0xde, &(0x7f0000000080)={{0x12, 0x1, 0x300, 0x0, 0x0, 0x0, 0xff, 0x41e, 0x3000, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xcc, 0x3, 0x1, 0x3, 0x80, 0x1, {0x8, 0xb, 0x0, 0x1, 0x1, 0x8, 0x20, 0x92}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0x2, 0x9, 0x25, 0xe7}, [@processing_unit={0x11, 0x24, 0x8, 0x3, 0x1, [0x2, 0x2, 0x1, 0x1, 0x2, 0x3]}, @mixer_unit={0xb, 0x24, 0x4, 0x2, 0x2, "734992c7bc5c"}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {[@format_type_ii_ext={0xa, 0x24, 0x2, 0x2, 0x8, 0x200, 0xf, 0x6}, @format_type_i_descriptor={0x6, 0x24, 0x2, 0x1, 0x3, 0xff}, @format_type_i_discrete={0x9, 0x24, 0x2, 0x1, 0x3, 0x2, 0xf1, 0x7, "9f"}, @as_header={0x10, 0x24, 0x1, 0x80, 0x0, 0x0, 0x5, 0xdf, 0x1}]}, {{0x9, 0x5, 0x1, 0x9, 0x20, 0x7, 0x8, 0x7, {0x8, 0x25, 0x1, 0x0, 0x30, 0x1, 0x2}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {[@as_header={0x10, 0x24, 0x1, 0x8, 0xd, 0x0, 0x1002, 0x80, 0x0, 0x9}, @format_type_i_discrete={0xe, 0x24, 0x2, 0x1, 0x3, 0x1, 0x1, 0x3, "e0d51ca67c48"}]}, {{0x9, 0x5, 0x82, 0x9, 0x40, 0x7, 0xd, 0x9, {0x8, 0x25, 0x1, 0x2, 0x30, 0x3, 0x8001}}}}}}}}]}}, &(0x7f00000005c0)={0xa, &(0x7f0000000180)={0xa, 0x6, 0x0, 0x2, 0xfc, 0x4, 0xff, 0x7}, 0xf2, &(0x7f00000001c0)={0x5, 0xf, 0xf2, 0x5, [@ext_cap={0x7, 0x10, 0x2, 0x8, 0x5, 0x7, 0x5}, @generic={0x19, 0x10, 0xb, "df1e87f56f513f07b3a32d9e1f49a00e334980f43c65"}, @generic={0xb6, 0x10, 0x2, "4c881764550412b5404c1c83092696a16fb2388282b154ea2ed9a06ec6e09401943400e6fcb99f88b0dbfa5b64833df20c01d335d36068b13501e413c1211a6c26eff44740bd470cd160964a62247a57f21aef0efff172018e83490d3bea165e146114d9ae47c2259c8e891d03b10e2f70a4f839d39fb7777a3cfe0d1ccc8d8a7a76c3f0ddfcf07cbd4b958aae795720b0f183ec50a9c2f61054d59eaa6e63f78a8a4ff48d936657817f541190e609fcad02f3"}, @ssp_cap={0x10, 0x10, 0xa, 0x50, 0x1, 0xfff, 0xf00, 0xf46b, [0xc0ff]}, @ext_cap={0x7, 0x10, 0x2, 0x14, 0x5, 0x6, 0xff01}]}, 0x5, [{0xdc, &(0x7f00000002c0)=@string={0xdc, 0x3, "e265881bde5c46bae6b54184af97765e2777ab97fb7e0aa335a934e79b4852ad2ed77b896409a05eed4b286e6f3b0e0b596d4ba5b248b1e87915d390589cde49934ed490b86bf34e9bec76a62969725746de0d57350c476f6b012faae0c4d76b83e9897fb805483ec4f570ce6c259fda8e536f9368c8e90bd2d948367a41e44bba1dd3c968f3a57e49f326d4dbbbcc4b5dfc3bcaea1f1f8e63facdc5e82f0c68438c2e1a3980e6d36e4af002b00ce6f2e15b095c1247edbd4a0b07fee28dfbc8d74e8fccadb73f23607ebe0dbd5212d093fcccd01f2d0722fdee"}}, {0x4, &(0x7f00000003c0)=@lang_id={0x4, 0x3, 0x420}}, {0x94, &(0x7f0000000400)=@string={0x94, 0x3, "b62fdaced8bd3e90bfc4aa3c894c10d9ec0bed50230cf939a9c14b363888280fbefc789145e4b190b19c372614efd24f231010968a37231c452113b6d5891cc6077be4244ce5fb68f186b52871342446ccc86cbd448b8b6b710e7d6e578b4daab09062d330adae482ddde0b4429e986089d105877657c2831716dca1f4d9f832f7860facb5354c95303f15c5bd673c881230"}}, {0x4, &(0x7f00000004c0)=@lang_id={0x4, 0x3, 0x807}}, {0xb9, &(0x7f0000000500)=@string={0xb9, 0x3, "f9d4aeefbb20c869adfccdf4f3b45d6a362b8c7764e09ac889efe16e6d7ec6f5aadb4a4f6f3c586d692cca4d112cd94943e5178b4e53b6c70a04d71f59207355041fc6811381d74f46fbd9179992795851eba5d43e0b8af94dcad2dad6dfbdafd6ff213cbfc2e17302a6cc6b517d6b6b4a9b9582d59338af2ee068a4488c6dc79d89614b578f8d2f9158e7e05c07d87a7cdab72bb71d1d4abc6988a8af29662c0aa0eadde6d52f2c56e6157fa1e80a53384fe167387e3a"}}]}) syz_usb_control_io$uac2(r1, &(0x7f0000000740)={0x14, &(0x7f0000000640)={0x0, 0xf, 0x15, {0x15, 0x22, "b0fb65755842962474250eb530a842cfba4660"}}, &(0x7f0000000680)={0x0, 0x3, 0x8f, @string={0x8f, 0x3, "96a826b43ee517c06e2c994633af8d3ac96c858f2e7590b2e25f6934317991c2f395e2c6ed1cd1f2edf0cbb6a29fe9795342f9946e687a512612a1844c513bb3c97a60071d4b8d1725dc571497e7384df1ba57a6a449a0ddd42dfaf7f2f1b1b4c7cfa10a0759ff05cefa48eec5461230937335147b49c05a18d4214d13d35da40b09789da7ff2f7796bdf8aeb1"}}}, &(0x7f00000009c0)={0x44, &(0x7f0000000780)={0x40, 0xa, 0x46, "9a3039ac78d48e27c49d0e141f839d2a59a6f99853b97fe56ba869d77becdc64efdf3e94d442532946f765d55d6d1ce846b66d7c79fd9d9db6ae0502374f53d49b6083e3b05b"}, &(0x7f0000000800)={0x0, 0xa, 0x1, 0x5}, &(0x7f0000000840)={0x0, 0x8, 0x1, 0x9}, &(0x7f0000000880)={0x20, 0x81, 0x3, "6156b0"}, &(0x7f00000008c0)={0x20, 0x82, 0x1, "89"}, &(0x7f0000000900)={0x20, 0x83, 0x3, "340e36"}, &(0x7f0000000940)={0x20, 0x84, 0x1, "9c"}, &(0x7f0000000980)={0x20, 0x85, 0x3, "3988b4"}}) r2 = openat$null(0xffffffffffffff9c, &(0x7f0000000a40), 0x4000, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f0000000a80)={0x2020, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x2020) write$FUSE_DIRENT(r2, &(0x7f0000002ac0)={0x70, 0x0, r3, [{0x1, 0xb, 0x0, 0x1ff}, {0x0, 0x4, 0xc, 0x5, '/dev/uinput\x00'}, {0x3, 0xfffffffffffffffa, 0x2, 0xc89, ':*'}]}, 0x70) syz_usb_control_io(r1, &(0x7f0000002d40)={0x2c, &(0x7f0000002b40)={0x20, 0x23, 0xaa, {0xaa, 0x0, "995f174c2dccb3b2c70a83f05eec19761853d51e235abd83791a4e9d738000f8ec7fb81d76c6f3fd825897e5c0e7276852825e222740f7bf25731c53781ed95c798f7905dd1bbe2519ccef2e4bf1aa93b0571687e89b05af01858a79eab8fb2e9dcc1e1a8eb702063be7b0205387d75453eafb65a3105c1b01784d87821f0050cd7af1a662b7763330e9bc7fb5442c1eb1c665b6c2c2f1ddf97f884a683749fb77953a6f8a10e2ee"}}, &(0x7f0000002c00)={0x0, 0x3, 0x3f, @string={0x3f, 0x3, "6713561d5267a0f6f25f599f8a82609c2679161acff1e34130082e931fb7ae5398ac791bc5bc67d8b57d55f4a4c8caab04feca45d00c8e469374cdd04a"}}, &(0x7f0000002c80)={0x0, 0xf, 0x29, {0x5, 0xf, 0x29, 0x1, [@ssp_cap={0x24, 0x10, 0xa, 0x9, 0x6, 0x1, 0x0, 0xfc00, [0x30, 0x1bf00, 0xc000, 0x3f27, 0x3fcf, 0xff0000]}]}}, &(0x7f0000002cc0)={0x20, 0x29, 0xf, {0xf, 0x29, 0x1, 0x1, 0x8, 0xf, "b547a1c4", "13f4aca8"}}, &(0x7f0000002d00)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x8, 0x80, 0x0, 0x80, 0x0, 0x9, 0x2}}}, &(0x7f0000003240)={0x84, &(0x7f0000002d80)={0x0, 0x17, 0xef, "3653d7b6139918a773614a850acf981728370aa1d5e1defa3f4689ea01cb09923345f12558f82cf01e9ce007c68bef5462c9717a1d6cb783061ec3da694b93dbd379e796db861a7339cb38852e609affb67dd810db47cbc1c3e0ae599faa220bbfefb193f158f5b03316813c6df90336f22a97f3412c658436df7b63ae77caf6955c204436e8db1b1f0dec56c4d95608411ef2e2ac6f2a53bc86425f19caf784034c4e757c00145db3150bf25a2bfd3b4314beec8f60406d7337b8fc7fdad02ebe0faf1b1804645c0bdf14401da8bd471f317df9e2b6a2b0d5e9ce9b77e29af4e2966ec6f7374dc5fac811235192be"}, &(0x7f0000002e80)={0x0, 0xa, 0x1, 0x4}, &(0x7f0000002ec0)={0x0, 0x8, 0x1, 0x5}, &(0x7f0000002f00)={0x20, 0x0, 0x4, {0x2, 0x2}}, &(0x7f0000002f40)={0x20, 0x0, 0x8, {0x2, 0x10, [0xf0]}}, &(0x7f0000002f80)={0x40, 0x7, 0x2}, &(0x7f0000002fc0)={0x40, 0x9, 0x1, 0xd}, &(0x7f0000003000)={0x40, 0xb, 0x2, "f0cb"}, &(0x7f0000003040)={0x40, 0xf, 0x2, 0x64e2}, &(0x7f0000003080)={0x40, 0x13, 0x6, @random="ec3ecb0fae4a"}, &(0x7f00000030c0)={0x40, 0x17, 0x6, @link_local}, &(0x7f0000003100)={0x40, 0x19, 0x2, "7dff"}, &(0x7f0000003140)={0x40, 0x1a, 0x2, 0x4}, &(0x7f0000003180)={0x40, 0x1c, 0x1, 0x9}, &(0x7f00000031c0)={0x40, 0x1e, 0x1, 0x1}, &(0x7f0000003200)={0x40, 0x21, 0x1, 0xb3}}) r7 = openat2$dir(0xffffffffffffff9c, &(0x7f0000003400)='./file0\x00', &(0x7f0000003440)={0x24000, 0x20, 0x8}, 0x18) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000003480)={0x0, 0x0, 0x0}, &(0x7f00000034c0)=0xc) stat(&(0x7f0000003500)='./file0\x00', &(0x7f0000003540)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r11 = openat$binderfs_feature(0xffffffffffffff9c, &(0x7f00000035c0)='./binderfs/features/oneway_spam_detection\x00', 0x0, 0x0) getresgid(&(0x7f0000003600), &(0x7f0000003640)=0x0, &(0x7f0000003680)=0x0) getresuid(&(0x7f0000003e80), &(0x7f0000003ec0), &(0x7f0000003f00)=0x0) r15 = getgid() syz_ublk_add_dev(r2, 0x0, 0x0, 0x0, &(0x7f0000004240)={0x2e, 0x10, 0x0, r2, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000004200)=@new_dev={0x3, 0xd38, 0x0, 0x0, 0x1000, 0xffffffff, r6, 0x0, 0x7}}}, &(0x7f00000042c0)) r17 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r18 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) sendmmsg$unix(r2, &(0x7f00000043c0)=[{{0x0, 0x0, &(0x7f00000033c0)=[{&(0x7f0000003300)="c98cfd4df94a5591b8fbfec3ef40fbe53b74c79928b2132bb10c85971397ab761b2e5287cc126ca7108af8d11d992828933e34cab2ca4a9148cd04d429e5d3c13444fffdc35cc20687cddfd7d20eca0c3a84f935eff74011c9180ecbd536b41a6ed03df9673fef52cfb8978ddf2ff37568347b0f3d466364c80abb2b017ff018a7453a60f47202ed0453e21fbb3c84bc59dfe4de82acce4a420d12a7bb32e769fd", 0xa1}], 0x1, &(0x7f00000036c0)=[@rights={{0x2c, 0x1, 0x1, [r2, r2, r0, r2, r2, 0xffffffffffffffff, r0]}}, @rights={{0x1c, 0x1, 0x1, [r2, r2, r7]}}, @rights={{0x18, 0x1, 0x1, [r0, r2]}}, @cred={{0x1c, 0x1, 0x2, {r8, r4, r10}}}, @rights={{0x24, 0x1, 0x1, [r2, r11, r2, r0, r2]}}, @cred={{0x1c, 0x1, 0x2, {r6, r4, r5}}}, @cred={{0x1c, 0x1, 0x2, {r6, r4, r13}}}, @cred={{0x1c, 0x1, 0x2, {r6, r4, r5}}}], 0x110, 0x20008880}}, {{0x0, 0x0, &(0x7f0000003dc0)=[{&(0x7f0000003800)="88ada2e8446382162807d34bac1b467bc78cfd727b937e68c14009cc61fe507554b7d28c791a86b61a22cd8a619b040e175e2eebb275695e36a3fab9a97575cfee6de96f94278f9315d08af08e8c7d04a92597fff3734432bf911db7ae260374f8cbbdff0a3d340a1bfbffb63f158e7b439c6745747bf2c2a27f1edb5444cd7a9d50898aab2eb3425d87c2be3e0bdcc543b71cc5b6038c87fce0194017ee3119f0f4", 0xa2}, {&(0x7f00000038c0)="de82a39fa24b9759f8c10cc1b22392c5281a70d0a4227e2b84c24507e6fb514c28bb2ea4e0475feb5314748518404f1f7ad4a0fc9a36a006e07b6d119aadf05fb11fa5a12d14c654b9575b57cca9cc2572896bc22841c582ed74ebb152a21321bbb367a2283e11a173af55dde8a115eb3268d6f948c210d06975255fa60faa41c6d58b7a69fc3bb3cafca834ef5fa9a5b0d251dee3a2a1f4d2e4a0cab1648889", 0xa0}, {&(0x7f0000003980)="c5ac224c4e71623d51859a028301d64be9dad7d3cca1558db2dcd254efff7c29d0e84edb221929b334e3a844ce8e3a809e16304cefb6357ec5d845c055111c5c3c83521b05706ac77442e185eb3e920501644ea94d6c30ab7104df805b9f7018fbe23be4082d46a559f01311aa4e09ea2cfd493a76d1319f1bc2938f5054dceaeb7b0831704a5d899abeed1c1599f0f72641a8b27224997e98ff7ab123ac78f2c9fcb53f96ab08d6fef72760c1f7cb2adca2db966d33", 0xb6}, {&(0x7f0000003a40)="d7242ad60b4a5c70a72a9df589c08f3438543986835cbf861c3fcff1d1f9cad3d0461562bf4e2a3a8b849651b981dae458c5af00cd5837c90b099b243ee3cfeac2247f6357db6cb375731aadab082805986fbc73e7af84f2575d7d555e14eaebf46ede660517fe52bc2584ee121c1d1ab04e4de86d673e69d9b4afda728f7e6b0770225f554554a26ca192e7f4c44cdcf4c4f835bf6f53ff373cfb917a4059345eb175ad7ad1a7d68b55dc35ca71dad10904", 0xb2}, {&(0x7f0000003b00)="d12faa1999e90a0ba23f7016f01e4edf5825e52cb3884f044c743c8207080a43177e690a565c753dc5fbd92449984ac8db4e7ee800e7be4eeadc36b4c431b5b03374d2e33dcd2dc8c4f9cab88fc73f439a6bcd273a358f2e40e936d569ea52f07c1a0093255622b7cfc8753089a06242b2019fce7b2b2205467ee313206690375f4bc4702b8a77cd269374914925611f72fa64ddd15e557c993b9b948f4af2ed", 0xa0}, {&(0x7f0000003bc0)="f53bf5072296ba7ba7ac9078274f51ac3068fef004b4f2d38d0a5911cedc114715ccf5ed63387cc4295a9013bdf9e2a76615687ad61bc36dcab015d231a72338450e9564cc958ffe417c4ebfbd7535ff21838a6df4b892dfcf60357783c6bb81ad5f217d8b5823b6a35ef3d26fc9a117f8f4bb0334bfd722195bbfad895ff73b1678a23e8583124d82435c1a279f5301bc265bcd", 0x94}, {&(0x7f0000003c80)="3dbba934d6dcceddb3cc924d53effa5be1163520d025c82f560ec745fa746d1de9deca3915492dc7681661b007c0ce5babca64ba3e2fdb6795", 0x39}, {&(0x7f0000003cc0)="a080406986634c9e3a5239d8424880ee4fbb84de7e5ec54412092929477ab0c23580a3258a9bf20a1d2d4a4f9c40743f927d004b12c0be65553c493345bf93307fc8b1cbf3d0e13214d4e6d56eec0059d0eacf87c21aa36c1860f9169ccbac1eaf6f3d1cd48ad95b5d6cf4c2edb0013aa65da60685924a146cad9e5b99ab60bc416df59a286dfdf0356e41688d5c9ed9e982dfa3864d", 0x96}, {&(0x7f0000003d80)="8e821878a6324e349aa872d305f1466139ad327bcca7ce2e92b22ade923bba14f2dd0263dda8609603d26007117a781b8a7a9f8a3eb8b7d60d39", 0x3a}], 0x9, &(0x7f0000003f40)=[@cred={{0x1c, 0x1, 0x2, {r6, r14, r15}}}, @rights={{0x14, 0x1, 0x1, [r2]}}, @cred={{0x1c, 0x1, 0x2, {r6, r4, r5}}}, @rights={{0x34, 0x1, 0x1, [r0, r0, r0, r2, 0xffffffffffffffff, r2, r2, r2, r2]}}], 0x90, 0x20044890}}, {{&(0x7f0000004000)=@abs={0x0, 0x0, 0x4e24}, 0x6e, &(0x7f00000041c0)=[{&(0x7f0000004080)="ad1eaf3b7ad06659a0bf0f56b74098419a15dc3c01304b3350d5a067ded8277042d4fe751884c0ee99f55b8fdd9e74b33190a7bf9617a0c92d459c1fb16c166c9c2e9605035a1b5599913421a549561ff58ea70decbb16154871730d2d2b93d0a2845f3a3591c07ac00ec925ac8ea01909f824a8da75640552c82a265370e8806fc3d9bb9889446c6b3dacfa061074d5f78f99aaa27865aa2a6dbfde363866838d2110ec969ea9af029848331ad99fb9d537", 0xb2}, {&(0x7f0000004140)="35f35584548f822e369579d1c864609fbd75d40ad4cb4251f818634ca953787b7c7f012ed8867dc43c2e12008536e940323aec538b01b73629b8178a491bab96ae9e17cd24d867dfe3f4e8106027933dcea2f339378b8aa48ffb8c4ea029cd68c51f039a15fea1d4b78bab02587a32784b6390f3", 0x74}], 0x2, &(0x7f0000004300)=[@rights={{0x18, 0x1, 0x1, [r2, r0]}}, @rights={{0x1c, 0x1, 0x1, [r0, r0, r0]}}, @cred={{0x1c, 0x1, 0x2, {r6, r4, r5}}}, @rights={{0x24, 0x1, 0x1, [r0, r0, r2, r2, r2]}}, @rights={{0x1c, 0x1, 0x1, [r2, r16, r17]}}, @rights={{0x14, 0x1, 0x1, [r18]}}], 0xb8, 0x88004}}], 0x3, 0x20008000) ioctl$SIOCSIFHWADDR(r2, 0x8924, &(0x7f0000004480)={'dvmrp0\x00', @random="84fe19f2bdae"}) setuid(r14) r19 = open(&(0x7f00000044c0)='./file0\x00', 0xa4d00, 0x2) bind$inet(r19, &(0x7f0000004500)={0x2, 0x4e24, @empty}, 0x10) ioctl$AUTOFS_IOC_EXPIRE(r2, 0x810c9365, &(0x7f0000004540)={{0x2, 0x14f}, 0x100, './file0\x00'}) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000004680)={{0x25a5, 0x8, 0x8b0d, 0x60}, 'syz1\x00', 0x1c}) ioctl$RTC_WKALM_RD(r19, 0x80287010, &(0x7f0000004700)) r20 = openat$pidfd(0xffffffffffffff9c, &(0x7f0000004740), 0xe1d4c6d5fb17b65b, 0x0) fsetxattr$system_posix_acl(r20, &(0x7f0000004780)='system.posix_acl_access\x00', &(0x7f00000047c0)={{}, {}, [{0x2, 0x0, r14}, {0x2, 0x4, 0xee01}], {0x4, 0x4}, [{0x8, 0x6, r9}, {0x8, 0x4, r10}, {0x8, 0x1, r9}, {0x8, 0x1, r12}], {0x10, 0x1}, {0x20, 0x1}}, 0x54, 0x3) lchown(&(0x7f0000004840)='./file0\x00', 0xee01, r5) ioctl$KVM_GET_CLOCK(r11, 0x8030ae7c, &(0x7f0000004880)) 2.188532077s ago: executing program 2 (id=223): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = inotify_init() r1 = fcntl$dupfd(r0, 0x406, r0) r2 = mmap$KVM_VCPU(&(0x7f0000ffb000/0x2000)=nil, 0x930, 0x1000002, 0x4018831, r1, 0x0) r3 = userfaultfd(0x80001) munmap(&(0x7f0000800000/0x800000)=nil, 0x800000) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x3000002, 0x9132, 0xffffffffffffffff, 0xa2c6000) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x4c, &(0x7f0000000340)={0x1, &(0x7f0000000380)=[{0xffff}]}, 0x10) connect$unix(r4, &(0x7f00000003c0)=@file={0x1, './file0\x00'}, 0x6e) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000240)={{&(0x7f0000ffa000/0x3000)=nil, 0x3000}, 0x1}) syz_memcpy_off$KVM_EXIT_MMIO(r2, 0x20, &(0x7f0000000080)="898af54270aac7e9556f7d7e207b0d92d026e22b33eb8275", 0x0, 0x18) ioctl$sock_inet6_tcp_SIOCATMARK(r1, 0x8905, &(0x7f0000000000)) r5 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r5, &(0x7f0000000440)={0x3, 0x0, &(0x7f0000000480)={&(0x7f00000004c0)={0x2, 0x5, 0x0, 0x2, 0x4, 0x0, 0x70bd2c, 0x25dfdbff, [@sadb_sa={0x2, 0x1, 0x4d4, 0x2, 0x0, 0xdd, 0xa, 0xc0000000}]}, 0x20}, 0x1, 0x7}, 0x0) r6 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f00000001c0)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40}]}) dup3(0xffffffffffffffff, r6, 0x80000) syz_memcpy_off$KVM_EXIT_MMIO(r2, 0x20, &(0x7f0000000100)="64be365de974de7ab149b947a8218d12625b0c29c0496e90", 0x0, 0x18) close_range(r0, 0xffffffffffffffff, 0x0) 2.004940061s ago: executing program 0 (id=225): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000005c0)='./binderfs/binder0\x00', 0x6, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) (async) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) poll(&(0x7f0000000080)=[{r2, 0x3028}], 0x1, 0x1) setsockopt$inet_tcp_int(r1, 0x6, 0x210000000013, &(0x7f0000000000)=0x100000001, 0x4) connect$inet(r1, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10) (async) connect$inet(r1, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000080), 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000600)) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) bind$bt_l2cap(r3, &(0x7f00000001c0)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe) (async) bind$bt_l2cap(r3, &(0x7f00000001c0)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe) setsockopt$bt_BT_DEFER_SETUP(r3, 0x112, 0x7, 0x0, 0x0) (async) setsockopt$bt_BT_DEFER_SETUP(r3, 0x112, 0x7, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x1c, 0x0, &(0x7f0000000200)=[@increfs, @clear_freeze={0x400c6314, 0x3, 0x3}, @register_looper]}) sendto(r1, &(0x7f00000000c0)="ed631fb7b680cb2da0d782fdf9eba76333c8b3715c5b8c1123517167ef7843a84942c3757bdb5a1fe16c1e798e702f0b7471520ec5cdb85ef892b99f9368ba9043f61699ed8d3bf4df00a2ba91602b67c6c6e07e09b224f0ed8ab7ea0d97ccf3fe08f2245ce541dbb777e40ea76cf9b990cf9a92cab1a265045515c059", 0x7d, 0xc001, &(0x7f0000000140)=@nl=@kern={0x10, 0x0, 0x0, 0x20000000}, 0x80) 1.990821321s ago: executing program 0 (id=226): r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) write$UHID_CREATE2(r0, &(0x7f0000000080)=ANY=[@ANYBLOB="0b00000073797a31000000dfff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a30000037b35f0a000089b4c45a10000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a3100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001"], 0x119) r1 = socket$nl_route(0x10, 0x3, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x8031, r0, 0x4000) write$UHID_INPUT2(r0, &(0x7f0000000200)={0xc, {0x9e, "a271d8c7e0d50f015cf5b299b9f9af04e45b09b9e44d58e6ae2bcbbf90663b4f0d01046dfe419fd64799e3ec05ffaeb3f1a1e8823cdd481df596931599f2a388d27a53e988f60e4d4e2f3e66a0008ebc1a5bccc3a928bb334388e322d3001feb4745074fac43eb4f5184be08d103e1796afe8afbef537c11e9aec50a12e5f4900a8536c66b1227607ab8a2bc2395b6c428dcf0b7301c8a29ef5cb485cf94"}}, 0xa4) syz_open_dev$hidraw(&(0x7f00000001c0), 0x0, 0x14a042) (async) r2 = syz_open_dev$hidraw(&(0x7f00000001c0), 0x0, 0x14a042) dup3(r2, r1, 0x0) (async) r3 = dup3(r2, r1, 0x0) write$UHID_INPUT(r3, 0x0, 0xfffffe4c) 1.863712345s ago: executing program 2 (id=227): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x60002, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f0000000080)={0x0, &(0x7f0000000440)=[@code={0xa, 0x62, {"0f01cfb9f90a00000f32c7442400a2000000c74424022e000000c7442406000000000f011424400f0d1cee26d8a300500000b9810200000f32b9800000c00f3235008000000f30f3410f09410f05460f07"}}, @nested_amd_clgi={0x17f, 0x10}, @uexit={0x0, 0x18, 0x3}, @nested_amd_clgi={0x17f, 0x10}, @nested_vmresume={0x130, 0x18, 0x3}, @nested_load_syzos={0x136, 0x123, {0x1, 0x4, [@nested_amd_vmcb_write_mask={0x17c, 0x38, {0x3, @save_area=0x5ff, 0x33, 0x10000, 0xdb8}}, @nested_load_code={0x12e, 0x7b, {0x0, "2e0fc7b8e17f00002edd4900450f011b410f01c3460fc79c50221f000066baf80cb838d3498fef66bafc0cecb9800000c00f3235002000000f3066b817010f00d866b871008ec8c744240000480000c74424024e000000c7442406000000000f011c24"}}, @nested_amd_invlpga={0x17d, 0x20, {0x41000, 0xd1a0}}, @uexit={0x0, 0x18, 0x83}, @cpuid={0x64, 0x18, {0x8, 0x1}}]}}, @in_dx={0x69, 0x20, {0x8b64, 0x1}}, @nested_vmlaunch={0x12f, 0x18, 0x3}, @nested_load_syzos={0x136, 0x38, {0x0, 0x40, [@nested_amd_vmload={0x182, 0x18, 0x2}]}}, @rdmsr={0x66, 0x18, {0x26b}}, @cpuid={0x64, 0x18, {0x1, 0x8}}, @out_dx={0x6a, 0x28, {0x1849, 0x0, 0x80000000}}, @nested_create_vm={0x12d, 0x18, 0x3}, @nested_amd_clgi={0x17f, 0x10}, @wr_crn={0x67, 0x20, {0x2, 0x72f4}}, @nested_amd_set_intercept={0x181, 0x30, {0x3, 0x3, 0x3, 0x1}}, @nested_create_vm={0x12d, 0x18, 0x3}, @nested_amd_vmload={0x182, 0x18, 0x2}, @nested_amd_inject_event={0x180, 0x38, {0x3, 0xbc, 0x0, 0x8, 0x1}}], 0x37d}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r0, 0xae04) openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x48a600, 0x98) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)) 1.786732716s ago: executing program 0 (id=228): r0 = socket$nl_generic(0x10, 0x3, 0x10) socket$inet(0x2, 0x2, 0x1) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_xfrm(0x10, 0x3, 0x6) syz_usb_connect$uac2(0x5, 0xa8, &(0x7f0000000280)=ANY=[@ANYBLOB="120110030000004090054c00400001020301090296000301053009080b00010107208c0904000000010120000924010040041d000708240b0001ff23000c2403", @ANYRES16], &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0}) socket(0x10, 0x803, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r2, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r1, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f00000006c0)=[@cred={{0x1c}}, @rights={{0x10}}, @rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x58}, 0x80) ioctl$FS_IOC_GET_ENCRYPTION_NONCE(r0, 0x8010661b, &(0x7f00000000c0)) pipe2(0x0, 0x0) syz_ublk_add_dev(r3, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000001c0)=@any_dev={0x4, 0x3f7, 0x0, 0x0, 0x1000, 0xe, 0x0, 0x0, 0x10}}}, &(0x7f0000000300)=0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = dup(r5) syz_ublk_setup_queues(r3, r4, &(0x7f0000000140)={0x0, 0x7590, 0x4000, 0x2, 0x128}, &(0x7f0000000440)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xad5e, 0x20000, 0xffffdfff, 0x2d9}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x8149, 0x20, 0x2, 0x13c}, 0xffffffffffffffff}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xd6d7, 0x200, 0xfffffffd, 0x1c7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x9314, 0x4, 0x2, 0x285}}], 0x4, 0x0, 0x0) syz_ublk_setup_queues(r6, r4, &(0x7f0000000040)={0x0, 0xc1, 0x10, 0xfffffffd, 0x7f}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3, 0x42, 0x3, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc81d, 0x2, 0x1, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x93ea, 0x2000, 0x4003bfff, 0x2b9}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x626d, 0x800, 0x1, 0x26d, 0x0, r7}}], 0x1, 0x0, 0x0) 1.723756228s ago: executing program 2 (id=229): r0 = socket$inet_udp(0x2, 0x2, 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, &(0x7f0000000080)={0x18, 0x0, 0x0, 0x0, 0x0, 0x0}) bind$inet(r0, &(0x7f0000000240)={0x2, 0x0, @local}, 0x6f) syz_open_dev$tty1(0xc, 0x4, 0x1) socket$inet_udp(0x2, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000280)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./proc\x00', 0x0, 0x4000, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r2, &(0x7f0000000300)='27', 0x2) mkdirat(r2, 0x0, 0x20) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000340), 0x121301, 0x0) 1.207480481s ago: executing program 2 (id=231): r0 = syz_usb_connect$uac3(0x2, 0x80, &(0x7f00000000c0)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x10, 0x582, 0xb2, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x6e, 0x3, 0x1, 0x1, 0xa0, 0x6, {0x8, 0xb, 0x0, 0x2, 0x1, 0x21, 0x30, 0x23}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0x10, 0xa, 0x5f25}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x62, 0x35, 0xf, 0x2, {0xa, 0x25, 0x25, 0x401, 0x5, 0x5}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x620, 0x6, 0x40, 0xc0, {0xa, 0x25, 0x25, 0x7ffdffff, 0x2f, 0x7}}}}}}}}]}}, 0x0) syz_usb_control_io(r0, &(0x7f0000000bc0)={0x2c, &(0x7f0000000900)={0x0, 0x22, 0xd0, {0xd0, 0xc, "c9f8a15aea0329d74b0d74582d62c4e9425746c5f85b445e52db1e54cdc122539e38df6b825630f1c9909adc028196c9da9feef6a45dc1736ac94cfb2566e29dd076df387edae6ce1e44408fa9ee548c24ef20467117978ad44a21c36f0613f9034c9d564cb926f717c720529b12991a9bfc08b64ede51e57349bb753e75acb56fdec1114443804b2c6f735de5ce9a30f980e51b2ed1d0b57e9d889ddedf1d7703c699f464310fe8ec8b129bd34d4e6dfe055651626ae63c6b0a9c24175118aa35b17b1c6e5cb38a81921f44d4b3"}}, &(0x7f0000000a00)={0x0, 0x3, 0xc0, @string={0xc0, 0x3, "b5b58955648f75598105a6a5de633b26a2a8edef8c1c4d5f0ebef5d2cb4d805304ed26e21a74e862c97eb98557e3d5f1d21dce120593001b8803d78a4fe76d92f7fe224ea15e7047e7ce81c549912d73aeebc56f5fdab5762dc4b1b89fac3248c228358a256e792ad6ee86f15885351c5e2a6c6b46ccedd2f0d7589206a095b27aca6fa47f4dd03a34602b1ea55e4afce3b7e66fa1266320befa5f61338fe4644f7edd303b8b293d66b74c2cf355fdaa471aa686cd830d4cffee9d09908e"}}, &(0x7f0000000b00)=ANY=[@ANYBLOB="000f2a004000050f4c00040b100100080000000800f710100af92100000000000800f09f000003100b07100218a80900"], &(0x7f0000000b40)={0x20, 0x29, 0xf, {0xf, 0x29, 0x8, 0xb, 0x3, 0x5, "e0d93568", "93ccc683"}}, &(0x7f0000000b80)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x0, 0x0, 0x0, 0x3, 0x4, 0x1, 0x6}}}, &(0x7f0000001000)={0x84, &(0x7f0000000c00)=ANY=[@ANYBLOB="4007320000009dfbab08acfa5808c6dfa4299d7df447ef8dc2286897251561fca510f53efc45c27d45b7ed7f1cb2"], &(0x7f0000000c40)={0x0, 0xa, 0x1, 0x6}, &(0x7f0000000c80)={0x0, 0x8, 0x1, 0x6}, &(0x7f0000000cc0)={0x20, 0x0, 0x4, {0x4, 0x2}}, &(0x7f0000000d00)={0x20, 0x0, 0x4, {0xe0, 0x20}}, &(0x7f0000000d40)={0x40, 0x7, 0x2}, &(0x7f0000000d80)={0x40, 0x9, 0x1, 0x9}, &(0x7f0000000dc0)={0x40, 0xb, 0x2, "17b2"}, &(0x7f0000000e00)={0x40, 0xf, 0x2, 0x6}, &(0x7f0000000e40)={0x40, 0x13, 0x6, @link_local}, &(0x7f0000000e80)={0x40, 0x17, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x3e}}, &(0x7f0000000ec0)={0x40, 0x19, 0x2, "e0ae"}, &(0x7f0000000f00)={0x40, 0x1a, 0x2}, &(0x7f0000000f40)={0x40, 0x1c, 0x1, 0x3}, &(0x7f0000000f80)={0x40, 0x1e, 0x1, 0x1}, &(0x7f0000000fc0)={0x40, 0x21, 0x1, 0x8}}) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000140)={'syz1\x00', {0xfff9, 0x0, 0x248, 0x9b99}, 0x25, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x4, 0x2dcd, 0x1, 0xb4, 0xfa97, 0xa2b9, 0x6, 0x7, 0xe1, 0x6, 0xfc000000, 0x403, 0xbbf, 0x3, 0xfffffff9, 0x101c0, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0x2, 0x5d6, 0x8001, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x2, 0x4, 0x16, 0x8, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0xa9, 0xff, 0xff, 0x2, 0x6, 0x2, 0x1000000, 0x489, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x6, 0x4], [0x5, 0xfff, 0x1, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000086f, 0x7ff, 0x2, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x6, 0x1c, 0x7, 0x1, 0xfffffffe, 0x3, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff8, 0x4, 0x46, 0x5, 0x7, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3ff, 0x200, 0x1, 0x7fff, 0x67af, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0xa0, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0xc, 0x2, 0x69, 0x80000001, 0x5, 0x2, 0x48d, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x9, 0x41, 0x6, 0xee4b, 0x2800004, 0x1, 0x10, 0x5, 0x9, 0x5, 0x0, 0x9, 0x3, 0xc7, 0xfff, 0x100008, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9, 0x9, 0x1, 0x100, 0x2, 0x6, 0x7ffe, 0x27, 0xf7cc, 0xd502, 0x8, 0x5, 0x9, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x1af8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000009, 0xa2a4, 0x21, 0x4000009, 0x81, 0x7, 0x9d87, 0x8, 0x8, 0x4, 0x140f1, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x0, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x408, 0x274, 0x6, 0xfffffff9, 0x4, 0x9, 0x9, 0x4, 0x463f, 0x4, 0x10dab, 0x5, 0x8, 0x13fff, 0xffff, 0x9]}, 0x45c) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000005c0), 0x0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000600), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) write(0xffffffffffffffff, &(0x7f0000000640)="2c0000001a", 0x5) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) sendmsg$NFNL_MSG_CTHELPER_DEL(0xffffffffffffffff, &(0x7f0000000680)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x80) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_inet6_SIOCADDRT(r5, 0x890b, &(0x7f0000000040)={@mcast1, @dev={0xfe, 0x80, '\x00', 0x25}, @mcast1, 0x0, 0x0, 0x0, 0x100, 0x100000, 0x140192}) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000700)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x4, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0xc], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f00000007c0), 0x0, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) r6 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r7 = dup(r6) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000800)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x2) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r8, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000840)=[@text32={0x20, &(0x7f0000000880)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r6, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f00000008c0)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r8, 0xae80, 0x0) ioctl$sock_inet6_udp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000000)) 1.112405332s ago: executing program 1 (id=232): r0 = creat(&(0x7f0000000000)='./file0\x00', 0xc9a9c042ad77c5e5) recvmsg$inet_nvme(r0, 0x0, 0x40003005) write$binfmt_elf32(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="7f454c4605069e0dffffffffffffffff0200030009000000ca020000380000005effff0006040000fbff20"], 0x58) ioctl$XFS_IOC_FSGROWFSRT(r0, 0x40105870, &(0x7f0000000040)={0xf, 0x8}) close(r0) execve(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) 1.042538235s ago: executing program 1 (id=233): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$TIPC_NL_NODE_GET(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x5c, r1, 0x1, 0x70bd28, 0x25dfdbff, {}, [@TIPC_NLA_BEARER={0x14, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xf, 0x1, @l2={'ib', 0x3a, 'bridge0\x00'}}]}, @TIPC_NLA_MON={0x34, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x6}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x3}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x1ff}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x6}, @TIPC_NLA_MON_REF={0x8, 0x2, 0xfffffff7}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x40}]}]}, 0x5c}}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$GTP_CMD_NEWPDP(r2, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x24, 0x0, 0x200, 0x70bd2a, 0x25dfdbfd, {}, [@GTPA_PEER_ADDRESS={0x8, 0x4, @multicast2}, @GTPA_MS_ADDRESS={0x8, 0x5, @multicast2}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000}, 0x10) syz_genetlink_get_family_id$devlink(&(0x7f0000000280), r0) ioctl$SNDRV_TIMER_IOCTL_CREATE(0xffffffffffffffff, 0xc02054a5, &(0x7f00000002c0)={0xd4f3, r0, 'id1\x00'}) ioctl$TIOCGWINSZ(r3, 0x5413, &(0x7f0000000340)) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$fou(&(0x7f00000003c0), r0) getsockname$packet(r3, &(0x7f0000000400)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000440)=0x14) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r3, 0x89f0, &(0x7f0000000500)={'syztnl0\x00', &(0x7f0000000480)={'ip6tnl0\x00', 0x0, 0x58, 0x9, 0x4, 0x1, 0x22, @private1, @ipv4={'\x00', '\xff\xff', @multicast2}, 0x7, 0x1, 0x7, 0x8}}) sendmsg$FOU_CMD_GET(r4, &(0x7f0000000600)={&(0x7f0000000380), 0xc, &(0x7f00000005c0)={&(0x7f0000000540)={0x6c, r5, 0x10, 0x70bd29, 0x25dfdbfc, {}, [@FOU_ATTR_PEER_V4={0x8, 0x8, @private=0xa010100}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0x89}, @FOU_ATTR_PEER_V6={0x14, 0x9, @empty}, @FOU_ATTR_IFINDEX={0x8, 0xb, r6}, @FOU_ATTR_LOCAL_V4={0x8, 0x6, @private=0xa010102}, @FOU_ATTR_AF={0x5, 0x2, 0x2}, @FOU_ATTR_PEER_V6={0x14, 0x9, @private2={0xfc, 0x2, '\x00', 0x1}}, @FOU_ATTR_IFINDEX={0x8, 0xb, r7}]}, 0x6c}, 0x1, 0x0, 0x0, 0x24048084}, 0x8001) r8 = pidfd_getfd(r3, r4, 0x0) sendmsg$IPVS_CMD_NEW_SERVICE(r8, &(0x7f0000000740)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000700)={&(0x7f0000000680)={0x7c, 0x0, 0x10, 0x70bd2b, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_SERVICE={0x48, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e23}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e21}, @IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x2c}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x77}, @IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x1}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x18}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x8000}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x9, 0x1}}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x1}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x8}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x74}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x1}]}, 0x7c}, 0x1, 0x0, 0x0, 0x40000}, 0x20000010) r9 = syz_genetlink_get_family_id$gtp(&(0x7f00000007c0), r8) sendmsg$GTP_CMD_DELPDP(r4, &(0x7f0000000880)={&(0x7f0000000780)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x24, r9, 0x8, 0x70bd28, 0x25dfdbfb, {}, [@GTPA_I_TEI={0x8, 0x8, 0x3}, @GTPA_FLOW={0x6, 0x6, 0x3}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000}, 0x40000) r10 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000900), r2) sendmsg$NL80211_CMD_GET_MPP(r2, &(0x7f0000000a00)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f00000009c0)={&(0x7f0000000940)={0x74, r10, 0x100, 0x70bd27, 0x25dfdbfd, {{}, {@void, @val={0xc, 0x99, {0xfffffff8, 0x54}}}}, [@NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @broadcast}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @device_b}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @broadcast}]}, 0x74}, 0x1, 0x0, 0x0, 0x4000010}, 0x94) ioctl$PIO_FONTX(r3, 0x4b6c, &(0x7f0000000e40)={0x1be, 0x1e, &(0x7f0000000a40)="0b9a99a29e3eabfb483f5a5fb15b292e2df8013ccc6bc19849260d1004225dbb09fea8a12e7d20f4e3089f25369f2343e77a702e9f06dae34af43ad0b82e04972e047a459023b307138eced63fd219470dfdc5316bf89e4dc22c5c84a162376bb944b01f0e47a2134dd262dd7677d68b5f42e655ffdd64b928504838d304913fad5b28ec3de116a05bbff096e0176478032a32bc556e64b4bca5677e2d129e7a3634b04db4340bf9b4c0ada5b3cf2a8a5b44a0db99ebcf7ec6697d2bca710892ae97a97e33ec37a3dd7ab04b5734efc3f283aa0021bf6acac1c80676dd6b0653b7d2bb9f49d8fa3702a745e923f69e1c86d8a5ebbfcc895f650ea47ab3aa0abdd4c657b584d280dd67e8b4e283b8dab573792485a4eaa9e38357a54b1e2c4bac26bb1c44cbf2140d75bc7d6a3e9cd94d1bf85ff1941d8d609f9bbab07db082f5da781b1496260a8e106cc9b83ab428656019a2310fd6e84218fccae10729f8b01850e3253ec2d3f6a325e4bb46235d9eb6e0e3e9ae9dd42a815c3615f97e8524a9c3aced0af3949fdb4fdf7f7bc6bb7f73f0682bf2ad227f2efcc2ac549f6d9c29a7bfd218d34f6749ec55dbb3478617007b42f8672c7a94f6647701cb807beb33daba73a276357edbe6b7f13d7eac431cd1fbb75554c7120ae89668c472ba6805cfb09a1b15ed578ad258839e3cd31282a8b0e7b7da720d677995794e3ab3783ccea0b9b956743974bc5a893c94b726c3c4c2e8eb5717f57a8e644332a392aff6abb684a2f268aecabefcbe06d71c4d3418deb357808c21991455cd21dc2bebbc9782703aea1bd5bee25ecfecd9113cbccbe902fdf39301087340b84d72f23300fabc406fbbd13182725c7c3d305825a81a8cb090ff5b1d1cb035e9dda4df669c5f821266ce91b83321826db41dc16d9e1af14bf3e5d7df94152097ad805eea83ee35f84fa6b4360dfdd3017f6de77a99eed92acab6211294a570f73eeab23f5cb09a50400a40c8665941ee79a10cdb2e1a2fb95006305dcf231e8af6cebe5a9e44be38996cf422d1fa7f778029ebbe92378c060880caaafcf15185963db6094733f5641cc3d326cd151f484878c40ebcdcaa3aa488d43ba3f1e725fa442666bd6c42f6d422faf4702ad9bb7821678532a0acd7430cbc2a77d034da2a0c2ad31fefb7278b52b78ec9dffe78c4c0f8b1c46283413dc34a80e4635d127af697e60314806ed57dd0fbe9bd55c370282766ad2580612b199e548927be7aa888dc7fe1c45e57a3a50cd1d99a1b7386b6f2fa5ffc501630f42f3054edd2ff1d37129ce6b92e8772fe73e84b5dce5a4bd6e6bf04261f45cf38e9cc32d8deda2b771e00ca7d1417ed9dadc5377961b71b9b8969203f9a49ee1535c1249d6e3b6cffc6b59eda073aade5a60badaea29a51b14d314a0670b0e5bcec231f94a7d416edc515"}) r11 = syz_genetlink_get_family_id$devlink(&(0x7f0000000ec0), r0) sendmsg$DEVLINK_CMD_RATE_GET(r2, &(0x7f0000000fc0)={&(0x7f0000000e80)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000f80)={&(0x7f0000000f00)={0x6c, r11, 0x8, 0x70bd2d, 0x25dfdbfe, {}, [@DEVLINK_ATTR_RATE_NODE_NAME={0xf, 0xa8, @name2}, @handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_PORT_INDEX={0x8, 0x3, 0x3}]}, 0x6c}, 0x1, 0x0, 0x0, 0x255ac865291c2b3d}, 0x20000040) ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f0000001000)={'wlan1\x00', 0x0}) syz_open_dev$loop(&(0x7f0000001040), 0x0, 0x240000) sendmsg$NL80211_CMD_SET_PMK(r2, &(0x7f0000001180)={&(0x7f0000001080)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000001140)={&(0x7f00000010c0)={0x48, r10, 0x4, 0x70bd28, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r12}, @void}}, [@NL80211_ATTR_PMKR0_NAME={0x14, 0x102, "a25201187fce68e3a60a22582d6d64d0"}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MAC={0xa}]}, 0x48}, 0x1, 0x0, 0x0, 0x4000844}, 0x48004) sendmsg$NL80211_CMD_CRIT_PROTOCOL_STOP(r4, &(0x7f0000001280)={&(0x7f00000011c0)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000001240)={&(0x7f0000001200)={0x20, r10, 0x200, 0x70bd2d, 0x25dfdbfd, {{}, {@void, @val={0xc, 0x99, {0xf, 0x9}}}}, ["", "", "", ""]}, 0x20}, 0x1, 0x0, 0x0, 0x4004011}, 0x4010) ioctl$PIO_UNIMAPCLR(r3, 0x4b68, &(0x7f00000012c0)={0x0, 0x1, 0x1000}) getsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, &(0x7f0000001340)={{{@in=@multicast2, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@private1}, 0x0, @in=@remote}}, &(0x7f0000001440)=0xe8) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000001480)={{{@in6=@loopback, @in6=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast1}, 0x0, @in=@initdev}}, &(0x7f0000001580)=0xe8) fsetxattr$system_posix_acl(r0, &(0x7f0000001300)='system.posix_acl_access\x00', &(0x7f0000001900)={{}, {0x1, 0x4}, [{0x2, 0x3, r13}, {0x2, 0x2, r14}, {0x2, 0x4}, {0x2, 0x6, 0xee01}, {0x2, 0x5}, {0x2, 0x6}, {}], {0x4, 0x2}, [], {0x10, 0x2}, {0x20, 0x2}}, 0x5c, 0x2) 1.042071105s ago: executing program 1 (id=234): r0 = landlock_create_ruleset(&(0x7f00000000c0)={0x20, 0x8, 0x0, 0x20, 0x1, 0x2}, 0x30, 0x0) landlock_restrict_self(r0, 0x0) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x180) mount(0x0, &(0x7f00000002c0)='./proc\x00', &(0x7f0000000180)='proc\x00', 0x0, 0x0) (async) ioctl$KVM_SET_XCRS(0xffffffffffffffff, 0x4188aea7, &(0x7f00000023c0)={0xf, 0x6, [{0x8, 0x0, 0x39baa21d}, {0x3988d011, 0x0, 0x530}, {0x1, 0x0, 0x80000000}, {0xffffffff}, {0x8001, 0x0, 0xffffffffffffffff}, {0x101, 0x0, 0x3}, {0xae2}, {0x9, 0x0, 0x100000000}, {0x5, 0x0, 0x1}, {0xa9, 0x0, 0x1}, {0x8, 0x0, 0x3}, {0x0, 0x0, 0x8001}, {0x1}, {0x9, 0x0, 0xfb0c}, {0xa, 0x0, 0x2}, {0xfffffffe, 0x0, 0x8}]}) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f0000002580)={0x0, 0x0, &(0x7f00000025c0)={&(0x7f0000002600)=ANY=[@ANYRES16, @ANYBLOB="01000000000000000000030000005800018044000400200001"], 0x6c}}, 0x0) (async) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r1, &(0x7f0000002640)={0x0, 0x0, &(0x7f0000002680)=[{&(0x7f00000026c0)=ANY=[@ANYBLOB="a400000056000100000000000000800007"], 0xa4}], 0x1, 0x0, 0x0, 0x4000001}, 0x0) (async) r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r2, &(0x7f0000000200)='7', 0x1) (async) read$FUSE(r2, &(0x7f0000000300)={0x2020, 0x0, 0x0, 0x0}, 0x2020) quotactl$Q_SETQUOTA(0xffffffff80000801, &(0x7f0000000040)=@loop={'/dev/loop', 0x0}, r3, &(0x7f0000002340)={0x0, 0x4, 0x3ff, 0x1, 0x7, 0x6f5, 0x0, 0x10000, 0x697}) open_tree(0xffffffffffffff9c, &(0x7f0000000000)='\x00', 0x89901) 1.041815315s ago: executing program 1 (id=235): bind$packet(0xffffffffffffffff, &(0x7f00000001c0)={0x11, 0x11, 0x0, 0x1, 0xf, 0x6, @broadcast}, 0x14) r0 = socket$packet(0x11, 0x3, 0x300) (async) sched_setattr(0x0, &(0x7f0000000000)={0x38, 0x5, 0x0, 0x7ffe, 0x0, 0xfff, 0x100000001, 0x7, 0xdffffffc, 0x2}, 0x0) (async) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/ptype\x00') preadv(r1, &(0x7f0000000080)=[{&(0x7f0000000280)=""/181, 0xb5}], 0x1, 0x802, 0xd2) (async, rerun: 32) iopl(0x3) (rerun: 32) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) (async) futex(0x0, 0x5, 0x1, 0x0, 0x0, 0xffffffff) (async, rerun: 64) r2 = syz_clone(0x100411, 0x0, 0x0, 0x0, 0x0, 0x0) (rerun: 64) syz_open_procfs(0xffffffffffffffff, 0x0) (async) tkill(r2, 0x12) (async) read$FUSE(0xffffffffffffffff, 0x0, 0x0) (async) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000240)=0x6, 0x4) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'erspan0\x00', 0x0}) sendto$packet(r0, &(0x7f0000000180)="0b032200eb1025120212475400f6a13bb1000000080086dd4803", 0x10300, 0x0, &(0x7f0000000140)={0x11, 0x0, r3}, 0x14) 596.419545ms ago: executing program 0 (id=236): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = inotify_init() r1 = fcntl$dupfd(r0, 0x406, r0) r2 = mmap$KVM_VCPU(&(0x7f0000ffb000/0x2000)=nil, 0x930, 0x1000002, 0x4018831, r1, 0x0) r3 = userfaultfd(0x80001) munmap(&(0x7f0000800000/0x800000)=nil, 0x800000) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x3000002, 0x9132, 0xffffffffffffffff, 0xa2c6000) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x4c, &(0x7f0000000340)={0x1, &(0x7f0000000380)=[{0xffff}]}, 0x10) connect$unix(r4, &(0x7f00000003c0)=@file={0x1, './file0\x00'}, 0x6e) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000240)={{&(0x7f0000ffa000/0x3000)=nil, 0x3000}, 0x1}) syz_memcpy_off$KVM_EXIT_MMIO(r2, 0x20, &(0x7f0000000080)="898af54270aac7e9556f7d7e207b0d92d026e22b33eb8275", 0x0, 0x18) ioctl$sock_inet6_tcp_SIOCATMARK(r1, 0x8905, &(0x7f0000000000)) r5 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r5, &(0x7f0000000440)={0x3, 0x0, &(0x7f0000000480)={&(0x7f00000004c0)={0x2, 0x5, 0x0, 0x2, 0x4, 0x0, 0x70bd2c, 0x25dfdbff, [@sadb_sa={0x2, 0x1, 0x4d4, 0x2, 0x0, 0xdd, 0xa, 0xc0000000}]}, 0x20}, 0x1, 0x7}, 0x0) r6 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f00000001c0)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40}]}) dup3(0xffffffffffffffff, r6, 0x80000) syz_memcpy_off$KVM_EXIT_MMIO(r2, 0x20, &(0x7f0000000100)="64be365de974de7ab149b947a8218d12625b0c29c0496e90", 0x0, 0x18) close_range(r0, 0xffffffffffffffff, 0x0) 338.025591ms ago: executing program 1 (id=237): io_setup(0x1, &(0x7f0000000000)=0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x1, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_SREGS(0xffffffffffffffff, 0x4138ae84, &(0x7f0000000100)={{0x4, 0x0, 0x0, 0x9a, 0x3, 0x1, 0xf, 0x0, 0x0, 0xf9, 0x1, 0x7f}, {0x94a0a44077550ca2, 0x2000, 0x3, 0x5, 0xc2, 0xbc, 0x9, 0x67, 0xc5, 0x7, 0x6, 0x44}, {0x1, 0xdddd1000, 0x3, 0x6, 0x9, 0x34, 0x10, 0x6, 0x3, 0x1c, 0x7, 0xff}, {0x8080000, 0x3ff8, 0x10, 0x58, 0x7d, 0x0, 0x0, 0xc, 0x7f, 0x5, 0x4, 0x1}, {0x504ce1cb89483871, 0xeeeca000, 0xa, 0x7, 0x80, 0x0, 0x9, 0x1, 0x1, 0x7, 0x5, 0xfd}, {0x4000, 0x6000, 0x9, 0x2, 0x3, 0x7, 0x1, 0xb7, 0x2, 0x1, 0x7c, 0xd}, {0xffff1000, 0x80a0000, 0x8, 0x2, 0x8, 0x3, 0x6, 0x0, 0x9, 0xb, 0x4, 0x7}, {0x74000, 0xdddd0000, 0xc, 0x3, 0x0, 0x0, 0x9, 0x80, 0x9, 0x8f, 0x2e, 0x31}, {0x4000, 0x59}, {0xffffffff, 0x6}, 0x10000, 0x0, 0x1, 0x304261, 0x7, 0x1000, 0xb000, [0x5, 0x3, 0xfff, 0x1]}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) ioctl$KVM_HYPERV_EVENTFD(r2, 0x4018aebd, &(0x7f0000000240)={0x0, 0xffffffffffffffff, 0x1}) r3 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r3, &(0x7f00000004c0)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x0, 0xfffffffd}}, 0x10) bind$tipc(r3, &(0x7f0000000500)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x0, 0x2}}, 0x10) r4 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r4, &(0x7f0000000540)=@nameseq={0x1e, 0x1, 0x0, {0x42}}, 0x10) bind$tipc(r4, &(0x7f0000000580)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x2, 0x4}}, 0x10) bind$tipc(r3, &(0x7f00000005c0)=@name={0x1e, 0x2, 0x0, {{0x42, 0x20000003}}}, 0x10) bind$tipc(r4, &(0x7f0000000600)=@nameseq={0x1e, 0x1, 0x2, {0x42, 0x1, 0x3}}, 0x10) bind$tipc(r3, 0x0, 0x0) r5 = memfd_create(&(0x7f0000000040)='\x02A\xbb\xcc\x96\x0e\x00\x00\x00\x00\x00\x00', 0x6) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1000001, 0x12, r5, 0x0) io_submit(r0, 0x1, &(0x7f0000000280)=[0x0]) openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0), 0x400000, 0x0) madvise(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x13) fdatasync(r5) close(r5) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) memfd_create(&(0x7f0000000400)='/dev/sda1\x00', 0x1) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) ioctl$FIBMAP(r6, 0x5393, &(0x7f0000000480)=0x3) socket$nl_generic(0x10, 0x3, 0x10) close_range(r2, r1, 0x2) socket$nl_generic(0x10, 0x3, 0x10) 242.410624ms ago: executing program 0 (id=238): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x60002, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f0000000080)={0x0, &(0x7f0000000440)=[@code={0xa, 0x62, {"0f01cfb9f90a00000f32c7442400a2000000c74424022e000000c7442406000000000f011424400f0d1cee26d8a300500000b9810200000f32b9800000c00f3235008000000f30f3410f09410f05460f07"}}, @nested_amd_clgi={0x17f, 0x10}, @uexit={0x0, 0x18, 0x3}, @nested_amd_clgi={0x17f, 0x10}, @nested_vmresume={0x130, 0x18, 0x3}, @nested_load_syzos={0x136, 0x123, {0x1, 0x4, [@nested_amd_vmcb_write_mask={0x17c, 0x38, {0x3, @save_area=0x5ff, 0x33, 0x10000, 0xdb8}}, @nested_load_code={0x12e, 0x7b, {0x0, "2e0fc7b8e17f00002edd4900450f011b410f01c3460fc79c50221f000066baf80cb838d3498fef66bafc0cecb9800000c00f3235002000000f3066b817010f00d866b871008ec8c744240000480000c74424024e000000c7442406000000000f011c24"}}, @nested_amd_invlpga={0x17d, 0x20, {0x41000, 0xd1a0}}, @uexit={0x0, 0x18, 0x83}, @cpuid={0x64, 0x18, {0x8, 0x1}}]}}, @in_dx={0x69, 0x20, {0x8b64, 0x1}}, @nested_vmlaunch={0x12f, 0x18, 0x3}, @nested_load_syzos={0x136, 0x38, {0x0, 0x40, [@nested_amd_vmload={0x182, 0x18, 0x2}]}}, @rdmsr={0x66, 0x18, {0x26b}}, @cpuid={0x64, 0x18, {0x1, 0x8}}, @out_dx={0x6a, 0x28, {0x1849, 0x0, 0x80000000}}, @nested_create_vm={0x12d, 0x18, 0x3}, @nested_amd_clgi={0x17f, 0x10}, @wr_crn={0x67, 0x20, {0x2, 0x72f4}}, @nested_amd_set_intercept={0x181, 0x30, {0x3, 0x3, 0x3, 0x1}}, @nested_create_vm={0x12d, 0x18, 0x3}, @nested_amd_vmload={0x182, 0x18, 0x2}, @nested_amd_inject_event={0x180, 0x38, {0x3, 0xbc, 0x0, 0x8, 0x1}}], 0x37d}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r0, 0xae04) openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x48a600, 0x98) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)) 38.874599ms ago: executing program 0 (id=239): r0 = socket$inet_udp(0x2, 0x2, 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, &(0x7f0000000080)={0x18, 0x0, 0x0, 0x0, 0x0, 0x0}) bind$inet(r0, &(0x7f0000000240)={0x2, 0x0, @local}, 0x6f) syz_open_dev$tty1(0xc, 0x4, 0x1) socket$inet_udp(0x2, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000280)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./proc\x00', 0x0, 0x4000, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r2, &(0x7f0000000300)='27', 0x2) mkdirat(r2, 0x0, 0x20) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000340), 0x121301, 0x0) 0s ago: executing program 1 (id=240): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040)='syz_tun\x00', 0x8) r1 = open(&(0x7f0000000180)='./file0\x00', 0x149442, 0x40) fcntl$setlease(r1, 0x400, 0x0) (async) fcntl$setlease(r1, 0x400, 0x2) (async) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @remote}, 0x1c) (async) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./dev\x00', 0x1ff) (async) mount(0x0, &(0x7f0000000200)='./dev\x00', &(0x7f0000000240)='devtmpfs\x00', 0x0, 0x0) (async) r2 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dev/sda\x00', 0x2, 0x8) fallocate(r2, 0x10, 0x1, 0x200000001004) (async) r3 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r3, &(0x7f00000000c0)=[{&(0x7f0000000100)="580000001400192340834b80040d8c560a067fbc45ff810500000000000058000b480400945f6400947e570028925a01000000000000008000f0fffeffe809000000fff5dd0000001000010004081000418e00030004fcff", 0x58}], 0x1) (async) mmap$IORING_OFF_SQ_RING(0x0, 0x8000, 0x2, 0x2172, 0xffffffffffffffff, 0x0) r4 = add_key(&(0x7f0000000c80)='asymmetric\x00', 0x0, &(0x7f0000000cc0)="308205553082033da00302010202147398ea982dd02ea8b1cf57c7f297b3e61afc8c0a300d06092a864886f70d01010b050030343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b65793020170d3232303531383232333234315a180f32313232303432343232333234315a30343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b657a30820222300d06092a864886f70d01010105000382020f003082020a0282020100ccac49dd3bcab0157e846ab20a695f1c0a61823b4f2ca3952c08584bb15d99e0c3c179c2b3ebc01e6d3e541dbdb7927b4ab59558b2522ec6244b7163803277a7385edb72ae6e0decfbb66d017fe95566dfbf1d76780231e8e507f8b7825c0dd4bbfba2590d2e3a78953a8b4606474446d7cd066a4113e319f6bb6e38f48301a3bf4a394fd70ae938b3f594144eddf743fd24b2493ca5f77a7cd4453d977568f1ed4c420b70ca85f3dee5882cc5beb69734ba2402cd8b869fa973ca73cf9281ee7555bb18675cff3fb5dd331b0ce978db5ccfaa5c4342df5ea96decd7d7ffe6a13a921adaaef68c6f7bd5b46e06e98fe8de093189ed0e11a1fa8ae9e964596253dad170be11d4999711cf99de0b9d947eaab852ea37db907e35bdd9fe6d0a487028ddd50d7f03809314238fb922cd7c29fef172b55c0b12cf9c15f6114c7a45258c450a34ac2d9a81ca0b1322cdeb1a38881897960881aacc8f0f8a327b7668036843bf11ba5560fd801c0d9b69b60972bc0f412f0782c6e3b21391c46d149531be19bdbcede14c74a2e0780bbb94ec4c533aa2b5841d4b657edcf7db367dbe9e3b366642667635bfbef0c13c7ce9425c24530305a86724500275ff24463b358976e670dac5518c9ae505b00bd02dd47d5775946bf90aad0e410015d04fc07f902d18488f28fe5da7cd999ebd026c8a31f31cc74be693cd42a2e46810479dfc210203000001a35d305b300c0603551d130101ff04023000300b0603551d0f040403020780301d0603551d0e04160414f58703bb33ce1b73ee02eccdee5b8817518fe3db301f0603551d23041830168014f58703bb33ce1b73ee02eccdee5b8817f7ffe3db300d06092a864886f70d01010b05000382020100c02e12417b738516c8db8679e8f5cd44f4c6e281235e47cbab25f11e583e317f78ad85ebfe148860f77fd226a2f4982afdba050c203312cc4d1461648193d333edc8fff178cc5f519f09d7be0d5c74fd9bdf524ac9a871253304106736d0b30bc9a14072ae417b68e6e47bd028f76de73f50fc917c9156d4dfa6bbe84d1b58aa3bfac119eb112f248b7cc5a98626aa6eb79bd5f806fb02527b9c9ea1e0078b5ee4b85529f648521c1b542d46d8e571b960d145b592898a63582ab3c6b276e23c825904ae5ac4997b2e4b4657b82924b2fdee2c0da483fa652a07358b97cfbd962ed17e6cc21e87b66c7665b5b262da8be973e3db33dd133a17636a76de8d8fe04761283a83ff8fe7c7e04aa3e507cfe98c35352ee7806631bf91580ae1253d38d3a4f059344707620fbe30dd818858f028b096e582f805b71301bcfac61f8672ccf9ee8ed9d6048c246cbf0f5d3739cf45c1933ad2ed5c5879748662307e8ebbdd7aa9edca40cb6247f4b49f527f7263a8f02baf452a48196de3fbf9196669c8cc62876c532b2d6e906c543a822541cb186aa422a8a1c447d781001c15510f1aafef9fa6618cbd6b8bede6ac0eb63a4c92e60f910a0f71c7a0b90d3a175a6f35c8e7504f46e870604806828b6658e673919c123d358e46ad5af5b3db692104fdd31cdf949d56b00ad195768dec9edd0b159764ade5f26202fc9e5f56423905b3", 0x559, 0xfffffffffffffffd) keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f0000000000)={r4, 0x9, 0x54}, 0x0, &(0x7f00000013c0)="3053607f31f9a278a7", 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.104' (ED25519) to the list of known hosts. [ 29.610861][ T36] audit: type=1400 audit(1792313283.320:64): avc: denied { mounton } for pid=287 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 29.614797][ T287] cgroup: Unknown subsys name 'net' [ 29.633616][ T36] audit: type=1400 audit(1792313283.320:65): avc: denied { mount } for pid=287 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 29.660906][ T36] audit: type=1400 audit(1792313283.350:66): avc: denied { unmount } for pid=287 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 29.661421][ T287] cgroup: Unknown subsys name 'devices' [ 29.787185][ T287] cgroup: Unknown subsys name 'hugetlb' [ 29.792909][ T287] cgroup: Unknown subsys name 'rlimit' [ 29.887146][ T36] audit: type=1400 audit(1792313283.600:67): avc: denied { setattr } for pid=287 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 29.910361][ T36] audit: type=1400 audit(1792313283.600:68): avc: denied { mounton } for pid=287 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 29.935171][ T36] audit: type=1400 audit(1792313283.600:69): avc: denied { mount } for pid=287 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 29.962007][ T289] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 29.970881][ T36] audit: type=1400 audit(1792313283.680:70): avc: denied { relabelto } for pid=289 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 29.996363][ T36] audit: type=1400 audit(1792313283.680:71): avc: denied { write } for pid=289 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 30.032223][ T36] audit: type=1400 audit(1792313283.740:72): avc: denied { read } for pid=287 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 30.033696][ T287] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 30.057760][ T36] audit: type=1400 audit(1792313283.740:73): avc: denied { open } for pid=287 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 31.409381][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.416606][ T296] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.423830][ T296] bridge_slave_0: entered allmulticast mode [ 31.430173][ T296] bridge_slave_0: entered promiscuous mode [ 31.437144][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.445193][ T296] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.452291][ T296] bridge_slave_1: entered allmulticast mode [ 31.458705][ T296] bridge_slave_1: entered promiscuous mode [ 31.516482][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.523605][ T295] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.530737][ T295] bridge_slave_0: entered allmulticast mode [ 31.537354][ T295] bridge_slave_0: entered promiscuous mode [ 31.544079][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.551151][ T295] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.558294][ T295] bridge_slave_1: entered allmulticast mode [ 31.564667][ T295] bridge_slave_1: entered promiscuous mode [ 31.587882][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.594989][ T294] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.602081][ T294] bridge_slave_0: entered allmulticast mode [ 31.608635][ T294] bridge_slave_0: entered promiscuous mode [ 31.618288][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.625551][ T294] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.632649][ T294] bridge_slave_1: entered allmulticast mode [ 31.639159][ T294] bridge_slave_1: entered promiscuous mode [ 31.671435][ T297] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.678554][ T297] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.685872][ T297] bridge_slave_0: entered allmulticast mode [ 31.692139][ T297] bridge_slave_0: entered promiscuous mode [ 31.701761][ T297] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.709072][ T297] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.716264][ T297] bridge_slave_1: entered allmulticast mode [ 31.722582][ T297] bridge_slave_1: entered promiscuous mode [ 31.873108][ T297] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.880322][ T297] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.887674][ T297] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.894737][ T297] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.905784][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.912865][ T294] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.920227][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.927316][ T294] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.944915][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.952003][ T295] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.959337][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.966499][ T295] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.982629][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.989758][ T296] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.997118][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.004197][ T296] bridge0: port 1(bridge_slave_0) entered forwarding state [ 32.057372][ T51] bridge0: port 1(bridge_slave_0) entered disabled state [ 32.064827][ T51] bridge0: port 2(bridge_slave_1) entered disabled state [ 32.072319][ T51] bridge0: port 1(bridge_slave_0) entered disabled state [ 32.080199][ T51] bridge0: port 2(bridge_slave_1) entered disabled state [ 32.087596][ T51] bridge0: port 1(bridge_slave_0) entered disabled state [ 32.095061][ T51] bridge0: port 2(bridge_slave_1) entered disabled state [ 32.110622][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.117748][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 32.131301][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.138419][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 32.148842][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.155949][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 32.176539][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.183652][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 32.194706][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.201802][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 32.215239][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.222310][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 32.252635][ T294] veth0_vlan: entered promiscuous mode [ 32.278843][ T296] veth0_vlan: entered promiscuous mode [ 32.291622][ T297] veth0_vlan: entered promiscuous mode [ 32.312355][ T294] veth1_macvtap: entered promiscuous mode [ 32.322117][ T295] veth0_vlan: entered promiscuous mode [ 32.332861][ T296] veth1_macvtap: entered promiscuous mode [ 32.342894][ T297] veth1_macvtap: entered promiscuous mode [ 32.365421][ T295] veth1_macvtap: entered promiscuous mode [ 32.404941][ T294] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 32.441874][ T314] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 32.529555][ T321] syzkaller1: entered promiscuous mode [ 32.548649][ T321] syzkaller1: entered allmulticast mode [ 32.677475][ T329] Zero length message leads to an empty skb [ 32.877984][ T330] rust_binder: Read failure Err(EFAULT) in pid:2 [ 32.919521][ T358] kvm_intel: kvm [357]: vcpu2, guest rIP: 0xfff0 Unhandled WRMSR(0x1d9) = 0x1 [ 33.008708][ T364] syzkaller1: entered promiscuous mode [ 33.014615][ T364] syzkaller1: entered allmulticast mode [ 33.043751][ T312] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 33.204679][ T312] usb 2-1: Using ep0 maxpacket: 32 [ 33.214858][ T312] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 33.237198][ T312] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 33.257237][ T312] usb 2-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 33.275525][ T312] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 33.293330][ T66] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 33.304441][ T312] usb 2-1: config 0 descriptor?? [ 33.319352][ T312] hub 2-1:0.0: USB hub found [ 33.464317][ T66] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 33.483243][ T66] usb 4-1: config 1 interface 0 altsetting 1 has 3 endpoint descriptors, different from the interface descriptor's value: 4 [ 33.504687][ T66] usb 4-1: New USB device found, idVendor=174c, idProduct=55aa, bcdDevice= 1.00 [ 33.523266][ T66] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 33.531834][ T66] usb 4-1: Product: syz [ 33.531857][ T312] hub 2-1:0.0: 1 port detected [ 33.541894][ T66] usb 4-1: Manufacturer: syz [ 33.552009][ T66] usb 4-1: SerialNumber: syz [ 33.564740][ T66] usb-storage 4-1:1.0: USB Mass Storage device detected [ 33.573095][ T66] usb-storage 4-1:1.0: Quirks match for vid 174c pid 55aa: 400000 [ 33.583286][ T66] scsi host1: usb-storage 4-1:1.0 [ 33.765079][ T9] usb 4-1: USB disconnect, device number 2 [ 33.984480][ T392] fuse: Bad value for 'fd' [ 34.062148][ T398] ======================================================= [ 34.062148][ T398] WARNING: The mand mount option has been deprecated and [ 34.062148][ T398] and is ignored by this kernel. Remove the mand [ 34.062148][ T398] option from the mount to silence this warning. [ 34.062148][ T398] ======================================================= [ 34.306301][ T412] futex_wake_op: syz.2.25 tries to shift op by -1; fix this program [ 34.434631][ T428] netlink: 100 bytes leftover after parsing attributes in process `syz.3.31'. [ 34.453671][ T428] netlink: 40 bytes leftover after parsing attributes in process `syz.3.31'. [ 34.462835][ T428] netlink: 20 bytes leftover after parsing attributes in process `syz.3.31'. [ 34.583335][ T311] usb 1-1: new full-speed USB device number 2 using dummy_hcd [ 34.589129][ T433] syz.3.33: vmalloc error: size 8192, failed to allocate pages, mode:0xdc2(GFP_KERNEL|__GFP_HIGHMEM|__GFP_ZERO), nodemask=(null),cpuset=syz3,mems_allowed=0 [ 34.606709][ T433] CPU: 1 UID: 0 PID: 433 Comm: syz.3.33 Not tainted syzkaller #0 bcd0852b9269e5a174a9e289c8567167f3c3d1d7 [ 34.606757][ T433] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 34.606788][ T433] Call Trace: [ 34.606800][ T433] [ 34.606812][ T433] __dump_stack+0x21/0x30 [ 34.606865][ T433] dump_stack_lvl+0x140/0x1c0 [ 34.606912][ T433] ? __cfi_dump_stack_lvl+0x10/0x10 [ 34.606973][ T433] ? _raw_spin_unlock_irqrestore+0x4a/0x70 [ 34.607008][ T433] dump_stack+0x19/0x20 [ 34.607054][ T433] warn_alloc+0x1e7/0x2c0 [ 34.607093][ T433] ? __cfi_warn_alloc+0x10/0x10 [ 34.607130][ T433] ? __kmalloc_node_noprof+0x252/0x500 [ 34.607173][ T433] ? __vmalloc_node_range_noprof+0x529/0x1300 [ 34.607215][ T433] __vmalloc_node_range_noprof+0x100b/0x1300 [ 34.607263][ T433] ? __cfi___vmalloc_node_range_noprof+0x10/0x10 [ 34.607304][ T433] ? class_find_device+0x318/0x390 [ 34.607350][ T433] ? __cfi_device_match_devt+0x10/0x10 [ 34.607394][ T433] ? __cfi_class_find_device+0x10/0x10 [ 34.607442][ T433] ? n_tty_open+0x38/0x1d0 [ 34.607475][ T433] vzalloc_noprof+0x103/0x1d0 [ 34.607514][ T433] ? n_tty_open+0x38/0x1d0 [ 34.607547][ T433] ? __cfi_ldsem_down_write+0x10/0x10 [ 34.607592][ T433] ? __cfi_vzalloc_noprof+0x10/0x10 [ 34.607632][ T433] ? _raw_spin_unlock_irqrestore+0x4a/0x70 [ 34.607663][ T433] n_tty_open+0x38/0x1d0 [ 34.607691][ T433] tty_ldisc_setup+0xd7/0x370 [ 34.607732][ T433] tty_init_dev+0x28b/0x4f0 [ 34.607778][ T433] ptmx_open+0xe1/0x2f0 [ 34.607815][ T433] chrdev_open+0x4eb/0x610 [ 34.607860][ T433] ? __cfi_chrdev_open+0x10/0x10 [ 34.607907][ T433] ? bpf_lsm_file_open+0xd/0x20 [ 34.607941][ T433] ? __cfi_chrdev_open+0x10/0x10 [ 34.608000][ T433] do_dentry_open+0x97c/0x1510 [ 34.608038][ T433] vfs_open+0x86/0x240 [ 34.608072][ T433] ? __cfi_vfs_open+0x10/0x10 [ 34.608107][ T433] ? may_open+0x352/0x430 [ 34.608141][ T433] path_openat+0x2c49/0x35a0 [ 34.608176][ T433] ? schedule+0xc5/0x240 [ 34.608210][ T433] ? kasan_save_alloc_info+0x3a/0x50 [ 34.608249][ T433] ? getname+0x1b/0x30 [ 34.608293][ T433] ? x64_sys_call+0xe69/0x2ee0 [ 34.608327][ T433] ? do_syscall_64+0x57/0xf0 [ 34.608359][ T433] ? do_filp_open+0x440/0x440 [ 34.608395][ T433] do_filp_open+0x1f2/0x440 [ 34.608430][ T433] ? __cfi_do_filp_open+0x10/0x10 [ 34.608466][ T433] ? alloc_fd+0x4c1/0x570 [ 34.608513][ T433] do_sys_openat2+0x134/0x1d0 [ 34.608549][ T433] ? putname+0x27/0x150 [ 34.608592][ T433] ? do_sys_open+0x100/0x100 [ 34.608630][ T433] __x64_sys_openat+0x13a/0x170 [ 34.608668][ T433] x64_sys_call+0xe69/0x2ee0 [ 34.608700][ T433] do_syscall_64+0x57/0xf0 [ 34.608723][ T433] ? clear_bhb_loop+0x50/0xa0 [ 34.608755][ T433] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 34.608791][ T433] RIP: 0033:0x7efd3939e559 [ 34.608833][ T433] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 34.608860][ T433] RSP: 002b:00007efd3a348028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 34.608894][ T433] RAX: ffffffffffffffda RBX: 00007efd39625fa0 RCX: 00007efd3939e559 [ 34.608917][ T433] RDX: 0000000000121301 RSI: 0000200000000340 RDI: ffffffffffffff9c [ 34.608940][ T433] RBP: 00007efd39435ab8 R08: 0000000000000000 R09: 0000000000000000 [ 34.608971][ T433] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 34.608989][ T433] R13: 00007efd39626038 R14: 00007efd39625fa0 R15: 00007fff47302d08 [ 34.609017][ T433] [ 34.609037][ T433] Mem-Info: [ 34.756152][ T311] usb 1-1: not running at top speed; connect to a high speed hub [ 34.758666][ T433] active_anon:5577 inactive_anon:0 isolated_anon:0 [ 34.758666][ T433] active_file:16193 inactive_file:2292 isolated_file:0 [ 34.758666][ T433] unevictable:0 dirty:248 writeback:0 [ 34.758666][ T433] slab_reclaimable:3990 slab_unreclaimable:71209 [ 34.758666][ T433] mapped:24201 shmem:186 pagetables:910 [ 34.758666][ T433] sec_pagetables:0 bounce:0 [ 34.758666][ T433] kernel_misc_reclaimable:0 [ 34.758666][ T433] free:1534035 free_pcp:2362 free_cma:0 [ 34.772601][ T311] usb 1-1: config 1 interface 0 altsetting 250 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 34.773019][ T433] Node 0 active_anon:22308kB inactive_anon:0kB active_file:64772kB inactive_file:9168kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:96804kB dirty:992kB writeback:0kB shmem:744kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:4292kB pagetables:3640kB sec_pagetables:0kB all_unreclaimable? no [ 34.779428][ T311] usb 1-1: config 1 interface 0 has no altsetting 0 [ 34.782804][ T433] DMA32 free:2949972kB boost:0kB min:19052kB low:23812kB high:28572kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:3145324kB managed:2955032kB mlocked:0kB bounce:0kB free_pcp:5060kB local_pcp:0kB free_cma:0kB [ 34.800112][ T311] usb 1-1: New USB device found, idVendor=04b3, idProduct=3108, bcdDevice= 0.40 [ 34.800642][ T433] lowmem_reserve[]: 0 3920 [ 34.807329][ T311] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 34.807532][ T312] hub 2-1:0.0: hub_hub_status failed (err = -32) [ 34.810285][ T433] 3920 [ 34.810304][ T433] Normal free:3186168kB boost:0kB min:26000kB low:32500kB high:39000kB reserved_highatomic:0KB free_highatomic:0KB active_anon:22308kB inactive_anon:0kB active_file:64772kB inactive_file:9168kB unevictable:0kB writepending:992kB present:5242880kB managed:4014840kB mlocked:0kB bounce:0kB free_pcp:4352kB local_pcp:3524kB free_cma:0kB [ 34.810400][ T433] lowmem_reserve[]: 0 0 0 [ 34.819334][ T433] DMA32: [ 34.828450][ T312] hub 2-1:0.0: config failed, can't get hub status (err -32) [ 34.828657][ T433] 5*4kB (M) 2*8kB [ 34.838930][ T311] usb 1-1: Product: 떩㎷퇂㟒骗㴹魤㝦죍Ϳ㭺玥煸ꓭ谌ኙ됦瀙▏冉뤩먼Ử᛹喠⢚昘㉫慉劌股᧘팇躬 [ 34.842619][ T433] (M) 5*16kB (M) 5*32kB (M) [ 34.856214][ T312] usbhid 2-1:0.0: can't add hid device: -32 [ 34.861087][ T433] 3*64kB (M) 5*128kB (M) 5*256kB (M) 5*512kB [ 34.872671][ T311] usb 1-1: Manufacturer: 㑲਄銭⌊徂늲槂∅ﻳ嫪₥╽뽉跹虛烫ຆ￲겤응ᤢ揧硋ꅋ怴퐓늷꙰뺁逾镡Α⒇㘗⊉塧閝喐ㅧ㔄溏釒畅㫌戓목醪┝‬扡뭦떫箲럀嚳㷷ⵍ埋쌾ꃬ懸遌출ˁ参਒饁갊꣩諀慎쳼謢㠏燭 [ 34.874945][ T433] (M) 4*1024kB (UM) 4*2048kB (M) [ 34.884675][ T312] usbhid 2-1:0.0: probe with driver usbhid failed with error -32 [ 34.885480][ T433] 716*4096kB [ 34.913332][ T311] usb 1-1: SerialNumber: syz [ 34.913597][ T433] (M) [ 34.967109][ T312] usb 2-1: USB disconnect, device number 2 [ 34.967629][ T433] = 2949972kB [ 35.261857][ T433] Normal: 1*4kB (E) 192*8kB (ME) 382*16kB (M) 381*32kB (M) 349*64kB (ME) 92*128kB (UME) 39*256kB (UME) 17*512kB (UME) 7*1024kB (M) 10*2048kB (UME) 753*4096kB (M) = 3184580kB [ 35.279340][ T433] 18635 total pagecache pages [ 35.284094][ T433] 0 pages in swap cache [ 35.288287][ T433] Free swap = 124984kB [ 35.292476][ T433] Total swap = 124996kB [ 35.296697][ T433] 2097051 pages RAM [ 35.300537][ T433] 0 pages HighMem/MovableOnly [ 35.305278][ T433] 354583 pages reserved [ 35.309468][ T433] 0 pages cma reserved [ 35.316359][ T433] Memory allocations: [ 35.320432][ T433] 0 B 0 init/main.c:1477 func:do_initcalls [ 35.327817][ T433] 0 B 0 init/do_mounts.c:186 func:mount_root_generic [ 35.335955][ T433] 0 B 0 init/do_mounts.c:158 func:do_mount_root [ 35.343698][ T433] 0 B 0 init/do_mounts.c:352 func:mount_nodev_root [ 35.351631][ T433] 0 B 0 init/do_mounts_rd.c:241 func:rd_load_image [ 35.359614][ T433] 0 B 0 init/do_mounts_rd.c:72 func:identify_ramdisk_image [ 35.368309][ T433] 0 B 0 init/initramfs.c:507 func:unpack_to_rootfs [ 35.376281][ T433] 0 B 0 init/initramfs.c:508 func:unpack_to_rootfs [ 35.384252][ T433] 0 B 0 init/initramfs.c:509 func:unpack_to_rootfs [ 35.392181][ T433] 0 B 0 init/initramfs.c:101 func:find_link [ 35.399568][ T433] ptm ptm0: ldisc open failed (-12), clearing slot 0 [ 35.511917][ T36] kauditd_printk_skb: 96 callbacks suppressed [ 35.511936][ T36] audit: type=1400 audit(1792313289.220:170): avc: denied { create } for pid=446 comm="syz.2.39" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 35.539435][ T36] audit: type=1400 audit(1792313289.230:171): avc: denied { write } for pid=446 comm="syz.2.39" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 35.558763][ T36] audit: type=1400 audit(1792313289.230:172): avc: denied { mount } for pid=446 comm="syz.2.39" name="/" dev="configfs" ino=2543 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=filesystem permissive=1 [ 35.582070][ T36] audit: type=1400 audit(1792313289.250:173): avc: denied { search } for pid=446 comm="syz.2.39" name="/" dev="configfs" ino=2543 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 35.604321][ T36] audit: type=1400 audit(1792313289.250:174): avc: denied { setattr } for pid=446 comm="syz.2.39" name="/" dev="configfs" ino=2543 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 35.646455][ T450] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 35.743215][ T10] usb 2-1: new low-speed USB device number 3 using dummy_hcd [ 35.904895][ T10] usb 2-1: unable to get BOS descriptor or descriptor too short [ 35.913579][ T10] usb 2-1: config 1 interface 0 altsetting 1 endpoint 0x82 is Bulk; changing to Interrupt [ 35.923844][ T10] usb 2-1: config 1 interface 0 altsetting 1 endpoint 0x3 is Bulk; changing to Interrupt [ 35.933780][ T10] usb 2-1: config 1 interface 0 has no altsetting 0 [ 35.942666][ T10] usb 2-1: string descriptor 0 read error: -22 [ 35.949362][ T10] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 35.958848][ T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 35.967210][ T312] usb 3-1: new full-speed USB device number 2 using dummy_hcd [ 35.976116][ T443] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 35.989059][ T443] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 35.997918][ T10] cdc_ether 2-1:1.0: probe with driver cdc_ether failed with error -22 [ 36.006719][ T36] audit: type=1400 audit(1792313289.710:175): avc: denied { read write } for pid=458 comm="syz.3.42" name="event2" dev="devtmpfs" ino=208 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 36.032017][ T36] audit: type=1400 audit(1792313289.710:176): avc: denied { open } for pid=458 comm="syz.3.42" path="/dev/input/event2" dev="devtmpfs" ino=208 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 36.113245][ T312] usb 3-1: device descriptor read/64, error -71 [ 36.272682][ T10] usb 2-1: USB disconnect, device number 3 [ 36.353253][ T312] usb 3-1: device descriptor read/64, error -71 [ 36.597249][ T312] usb 3-1: new full-speed USB device number 3 using dummy_hcd [ 36.743222][ T312] usb 3-1: device descriptor read/64, error -71 [ 36.900393][ T36] audit: type=1400 audit(1792313290.610:177): avc: denied { ioctl } for pid=474 comm="syz.1.46" path="/dev/uinput" dev="devtmpfs" ino=194 ioctlcmd=0x55c8 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 36.983187][ T312] usb 3-1: device descriptor read/64, error -71 [ 37.008455][ T477] fuse: Unknown parameter '' [ 37.013076][ T36] audit: type=1400 audit(1792313290.720:178): avc: denied { mounton } for pid=476 comm="syz.1.47" path="/6/file0" dev="tmpfs" ino=50 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 37.035740][ T36] audit: type=1400 audit(1792313290.720:179): avc: denied { mounton } for pid=476 comm="syz.1.47" path="/6/file0" dev="fuse" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=file permissive=1 [ 37.093335][ T312] usb usb3-port1: attempt power cycle [ 37.303260][ T31] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 37.332955][ T311] usbhid 1-1:1.0: can't add hid device: -71 [ 37.343253][ T311] usbhid 1-1:1.0: probe with driver usbhid failed with error -71 [ 37.354074][ T311] usb 1-1: USB disconnect, device number 2 [ 37.363485][ T486] fuse: Bad value for 'rootmode' [ 37.433256][ T312] usb 3-1: new full-speed USB device number 4 using dummy_hcd [ 37.454306][ T312] usb 3-1: device descriptor read/8, error -71 [ 37.469251][ T31] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 37.480410][ T31] usb 2-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 1024 [ 37.493215][ T31] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 37.502573][ T31] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 37.510815][ T31] usb 2-1: Product: syz [ 37.515220][ T31] usb 2-1: Manufacturer: syz [ 37.519852][ T31] usb 2-1: SerialNumber: syz [ 37.527070][ T31] cdc_mbim 2-1:1.0: skipping garbage [ 37.584239][ T312] usb 3-1: device descriptor read/8, error -71 [ 37.727015][ T479] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 37.823224][ T312] usb 3-1: new full-speed USB device number 5 using dummy_hcd [ 37.844998][ T312] usb 3-1: device descriptor read/8, error -71 [ 37.860540][ T496] rust_binder: Read failure Err(EFAULT) in pid:37 [ 37.974346][ T312] usb 3-1: device descriptor read/8, error -71 [ 38.083532][ T312] usb usb3-port1: unable to enumerate USB device [ 38.143210][ T448] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 38.293209][ T448] usb 4-1: Using ep0 maxpacket: 32 [ 38.299685][ T448] usb 4-1: config 0 interface 0 altsetting 1 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 38.310658][ T448] usb 4-1: config 0 interface 0 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 38.323744][ T448] usb 4-1: config 0 interface 0 has no altsetting 0 [ 38.330421][ T448] usb 4-1: New USB device found, idVendor=0458, idProduct=5019, bcdDevice= 0.00 [ 38.339758][ T448] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 38.345384][ T479] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 38.351261][ T448] usb 4-1: config 0 descriptor?? [ 38.366771][ T31] cdc_mbim 2-1:1.0: setting rx_max = 16384 [ 38.562476][ T498] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 38.571849][ T498] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 38.572542][ T31] cdc_mbim 2-1:1.0: cdc-wdm0: USB WDM device [ 38.587432][ T31] wwan wwan0: port wwan0mbim0 attached [ 38.594050][ T448] usbhid 4-1:0.0: can't add hid device: -71 [ 38.601774][ T31] cdc_mbim 2-1:1.0 wwan0: register 'cdc_mbim' at usb-dummy_hcd.1-1, CDC MBIM, a6:de:7a:28:1c:a8 [ 38.612368][ T448] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 38.621392][ T448] usb 4-1: USB disconnect, device number 3 [ 38.713250][ T312] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 38.768804][ T150] 8021q: adding VLAN 0 to HW filter on device wwan0 [ 38.776724][ T311] usb 2-1: USB disconnect, device number 4 [ 38.785742][ T311] cdc_mbim 2-1:1.0 wwan0: unregister 'cdc_mbim' usb-dummy_hcd.1-1, CDC MBIM [ 38.839641][ T311] wwan wwan0: port wwan0mbim0 disconnected [ 38.873213][ T312] usb 1-1: Using ep0 maxpacket: 32 [ 38.879593][ T312] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 38.896860][ T312] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 38.908817][ T312] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 38.921700][ T312] usb 1-1: New USB device found, idVendor=0458, idProduct=5011, bcdDevice= 0.00 [ 38.930809][ T312] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 38.943205][ T312] usb 1-1: config 0 descriptor?? [ 39.143212][ T457] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 39.283227][ T457] usb 3-1: device descriptor read/64, error -71 [ 39.364322][ T312] input: HID 0458:5011 as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/0003:0458:5011.0001/input/input5 [ 39.377180][ T312] input: HID 0458:5011 as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/0003:0458:5011.0001/input/input6 [ 39.411016][ T312] kye 0003:0458:5011.0001: input,hiddev96,hidraw0: USB HID v0.00 Mouse [HID 0458:5011] on usb-dummy_hcd.0-1/input0 [ 39.523247][ T457] usb 3-1: device descriptor read/64, error -71 [ 39.557743][ T448] usb 1-1: USB disconnect, device number 3 [ 39.592847][ T298] Bluetooth: hci0: Frame reassembly failed (-84) [ 39.641712][ T564] netlink: 'syz.3.68': attribute type 13 has an invalid length. [ 39.763197][ T457] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 39.779279][ T578] Unsupported ieee802154 address type: 0 [ 39.893199][ T457] usb 3-1: device descriptor read/64, error -71 [ 39.991797][ T584] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=584 comm=syz.3.71 [ 40.084374][ T591] SELinux: Context system_u:object_r:crond_var_run_t:s0 is not valid (left unmapped). [ 40.095115][ T591] fuse: Unknown parameter '_d' [ 40.133202][ T457] usb 3-1: device descriptor read/64, error -71 [ 40.243289][ T457] usb usb3-port1: attempt power cycle [ 40.333212][ T312] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 40.483227][ T312] usb 1-1: Using ep0 maxpacket: 16 [ 40.489627][ T312] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 40.499875][ T312] usb 1-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 40.512727][ T312] usb 1-1: New USB device found, idVendor=0644, idProduct=8021, bcdDevice= 0.40 [ 40.521923][ T312] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 40.530071][ T312] usb 1-1: Product: syz [ 40.534415][ T312] usb 1-1: Manufacturer: syz [ 40.539057][ T312] usb 1-1: SerialNumber: syz [ 40.593204][ T457] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 40.614271][ T457] usb 3-1: device descriptor read/8, error -71 [ 40.744317][ T457] usb 3-1: device descriptor read/8, error -71 [ 40.869172][ T312] usb 1-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 40.876325][ T312] usb 1-1: 2:1 : no or invalid class specific endpoint descriptor [ 40.884419][ T312] usb 1-1: 2:1 : format type 37 is not supported yet [ 40.894713][ T312] usb 1-1: USB disconnect, device number 4 [ 40.908897][ T434] udevd[434]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 40.935893][ T36] kauditd_printk_skb: 42 callbacks suppressed [ 40.935911][ T36] audit: type=1400 audit(1792313294.650:222): avc: denied { create } for pid=593 comm="syz.3.74" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 40.983376][ T457] usb 3-1: new high-speed USB device number 9 using dummy_hcd [ 41.005569][ T457] usb 3-1: device descriptor read/8, error -71 [ 41.048738][ T601] kvm: kvm [600]: vcpu2, guest rIP: 0x9135 Unhandled WRMSR(0x11e) = 0x0 [ 41.134528][ T457] usb 3-1: device descriptor read/8, error -71 [ 41.181754][ T36] audit: type=1400 audit(1792313294.890:223): avc: denied { mount } for pid=603 comm="syz.3.76" name="/" dev="devtmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 41.204482][ T36] audit: type=1400 audit(1792313294.890:224): avc: denied { write } for pid=603 comm="syz.3.76" name="sda" dev="devtmpfs" ino=91 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 41.227635][ T36] audit: type=1400 audit(1792313294.890:225): avc: denied { mounton } for pid=603 comm="syz.3.76" path="/22/dev" dev="devtmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=dir permissive=1 [ 41.260165][ T457] usb usb3-port1: unable to enumerate USB device [ 41.376600][ T36] audit: type=1400 audit(1792313295.090:226): avc: denied { write } for pid=296 comm="syz-executor" name="15" dev="tmpfs" ino=97 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 trawcon="system_u:object_r:crond_var_run_t:s0" [ 41.402814][ T36] audit: type=1400 audit(1792313295.090:227): avc: denied { remove_name } for pid=296 comm="syz-executor" name="file0" dev="tmpfs" ino=102 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 trawcon="system_u:object_r:crond_var_run_t:s0" [ 41.431219][ T36] audit: type=1400 audit(1792313295.090:228): avc: denied { rmdir } for pid=296 comm="syz-executor" name="15" dev="tmpfs" ino=97 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 trawcon="system_u:object_r:crond_var_run_t:s0" [ 41.603201][ T562] Bluetooth: hci0: command 0x1003 tx timeout [ 41.609389][ T55] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 41.620636][ T560] can0: slcan on ptm0. [ 41.674324][ T566] can0 (unregistered): slcan off ptm0. [ 41.686156][ T570] can0: slcan on ptm0. [ 41.693866][ T36] audit: type=1400 audit(1792313295.410:229): avc: denied { search } for pid=150 comm="dhcpcd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 41.752724][ T36] audit: type=1400 audit(1792313295.460:230): avc: denied { read } for pid=619 comm="dhcpcd-run-hook" name="resolv.conf" dev="tmpfs" ino=426 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 41.776210][ T36] audit: type=1400 audit(1792313295.460:231): avc: denied { open } for pid=619 comm="dhcpcd-run-hook" path="/run/dhcpcd/hook-state/resolv.conf" dev="tmpfs" ino=426 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 41.776957][ T559] can0 (unregistered): slcan off ptm0. [ 42.320819][ T661] sit0: entered promiscuous mode [ 42.339574][ T661] netlink: 'syz.0.81': attribute type 1 has an invalid length. [ 42.360710][ T661] netlink: 1 bytes leftover after parsing attributes in process `syz.0.81'. [ 42.390234][ T661] FAULT_INJECTION: forcing a failure. [ 42.390234][ T661] name failslab, interval 1, probability 0, space 0, times 0 [ 42.423324][ T661] CPU: 0 UID: 0 PID: 661 Comm: syz.0.81 Not tainted syzkaller #0 bcd0852b9269e5a174a9e289c8567167f3c3d1d7 [ 42.423361][ T661] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 42.423377][ T661] Call Trace: [ 42.423384][ T661] [ 42.423393][ T661] __dump_stack+0x21/0x30 [ 42.423435][ T661] dump_stack_lvl+0x140/0x1c0 [ 42.423472][ T661] ? __cfi_dump_stack_lvl+0x10/0x10 [ 42.423509][ T661] ? selinux_kernfs_init_security+0x14b/0x4b0 [ 42.423545][ T661] dump_stack+0x19/0x20 [ 42.423580][ T661] should_fail_ex+0x3c2/0x510 [ 42.423604][ T661] should_failslab+0xac/0x100 [ 42.423628][ T661] kmem_cache_alloc_noprof+0x42/0x410 [ 42.423660][ T661] ? __kernfs_new_node+0xf1/0x740 [ 42.423684][ T661] ? bpf_lsm_kernfs_init_security+0xd/0x20 [ 42.423710][ T661] __kernfs_new_node+0xf1/0x740 [ 42.423732][ T661] ? __kasan_check_write+0x18/0x20 [ 42.423764][ T661] ? kernfs_new_node+0x280/0x280 [ 42.423787][ T661] ? down_write+0xee/0x2b0 [ 42.423818][ T661] ? __cfi_down_write+0x10/0x10 [ 42.423849][ T661] ? __kasan_check_write+0x18/0x20 [ 42.423881][ T661] ? up_write+0x66/0x280 [ 42.423908][ T661] ? kernfs_activate+0x1ee/0x200 [ 42.423932][ T661] kernfs_new_node+0x154/0x280 [ 42.423957][ T661] __kernfs_create_file+0x52/0x280 [ 42.423986][ T661] sysfs_add_file_mode_ns+0x1d2/0x280 [ 42.424018][ T661] internal_create_group+0x66c/0xe70 [ 42.424053][ T661] ? __kasan_check_write+0x18/0x20 [ 42.424086][ T661] ? sysfs_create_group+0x40/0x40 [ 42.424121][ T661] ? kernfs_activate+0x1ee/0x200 [ 42.424146][ T661] sysfs_create_groups+0x5c/0x130 [ 42.424181][ T661] device_add_attrs+0xdf/0x850 [ 42.424212][ T661] ? device_add_class_symlinks+0x260/0x260 [ 42.424242][ T661] ? __kasan_check_write+0x18/0x20 [ 42.424272][ T661] ? kobject_put+0x1cc/0x2a0 [ 42.424318][ T661] ? device_add_class_symlinks+0x22e/0x260 [ 42.424350][ T661] device_add+0x4db/0xbf0 [ 42.424380][ T661] netdev_register_kobject+0x196/0x330 [ 42.424413][ T661] register_netdevice+0x1042/0x1a80 [ 42.424451][ T661] ? __cfi_register_netdevice+0x10/0x10 [ 42.424486][ T661] ? radix_tree_lookup+0x283/0x2a0 [ 42.424510][ T661] ppp_dev_configure+0x80a/0xb40 [ 42.424537][ T661] ppp_ioctl+0x850/0x17e0 [ 42.424562][ T661] ? __cfi_ppp_ioctl+0x10/0x10 [ 42.424586][ T661] ? __fget_files+0x2bc/0x330 [ 42.424609][ T661] ? bpf_lsm_file_ioctl+0xd/0x20 [ 42.424633][ T661] ? security_file_ioctl+0x3e/0x110 [ 42.424664][ T661] ? __cfi_ppp_ioctl+0x10/0x10 [ 42.424687][ T661] __se_sys_ioctl+0x126/0x1b0 [ 42.424711][ T661] __x64_sys_ioctl+0x7f/0xa0 [ 42.424732][ T661] x64_sys_call+0x1878/0x2ee0 [ 42.424756][ T661] do_syscall_64+0x57/0xf0 [ 42.424777][ T661] ? clear_bhb_loop+0x50/0xa0 [ 42.424806][ T661] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 42.424834][ T661] RIP: 0033:0x7f8f9439e559 [ 42.424855][ T661] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 42.424874][ T661] RSP: 002b:00007f8f95271028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 42.424900][ T661] RAX: ffffffffffffffda RBX: 00007f8f94625fa0 RCX: 00007f8f9439e559 [ 42.424919][ T661] RDX: 0000200000000300 RSI: 00000000c004743e RDI: 0000000000000008 [ 42.424935][ T661] RBP: 00007f8f94435ab8 R08: 0000000000000000 R09: 0000000000000000 [ 42.424950][ T661] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 42.424964][ T661] R13: 00007f8f94626038 R14: 00007f8f94625fa0 R15: 00007ffc73db6ca8 [ 42.424985][ T661] [ 42.860010][ T686] can0: slcan on ttyS3. [ 42.934688][ T684] can0 (unregistered): slcan off ttyS3. [ 43.619944][ T766] rust_binder: 765:766 BC_CLEAR_FREEZE_NOTIFICATION freeze notification cookie mismatch [ 43.634942][ T766] rust_binder: Write failure EINVAL in pid:112 [ 43.641229][ T766] rust_binder: 765:766 BC_CLEAR_FREEZE_NOTIFICATION freeze notification cookie mismatch [ 43.651080][ T766] rust_binder: Write failure EINVAL in pid:112 [ 43.657385][ T766] rust_binder: 765:766 BC_CLEAR_FREEZE_NOTIFICATION freeze notification cookie mismatch [ 43.667263][ T766] rust_binder: Write failure EINVAL in pid:112 [ 43.673554][ T766] rust_binder: 765:766 BC_CLEAR_FREEZE_NOTIFICATION freeze notification cookie mismatch [ 43.683679][ T766] rust_binder: Write failure EINVAL in pid:112 [ 43.689987][ T766] rust_binder: 765:766 BC_CLEAR_FREEZE_NOTIFICATION freeze notification cookie mismatch [ 43.699862][ T766] rust_binder: Write failure EINVAL in pid:112 [ 43.706188][ T766] rust_binder: 765:766 BC_CLEAR_FREEZE_NOTIFICATION freeze notification cookie mismatch [ 43.716048][ T766] rust_binder: Write failure EINVAL in pid:112 [ 43.722342][ T766] rust_binder: 765:766 BC_CLEAR_FREEZE_NOTIFICATION freeze notification cookie mismatch [ 43.732316][ T766] rust_binder: Write failure EINVAL in pid:112 [ 43.738601][ T766] rust_binder: 765:766 BC_CLEAR_FREEZE_NOTIFICATION freeze notification cookie mismatch [ 43.748444][ T766] rust_binder: Write failure EINVAL in pid:112 [ 43.754929][ T766] rust_binder: 765:766 BC_CLEAR_FREEZE_NOTIFICATION freeze notification cookie mismatch [ 43.764784][ T766] rust_binder: Write failure EINVAL in pid:112 [ 43.771044][ T766] rust_binder: 765:766 BC_CLEAR_FREEZE_NOTIFICATION freeze notification cookie mismatch [ 43.781239][ T766] rust_binder: Write failure EINVAL in pid:112 [ 43.813228][ T311] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 43.964361][ T311] usb 2-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 43.973310][ T311] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 43.983596][ T311] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 43.992581][ T311] usb 2-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 1.00 [ 44.001866][ T311] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 44.212936][ T66] usb 2-1: USB disconnect, device number 5 [ 44.333335][ T31] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 44.442300][ T311] rust_binder: 765: undelivered freeze notification, 0000000000000001 [ 44.484295][ T31] usb 1-1: config 1 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 44.495300][ T31] usb 1-1: config 1 interface 1 altsetting 0 endpoint 0x3 has an invalid bInterval 0, changing to 7 [ 44.506179][ T31] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a7, bcdDevice= 1.00 [ 44.515297][ T31] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 44.728996][ T31] cdc_acm 1-1:1.0: ttyACM0: USB ACM device [ 44.741455][ T31] usb 1-1: USB disconnect, device number 5 [ 44.883240][ T55] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 44.885536][ T562] Bluetooth: hci0: command 0x1003 tx timeout [ 44.897873][ T678] can0: slcan on ptm0. [ 44.944436][ T677] can0 (unregistered): slcan off ptm0. [ 45.223230][ T31] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 45.267544][ T813] overlayfs: missing 'lowerdir' [ 45.355201][ T817] mtrr: base(0x20000000) is not aligned on a size(0x0000) boundary [ 45.404867][ T31] usb 3-1: unable to get BOS descriptor or descriptor too short [ 45.413389][ T31] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 45.423657][ T31] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 45.433979][ T31] usb 3-1: New USB device found, idVendor=1235, idProduct=0010, bcdDevice= 0.40 [ 45.443061][ T31] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 45.453194][ T31] usb 3-1: Product: syz [ 45.457397][ T31] usb 3-1: Manufacturer: syz [ 45.462026][ T31] usb 3-1: SerialNumber: syz [ 45.468784][ T31] usb 3-1: selecting invalid altsetting 1 [ 45.476574][ T31] usb 3-1: unit 6 not found! [ 45.483198][ T448] usb 1-1: new full-speed USB device number 6 using dummy_hcd [ 45.620409][ T831] syz.3.113: vmalloc error: size 4096, failed to allocate pages, mode:0xdc2(GFP_KERNEL|__GFP_HIGHMEM|__GFP_ZERO), nodemask=(null),cpuset=syz3,mems_allowed=0 [ 45.633337][ T311] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 45.636454][ T831] CPU: 1 UID: 0 PID: 831 Comm: syz.3.113 Not tainted syzkaller #0 bcd0852b9269e5a174a9e289c8567167f3c3d1d7 [ 45.636558][ T831] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 45.636592][ T831] Call Trace: [ 45.636622][ T831] [ 45.636644][ T831] __dump_stack+0x21/0x30 [ 45.636747][ T831] dump_stack_lvl+0x140/0x1c0 [ 45.636844][ T831] ? __cfi_dump_stack_lvl+0x10/0x10 [ 45.636937][ T831] ? _raw_spin_unlock_irqrestore+0x4a/0x70 [ 45.637014][ T831] dump_stack+0x19/0x20 [ 45.637100][ T831] warn_alloc+0x1e7/0x2c0 [ 45.637166][ T831] ? __cfi_warn_alloc+0x10/0x10 [ 45.637245][ T831] ? __kmalloc_node_noprof+0x252/0x500 [ 45.637331][ T831] ? __vmalloc_node_range_noprof+0x529/0x1300 [ 45.637414][ T831] __vmalloc_node_range_noprof+0x100b/0x1300 [ 45.637518][ T831] ? __cfi___vmalloc_node_range_noprof+0x10/0x10 [ 45.637594][ T831] ? class_find_device+0x318/0x390 [ 45.637698][ T831] ? __cfi_device_match_devt+0x10/0x10 [ 45.637812][ T831] ? __cfi_class_find_device+0x10/0x10 [ 45.637911][ T831] ? n_tty_open+0x38/0x1d0 [ 45.637981][ T831] vzalloc_noprof+0x103/0x1d0 [ 45.638050][ T831] ? n_tty_open+0x38/0x1d0 [ 45.638117][ T831] ? __cfi_vzalloc_noprof+0x10/0x10 [ 45.638192][ T831] ? __kasan_check_write+0x18/0x20 [ 45.638278][ T831] ? up_write+0x66/0x280 [ 45.638354][ T831] n_tty_open+0x38/0x1d0 [ 45.638420][ T831] tty_ldisc_setup+0x1d9/0x370 [ 45.638516][ T831] tty_init_dev+0x28b/0x4f0 [ 45.638612][ T831] ptmx_open+0xe1/0x2f0 [ 45.638682][ T831] ? selinux_file_open+0x46c/0x630 [ 45.638761][ T831] chrdev_open+0x4eb/0x610 [ 45.638855][ T831] ? __cfi_chrdev_open+0x10/0x10 [ 45.638956][ T831] ? bpf_lsm_file_open+0xd/0x20 [ 45.639038][ T831] ? __cfi_chrdev_open+0x10/0x10 [ 45.639157][ T831] do_dentry_open+0x97c/0x1510 [ 45.639250][ T831] vfs_open+0x86/0x240 [ 45.639317][ T831] ? __cfi_vfs_open+0x10/0x10 [ 45.639384][ T831] ? may_open+0x352/0x430 [ 45.639454][ T831] path_openat+0x2c49/0x35a0 [ 45.639531][ T831] ? schedule+0xc5/0x240 [ 45.639595][ T831] ? kasan_save_alloc_info+0x3a/0x50 [ 45.639672][ T831] ? getname+0x1b/0x30 [ 45.639755][ T831] ? x64_sys_call+0xe69/0x2ee0 [ 45.639819][ T831] ? do_syscall_64+0x57/0xf0 [ 45.639876][ T831] ? do_filp_open+0x440/0x440 [ 45.639950][ T831] do_filp_open+0x1f2/0x440 [ 45.640009][ T831] ? __cfi_do_filp_open+0x10/0x10 [ 45.640081][ T831] ? alloc_fd+0x4c1/0x570 [ 45.640174][ T831] do_sys_openat2+0x134/0x1d0 [ 45.640239][ T831] ? putname+0x27/0x150 [ 45.640322][ T831] ? do_sys_open+0x100/0x100 [ 45.640395][ T831] ? __cfi_do_mkdirat+0x10/0x10 [ 45.640479][ T831] __x64_sys_openat+0x13a/0x170 [ 45.640584][ T831] x64_sys_call+0xe69/0x2ee0 [ 45.640650][ T831] do_syscall_64+0x57/0xf0 [ 45.640706][ T831] ? clear_bhb_loop+0x50/0xa0 [ 45.640784][ T831] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 45.640860][ T831] RIP: 0033:0x7efd3939e559 [ 45.640922][ T831] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 45.640968][ T831] RSP: 002b:00007efd3a348028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 45.641037][ T831] RAX: ffffffffffffffda RBX: 00007efd39625fa0 RCX: 00007efd3939e559 [ 45.641081][ T831] RDX: 0000000000121301 RSI: 0000200000000340 RDI: ffffffffffffff9c [ 45.641124][ T831] RBP: 00007efd39435ab8 R08: 0000000000000000 R09: 0000000000000000 [ 45.641168][ T831] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 45.641208][ T831] R13: 00007efd39626038 R14: 00007efd39625fa0 R15: 00007fff47302d08 [ 45.641263][ T831] [ 45.641320][ T831] Mem-Info: [ 45.813267][ T311] usb 2-1: Using ep0 maxpacket: 32 [ 45.816166][ T831] active_anon:22277 inactive_anon:1 isolated_anon:0 [ 45.816166][ T831] active_file:19271 inactive_file:2305 isolated_file:0 [ 45.816166][ T831] unevictable:0 dirty:40 writeback:0 [ 45.816166][ T831] slab_reclaimable:5168 slab_unreclaimable:70242 [ 45.816166][ T831] mapped:24411 shmem:15638 pagetables:889 [ 45.816166][ T831] sec_pagetables:0 bounce:0 [ 45.816166][ T831] kernel_misc_reclaimable:0 [ 45.816166][ T831] free:1511196 free_pcp:1994 free_cma:0 [ 45.827286][ T311] usb 2-1: New USB device found, idVendor=0582, idProduct=0025, bcdDevice= 0.40 [ 45.829733][ T831] Node 0 active_anon:89108kB inactive_anon:4kB active_file:77084kB inactive_file:9220kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:97644kB dirty:160kB writeback:0kB shmem:62552kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:4576kB pagetables:3556kB sec_pagetables:0kB all_unreclaimable? no [ 45.835091][ T311] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 45.838747][ T831] DMA32 free:2949972kB boost:0kB min:19052kB low:23812kB high:28572kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:3145324kB managed:2955032kB mlocked:0kB bounce:0kB free_pcp:5060kB local_pcp:0kB free_cma:0kB [ 45.843694][ T311] usb 2-1: Product: syz [ 45.848358][ T831] lowmem_reserve[]: 0 [ 45.853254][ T311] usb 2-1: Manufacturer: syz [ 45.857300][ T831] 3920 [ 45.861950][ T311] usb 2-1: SerialNumber: syz [ 45.866590][ T831] 3920 [ 45.866609][ T831] Normal free:3094812kB boost:0kB min:26000kB low:32500kB high:39000kB reserved_highatomic:0KB free_highatomic:0KB active_anon:89108kB inactive_anon:4kB active_file:77084kB inactive_file:9220kB unevictable:0kB writepending:160kB present:5242880kB managed:4014840kB mlocked:0kB bounce:0kB free_pcp:2884kB local_pcp:1444kB free_cma:0kB [ 46.184741][ T831] lowmem_reserve[]: 0 0 0 [ 46.189100][ T831] DMA32: 5*4kB (M) 2*8kB (M) 5*16kB (M) 5*32kB (M) 3*64kB (M) 5*128kB (M) 5*256kB (M) 5*512kB (M) 4*1024kB (UM) 4*2048kB (M) 716*4096kB (M) = 2949972kB [ 46.204589][ T831] Normal: 56*4kB (UE) 204*8kB (M) 374*16kB (M) 474*32kB (UME) 384*64kB (UME) 86*128kB (UM) 43*256kB (UME) 18*512kB (UME) 11*1024kB (M) 11*2048kB (UME) 728*4096kB (UM) = 3094496kB [ 46.222541][ T831] 37212 total pagecache pages [ 46.227270][ T831] 2 pages in swap cache [ 46.231457][ T831] Free swap = 124444kB [ 46.235657][ T831] Total swap = 124996kB [ 46.239836][ T831] 2097051 pages RAM [ 46.243699][ T831] 0 pages HighMem/MovableOnly [ 46.248396][ T831] 354583 pages reserved [ 46.252552][ T831] 0 pages cma reserved [ 46.258814][ T831] Memory allocations: [ 46.262835][ T831] 0 B 0 init/main.c:1477 func:do_initcalls [ 46.270091][ T831] 0 B 0 init/do_mounts.c:186 func:mount_root_generic [ 46.278206][ T831] 0 B 0 init/do_mounts.c:158 func:do_mount_root [ 46.285892][ T831] 0 B 0 init/do_mounts.c:352 func:mount_nodev_root [ 46.293861][ T831] 0 B 0 init/do_mounts_rd.c:241 func:rd_load_image [ 46.301780][ T831] 0 B 0 init/do_mounts_rd.c:72 func:identify_ramdisk_image [ 46.310454][ T831] 0 B 0 init/initramfs.c:507 func:unpack_to_rootfs [ 46.318400][ T831] 0 B 0 init/initramfs.c:508 func:unpack_to_rootfs [ 46.326809][ T831] 0 B 0 init/initramfs.c:509 func:unpack_to_rootfs [ 46.334766][ T831] 0 B 0 init/initramfs.c:101 func:find_link [ 46.342154][ T831] ptm ptm0: ldisc open failed (-12), clearing slot 0 [ 46.364182][ T448] usb 1-1: config 0 interface 0 altsetting 4 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 46.375295][ T448] usb 1-1: config 0 interface 0 altsetting 4 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 46.388174][ T448] usb 1-1: config 0 interface 0 has no altsetting 0 [ 46.394979][ T448] usb 1-1: New USB device found, idVendor=0c12, idProduct=0030, bcdDevice= 0.00 [ 46.404076][ T448] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 46.412855][ T448] usb 1-1: config 0 descriptor?? [ 46.551572][ T31] usb 3-1: 2:0: failed to get current value for ch 0 (-71) [ 46.563201][ T31] snd-usb-audio 3-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 46.574570][ T31] usb 3-1: USB disconnect, device number 10 [ 46.636866][ T311] usb 2-1: 1:1: cannot get freq (v2/v3): err -32 [ 46.659969][ T434] udevd[434]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 46.820665][ T448] zeroplus 0003:0C12:0030.0002: unknown main item tag 0x7 [ 46.827912][ T448] zeroplus 0003:0C12:0030.0002: unknown main item tag 0x7 [ 46.836076][ T448] zeroplus 0003:0C12:0030.0002: hidraw0: USB HID v11.08 Device [HID 0c12:0030] on usb-dummy_hcd.0-1/input0 [ 46.847568][ T448] zeroplus 0003:0C12:0030.0002: no inputs found [ 46.870872][ T311] usb 2-1: 1:1: cannot get freq (v2/v3): err -71 [ 46.878883][ T311] usb 2-1: 2:1: cannot get freq (v2/v3): err -71 [ 46.888734][ T311] usb 2-1: 2:1: cannot set freq 44100 (v2/v3): err -71 [ 46.907808][ T311] usb 2-1: USB disconnect, device number 6 [ 46.930613][ T371] udevd[371]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 47.067833][ T36] kauditd_printk_skb: 34 callbacks suppressed [ 47.067852][ T36] audit: type=1400 audit(1792313300.780:266): avc: denied { create } for pid=839 comm="syz.3.115" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 47.096074][ T36] audit: type=1400 audit(1792313300.780:267): avc: denied { mounton } for pid=839 comm="syz.3.115" path="/30/file0" dev="tmpfs" ino=195 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 47.123065][ T36] audit: type=1400 audit(1792313300.830:268): avc: denied { create } for pid=839 comm="syz.3.115" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 47.372570][ T855] tipc: Started in network mode [ 47.377509][ T855] tipc: Node identity , cluster identity 4711 [ 47.383655][ T855] tipc: Failed to set node id, please configure manually [ 47.390707][ T855] tipc: Enabling of bearer rejected, failed to enable media [ 47.400245][ T855] tipc: Started in network mode [ 47.405254][ T855] tipc: Node identity ac14140f, cluster identity 4711 [ 47.412623][ T855] tipc: New replicast peer: 255.255.255.255 [ 47.418929][ T855] tipc: Enabled bearer , priority 10 [ 47.439995][ T855] netlink: 'syz.1.117': attribute type 150 has an invalid length. [ 47.448540][ T855] netlink: 12 bytes leftover after parsing attributes in process `syz.1.117'. [ 47.463168][ T448] usb 3-1: new high-speed USB device number 11 using dummy_hcd [ 47.584456][ T31] usb 1-1: USB disconnect, device number 6 [ 47.599311][ T864] input: syz1 as /devices/virtual/input/input7 [ 47.613482][ T448] usb 3-1: Using ep0 maxpacket: 32 [ 47.620166][ T448] usb 3-1: config 0 interface 0 altsetting 4 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 47.633620][ T448] usb 3-1: config 0 interface 0 has no altsetting 0 [ 47.640352][ T448] usb 3-1: New USB device found, idVendor=0458, idProduct=5013, bcdDevice= 0.00 [ 47.650724][ T448] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 47.660186][ T448] usb 3-1: config 0 descriptor?? [ 47.667910][ T448] usbhid 3-1:0.0: can't add hid device: -22 [ 47.674309][ T448] usbhid 3-1:0.0: probe with driver usbhid failed with error -22 [ 47.690645][ T36] audit: type=1400 audit(1792313301.400:269): avc: denied { getopt } for pid=869 comm="syz.0.121" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 47.691146][ T870] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 47.723681][ T36] audit: type=1400 audit(1792313301.440:270): avc: denied { map } for pid=869 comm="syz.0.121" path="socket:[7388]" dev="sockfs" ino=7388 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 47.748018][ T36] audit: type=1400 audit(1792313301.440:271): avc: denied { read } for pid=869 comm="syz.0.121" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 47.805813][ T36] audit: type=1400 audit(1792313301.520:272): avc: denied { unlink } for pid=297 comm="syz-executor" name="file0" dev="tmpfs" ino=195 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 47.847363][ T36] audit: type=1400 audit(1792313301.560:273): avc: denied { block_suspend } for pid=876 comm="syz.3.124" capability=36 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 48.143244][ T31] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 48.220924][ T885] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 48.229574][ T885] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 48.237914][ T36] audit: type=1400 audit(1792313301.950:274): avc: denied { ioctl } for pid=843 comm="syz.2.116" path="/dev/fuse" dev="devtmpfs" ino=23 ioctlcmd=0xe501 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 48.245224][ T853] process 'syz.2.116' launched './file0' with NULL argv: empty string added [ 48.294351][ T31] usb 4-1: config 0 interface 0 altsetting 5 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 48.304545][ T36] audit: type=1400 audit(1792313302.010:275): avc: denied { write } for pid=886 comm="syz.0.127" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 48.305596][ T31] usb 4-1: config 0 interface 0 has no altsetting 0 [ 48.331675][ T31] usb 4-1: New USB device found, idVendor=28bd, idProduct=0933, bcdDevice= 0.00 [ 48.348254][ T31] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 48.358316][ T31] usb 4-1: config 0 descriptor?? [ 48.411554][ T896] overlay: Unknown parameter 'pcr' [ 48.423423][ T457] tipc: Node number set to 2886997007 [ 48.569422][ T31] input: HID 28bd:0933 Mouse as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/0003:28BD:0933.0003/input/input8 [ 48.583838][ T31] uclogic 0003:28BD:0933.0003: input,hidraw0: USB HID v0.00 Mouse [HID 28bd:0933] on usb-dummy_hcd.3-1/input0 [ 48.603647][ T311] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 48.764227][ T311] usb 2-1: config 0 interface 0 altsetting 8 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 48.775266][ T311] usb 2-1: config 0 interface 0 altsetting 8 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 48.778759][ T31] usb 4-1: USB disconnect, device number 4 [ 48.795171][ T311] usb 2-1: config 0 interface 0 has no altsetting 0 [ 48.802034][ T311] usb 2-1: New USB device found, idVendor=04d8, idProduct=f002, bcdDevice= 0.00 [ 48.812945][ T311] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 48.823089][ T311] usb 2-1: config 0 descriptor?? [ 49.033816][ T891] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 49.042437][ T891] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 49.051837][ T891] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 49.060492][ T891] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 49.069329][ T891] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 49.078013][ T891] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 49.433217][ T31] usb 1-1: new full-speed USB device number 7 using dummy_hcd [ 49.543211][ T457] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 49.584679][ T31] usb 1-1: unable to get BOS descriptor or descriptor too short [ 49.592844][ T31] usb 1-1: not running at top speed; connect to a high speed hub [ 49.601427][ T31] usb 1-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 4 [ 49.614162][ T31] usb 1-1: New USB device found, idVendor=17cc, idProduct=1000, bcdDevice= 0.40 [ 49.623273][ T31] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 49.631290][ T31] usb 1-1: Product: syz [ 49.635509][ T31] usb 1-1: Manufacturer: syz [ 49.640145][ T31] usb 1-1: SerialNumber: syz [ 49.693202][ T457] usb 4-1: Using ep0 maxpacket: 16 [ 49.699623][ T457] usb 4-1: New USB device found, idVendor=05d1, idProduct=2001, bcdDevice=28.00 [ 49.709001][ T457] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 49.717997][ T457] usb 4-1: config 0 descriptor?? [ 49.726533][ T457] ftdi_sio 4-1:0.0: FTDI USB Serial Device converter detected [ 49.736609][ T457] usb 4-1: Detected FT2233HP [ 49.848075][ T905] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 49.856789][ T905] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 49.865987][ T905] overlay: ./file0 is not a directory [ 49.927043][ T457] ftdi_sio ttyUSB0: Unable to read latency timer: -32 [ 49.935163][ T457] usb 4-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 50.118160][ T448] usb 3-1: USB disconnect, device number 11 [ 50.144189][ T911] overlayfs: upperdir is in-use as upperdir/workdir of another mount, accessing files from both mounts will result in undefined behavior. [ 50.173269][ T911] overlayfs: workdir is in-use as upperdir/workdir of another mount, accessing files from both mounts will result in undefined behavior. [ 50.256369][ T408] Bluetooth: hci0: Frame reassembly failed (-84) [ 50.278594][ T31] snd-usb-audio 1-1:1.0: probe with driver snd-usb-audio failed with error -71 [ 50.288650][ T31] snd-usb-audio 1-1:1.1: probe with driver snd-usb-audio failed with error -71 [ 50.298813][ T31] snd-usb-audio 1-1:1.2: probe with driver snd-usb-audio failed with error -71 [ 50.308919][ T31] usb 1-1: USB disconnect, device number 7 [ 50.646363][ T973] fuseblk: Unknown parameter 'uid<00000000000000000000' [ 50.772695][ T986] ptm ptm4: ldisc open failed (-12), clearing slot 4 [ 51.383164][ T311] usbhid 2-1:0.0: can't add hid device: -71 [ 51.389190][ T311] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 51.400668][ T311] usb 2-1: USB disconnect, device number 7 [ 51.589273][ T997] mmap: syz.0.140 (997) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 51.637764][ T1001] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 51.783193][ T311] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 51.843228][ T987] ftdi_sio ttyUSB0: ftdi_set_termios urb failed to set baudrate [ 51.851199][ T987] ftdi_sio ttyUSB0: failed to set flow control: -32 [ 51.859121][ T906] ftdi_sio ttyUSB0: failed to get modem status: -32 [ 51.866156][ T906] ftdi_sio ttyUSB0: error from flowcontrol urb [ 51.872832][ T312] usb 4-1: USB disconnect, device number 5 [ 51.881739][ T312] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 51.891453][ T312] ftdi_sio 4-1:0.0: device disconnected [ 51.903219][ T457] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 51.943231][ T311] usb 2-1: Using ep0 maxpacket: 8 [ 51.950290][ T311] usb 2-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 64 [ 51.960197][ T311] usb 2-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 16 [ 52.054396][ T457] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 52.066871][ T457] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 1.00 [ 52.076026][ T457] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 52.084127][ T457] usb 1-1: Product: syz [ 52.088332][ T457] usb 1-1: Manufacturer: syz [ 52.092957][ T457] usb 1-1: SerialNumber: syz [ 52.100980][ T457] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 52.107056][ T457] cdc_wdm 1-1:1.0: Unknown control protocol [ 52.299512][ T36] kauditd_printk_skb: 7 callbacks suppressed [ 52.299529][ T36] audit: type=1400 audit(1792313306.010:283): avc: denied { read write } for pid=1002 comm="syz.0.142" name="cdc-wdm0" dev="devtmpfs" ino=521 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:modem_device_t tclass=chr_file permissive=1 [ 52.323290][ T55] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 52.329380][ T562] Bluetooth: hci0: command 0x1003 tx timeout [ 52.341533][ T36] audit: type=1400 audit(1792313306.010:284): avc: denied { open } for pid=1002 comm="syz.0.142" path="/dev/cdc-wdm0" dev="devtmpfs" ino=521 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:modem_device_t tclass=chr_file permissive=1 [ 52.633182][ T457] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 52.783176][ T457] usb 4-1: Using ep0 maxpacket: 32 [ 52.789424][ T457] usb 4-1: config 1 interface 0 altsetting 16 bulk endpoint 0x1 has invalid maxpacket 8 [ 52.799335][ T457] usb 4-1: config 1 interface 0 altsetting 16 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 52.812561][ T457] usb 4-1: config 1 interface 0 has no altsetting 0 [ 52.820701][ T457] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 52.829898][ T457] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 52.837986][ T457] usb 4-1: Product: syz [ 52.842240][ T457] usb 4-1: Manufacturer: syz [ 52.846905][ T457] usb 4-1: SerialNumber: syz [ 52.852510][ T31] usb 1-1: USB disconnect, device number 8 [ 52.860839][ T1011] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 53.081455][ T457] usb 4-1: USB disconnect, device number 6 [ 53.106703][ T1022] FAULT_INJECTION: forcing a failure. [ 53.106703][ T1022] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 53.119905][ T1022] CPU: 0 UID: 0 PID: 1022 Comm: syz.2.148 Not tainted syzkaller #0 bcd0852b9269e5a174a9e289c8567167f3c3d1d7 [ 53.119931][ T1022] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 53.119942][ T1022] Call Trace: [ 53.119948][ T1022] [ 53.119955][ T1022] __dump_stack+0x21/0x30 [ 53.119988][ T1022] dump_stack_lvl+0x140/0x1c0 [ 53.120013][ T1022] ? __cfi_dump_stack_lvl+0x10/0x10 [ 53.120041][ T1022] dump_stack+0x19/0x20 [ 53.120064][ T1022] should_fail_ex+0x3c2/0x510 [ 53.120081][ T1022] should_fail+0xf/0x20 [ 53.120094][ T1022] should_fail_usercopy+0x1e/0x30 [ 53.120111][ T1022] _copy_from_iter+0x56d/0x1520 [ 53.120132][ T1022] ? __cfi__copy_from_iter+0x10/0x10 [ 53.120150][ T1022] ? __check_object_size+0x54c/0x870 [ 53.120174][ T1022] ? __cfi___check_object_size+0x10/0x10 [ 53.120198][ T1022] ? skb_put+0x10e/0x200 [ 53.120216][ T1022] netlink_sendmsg+0x66d/0xad0 [ 53.120238][ T1022] ? __cfi_netlink_sendmsg+0x10/0x10 [ 53.120260][ T1022] ? bpf_lsm_socket_sendmsg+0xd/0x20 [ 53.120285][ T1022] ? security_socket_sendmsg+0x3d/0x100 [ 53.120305][ T1022] ? __cfi_netlink_sendmsg+0x10/0x10 [ 53.120327][ T1022] sock_write_iter+0x445/0x490 [ 53.120351][ T1022] ? __cfi_sock_write_iter+0x10/0x10 [ 53.120377][ T1022] ? selinux_file_permission+0x8a4/0xb60 [ 53.120401][ T1022] do_iter_readv_writev+0x629/0x820 [ 53.120426][ T1022] ? vfs_iter_read+0x5e0/0x5e0 [ 53.120452][ T1022] ? bpf_lsm_file_permission+0xd/0x20 [ 53.120468][ T1022] vfs_writev+0x4a5/0xe90 [ 53.120486][ T1022] ? do_writev+0x2e0/0x2e0 [ 53.120501][ T1022] ? vfs_write+0xbcf/0xfd0 [ 53.120528][ T1022] do_writev+0x151/0x2e0 [ 53.120544][ T1022] ? vfs_readv+0xa00/0xa00 [ 53.120560][ T1022] ? __kasan_check_write+0x18/0x20 [ 53.120582][ T1022] ? fpregs_restore_userregs+0x11c/0x260 [ 53.120606][ T1022] __x64_sys_writev+0x81/0x90 [ 53.120630][ T1022] x64_sys_call+0x1fbb/0x2ee0 [ 53.120647][ T1022] do_syscall_64+0x57/0xf0 [ 53.120661][ T1022] ? clear_bhb_loop+0x50/0xa0 [ 53.120681][ T1022] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 53.120701][ T1022] RIP: 0033:0x7f228d79e559 [ 53.120715][ T1022] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 53.120728][ T1022] RSP: 002b:00007f228e659028 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 [ 53.120745][ T1022] RAX: ffffffffffffffda RBX: 00007f228da25fa0 RCX: 00007f228d79e559 [ 53.120758][ T1022] RDX: 0000000000000003 RSI: 0000200000000140 RDI: 0000000000000006 [ 53.120768][ T1022] RBP: 00007f228d835ab8 R08: 0000000000000000 R09: 0000000000000000 [ 53.120778][ T1022] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 53.120788][ T1022] R13: 00007f228da26038 R14: 00007f228da25fa0 R15: 00007fff6ce02528 [ 53.120802][ T1022] [ 53.408338][ T36] audit: type=1400 audit(1792313307.120:285): avc: denied { bind } for pid=1024 comm="syz.0.149" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 53.410620][ T1025] capability: warning: `syz.0.149' uses deprecated v2 capabilities in a way that may be insecure [ 53.592542][ T36] audit: type=1400 audit(1792313307.300:286): avc: denied { accept } for pid=1041 comm="syz.3.152" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_route_socket permissive=1 [ 53.622481][ T36] audit: type=1326 audit(1792313307.330:287): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1043 comm="syz.3.153" exe="/root/ci2-android-6-12-rust/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7efd3939e559 code=0x0 [ 53.676149][ T36] audit: type=1326 audit(1792313307.390:288): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1043 comm="syz.3.153" exe="/root/ci2-android-6-12-rust/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7efd3939e559 code=0x0 [ 53.713192][ T312] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 53.874339][ T312] usb 1-1: config 0 interface 0 altsetting 5 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 53.885386][ T312] usb 1-1: config 0 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 53.898286][ T312] usb 1-1: config 0 interface 0 has no altsetting 0 [ 53.904995][ T312] usb 1-1: New USB device found, idVendor=06a3, idProduct=0cd0, bcdDevice= 0.00 [ 53.914139][ T312] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 53.922909][ T312] usb 1-1: config 0 descriptor?? [ 53.963203][ T31] usb 3-1: new high-speed USB device number 12 using dummy_hcd [ 54.113181][ T31] usb 3-1: Using ep0 maxpacket: 32 [ 54.119564][ T31] usb 3-1: config 0 interface 0 altsetting 68 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 54.132550][ T31] usb 3-1: config 0 interface 0 has no altsetting 0 [ 54.139228][ T31] usb 3-1: New USB device found, idVendor=0757, idProduct=0a00, bcdDevice= 0.00 [ 54.148358][ T31] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 54.157292][ T31] usb 3-1: config 0 descriptor?? [ 54.334747][ T312] input: HID 06a3:0cd0 as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/0003:06A3:0CD0.0004/input/input9 [ 54.352123][ T312] saitek 0003:06A3:0CD0.0004: input,hiddev96,hidraw0: USB HID v0.00 Device [HID 06a3:0cd0] on usb-dummy_hcd.0-1/input0 [ 54.364337][ T1051] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 54.379870][ T1051] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 54.389318][ T1051] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 54.398820][ T1051] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 54.409353][ T1051] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 54.423316][ T1051] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 54.441059][ T311] usb 2-1: string descriptor 0 read error: -71 [ 54.450812][ T1051] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 54.464582][ T311] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 54.474140][ T311] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 54.480465][ T1051] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 54.490354][ T311] usb 2-1: can't set config #1, error -71 [ 54.499649][ T1051] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 54.509547][ T1051] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 54.515822][ T311] usb 2-1: USB disconnect, device number 8 [ 54.540159][ T31] nti 0003:0757:0A00.0005: hidraw1: USB HID v10.01 Device [HID 0757:0a00] on usb-dummy_hcd.2-1/input0 [ 54.973209][ T311] usb 2-1: new full-speed USB device number 9 using dummy_hcd [ 55.050796][ T36] audit: type=1400 audit(1792313308.760:289): avc: denied { bind } for pid=1065 comm="syz.3.158" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 55.086175][ T1069] netlink: 68 bytes leftover after parsing attributes in process `syz.3.159'. [ 55.096649][ T468] usb 1-1: USB disconnect, device number 9 [ 55.134460][ T311] usb 2-1: config 1 has an invalid interface number: 1 but max is 0 [ 55.142540][ T311] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 55.152707][ T311] usb 2-1: config 1 has no interface number 0 [ 55.158927][ T311] usb 2-1: config 1 interface 1 altsetting 0 endpoint 0xC has an invalid bInterval 0, changing to 10 [ 55.169944][ T311] usb 2-1: config 1 interface 1 altsetting 0 endpoint 0xC has invalid wMaxPacketSize 0 [ 55.181296][ T311] usb 2-1: New USB device found, idVendor=1a86, idProduct=752d, bcdDevice= 0.40 [ 55.190453][ T311] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=2 [ 55.198580][ T311] usb 2-1: Product: syz [ 55.202754][ T311] usb 2-1: Manufacturer: syz [ 55.207403][ T311] usb 2-1: SerialNumber: syz [ 55.422989][ T311] usb 2-1: USB disconnect, device number 9 [ 55.435620][ T510] udevd[510]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.1/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 55.677463][ T1076] netlink: 4 bytes leftover after parsing attributes in process `syz.0.161'. [ 55.686517][ T1076] netlink: 4 bytes leftover after parsing attributes in process `syz.0.161'. [ 55.948254][ T36] audit: type=1400 audit(1792313309.660:290): avc: denied { remount } for pid=1080 comm="syz.1.163" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 56.243205][ T31] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 56.363199][ T45] usb 2-1: new full-speed USB device number 10 using dummy_hcd [ 56.393186][ T31] usb 4-1: Using ep0 maxpacket: 32 [ 56.399629][ T31] usb 4-1: config 0 has an invalid interface number: 67 but max is 0 [ 56.408563][ T31] usb 4-1: config 0 has no interface number 0 [ 56.416571][ T31] usb 4-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 56.426028][ T31] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 56.434486][ T31] usb 4-1: Product: syz [ 56.438894][ T31] usb 4-1: Manufacturer: syz [ 56.443820][ T31] usb 4-1: SerialNumber: syz [ 56.450969][ T31] usb 4-1: config 0 descriptor?? [ 56.458324][ T31] smsc95xx v2.0.0 [ 56.503192][ T45] usb 2-1: device descriptor read/64, error -71 [ 56.731473][ T468] usb 3-1: USB disconnect, device number 12 [ 56.743647][ T45] usb 2-1: device descriptor read/64, error -71 [ 56.756205][ T1092] FAULT_INJECTION: forcing a failure. [ 56.756205][ T1092] name failslab, interval 1, probability 0, space 0, times 0 [ 56.769193][ T1092] CPU: 0 UID: 0 PID: 1092 Comm: syz.2.166 Not tainted syzkaller #0 bcd0852b9269e5a174a9e289c8567167f3c3d1d7 [ 56.769230][ T1092] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 56.769245][ T1092] Call Trace: [ 56.769253][ T1092] [ 56.769261][ T1092] __dump_stack+0x21/0x30 [ 56.769301][ T1092] dump_stack_lvl+0x140/0x1c0 [ 56.769335][ T1092] ? __cfi_dump_stack_lvl+0x10/0x10 [ 56.769369][ T1092] ? vfs_write+0xbcf/0xfd0 [ 56.769401][ T1092] dump_stack+0x19/0x20 [ 56.769433][ T1092] should_fail_ex+0x3c2/0x510 [ 56.769456][ T1092] ? __se_sys_memfd_create+0x2cb/0x8f0 [ 56.769488][ T1092] should_failslab+0xac/0x100 [ 56.769508][ T1092] __kmalloc_noprof+0x69/0x510 [ 56.769536][ T1092] ? __se_sys_futex+0x13c/0x320 [ 56.769560][ T1092] ? __se_sys_memfd_create+0x2cb/0x8f0 [ 56.769592][ T1092] ? strnlen_user+0xaa/0x180 [ 56.769615][ T1092] __se_sys_memfd_create+0x2cb/0x8f0 [ 56.769647][ T1092] ? __x64_sys_memfd_create+0x80/0x80 [ 56.769680][ T1092] ? __kasan_check_write+0x18/0x20 [ 56.769712][ T1092] __x64_sys_memfd_create+0x5f/0x80 [ 56.769744][ T1092] x64_sys_call+0x29f8/0x2ee0 [ 56.769769][ T1092] do_syscall_64+0x57/0xf0 [ 56.769789][ T1092] ? clear_bhb_loop+0x50/0xa0 [ 56.769818][ T1092] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 56.769843][ T1092] RIP: 0033:0x7f228d79e559 [ 56.769863][ T1092] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 56.769884][ T1092] RSP: 002b:00007f228e659028 EFLAGS: 00000246 ORIG_RAX: 000000000000013f [ 56.769909][ T1092] RAX: ffffffffffffffda RBX: 00007f228da25fa0 RCX: 00007f228d79e559 [ 56.769927][ T1092] RDX: 0000000000000000 RSI: 0000000000000002 RDI: 00002000000003c0 [ 56.769943][ T1092] RBP: 00007f228d835ab8 R08: 0000000000000000 R09: 0000000000000000 [ 56.769958][ T1092] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 56.769972][ T1092] R13: 00007f228da26038 R14: 00007f228da25fa0 R15: 00007fff6ce02528 [ 56.769992][ T1092] [ 56.859127][ T31] smsc95xx 4-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -32 [ 56.985624][ T31] smsc95xx 4-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 57.113221][ T45] usb 2-1: new full-speed USB device number 11 using dummy_hcd [ 57.153189][ T468] usb 3-1: new full-speed USB device number 13 using dummy_hcd [ 57.195475][ T31] smsc95xx 4-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -61 [ 57.206346][ T31] smsc95xx 4-1:0.67: probe with driver smsc95xx failed with error -61 [ 57.243216][ T45] usb 2-1: device descriptor read/64, error -71 [ 57.304405][ T468] usb 3-1: config 17 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 57.316146][ T468] usb 3-1: config 17 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 57.327326][ T468] usb 3-1: config 17 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 64 [ 57.339286][ T468] usb 3-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.00 [ 57.348395][ T468] usb 3-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 57.356467][ T468] usb 3-1: Manufacturer: syz [ 57.362039][ T1092] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 57.493221][ T45] usb 2-1: device descriptor read/64, error -71 [ 57.587978][ T1092] FAULT_INJECTION: forcing a failure. [ 57.587978][ T1092] name failslab, interval 1, probability 0, space 0, times 0 [ 57.597438][ T1095] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 57.610095][ T45] usb usb2-port1: attempt power cycle [ 57.611408][ T1092] CPU: 0 UID: 0 PID: 1092 Comm: syz.2.166 Not tainted syzkaller #0 bcd0852b9269e5a174a9e289c8567167f3c3d1d7 [ 57.611488][ T1092] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 57.611531][ T1092] Call Trace: [ 57.611551][ T1092] [ 57.611572][ T1092] __dump_stack+0x21/0x30 [ 57.611693][ T1092] dump_stack_lvl+0x140/0x1c0 [ 57.611794][ T1092] ? __cfi_dump_stack_lvl+0x10/0x10 [ 57.611894][ T1092] ? vfs_write+0xbcf/0xfd0 [ 57.611991][ T1092] dump_stack+0x19/0x20 [ 57.612067][ T1092] should_fail_ex+0x3c2/0x510 [ 57.612124][ T1092] ? __se_sys_memfd_create+0x2cb/0x8f0 [ 57.612203][ T1092] should_failslab+0xac/0x100 [ 57.612265][ T1092] __kmalloc_noprof+0x69/0x510 [ 57.612344][ T1092] ? __se_sys_futex+0x13c/0x320 [ 57.612401][ T1092] ? __se_sys_memfd_create+0x2cb/0x8f0 [ 57.612473][ T1092] ? strnlen_user+0xaa/0x180 [ 57.612527][ T1092] __se_sys_memfd_create+0x2cb/0x8f0 [ 57.612611][ T1092] ? __x64_sys_memfd_create+0x80/0x80 [ 57.612688][ T1092] ? __kasan_check_write+0x18/0x20 [ 57.612769][ T1092] __x64_sys_memfd_create+0x5f/0x80 [ 57.612844][ T1092] x64_sys_call+0x29f8/0x2ee0 [ 57.612906][ T1092] do_syscall_64+0x57/0xf0 [ 57.612962][ T1092] ? clear_bhb_loop+0x50/0xa0 [ 57.613054][ T1092] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 57.613143][ T1092] RIP: 0033:0x7f228d79e559 [ 57.613196][ T1092] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 57.613248][ T1092] RSP: 002b:00007f228e659028 EFLAGS: 00000246 ORIG_RAX: 000000000000013f [ 57.613314][ T1092] RAX: ffffffffffffffda RBX: 00007f228da25fa0 RCX: 00007f228d79e559 [ 57.613359][ T1092] RDX: 0000000000000000 RSI: 0000000000000002 RDI: 00002000000003c0 [ 57.613394][ T1092] RBP: 00007f228d835ab8 R08: 0000000000000000 R09: 0000000000000000 [ 57.613431][ T1092] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 57.613466][ T1092] R13: 00007f228da26038 R14: 00007f228da25fa0 R15: 00007fff6ce02528 [ 57.613512][ T1092] [ 57.660245][ T1095] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 57.826108][ T468] aiptek 3-1:17.0: Aiptek using 400 ms programming speed [ 57.834038][ T468] input: Aiptek as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:17.0/input/input10 [ 57.845667][ T468] usb 3-1: USB disconnect, device number 13 [ 57.845679][ C1] aiptek 3-1:17.0: aiptek_irq - usb_submit_urb failed with result -19 [ 58.023201][ T45] usb 2-1: new full-speed USB device number 12 using dummy_hcd [ 58.044203][ T45] usb 2-1: device descriptor read/8, error -71 [ 58.184556][ T45] usb 2-1: device descriptor read/8, error -71 [ 58.370974][ T1106] netlink: 4 bytes leftover after parsing attributes in process `syz.2.168'. [ 58.380080][ T1107] netlink: 4 bytes leftover after parsing attributes in process `syz.2.168'. [ 58.392207][ T1107] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=1107 comm=syz.2.168 [ 58.403559][ T1106] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=1106 comm=syz.2.168 [ 58.406036][ T1107] netlink: 8 bytes leftover after parsing attributes in process `syz.2.168'. [ 58.433204][ T45] usb 2-1: new full-speed USB device number 13 using dummy_hcd [ 58.464354][ T45] usb 2-1: device descriptor read/8, error -71 [ 58.604344][ T45] usb 2-1: device descriptor read/8, error -71 [ 58.713336][ T45] usb usb2-port1: unable to enumerate USB device [ 58.767077][ T36] audit: type=1400 audit(1792313312.480:291): avc: denied { relabelfrom } for pid=1120 comm="syz.0.173" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tun_socket permissive=1 [ 58.786894][ T36] audit: type=1400 audit(1792313312.480:292): avc: denied { relabelto } for pid=1120 comm="syz.0.173" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tun_socket permissive=1 [ 58.813425][ T31] usb 3-1: new high-speed USB device number 14 using dummy_hcd [ 58.973246][ T31] usb 3-1: Using ep0 maxpacket: 16 [ 58.979745][ T31] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 58.990964][ T31] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 59.000809][ T31] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 59.013857][ T31] usb 3-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 59.023183][ T31] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 59.043307][ T31] usb 3-1: config 0 descriptor?? [ 59.094654][ T468] usb 4-1: USB disconnect, device number 7 [ 59.198247][ T1139] FAULT_INJECTION: forcing a failure. [ 59.198247][ T1139] name failslab, interval 1, probability 0, space 0, times 0 [ 59.211279][ T1139] CPU: 0 UID: 0 PID: 1139 Comm: syz.3.178 Not tainted syzkaller #0 bcd0852b9269e5a174a9e289c8567167f3c3d1d7 [ 59.211325][ T1139] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 59.211353][ T1139] Call Trace: [ 59.211362][ T1139] [ 59.211370][ T1139] __dump_stack+0x21/0x30 [ 59.211415][ T1139] dump_stack_lvl+0x140/0x1c0 [ 59.211453][ T1139] ? __cfi_dump_stack_lvl+0x10/0x10 [ 59.211492][ T1139] ? gfp_to_alloc_flags_cma+0x96/0x1c0 [ 59.211527][ T1139] ? __alloc_pages_noprof+0x35a/0x7e0 [ 59.211558][ T1139] dump_stack+0x19/0x20 [ 59.211593][ T1139] should_fail_ex+0x3c2/0x510 [ 59.211619][ T1139] should_failslab+0xac/0x100 [ 59.211643][ T1139] __kmalloc_cache_node_noprof+0x46/0x430 [ 59.211678][ T1139] ? __vmap_pages_range_noflush+0xaa8/0xb80 [ 59.211708][ T1139] ? __get_vm_area_node+0x150/0x390 [ 59.211738][ T1139] __get_vm_area_node+0x150/0x390 [ 59.211776][ T1139] __vmalloc_node_range_noprof+0x340/0x1300 [ 59.211808][ T1139] ? n_tty_open+0x38/0x1d0 [ 59.211842][ T1139] ? _raw_spin_lock_irqsave+0xc1/0x160 [ 59.211867][ T1139] ? __cfi___vmalloc_node_range_noprof+0x10/0x10 [ 59.211899][ T1139] ? class_find_device+0x318/0x390 [ 59.211936][ T1139] ? __cfi_device_match_devt+0x10/0x10 [ 59.211973][ T1139] ? __cfi_class_find_device+0x10/0x10 [ 59.212012][ T1139] ? n_tty_open+0x38/0x1d0 [ 59.212038][ T1139] vzalloc_noprof+0x103/0x1d0 [ 59.212069][ T1139] ? n_tty_open+0x38/0x1d0 [ 59.212095][ T1139] ? __cfi_vzalloc_noprof+0x10/0x10 [ 59.212126][ T1139] ? __kasan_check_write+0x18/0x20 [ 59.212158][ T1139] ? up_write+0x66/0x280 [ 59.212187][ T1139] n_tty_open+0x38/0x1d0 [ 59.212213][ T1139] tty_ldisc_setup+0x1d9/0x370 [ 59.212249][ T1139] tty_init_dev+0x28b/0x4f0 [ 59.212285][ T1139] ptmx_open+0xe1/0x2f0 [ 59.212311][ T1139] ? selinux_file_open+0x46c/0x630 [ 59.212347][ T1139] chrdev_open+0x4eb/0x610 [ 59.212384][ T1139] ? __cfi_chrdev_open+0x10/0x10 [ 59.212422][ T1139] ? bpf_lsm_file_open+0xd/0x20 [ 59.212448][ T1139] ? __cfi_chrdev_open+0x10/0x10 [ 59.212483][ T1139] do_dentry_open+0x97c/0x1510 [ 59.212514][ T1139] vfs_open+0x86/0x240 [ 59.212540][ T1139] ? __cfi_vfs_open+0x10/0x10 [ 59.212568][ T1139] ? may_open+0x352/0x430 [ 59.212593][ T1139] path_openat+0x2c49/0x35a0 [ 59.212622][ T1139] ? kasan_save_alloc_info+0x3a/0x50 [ 59.212654][ T1139] ? getname+0x1b/0x30 [ 59.212689][ T1139] ? x64_sys_call+0xe69/0x2ee0 [ 59.212714][ T1139] ? do_syscall_64+0x57/0xf0 [ 59.212738][ T1139] ? do_filp_open+0x440/0x440 [ 59.212775][ T1139] do_filp_open+0x1f2/0x440 [ 59.212803][ T1139] ? __cfi_do_filp_open+0x10/0x10 [ 59.212833][ T1139] ? alloc_fd+0x4c1/0x570 [ 59.212872][ T1139] do_sys_openat2+0x134/0x1d0 [ 59.212902][ T1139] ? do_sys_open+0x100/0x100 [ 59.212932][ T1139] __x64_sys_openat+0x13a/0x170 [ 59.212963][ T1139] x64_sys_call+0xe69/0x2ee0 [ 59.212987][ T1139] do_syscall_64+0x57/0xf0 [ 59.213009][ T1139] ? clear_bhb_loop+0x50/0xa0 [ 59.213040][ T1139] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 59.213070][ T1139] RIP: 0033:0x7efd3939e559 [ 59.213091][ T1139] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 59.213117][ T1139] RSP: 002b:00007efd3a348028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 59.213145][ T1139] RAX: ffffffffffffffda RBX: 00007efd39625fa0 RCX: 00007efd3939e559 [ 59.213162][ T1139] RDX: 0000000000121301 RSI: 00002000000003c0 RDI: ffffffffffffff9c [ 59.213182][ T1139] RBP: 00007efd39435ab8 R08: 0000000000000000 R09: 0000000000000000 [ 59.213198][ T1139] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 59.213214][ T1139] R13: 00007efd39626038 R14: 00007efd39625fa0 R15: 00007fff47302d08 [ 59.213236][ T1139] [ 59.580947][ T1139] warn_alloc: 1 callbacks suppressed [ 59.580985][ T1139] syz.3.178: vmalloc error: size 8936, vm_struct allocation failed, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=syz3,mems_allowed=0 [ 59.608275][ T1139] CPU: 0 UID: 0 PID: 1139 Comm: syz.3.178 Not tainted syzkaller #0 bcd0852b9269e5a174a9e289c8567167f3c3d1d7 [ 59.608312][ T1139] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 59.608329][ T1139] Call Trace: [ 59.608337][ T1139] [ 59.608346][ T1139] __dump_stack+0x21/0x30 [ 59.608388][ T1139] dump_stack_lvl+0x140/0x1c0 [ 59.608425][ T1139] ? __cfi_dump_stack_lvl+0x10/0x10 [ 59.608462][ T1139] ? _raw_spin_unlock_irqrestore+0x4a/0x70 [ 59.608488][ T1139] dump_stack+0x19/0x20 [ 59.608522][ T1139] warn_alloc+0x1e7/0x2c0 [ 59.608550][ T1139] ? __kasan_kmalloc+0x28/0xb0 [ 59.608573][ T1139] ? __cfi_warn_alloc+0x10/0x10 [ 59.608599][ T1139] ? __get_vm_area_node+0x150/0x390 [ 59.608628][ T1139] ? __get_vm_area_node+0x382/0x390 [ 59.608656][ T1139] __vmalloc_node_range_noprof+0x365/0x1300 [ 59.608693][ T1139] ? _raw_spin_lock_irqsave+0xc1/0x160 [ 59.608715][ T1139] ? __cfi___vmalloc_node_range_noprof+0x10/0x10 [ 59.608745][ T1139] ? class_find_device+0x318/0x390 [ 59.608781][ T1139] ? __cfi_device_match_devt+0x10/0x10 [ 59.608816][ T1139] ? __cfi_class_find_device+0x10/0x10 [ 59.608854][ T1139] ? n_tty_open+0x38/0x1d0 [ 59.608879][ T1139] vzalloc_noprof+0x103/0x1d0 [ 59.608908][ T1139] ? n_tty_open+0x38/0x1d0 [ 59.608934][ T1139] ? __cfi_vzalloc_noprof+0x10/0x10 [ 59.608964][ T1139] ? __kasan_check_write+0x18/0x20 [ 59.608995][ T1139] ? up_write+0x66/0x280 [ 59.609022][ T1139] n_tty_open+0x38/0x1d0 [ 59.609048][ T1139] tty_ldisc_setup+0x1d9/0x370 [ 59.609083][ T1139] tty_init_dev+0x28b/0x4f0 [ 59.609117][ T1139] ptmx_open+0xe1/0x2f0 [ 59.609143][ T1139] ? selinux_file_open+0x46c/0x630 [ 59.609177][ T1139] chrdev_open+0x4eb/0x610 [ 59.609212][ T1139] ? __cfi_chrdev_open+0x10/0x10 [ 59.609254][ T1139] ? bpf_lsm_file_open+0xd/0x20 [ 59.609281][ T1139] ? __cfi_chrdev_open+0x10/0x10 [ 59.609312][ T1139] do_dentry_open+0x97c/0x1510 [ 59.609340][ T1139] vfs_open+0x86/0x240 [ 59.609365][ T1139] ? __cfi_vfs_open+0x10/0x10 [ 59.609391][ T1139] ? may_open+0x352/0x430 [ 59.609416][ T1139] path_openat+0x2c49/0x35a0 [ 59.609443][ T1139] ? kasan_save_alloc_info+0x3a/0x50 [ 59.609473][ T1139] ? getname+0x1b/0x30 [ 59.609507][ T1139] ? x64_sys_call+0xe69/0x2ee0 [ 59.609530][ T1139] ? do_syscall_64+0x57/0xf0 [ 59.609554][ T1139] ? do_filp_open+0x440/0x440 [ 59.609581][ T1139] do_filp_open+0x1f2/0x440 [ 59.609607][ T1139] ? __cfi_do_filp_open+0x10/0x10 [ 59.609638][ T1139] ? alloc_fd+0x4c1/0x570 [ 59.609674][ T1139] do_sys_openat2+0x134/0x1d0 [ 59.609703][ T1139] ? do_sys_open+0x100/0x100 [ 59.609731][ T1139] __x64_sys_openat+0x13a/0x170 [ 59.609761][ T1139] x64_sys_call+0xe69/0x2ee0 [ 59.609784][ T1139] do_syscall_64+0x57/0xf0 [ 59.609805][ T1139] ? clear_bhb_loop+0x50/0xa0 [ 59.609835][ T1139] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 59.609863][ T1139] RIP: 0033:0x7efd3939e559 [ 59.609884][ T1139] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 59.609905][ T1139] RSP: 002b:00007efd3a348028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 59.609932][ T1139] RAX: ffffffffffffffda RBX: 00007efd39625fa0 RCX: 00007efd3939e559 [ 59.609951][ T1139] RDX: 0000000000121301 RSI: 00002000000003c0 RDI: ffffffffffffff9c [ 59.609969][ T1139] RBP: 00007efd39435ab8 R08: 0000000000000000 R09: 0000000000000000 [ 59.609985][ T1139] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 59.610000][ T1139] R13: 00007efd39626038 R14: 00007efd39625fa0 R15: 00007fff47302d08 [ 59.610024][ T1139] [ 59.610121][ T1139] Mem-Info: [ 59.780415][ T36] audit: type=1400 audit(1792313313.490:293): avc: denied { create } for pid=1147 comm="syz.1.179" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 59.844417][ T1139] active_anon:22670 inactive_anon:1 isolated_anon:0 [ 59.844417][ T1139] active_file:20341 inactive_file:2311 isolated_file:0 [ 59.844417][ T1139] unevictable:0 dirty:65 writeback:0 [ 59.844417][ T1139] slab_reclaimable:5885 slab_unreclaimable:70851 [ 59.844417][ T1139] mapped:25639 shmem:15658 pagetables:1045 [ 59.844417][ T1139] sec_pagetables:3 bounce:0 [ 59.844417][ T1139] kernel_misc_reclaimable:0 [ 59.844417][ T1139] free:1499336 free_pcp:7137 free_cma:0 [ 59.898020][ T36] audit: type=1400 audit(1792313313.530:294): avc: denied { getopt } for pid=1147 comm="syz.1.179" lport=58 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 59.911171][ T1139] Node 0 active_anon:90880kB inactive_anon:4kB active_file:81364kB inactive_file:9244kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:102556kB dirty:260kB writeback:0kB shmem:62632kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:6440kB pagetables:4280kB sec_pagetables:12kB all_unreclaimable? no [ 60.081579][ T1139] DMA32 free:2949972kB boost:0kB min:19052kB low:23812kB high:28572kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:3145324kB managed:2955032kB mlocked:0kB bounce:0kB free_pcp:5060kB local_pcp:0kB free_cma:0kB [ 60.113257][ T1139] lowmem_reserve[]: 0 3920 3920 [ 60.118424][ T1139] Normal free:3046824kB boost:0kB min:26000kB low:32500kB high:39000kB reserved_highatomic:0KB free_highatomic:0KB active_anon:90916kB inactive_anon:4kB active_file:81364kB inactive_file:9244kB unevictable:0kB writepending:348kB present:5242880kB managed:4014840kB mlocked:0kB bounce:0kB free_pcp:23964kB local_pcp:5780kB free_cma:0kB [ 60.118610][ T31] usbhid 3-1:0.0: can't add hid device: -71 [ 60.149776][ T1139] lowmem_reserve[]: 0 0 0 [ 60.160098][ T1139] DMA32: 5*4kB (M) 2*8kB (M) 5*16kB (M) 5*32kB (M) 3*64kB (M) 5*128kB (M) 5*256kB (M) 5*512kB (M) 4*1024kB (UM) 4*2048kB (M) 716*4096kB (M) = 2949972kB [ 60.171366][ T31] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 60.183438][ T1139] Normal: 2*4kB (ME) 1*8kB (U) 70*16kB (UM) 64*32kB (M) 416*64kB (UME) 46*128kB (UM) 30*256kB (M) 14*512kB (M) 12*1024kB (UM) 5*2048kB (UM) 726*4096kB (UM) = 3046768kB [ 60.202026][ T1139] 38292 total pagecache pages [ 60.209808][ T31] usb 3-1: USB disconnect, device number 14 [ 60.217759][ T1139] 2 pages in swap cache [ 60.221965][ T1139] Free swap = 124444kB [ 60.230615][ T1139] Total swap = 124996kB [ 60.234948][ T1139] 2097051 pages RAM [ 60.239045][ T1139] 0 pages HighMem/MovableOnly [ 60.243876][ T1139] 354583 pages reserved [ 60.248204][ T1139] 0 pages cma reserved [ 60.257176][ T1139] Memory allocations: [ 60.261282][ T1139] 0 B 0 init/main.c:1477 func:do_initcalls [ 60.268853][ T1139] 0 B 0 init/do_mounts.c:186 func:mount_root_generic [ 60.277032][ T1139] 0 B 0 init/do_mounts.c:158 func:do_mount_root [ 60.284929][ T1139] 0 B 0 init/do_mounts.c:352 func:mount_nodev_root [ 60.292922][ T1139] 0 B 0 init/do_mounts_rd.c:241 func:rd_load_image [ 60.301101][ T1139] 0 B 0 init/do_mounts_rd.c:72 func:identify_ramdisk_image [ 60.309997][ T1139] 0 B 0 init/initramfs.c:507 func:unpack_to_rootfs [ 60.318167][ T1139] 0 B 0 init/initramfs.c:508 func:unpack_to_rootfs [ 60.326280][ T1139] 0 B 0 init/initramfs.c:509 func:unpack_to_rootfs [ 60.334380][ T1139] 0 B 0 init/initramfs.c:101 func:find_link [ 60.341917][ T1139] ptm ptm0: ldisc open failed (-12), clearing slot 0 [ 60.367002][ T1155] fuse: Bad value for 'user_id' [ 60.372035][ T1155] fuse: Bad value for 'user_id' [ 60.481734][ T36] audit: type=1400 audit(1792313314.190:295): avc: denied { append } for pid=1160 comm="syz.0.183" name="001" dev="devtmpfs" ino=108 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 60.913190][ T31] usb 3-1: new full-speed USB device number 15 using dummy_hcd [ 60.958466][ T36] audit: type=1400 audit(1792313314.670:296): avc: denied { ioctl } for pid=1181 comm="syz.1.190" path="socket:[10367]" dev="sockfs" ino=10367 ioctlcmd=0x9418 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 61.076736][ T31] usb 3-1: config 0 has an invalid interface number: 41 but max is 0 [ 61.097295][ T31] usb 3-1: config 0 has no interface number 0 [ 61.107435][ T31] usb 3-1: config 0 interface 41 has no altsetting 0 [ 61.121065][ T31] usb 3-1: New USB device found, idVendor=0fe6, idProduct=9800, bcdDevice=d1.9a [ 61.131088][ T31] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 61.144730][ T31] usb 3-1: Product: syz [ 61.154186][ T1191] syzkaller0: default qdisc (pfifo_fast) fail, fallback to noqueue [ 61.154532][ T31] usb 3-1: Manufacturer: syz [ 61.180255][ T31] usb 3-1: SerialNumber: syz [ 61.190087][ T31] usb 3-1: config 0 descriptor?? [ 61.218068][ T1193] FAULT_INJECTION: forcing a failure. [ 61.218068][ T1193] name failslab, interval 1, probability 0, space 0, times 0 [ 61.244742][ T1193] CPU: 0 UID: 0 PID: 1193 Comm: syz.1.193 Not tainted syzkaller #0 bcd0852b9269e5a174a9e289c8567167f3c3d1d7 [ 61.244781][ T1193] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 61.244797][ T1193] Call Trace: [ 61.244805][ T1193] [ 61.244813][ T1193] __dump_stack+0x21/0x30 [ 61.244852][ T1193] dump_stack_lvl+0x140/0x1c0 [ 61.244885][ T1193] ? __cfi_dump_stack_lvl+0x10/0x10 [ 61.244923][ T1193] dump_stack+0x19/0x20 [ 61.244957][ T1193] should_fail_ex+0x3c2/0x510 [ 61.244979][ T1193] ? realloc_user_queue+0xcc/0x420 [ 61.245010][ T1193] should_failslab+0xac/0x100 [ 61.245032][ T1193] __kmalloc_noprof+0x69/0x510 [ 61.245064][ T1193] ? kasan_save_alloc_info+0x3a/0x50 [ 61.245094][ T1193] ? realloc_user_queue+0xcc/0x420 [ 61.245122][ T1193] ? __kasan_kmalloc+0x96/0xb0 [ 61.245144][ T1193] realloc_user_queue+0xcc/0x420 [ 61.245172][ T1193] ? __kasan_check_write+0x18/0x20 [ 61.245203][ T1193] ? __cfi_snd_timer_user_open+0x10/0x10 [ 61.245232][ T1193] snd_timer_user_open+0x10e/0x230 [ 61.245269][ T1193] ? snd_open+0x30a/0x3a0 [ 61.245301][ T1193] ? __cfi_snd_timer_user_open+0x10/0x10 [ 61.245331][ T1193] snd_open+0x324/0x3a0 [ 61.245362][ T1193] chrdev_open+0x4eb/0x610 [ 61.245397][ T1193] ? __cfi_chrdev_open+0x10/0x10 [ 61.245430][ T1193] ? bpf_lsm_file_open+0xd/0x20 [ 61.245454][ T1193] ? __cfi_chrdev_open+0x10/0x10 [ 61.245486][ T1193] do_dentry_open+0x97c/0x1510 [ 61.245515][ T1193] vfs_open+0x86/0x240 [ 61.245540][ T1193] ? __cfi_vfs_open+0x10/0x10 [ 61.245566][ T1193] ? may_open+0x352/0x430 [ 61.245591][ T1193] path_openat+0x2c49/0x35a0 [ 61.245618][ T1193] ? kasan_save_alloc_info+0x3a/0x50 [ 61.245647][ T1193] ? getname+0x1b/0x30 [ 61.245679][ T1193] ? x64_sys_call+0xe69/0x2ee0 [ 61.245702][ T1193] ? do_syscall_64+0x57/0xf0 [ 61.245725][ T1193] ? do_filp_open+0x440/0x440 [ 61.245751][ T1193] do_filp_open+0x1f2/0x440 [ 61.245776][ T1193] ? __cfi_do_filp_open+0x10/0x10 [ 61.245805][ T1193] ? alloc_fd+0x4c1/0x570 [ 61.245841][ T1193] do_sys_openat2+0x134/0x1d0 [ 61.245868][ T1193] ? fput+0x1a4/0x230 [ 61.245893][ T1193] ? do_sys_open+0x100/0x100 [ 61.245922][ T1193] __x64_sys_openat+0x13a/0x170 [ 61.245951][ T1193] x64_sys_call+0xe69/0x2ee0 [ 61.245974][ T1193] do_syscall_64+0x57/0xf0 [ 61.245995][ T1193] ? clear_bhb_loop+0x50/0xa0 [ 61.246023][ T1193] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 61.246050][ T1193] RIP: 0033:0x7f4b52f9e559 [ 61.246069][ T1193] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 61.246089][ T1193] RSP: 002b:00007f4b53e73028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 61.246115][ T1193] RAX: ffffffffffffffda RBX: 00007f4b53225fa0 RCX: 00007f4b52f9e559 [ 61.246134][ T1193] RDX: 0000000000000000 RSI: 00002000000004c0 RDI: ffffffffffffff9c [ 61.246150][ T1193] RBP: 00007f4b53035ab8 R08: 0000000000000000 R09: 0000000000000000 [ 61.246166][ T1193] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 61.246181][ T1193] R13: 00007f4b53226038 R14: 00007f4b53225fa0 R15: 00007ffd150cab28 [ 61.246202][ T1193] [ 61.623494][ T1194] FAULT_INJECTION: forcing a failure. [ 61.623494][ T1194] name fail_futex, interval 1, probability 0, space 0, times 1 [ 61.645896][ T1194] CPU: 1 UID: 0 PID: 1194 Comm: syz.1.193 Not tainted syzkaller #0 bcd0852b9269e5a174a9e289c8567167f3c3d1d7 [ 61.645948][ T1194] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 61.645966][ T1194] Call Trace: [ 61.645974][ T1194] [ 61.645989][ T1194] __dump_stack+0x21/0x30 [ 61.646036][ T1194] dump_stack_lvl+0x140/0x1c0 [ 61.646080][ T1194] ? __cfi_dump_stack_lvl+0x10/0x10 [ 61.646128][ T1194] dump_stack+0x19/0x20 [ 61.646170][ T1194] should_fail_ex+0x3c2/0x510 [ 61.646202][ T1194] should_fail+0xf/0x20 [ 61.646230][ T1194] get_futex_key+0x178/0x940 [ 61.646258][ T1194] ? __cfi_get_futex_key+0x10/0x10 [ 61.646288][ T1194] ? __asan_set_shadow_00+0x12/0x20 [ 61.646323][ T1194] ? userfaultfd_ioctl+0x684/0x45c0 [ 61.646371][ T1194] futex_wait_setup+0xae/0x260 [ 61.646410][ T1194] ? __cfi_futex_wait_setup+0x10/0x10 [ 61.646448][ T1194] ? __asan_memcpy+0x5a/0x80 [ 61.646487][ T1194] __futex_wait+0x12c/0x3d0 [ 61.646524][ T1194] ? __cfi___futex_wait+0x10/0x10 [ 61.646562][ T1194] ? __cfi_futex_wake_mark+0x10/0x10 [ 61.646599][ T1194] ? __kasan_check_read+0x15/0x20 [ 61.646637][ T1194] ? futex_wake+0x627/0x950 [ 61.646675][ T1194] futex_wait+0x128/0x7c0 [ 61.646721][ T1194] ? __cfi_futex_wait+0x10/0x10 [ 61.646759][ T1194] ? selinux_file_ioctl+0x732/0x1480 [ 61.646799][ T1194] ? __cfi_userfaultfd_unmap_complete+0x10/0x10 [ 61.646842][ T1194] ? __cfi_selinux_file_ioctl+0x10/0x10 [ 61.646883][ T1194] do_futex+0x32a/0x510 [ 61.646914][ T1194] ? __cfi_do_futex+0x10/0x10 [ 61.646946][ T1194] ? vm_mmap_pgoff+0x152/0x4b0 [ 61.646987][ T1194] __se_sys_futex+0x13c/0x320 [ 61.647019][ T1194] ? __x64_sys_futex+0x110/0x110 [ 61.647050][ T1194] ? __kasan_check_write+0x18/0x20 [ 61.647094][ T1194] __x64_sys_futex+0xe9/0x110 [ 61.647127][ T1194] x64_sys_call+0x227f/0x2ee0 [ 61.647156][ T1194] do_syscall_64+0x57/0xf0 [ 61.647184][ T1194] ? clear_bhb_loop+0x50/0xa0 [ 61.647221][ T1194] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 61.647256][ T1194] RIP: 0033:0x7f4b52f9e559 [ 61.647317][ T1194] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 61.647344][ T1194] RSP: 002b:00007f4b53e520e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 61.647376][ T1194] RAX: ffffffffffffffda RBX: 00007f4b53226098 RCX: 00007f4b52f9e559 [ 61.647398][ T1194] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f4b53226098 [ 61.647419][ T1194] RBP: 00007f4b53226090 R08: 0000000000000000 R09: 0000000000000000 [ 61.647441][ T1194] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 61.647460][ T1194] R13: 00007f4b53226128 R14: 00007ffd150caa40 R15: 00007ffd150cab28 [ 61.647488][ T1194] [ 61.961643][ T31] CoreChips 3-1:0.41 (unnamed net_device) (uninitialized): set LINK LED failed : -71 [ 61.971312][ T31] CoreChips 3-1:0.41: probe with driver CoreChips failed with error -71 [ 61.981692][ T31] usb 3-1: USB disconnect, device number 15 [ 62.053188][ T45] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 62.203191][ T45] usb 4-1: Using ep0 maxpacket: 32 [ 62.209611][ T45] usb 4-1: config 0 interface 0 altsetting 68 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 62.222602][ T45] usb 4-1: config 0 interface 0 has no altsetting 0 [ 62.229266][ T45] usb 4-1: New USB device found, idVendor=0757, idProduct=0a00, bcdDevice= 0.00 [ 62.238351][ T45] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 62.246986][ T45] usb 4-1: config 0 descriptor?? [ 62.516991][ T1210] kvm: kvm [1209]: vcpu0, guest rIP: 0x9134 Unhandled WRMSR(0x11e) = 0xbe702111 [ 62.612461][ T36] audit: type=1400 audit(1792313316.320:297): avc: denied { accept } for pid=1218 comm="syz.1.199" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=udp_socket permissive=1 [ 62.662340][ T45] nti 0003:0757:0A00.0006: hidraw0: USB HID v10.01 Device [HID 0757:0a00] on usb-dummy_hcd.3-1/input0 [ 62.803257][ T31] usb 3-1: new high-speed USB device number 16 using dummy_hcd [ 62.864870][ T457] usb 4-1: USB disconnect, device number 8 [ 62.893257][ T448] usb 2-1: new high-speed USB device number 14 using dummy_hcd [ 62.963933][ T31] usb 3-1: Using ep0 maxpacket: 16 [ 62.970416][ T31] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 62.981522][ T31] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x2 has an invalid bInterval 0, changing to 7 [ 62.993003][ T31] usb 3-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 5 [ 63.005990][ T31] usb 3-1: New USB device found, idVendor=057e, idProduct=2019, bcdDevice= 0.00 [ 63.015086][ T31] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 63.023899][ T31] usb 3-1: config 0 descriptor?? [ 63.064361][ T448] usb 2-1: config 2 has an invalid interface number: 43 but max is 0 [ 63.072546][ T448] usb 2-1: config 2 has no interface number 0 [ 63.078741][ T448] usb 2-1: config 2 interface 43 altsetting 13 bulk endpoint 0x1 has invalid maxpacket 64 [ 63.088727][ T448] usb 2-1: config 2 interface 43 altsetting 13 has an endpoint descriptor with address 0xA5, changing to 0x85 [ 63.100465][ T448] usb 2-1: config 2 interface 43 altsetting 13 bulk endpoint 0x85 has invalid maxpacket 8 [ 63.110439][ T448] usb 2-1: config 2 interface 43 has no altsetting 0 [ 63.118582][ T448] usb 2-1: New USB device found, idVendor=0781, idProduct=0005, bcdDevice= 0.05 [ 63.127706][ T448] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 63.135784][ T448] usb 2-1: Product: syz [ 63.139984][ T448] usb 2-1: Manufacturer: syz [ 63.144660][ T448] usb 2-1: SerialNumber: syz [ 63.150776][ T1226] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 63.158079][ T1226] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 63.367987][ T448] ums-usbat 2-1:2.43: USB Mass Storage device detected [ 63.375879][ T448] ums-usbat 2-1:2.43: Quirks match for vid 0781 pid 0005: 1 [ 63.424331][ T448] ums-usbat 2-1:2.43: probe with driver ums-usbat failed with error -5 [ 63.440856][ T31] nintendo 0003:057E:2019.0007: unknown main item tag 0x0 [ 63.448734][ T448] usb 2-1: USB disconnect, device number 14 [ 63.454889][ T31] nintendo 0003:057E:2019.0007: unknown main item tag 0x0 [ 63.463194][ T31] nintendo 0003:057E:2019.0007: unknown main item tag 0x0 [ 63.471361][ T31] nintendo 0003:057E:2019.0007: unknown main item tag 0x0 [ 63.478828][ T31] nintendo 0003:057E:2019.0007: unknown main item tag 0x0 [ 63.487041][ T31] nintendo 0003:057E:2019.0007: hidraw0: USB HID v80.05 Device [HID 057e:2019] on usb-dummy_hcd.2-1/input0 [ 63.638277][ C1] usb 3-1: input irq status -75 received [ 63.973245][ T448] usb 4-1: new high-speed USB device number 9 using dummy_hcd [ 64.016843][ T1253] netlink: 'syz.0.207': attribute type 4 has an invalid length. [ 64.038864][ T1210] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=56627 sclass=netlink_xfrm_socket pid=1210 comm=syz.2.197 [ 64.067378][ T31] nintendo 0003:057E:2019.0007: Failed to get joycon info; ret=-71 [ 64.080751][ T31] nintendo 0003:057E:2019.0007: Failed to retrieve controller info; ret=-71 [ 64.090521][ T31] nintendo 0003:057E:2019.0007: Failed to initialize controller; ret=-71 [ 64.104761][ T31] nintendo 0003:057E:2019.0007: probe - fail = -71 [ 64.111573][ T31] nintendo 0003:057E:2019.0007: probe with driver nintendo failed with error -71 [ 64.126534][ T31] usb 3-1: USB disconnect, device number 16 [ 64.133168][ T448] usb 4-1: Using ep0 maxpacket: 16 [ 64.144611][ T448] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 64.155763][ T448] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 96 [ 64.166034][ T448] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 8 [ 64.176674][ T448] usb 4-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 18 [ 64.191142][ T448] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 64.200621][ T448] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 64.208869][ T448] usb 4-1: SerialNumber: syz [ 64.215279][ T1244] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 64.222504][ T1244] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 64.230988][ T448] hub 4-1:1.0: bad descriptor, ignoring hub [ 64.237010][ T448] hub 4-1:1.0: probe with driver hub failed with error -5 [ 64.333187][ T45] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 64.423170][ T36] audit: type=1400 audit(1792313318.130:298): avc: denied { connect } for pid=1256 comm="syz.1.209" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 64.443461][ T1244] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 64.450730][ T1244] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 64.458312][ T36] audit: type=1400 audit(1792313318.130:299): avc: denied { ioctl } for pid=1256 comm="syz.1.209" path="/42/file0/.pending_reads" dev="incremental-fs" ino=2 ioctlcmd=0x671e scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 64.514430][ T45] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 64.524980][ T45] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 64.534794][ T45] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 0 [ 64.544834][ T45] usb 1-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 64.557913][ T45] usb 1-1: New USB device found, idVendor=067b, idProduct=2303, bcdDevice= 1.00 [ 64.567042][ T45] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 64.578596][ T45] pl2303 1-1:1.0: required endpoints missing [ 64.723201][ T457] usb 2-1: new high-speed USB device number 15 using dummy_hcd [ 64.780408][ T1265] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 64.797941][ T1265] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 64.816614][ T45] usb 1-1: USB disconnect, device number 10 [ 64.859750][ T36] audit: type=1400 audit(1792313318.570:300): avc: denied { nlmsg_write } for pid=1269 comm="syz.2.213" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_audit_socket permissive=1 [ 64.884789][ T457] usb 2-1: config 0 has an invalid descriptor of length 1, skipping remainder of the config [ 64.898178][ T1244] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 64.900273][ T457] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 32 [ 64.912923][ T1244] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 64.924345][ T36] audit: type=1400 audit(1792313318.640:301): avc: denied { write } for pid=1243 comm="syz.3.204" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=key permissive=1 [ 64.939900][ T457] usb 2-1: config 0 has no interface number 0 [ 64.949626][ T457] usb 2-1: config 0 interface 3 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 9 [ 64.965405][ T448] cdc_ether 4-1:1.0 usb0: register 'cdc_ether' at usb-dummy_hcd.3-1, CDC Ethernet Device, 42:42:42:42:42:42 [ 64.974774][ T457] usb 2-1: New USB device found, idVendor=0eef, idProduct=72c4, bcdDevice= 0.00 [ 64.986292][ T457] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 65.004534][ T457] usb 2-1: SerialNumber: syz [ 65.010574][ T457] usb 2-1: config 0 descriptor?? [ 65.213898][ C0] cdc_ether 4-1:1.0 usb0: CDC: unexpected notification 68! [ 65.222072][ C0] cdc_ether 4-1:1.0 usb0: CDC: unexpected notification 03! [ 65.229492][ C0] cdc_ether 4-1:1.0 usb0: CDC: unexpected notification 10! [ 65.246902][ T36] audit: type=1400 audit(1792313318.960:302): avc: denied { create } for pid=1289 comm="syz.2.215" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ax25_socket permissive=1 [ 65.261755][ T1290] netlink: 32 bytes leftover after parsing attributes in process `syz.2.215'. [ 65.278864][ T36] audit: type=1400 audit(1792313318.970:303): avc: denied { setopt } for pid=1289 comm="syz.2.215" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 65.302918][ T36] audit: type=1400 audit(1792313318.970:304): avc: denied { bind } for pid=1289 comm="syz.2.215" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 65.323564][ T36] audit: type=1400 audit(1792313319.010:305): avc: denied { associate } for pid=1289 comm="syz.2.215" name="blkio.bfq.io_merged_recursive" scontext=root:object_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 65.360618][ T36] audit: type=1400 audit(1792313319.010:306): avc: denied { mounton } for pid=1289 comm="syz.2.215" path="/proc/219/task" dev="proc" ino=10899 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=dir permissive=1 [ 65.447652][ T457] usb 4-1: USB disconnect, device number 9 [ 65.455256][ T457] cdc_ether 4-1:1.0 usb0: unregister 'cdc_ether' usb-dummy_hcd.3-1, CDC Ethernet Device [ 65.853241][ T468] usb 1-1: new high-speed USB device number 11 using dummy_hcd [ 65.939947][ T1323] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 65.949277][ T1323] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 66.002736][ T36] audit: type=1400 audit(1792313319.710:307): avc: denied { bind } for pid=1258 comm="syz.1.210" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 66.034700][ T468] usb 1-1: Using ep0 maxpacket: 32 [ 66.040746][ T1324] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 66.053582][ T1324] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 66.063728][ T468] usb 1-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 176, changing to 7 [ 66.080471][ T468] usb 1-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 220, changing to 7 [ 66.113389][ T468] usb 1-1: New USB device found, idVendor=0e41, idProduct=4153, bcdDevice= 0.40 [ 66.131291][ T468] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 66.149759][ T468] usb 1-1: Product: 晶ᖎ纗怘쬭‶྆ಪᶳ礝鷳큖爻Ŝ䎯▲☀峏揰ፚ೵徘ᴡڦ颸⽿⓼ [ 66.174854][ T468] usb 1-1: Manufacturer: 獶᡼⛻刾ǘ刺偫續ى罅脃귭⯭齙プ埈뢳縭깕悔П毯⪏᜙樽텑學줺궙㺜ȕ䦪풐ɮ欸಩ॺᩁፀ劶ꢈ몘툓쪘ঐ뮇 [ 66.211641][ T468] usb 1-1: SerialNumber: 䀊 [ 66.433691][ T468] usb 1-1: Audio class v2/v3 interfaces need an interface association [ 66.453368][ T468] snd-usb-audio 1-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 66.480017][ T434] udevd[434]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 66.497814][ T468] usb 1-1: USB disconnect, device number 11 [ 66.903169][ T312] usb 4-1: new full-speed USB device number 10 using dummy_hcd [ 66.993836][ T1342] drivers/android/binder/thread.rs:1806: 55 callbacks suppressed [ 66.993857][ T1342] rust_binder: Write failure EINVAL in pid:228 [ 67.023992][ T468] hid-generic 0000:0000:0000.0008: unknown main item tag 0x0 [ 67.043173][ T312] usb 4-1: device descriptor read/64, error -71 [ 67.049594][ T468] hid-generic 0000:0000:0000.0008: hidraw0: HID v0.00 Device [syz1] on syz0 [ 67.129362][ T1345] hid-generic 0000:0000:0000.0008: pid 1345 passed too large report [ 67.293198][ T312] usb 4-1: device descriptor read/64, error -71 [ 67.413221][ T468] usb 1-1: new high-speed USB device number 12 using dummy_hcd [ 67.533245][ T312] usb 4-1: new full-speed USB device number 11 using dummy_hcd [ 67.564756][ T468] usb 1-1: unable to get BOS descriptor or descriptor too short [ 67.573238][ T468] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 67.583428][ T468] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 67.586816][ T45] usb 2-1: USB disconnect, device number 15 [ 67.601113][ T468] usb 1-1: New USB device found, idVendor=0590, idProduct=004c, bcdDevice= 0.40 [ 67.614507][ T468] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 67.622549][ T468] usb 1-1: Product: syz [ 67.627012][ T468] usb 1-1: Manufacturer: syz [ 67.631804][ T468] usb 1-1: SerialNumber: syz [ 67.673206][ T312] usb 4-1: device descriptor read/64, error -71 [ 67.886995][ T468] usb 1-1: USB disconnect, device number 12 [ 67.913372][ T312] usb 4-1: device descriptor read/64, error -71 [ 67.945316][ T1368] netlink: 140 bytes leftover after parsing attributes in process `syz.1.234'. [ 68.033275][ T312] usb usb4-port1: attempt power cycle [ 68.053169][ T311] usb 3-1: new full-speed USB device number 17 using dummy_hcd [ 68.062296][ T1375] cgroup: fork rejected by pids controller in /syz1 [ 68.204242][ T311] usb 3-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 53, changing to 4 [ 68.215270][ T311] usb 3-1: config 1 interface 2 altsetting 1 endpoint 0x82 has invalid maxpacket 1568, setting to 1023 [ 68.234558][ T311] usb 3-1: New USB device found, idVendor=0582, idProduct=00b2, bcdDevice= 0.40 [ 68.243922][ T311] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 68.251956][ T311] usb 3-1: Product: syz [ 68.256340][ T311] usb 3-1: Manufacturer: syz [ 68.261008][ T311] usb 3-1: SerialNumber: syz [ 68.373228][ T312] usb 4-1: new full-speed USB device number 12 using dummy_hcd [ 68.402797][ T312] usb 4-1: device descriptor read/8, error -71 [ 68.534183][ T312] usb 4-1: device descriptor read/8, error -71 [ 68.773175][ T312] usb 4-1: new full-speed USB device number 13 using dummy_hcd [ 68.794911][ T312] usb 4-1: device descriptor read/8, error -71 [ 68.925621][ T312] usb 4-1: device descriptor read/8, error -71 [ 69.015583][ T1459] usercopy: Kernel memory exposure attempt detected from SLUB object 'kmalloc-96' (offset 0, size 512)! [ 69.043332][ T1459] ------------[ cut here ]------------ [ 69.048974][ T1459] kernel BUG at mm/usercopy.c:103! [ 69.053764][ T312] usb usb4-port1: unable to enumerate USB device [ 69.055981][ T1459] Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI [ 69.067432][ T1459] CPU: 1 UID: 0 PID: 1459 Comm: syz.1.240 Not tainted syzkaller #0 bcd0852b9269e5a174a9e289c8567167f3c3d1d7 [ 69.078950][ T1459] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 69.089052][ T1459] RIP: 0010:usercopy_abort+0x89/0x90 [ 69.094387][ T1459] Code: 89 cb 49 c7 c6 60 11 37 86 4c 0f 44 f6 48 c7 c7 00 10 37 86 4c 89 de 4c 89 c9 4d 89 d1 50 53 41 56 e8 1b 75 ff ff 48 83 c4 18 <0f> 0b cc cc cc cc cc b8 02 bb da cf 90 90 90 90 90 90 90 90 90 90 [ 69.114042][ T1459] RSP: 0018:ffffc90010fefad0 EFLAGS: 00010292 [ 69.120157][ T1459] RAX: 0000000000000065 RBX: 0000000000000000 RCX: 385e28a68e537200 [ 69.128182][ T1459] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000002 [ 69.136246][ T1459] RBP: ffffc90010fefae0 R08: ffffc90010fef7a7 R09: 1ffff920021fdef4 [ 69.144663][ T1459] R10: dffffc0000000000 R11: fffff520021fdef5 R12: ffff888100041280 [ 69.152679][ T1459] R13: 0000000000000001 R14: ffffffff86371160 R15: 0000000000000000 [ 69.160696][ T1459] FS: 00007f4b53e316c0(0000) GS:ffff8881f6d00000(0000) knlGS:0000000000000000 [ 69.169788][ T1459] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 69.176425][ T1459] CR2: 0000200000001000 CR3: 000000013fd5a000 CR4: 00000000003526b0 [ 69.184450][ T1459] Call Trace: [ 69.187766][ T1459] [ 69.190736][ T1459] __check_heap_object+0xc7/0x110 [ 69.195820][ T1459] __check_object_size+0x29a/0x870 [ 69.200991][ T1459] ? __cfi___check_object_size+0x10/0x10 [ 69.206719][ T1459] ? __kmalloc_noprof+0x240/0x510 [ 69.211802][ T1459] ? __cfi_software_key_eds_op+0x10/0x10 [ 69.217493][ T1459] ? asymmetric_key_eds_op+0x119/0x150 [ 69.222994][ T1459] keyctl_pkey_e_d_s+0x252/0x3b0 [ 69.228030][ T1459] ? __cfi_keyctl_pkey_e_d_s+0x10/0x10 [ 69.233552][ T1459] __se_sys_keyctl+0x780/0xe40 [ 69.238359][ T1459] ? __x64_sys_keyctl+0xf0/0xf0 [ 69.243250][ T1459] ? __cfi_do_futex+0x10/0x10 [ 69.248019][ T1459] ? kvfree_sensitive+0x51/0x70 [ 69.252928][ T1459] ? __se_sys_futex+0x13c/0x320 [ 69.257822][ T1459] ? __x64_sys_futex+0x110/0x110 [ 69.262817][ T1459] ? __kasan_check_write+0x18/0x20 [ 69.268034][ T1459] ? fpregs_restore_userregs+0x11c/0x260 [ 69.273719][ T1459] __x64_sys_keyctl+0xc3/0xf0 [ 69.278447][ T1459] x64_sys_call+0x996/0x2ee0 [ 69.283091][ T1459] do_syscall_64+0x57/0xf0 [ 69.287552][ T1459] ? clear_bhb_loop+0x50/0xa0 [ 69.292284][ T1459] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 69.298233][ T1459] RIP: 0033:0x7f4b52f9e559 [ 69.302703][ T1459] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 69.322381][ T1459] RSP: 002b:00007f4b53e31028 EFLAGS: 00000246 ORIG_RAX: 00000000000000fa [ 69.330849][ T1459] RAX: ffffffffffffffda RBX: 00007f4b53226180 RCX: 00007f4b52f9e559 [ 69.338872][ T1459] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000019 [ 69.346913][ T1459] RBP: 00007f4b53035ab8 R08: 0000000000000000 R09: 0000000000000000 [ 69.354937][ T1459] R10: 00002000000013c0 R11: 0000000000000246 R12: 0000000000000000 [ 69.362959][ T1459] R13: 00007f4b53226218 R14: 00007f4b53226180 R15: 00007ffd150cab28 [ 69.370977][ T1459] [ 69.374039][ T1459] Modules linked in: [ 69.378239][ T1459] ---[ end trace 0000000000000000 ]--- [ 69.384847][ T1459] RIP: 0010:usercopy_abort+0x89/0x90 [ 69.390274][ T1459] Code: 89 cb 49 c7 c6 60 11 37 86 4c 0f 44 f6 48 c7 c7 00 10 37 86 4c 89 de 4c 89 c9 4d 89 d1 50 53 41 56 e8 1b 75 ff ff 48 83 c4 18 <0f> 0b cc cc cc cc cc b8 02 bb da cf 90 90 90 90 90 90 90 90 90 90 [ 69.410144][ T1459] RSP: 0018:ffffc90010fefad0 EFLAGS: 00010292 [ 69.417023][ T1459] RAX: 0000000000000065 RBX: 0000000000000000 RCX: 385e28a68e537200 [ 69.425246][ T1459] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000002 [ 69.433361][ T1459] RBP: ffffc90010fefae0 R08: ffffc90010fef7a7 R09: 1ffff920021fdef4 [ 69.451633][ T1459] R10: dffffc0000000000 R11: fffff520021fdef5 R12: ffff888100041280 [ 69.459876][ T1459] R13: 0000000000000001 R14: ffffffff86371160 R15: 0000000000000000 [ 69.468218][ T1459] FS: 00007f4b53e316c0(0000) GS:ffff8881f6d00000(0000) knlGS:0000000000000000 [ 69.477332][ T1459] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 69.484100][ T1459] CR2: 00007f8f945f17f8 CR3: 000000013fd5a000 CR4: 00000000003526b0 [ 69.492307][ T1459] Kernel panic - not syncing: Fatal exception [ 69.499013][ T1459] Kernel Offset: disabled [ 69.503366][ T1459] Rebooting in 86400 seconds..