last executing test programs: 4.235009457s ago: executing program 2 (id=265): r0 = syz_usb_connect(0x5, 0x39, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000200000040109710780001010200010902270001010080320904000003ff000000070581020002000705010200020007058203"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$uac2(r0, 0x0, &(0x7f0000000a80)={0x44, &(0x7f0000000780)={0x40, 0x30, 0x1, "b7"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$uac2(r0, 0x0, 0x0) 1.211038731s ago: executing program 3 (id=309): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x80102, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = eventfd2(0xe5c, 0x80000) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f0000000040)={0x4}) r3 = eventfd2(0x42000006, 0x801) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000240)={r3, 0x7, 0x2, r2}) r4 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f0000000600)={0x0, 0x0, @pic={0x9, 0xc0, 0x5, 0x7, 0x7f, 0x0, 0x1, 0x9, 0x1, 0x41, 0x3, 0x58, 0x7, 0x5, 0xb, 0x7f}}) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f00000002c0)={[0xcb, 0xe, 0x2000000000004, 0x80000000000006d, 0x1f, 0x4000000001002, 0x80000ef, 0x4, 0x7fffffffffffb, 0x8d, 0x8, 0x3, 0xfffffffffffffffe, 0x0, 0x7, 0xbdf], 0x60000, 0x67a64fa265da9e56}) ioctl$KVM_RUN(r4, 0xae80, 0x0) 1.210877251s ago: executing program 2 (id=310): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000180)=@file={0x0, './bus\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) epoll_create1(0x0) socket$inet6(0xa, 0x2, 0x0) poll(&(0x7f0000000140)=[{r1, 0x2cfc08c20dafc34e}], 0x1, 0x8000007) 1.095375573s ago: executing program 3 (id=311): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pnp/devices/00:04/resources\x00', 0x2, 0x0) read$FUSE(r0, &(0x7f0000000240)={0x2020}, 0x2020) 1.080405414s ago: executing program 3 (id=312): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e22, 0x9, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0xb}}, 0x3}, 0x1c) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x4e22, 0x7, @ipv4={'\x00', '\xff\xff', @empty}, 0x2}, 0x1c) r1 = fcntl$dupfd(r0, 0x0, r0) sendmsg$NL80211_CMD_SET_INTERFACE(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000e40)=ANY=[], 0x20}, 0x1, 0x0, 0x0, 0x4880}, 0x1) recvmmsg$unix(r1, &(0x7f00000021c0)=[{{&(0x7f0000001f80)=@abs, 0x6e, 0x0, 0x0, &(0x7f0000002180)}}], 0x1, 0x141, 0x0) 1.023390946s ago: executing program 0 (id=313): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_SET(r1, 0x0, 0x4008000) sendmsg$IPCTNL_MSG_CT_DELETE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000001c0)=ANY=[@ANYBLOB="2c0000000201010400000000000000000a0000041800018014000180080001006401010108fc01"], 0x2c}, 0x1, 0x0, 0x0, 0x8010}, 0x4) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) connect$unix(0xffffffffffffffff, &(0x7f00000002c0)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f00000029c0)={0x0, 0x31000000, &(0x7f0000000100)={&(0x7f0000000040)={0x1c, 0x10, 0x701, 0x0, 0x0, {0xa}, [@typed={0x6, 0x1, 0x0, 0x0, @str='\x15\x00'}]}, 0x1c}}, 0x0) 1.023086835s ago: executing program 3 (id=315): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=ANY=[@ANYBLOB="18000000260001031dbd7002fadbdf25010000000400ae"], 0x18}}, 0x0) recvmmsg(r3, &(0x7f0000008d80)=[{{0x0, 0x0, &(0x7f00000015c0)}, 0x8}, {{0x0, 0x0, 0x0}, 0x3}, {{0x0, 0x0, 0x0}, 0x2}, {{0x0, 0x0, 0x0}, 0xfffffffd}, {{0x0, 0x0, 0x0}, 0xff}], 0x5, 0x0, 0x0) 660.159844ms ago: executing program 0 (id=318): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x800000, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CAP_EXIT_HYPERCALL(r1, 0x4068aea3, &(0x7f0000000040)={0x79, 0x0, 0xc}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe2000/0x18000)=nil, &(0x7f00000000c0)=[@text32={0x20, 0x0}], 0x1, 0x3, 0x0, 0x0) ioctl$KVM_CAP_HALT_POLL(r1, 0x4068aea3, &(0x7f00000005c0)={0xb6, 0x0, 0x80055e}) ioctl$KVM_SET_LAPIC(r2, 0x4400ae8f, &(0x7f00000001c0)={"c718ae3ddd25e4c2826499cb6a055b56a5a7336f377a556f824db28eb6743cf045afd0e932534b9eb3b847abbcef63c85319991745999ed89ff49783a84d57cf175a89f8733d74a1bdddcb0a6c3f7535e7976e79da1b52de6403f6710d606fafaf685ec19f369b7829b12aa2b8cd2ab52f9c688683979cdb9516cb61f2adb9aefd44fee30bddb81ebefa818f31f60d89a4e390920c7ed0e2512fd59f719e734b0a1d1f3ff7babb54258a1585514aac0b000000733671e0543929c06f72fc598939003ac6777f3497523536fd25ac4f1e265f5038fa7455f2cc6131d4a189a16b0f0b89e6a495e1d95b840c36488adc22cb2d1b8af57f6dce7214152ba1b3c0d3ad0a6db821518e44b24cb36a02d76ea11a1c45879fc77e7bb2af8c345ddddf49f41228df2114f2c27d16499fa36097a5015ad61a6a9484c09e0a2dfb50f7b7ca71135dc32804a80380a6e20e0ae03be775e472cd31d6a31e615937c38e746a5cf6c9d8194242990dd497a2c52ab50300000000000000cebbd983c3f86dbe92c4b751c04693cb09af88521ab305ceabf6d2bab40bb1b219fbe95ace2f6c49fea798e76b4ef336dff5ac0f7ab022b800ac1aa42fd231b52465a410177ed85dcc9c6d794e2aa0b90cdc409541aa85fa16e3cbc3a9d6c83ffd4d01e5ba898555eeffccf0cb28ce5df0ba31cb793675276162de2fdcb486455bca57edf4fb14e1533554eb22527d66a28a960c430f6136927f54e670c46292454fe28485f35405025844fd24fe846f6656c77d9b5f2b4750ac4805897b02c85caba80000bb96f71f468c9e746d860238b3b113ab1eef51e1507f8832d5d69528083d44548e491477cda51d7e083a134097438e9d7ea34eae8a2e6b516327db9310c7478a37f5c562037196131cc7c84fa29c3c2576f2ae7570b5a98aaa49ca7ddfd5a8c046ce82e4a2d06082ad7a3ab0dfbe208630b1410b674781855752c9c57c1c5ab0a74a336ce89b3a9c0d37a3ca4e698a798a85faf7f4f1dc020b7dd5750062c9810c4bc1ad7afe338f2b0f29059e684fe16098eb30da105be01ca11a293635dfc6d25ecc770ba72792fd3c6851d951b770d0f9edafb1cb4241350d85b04ed737a9bfd7e8301c43b65a95dda76d6850860ba3195040b14c8ad1a8b52472785521147182352a1dbd93595cbc26e813ccd75e16f9247fe82ed150c121f0041022522ec76476f0a9cffa3be1d3ffffffffffffffff29358bbfd8b7a12fe94a0355beb9420eee0a5c11220100c782b89e9430de84b220e8c0df4bd40be3400c58f149319f891fe86fba751dab3326bf2deb9e782b37ec9c7adf36025a091a4b3600000000000000000000000000000000000000000000000000000000000000000600"}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 547.333087ms ago: executing program 1 (id=321): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000a80)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000200)={'syzkaller0\x00', @link_local}) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="7bedcb5d07081196f37538e486dd6372ce22667f2b00dbf6e97158cf474fec87891f6d76745b686158bbcfe8875afdef00010000000006"], 0x66) 547.159707ms ago: executing program 0 (id=322): r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file2\x00', 0x143042, 0x80) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) copy_file_range(r0, 0x0, r0, 0x0, 0x9, 0x0) 547.035467ms ago: executing program 0 (id=323): r0 = openat$urandom(0xffffffffffffff9c, &(0x7f0000000000), 0x8000, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000240)='proc\x00', 0x4000, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r1, &(0x7f0000000000)='3', 0x4e) readv(r0, &(0x7f0000001340)=[{&(0x7f0000000200)=""/4082, 0xff2}, {0x0}], 0x2) 516.265938ms ago: executing program 0 (id=324): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)={0x4c, 0x2, 0x6, 0x801, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_TYPENAME={0x12, 0x3, 'hash:net,port\x00'}]}, 0x4c}}, 0x0) sendmsg$IPSET_CMD_TEST(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000600)={0x44, 0xb, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_DATA={0x1c, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0x18, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x14, 0x2, 0x1, 0x0, @remote}}]}]}, 0x44}}, 0x0) 247.937924ms ago: executing program 0 (id=325): write(0xffffffffffffffff, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x4, 0x401d031, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, 0x0, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x40800) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000100)=0x2) sched_setscheduler(r2, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000032680)=""/102392, 0x18ff8) bind$netlink(r0, &(0x7f0000000180)={0x10, 0x0, 0x25dfdbfd, 0x1000000}, 0xc) sched_setaffinity(0x0, 0xfffffef7, &(0x7f0000000740)=0x410000002) r4 = openat$ublk_ctrl(0xffffffffffffff9c, 0x0, 0x2, 0x0) r5 = syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0xc, 0x0, r4, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)=0x0) sendmsg$NFT_MSG_GETFLOWTABLE(0xffffffffffffffff, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={&(0x7f00000015c0)={0x20, 0x17, 0xa, 0x301, 0x0, 0x0, {0x2, 0x0, 0x4}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz1\x00'}]}, 0x20}}, 0x4) r7 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r5, 0x2) syz_ublk_setup_queues(r7, r6, &(0x7f0000000340)={0x0, 0x92d1, 0x400, 0x80000002, 0x165}, 0x0, 0x4, &(0x7f0000001a40)={0x2e, 0x10, 0x0, r7, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x9}, 0x0, 0x0, '\x00', {0x0, 0x81c, 0x0, 0x0}}, &(0x7f0000001ac0)) 195.393486ms ago: executing program 1 (id=326): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./trace\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./trace\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./trace/set_event\x00', 0x2, 0x0) preadv(r0, &(0x7f0000003680)=[{&(0x7f00000014c0)=""/223, 0xdf}], 0x1, 0xb, 0x2) 195.260555ms ago: executing program 2 (id=327): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000200)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) mount_setattr(0xffffffffffffffff, 0x0, 0x8000, 0x0, 0x0) 195.119606ms ago: executing program 1 (id=328): r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000100), 0x2400, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0xe) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$PPPIOCATTCHAN(r1, 0x40047438, &(0x7f0000000100)=0x1) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, 0x0) ioctl$PPPIOCATTCHAN(r1, 0x80047453, 0x0) 195.036055ms ago: executing program 2 (id=329): r0 = gettid() setns(0xc9, 0x0) syz_open_procfs(r0, &(0x7f00000000c0)='net/route\x00') r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x9, 0x0, 0x7fff0000}]}) close_range(r1, 0xffffffffffffffff, 0x0) 183.655726ms ago: executing program 2 (id=330): r0 = gettid() timer_create(0x1, &(0x7f0000000800)={0x0, 0x21, 0x4, @tid=r0}, &(0x7f0000000000)=0x0) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x3ed4, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) timer_settime(r1, 0x1, &(0x7f0000000040), 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) fadvise64(r2, 0x401, 0x3, 0x0) 135.233907ms ago: executing program 1 (id=331): pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) symlinkat(&(0x7f0000000200)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0xffffffffffffff9c, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYBLOB="b80000001300e9990000000000000000fc000000000000000100000000000000ac1e000100000000000000000000000000000000000000000a00"], 0xb8}}, 0x20040014) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0x100, 0x0, 0x25dfdbfb, {{@in6=@private0={0xfc, 0x0, '\x00', 0x1}, @in=@multicast2, 0x0, 0x4, 0x0, 0x0, 0xa, 0x60, 0x80, 0x3b, 0x0, 0xee01}, {0x0, 0x2, 0x0, 0x2000000000000, 0x40, 0xfffffffffffffdfd, 0x50}, {0x5}, 0x6, 0x40000000, 0x0, 0x1, 0x2}}, 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x50) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9990000000000000000fc000000000000000100000000000000ac"], 0xb8}}, 0x20004000) sendmsg$nl_xfrm(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9990000020000000000fc0000000000000000"], 0xb8}, 0x1, 0x0, 0x0, 0x80c0}, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000800)=ANY=[@ANYBLOB="b80000001300e9990500000000000000fc000000000000000000000000000000fc00000000000000000000000000000000000000000000000a0030"], 0xb8}}, 0x4000) 135.049407ms ago: executing program 3 (id=332): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000100)='tmpfs\x00', 0x0, 0x0) mount$tmpfs(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x2640b3, &(0x7f0000000040)={[{@size={'size', 0x3d, [0x25]}}]}) 53.536809ms ago: executing program 3 (id=333): r0 = syz_usb_connect(0x5, 0x58, &(0x7f0000000000)={{0x12, 0x1, 0x310, 0x8e, 0x3a, 0xc6, 0x20, 0x694, 0x1, 0x7813, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x46, 0x2, 0xe, 0x6, 0x10, 0x3, "", [{{0x9, 0x4, 0x39, 0xd8, 0x1, 0x1a, 0xda, 0xa8, 0x8, [], [{{0x9, 0x5, 0x8, 0x10, 0x20, 0x7, 0x9, 0x80}}]}}, {{0x9, 0x4, 0xe4, 0x5, 0x3, 0xb9, 0x56, 0xda, 0x2, [], [{{0x9, 0x5, 0x8, 0x0, 0x400, 0x1, 0x12, 0xfc}}, {{0x9, 0x5, 0xb, 0x0, 0x20, 0x7, 0x3, 0x9a, [@generic={0x7, 0x5, "d15b89f26d"}]}}, {{0x9, 0x5, 0x9, 0x3, 0x40, 0x7a, 0xa, 0x84}}]}}]}}]}}, &(0x7f0000000a40)={0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r0, &(0x7f0000000bc0)={0x14, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="0003040000000403"], 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000011c0)={0x24, 0x0, &(0x7f0000001040)={0x0, 0x3, 0x2, @string={0x2}}, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000001600)={0x24, 0x0, &(0x7f0000001540)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x44a}}, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000500)={0x18, &(0x7f0000000300)=ANY=[@ANYBLOB='@\b\b'], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000002280)={0x84, &(0x7f0000000080)={0x20, 0x6, 0x4, "348b35e5"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) writev(r1, &(0x7f0000000540)=[{0x0}, {&(0x7f00000000c0)='*', 0x1}], 0x2) 53.424259ms ago: executing program 1 (id=334): setns(0xc9, 0x0) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000000c0)='net/packet\x00') pread64(r0, &(0x7f00000003c0)=""/188, 0xbc, 0x40) 14.5871ms ago: executing program 2 (id=335): r0 = socket$tipc(0x1e, 0x5, 0x0) connect$tipc(r0, &(0x7f0000000080)=@id={0x1e, 0x3, 0x2, {0x4e22}}, 0x10) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r2, 0x0, 0x6, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r4 = openat$cgroup_procs(r3, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) r5 = openat$cgroup_procs(r3, &(0x7f00000002c0)='tasks\x00', 0x2, 0x0) write$cgroup_pid(r4, &(0x7f00000000c0), 0x12) pread64(r5, &(0x7f0000002880)=""/4103, 0x1007, 0x4) 0s ago: executing program 1 (id=336): r0 = add_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000100)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffc) r1 = add_key(&(0x7f0000000040)='asymmetric\x00', 0x0, &(0x7f0000000200)="308205553082033da00302010202147398ea982dd02ea8b1cf57c7f297b3e61afc8c0a300d06092a864886f70d01010b050030343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b65793020170d3232303531383232333234315a180f32313232303432343232333234315a30343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b657a30820222300d06092a864886f70d01010105000382020f003082020a0282020100ccac49dd3bcab0157e846ab20a695f1c0a61823b4f2ca3952c08584bb15d99e0c3c179c2b3ebc01e6d3e541dbdb7927b4db59558b2522ec6244b7163803277a7385edb72ae6e0decfbb66d017fe95566dfbf1d76780231e8e507f8b7825c0dd4bbfba2590d2e3a78953a8b4606474446d7cd066a4113e319f6bb6e38f48301a3bf4a394fd70ae938b3f594144eddf743fd24b2493ca5f77a7cd4453d977568f1ed4c420b70ca85f3dee5882cc5beb69734ba2402cd8b869fa973ca73cf9281ee7555bb18675cff3fb5dd331b0ce978db5ccfaa5c4342df5ea96decd7d7ffe6a13a921adaaef68c6f7bd5b46e06e98fe8de093189ed0e11a1fa8ae9e964596253dad170be11d4999711cf99de0b9d947eaab852ea37db907e35bdd9fe6d0a487028ddd50d7f03809314238fb922cd7c29fef172b55c0b12cf9c15f6114c7a45258c450a34ac2d9a81ca0b1322cdeb1a38881897960881aacc8f0f8a327b7668036843bf11ba5560fd801c0d9b69b60972bc0f412f0782c6e3b21391c46d149531be19bdbcede14c74a2e0780bbb94ec4c533aa2b5841d4b657edcf7db367dbe9e3b366642667635bfbef0c13c7ce9425c24530305a86724500275ff24463b358976e670dac5518c9ae505b00bd02dd47d5775946bf90aad0e410015d04fc07f902d18488f28fe5da7cd999ebd026c8a31f31cc74be693cd42a2e46810479dfc210203010001a35d305b300c0603551d130101ff04023000300b0603551d0f040403020780301d0603551d0e04160414f58703bb33ce1b73ee02eccdee5b8817518fe3db301f0603551d23041830168014f58703bb33ce1b73ee02eccdee5b8817518fe3db300d06092a864886f70d01010b05000382020100c02e12417b738516c8db8679e8f5cd44f4c6e281235e47cbab25f11e583e317f78ad85ebfe148860f77fd226a2f4982afdba050c203312cc4d1461648193d333edc8fff178cc5f519f09d7be0d5c74fd9bdf524ac9a871253304106736d0b30bc9a14072ae417b68e6e47bd028f76de73f50fc917c9156d4dfa6bbe84d1b58aa28fac119eb112f248b7cc5a98626aa6eb79bd5f806fb02527b9c9ea1e0078b5ee4b85529f648521c1b542d46d8e571b960d145b592898a63582ab3c6b276e23c825904ae5ac4997b2e4b4657b82924b2fdee2c0da483fa652a07358b97cfbd962ed17e6cc21e87b66c7665b5b262da8be973e3db33dd133a17636a76de8d8fe04761283a83ff8fe7c7e04aa3e507cfe98c35352ee7806631bf91580ae1253d38d3a4f059344707620fbe30dd818858f028b096e582f805b71301bcfac61f8672ccf9ee8ed9d6048c246cbf0f5d3739cf45c1933ad2ed5c5879748662307e8ebbdd7aa9edca40cb6247f4b49f527f7263a8f02baf452a48196de3fbf9196669c8cc62876c532b2d6e906c543a822541cb186aa422a8a1c447d781001c15510f1aafef9fa6618cbd6b8bede6ac0eb63a4c92e60f910a0f71c7a0b90d3a175a6f35c8e7504f46e870604806828b6658e673919c123d358e46ad5af5b3db692104fdd31cdf949d56b00ad195768dec9edd0b159764ade5f26202fc9e5f56423905b3", 0x559, r0) keyctl$KEYCTL_PKEY_VERIFY(0x1c, &(0x7f0000000000)={r1, 0x0, 0x2}, &(0x7f0000000180)=ANY=[@ANYBLOB='enc=pkcs1'], 0x0, &(0x7f0000000840)="cf9f") kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.10' (ED25519) to the list of known hosts. [ 21.060056][ T36] audit: type=1400 audit(1791071165.609:64): avc: denied { mounton } for pid=286 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 21.061148][ T286] cgroup: Unknown subsys name 'net' [ 21.082710][ T36] audit: type=1400 audit(1791071165.609:65): avc: denied { mount } for pid=286 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 21.109946][ T36] audit: type=1400 audit(1791071165.629:66): avc: denied { unmount } for pid=286 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 21.110518][ T286] cgroup: Unknown subsys name 'devices' [ 21.211450][ T286] cgroup: Unknown subsys name 'hugetlb' [ 21.217058][ T286] cgroup: Unknown subsys name 'rlimit' [ 21.329023][ T36] audit: type=1400 audit(1791071165.869:67): avc: denied { setattr } for pid=286 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 21.352191][ T36] audit: type=1400 audit(1791071165.869:68): avc: denied { mounton } for pid=286 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 21.377031][ T36] audit: type=1400 audit(1791071165.869:69): avc: denied { mount } for pid=286 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 21.381313][ T288] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 21.408876][ T36] audit: type=1400 audit(1791071165.949:70): avc: denied { relabelto } for pid=288 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.434308][ T36] audit: type=1400 audit(1791071165.949:71): avc: denied { write } for pid=288 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.462029][ T36] audit: type=1400 audit(1791071166.009:72): avc: denied { read } for pid=286 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.462533][ T286] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 21.487508][ T36] audit: type=1400 audit(1791071166.009:73): avc: denied { open } for pid=286 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.765873][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.773010][ T295] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.780189][ T295] bridge_slave_0: entered allmulticast mode [ 22.786354][ T295] bridge_slave_0: entered promiscuous mode [ 22.794100][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.801211][ T295] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.808250][ T295] bridge_slave_1: entered allmulticast mode [ 22.814497][ T295] bridge_slave_1: entered promiscuous mode [ 22.843247][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.850306][ T293] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.857350][ T293] bridge_slave_0: entered allmulticast mode [ 22.863821][ T293] bridge_slave_0: entered promiscuous mode [ 22.870279][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.877311][ T293] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.884533][ T293] bridge_slave_1: entered allmulticast mode [ 22.890752][ T293] bridge_slave_1: entered promiscuous mode [ 22.919984][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.927030][ T294] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.934097][ T294] bridge_slave_0: entered allmulticast mode [ 22.940364][ T294] bridge_slave_0: entered promiscuous mode [ 22.946775][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.953848][ T294] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.960933][ T294] bridge_slave_1: entered allmulticast mode [ 22.967204][ T294] bridge_slave_1: entered promiscuous mode [ 23.030834][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.037888][ T296] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.045000][ T296] bridge_slave_0: entered allmulticast mode [ 23.051246][ T296] bridge_slave_0: entered promiscuous mode [ 23.080982][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.088031][ T296] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.095102][ T296] bridge_slave_1: entered allmulticast mode [ 23.101231][ T296] bridge_slave_1: entered promiscuous mode [ 23.169004][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.176068][ T295] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.183352][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.190383][ T295] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.199063][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.206118][ T293] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.213405][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.220433][ T293] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.230557][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.237608][ T294] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.244881][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.251931][ T294] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.315002][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.322737][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.329975][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.337065][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.344659][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.351817][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.372810][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.379882][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.387500][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.394543][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.402783][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.409824][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.421596][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.428624][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.436300][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.443337][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.455503][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.462551][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.511846][ T295] veth0_vlan: entered promiscuous mode [ 23.526943][ T293] veth0_vlan: entered promiscuous mode [ 23.534871][ T309] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.541940][ T309] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.550163][ T309] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.557197][ T309] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.578050][ T295] veth1_macvtap: entered promiscuous mode [ 23.592959][ T294] veth0_vlan: entered promiscuous mode [ 23.603162][ T293] veth1_macvtap: entered promiscuous mode [ 23.635711][ T294] veth1_macvtap: entered promiscuous mode [ 23.648837][ T296] veth0_vlan: entered promiscuous mode [ 23.655766][ T295] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 23.683301][ T312] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 23.711167][ T296] veth1_macvtap: entered promiscuous mode [ 23.748915][ T319] FAULT_INJECTION: forcing a failure. [ 23.748915][ T319] name failslab, interval 1, probability 0, space 0, times 1 [ 23.763046][ T319] CPU: 1 UID: 0 PID: 319 Comm: syz.3.5 Not tainted syzkaller #0 60889c1c5e6bdc1f3cb1b6a230ba908545dccc71 [ 23.763075][ T319] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 23.763095][ T319] Call Trace: [ 23.763101][ T319] [ 23.763108][ T319] __dump_stack+0x21/0x30 [ 23.763145][ T319] dump_stack_lvl+0x140/0x1c0 [ 23.763169][ T319] ? __cfi_dump_stack_lvl+0x10/0x10 [ 23.763194][ T319] ? __cfi_do_futex+0x10/0x10 [ 23.763217][ T319] ? alloc_file_pseudo+0x191/0x1f0 [ 23.763242][ T319] dump_stack+0x19/0x20 [ 23.763264][ T319] should_fail_ex+0x3c2/0x510 [ 23.763287][ T319] should_failslab+0xac/0x100 [ 23.763307][ T319] __kmalloc_cache_noprof+0x41/0x470 [ 23.763330][ T319] ? do_eventfd+0x88/0x390 [ 23.763351][ T319] do_eventfd+0x88/0x390 [ 23.763370][ T319] __x64_sys_eventfd2+0x5e/0x70 [ 23.763389][ T319] x64_sys_call+0x29ec/0x2ee0 [ 23.763406][ T319] do_syscall_64+0x57/0xf0 [ 23.763424][ T319] ? clear_bhb_loop+0x50/0xa0 [ 23.763448][ T319] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 23.763471][ T319] RIP: 0033:0x7f38aa59e159 [ 23.763493][ T319] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 23.763505][ T319] RSP: 002b:00007f38ab503028 EFLAGS: 00000246 ORIG_RAX: 0000000000000122 [ 23.763530][ T319] RAX: ffffffffffffffda RBX: 00007f38aa826090 RCX: 00007f38aa59e159 [ 23.763543][ T319] RDX: 0000000000000000 RSI: 0000000000000801 RDI: 0000000000000002 [ 23.763555][ T319] RBP: 00007f38aa63506b R08: 0000000000000000 R09: 0000000000000000 [ 23.763567][ T319] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 23.763578][ T319] R13: 00007f38aa826128 R14: 00007f38aa826090 R15: 00007ffd165c2df8 [ 23.763594][ T319] [ 23.774333][ T324] netlink: 'syz.2.3': attribute type 13 has an invalid length. [ 23.999975][ T341] mmap: syz.3.9 (341) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 24.014170][ T344] ======================================================= [ 24.014170][ T344] WARNING: The mand mount option has been deprecated and [ 24.014170][ T344] and is ignored by this kernel. Remove the mand [ 24.014170][ T344] option from the mount to silence this warning. [ 24.014170][ T344] ======================================================= [ 24.213006][ T365] netlink: 'syz.1.15': attribute type 4 has an invalid length. [ 24.222502][ T365] netlink: 'syz.1.15': attribute type 4 has an invalid length. [ 24.352163][ T377] capability: warning: `syz.1.18' uses deprecated v2 capabilities in a way that may be insecure [ 24.370565][ T377] FAULT_INJECTION: forcing a failure. [ 24.370565][ T377] name failslab, interval 1, probability 0, space 0, times 0 [ 24.383842][ T377] CPU: 1 UID: 0 PID: 377 Comm: syz.1.18 Not tainted syzkaller #0 60889c1c5e6bdc1f3cb1b6a230ba908545dccc71 [ 24.383875][ T377] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 24.383887][ T377] Call Trace: [ 24.383893][ T377] [ 24.383901][ T377] __dump_stack+0x21/0x30 [ 24.383932][ T377] dump_stack_lvl+0x140/0x1c0 [ 24.383958][ T377] ? __cfi_dump_stack_lvl+0x10/0x10 [ 24.383985][ T377] dump_stack+0x19/0x20 [ 24.384010][ T377] should_fail_ex+0x3c2/0x510 [ 24.384033][ T377] should_failslab+0xac/0x100 [ 24.384054][ T377] __kmalloc_cache_noprof+0x41/0x470 [ 24.384075][ T377] ? io_wq_create+0xe0/0x9d0 [ 24.384095][ T377] ? __kasan_check_write+0x18/0x20 [ 24.384114][ T377] ? mutex_unlock+0x90/0x240 [ 24.384152][ T377] io_wq_create+0xe0/0x9d0 [ 24.384172][ T377] io_uring_alloc_task_context+0x2a5/0x6b0 [ 24.384195][ T377] ? alloc_file_pseudo+0x191/0x1f0 [ 24.384229][ T377] ? __cfi_io_uring_alloc_task_context+0x10/0x10 [ 24.384250][ T377] ? __cfi_io_wq_submit_work+0x10/0x10 [ 24.384276][ T377] ? __cfi_io_wq_free_work+0x10/0x10 [ 24.384308][ T377] ? __cfi_anon_inode_make_secure_inode+0x10/0x10 [ 24.384337][ T377] __io_uring_add_tctx_node+0x324/0x590 [ 24.384365][ T377] ? __cfi___io_uring_add_tctx_node+0x10/0x10 [ 24.384389][ T377] ? anon_inode_create_getfile+0x3f/0x50 [ 24.384416][ T377] io_uring_create+0xc78/0x13f0 [ 24.384442][ T377] __se_sys_io_uring_setup+0x2a4/0x2b0 [ 24.384474][ T377] ? __se_sys_futex+0x13c/0x320 [ 24.384500][ T377] ? __x64_sys_io_uring_setup+0x80/0x80 [ 24.384528][ T377] ? __kasan_check_write+0x18/0x20 [ 24.384549][ T377] __x64_sys_io_uring_setup+0x5f/0x80 [ 24.384576][ T377] x64_sys_call+0x22c0/0x2ee0 [ 24.384594][ T377] do_syscall_64+0x57/0xf0 [ 24.384613][ T377] ? clear_bhb_loop+0x50/0xa0 [ 24.384638][ T377] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 24.384668][ T377] RIP: 0033:0x7f943939e159 [ 24.384685][ T377] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 24.384701][ T377] RSP: 002b:00007f943a241fb8 EFLAGS: 00000206 ORIG_RAX: 00000000000001a9 [ 24.384722][ T377] RAX: ffffffffffffffda RBX: 00002000000005c0 RCX: 00007f943939e159 [ 24.384737][ T377] RDX: 0000200000000440 RSI: 00002000000005c0 RDI: 0000000000000efe [ 24.384750][ T377] RBP: 00007f943943506b R08: 0000000000000000 R09: 0000000000000000 [ 24.384764][ T377] R10: 0000200000000180 R11: 0000000000000206 R12: 0000200000000440 [ 24.384777][ T377] R13: 0000200000000180 R14: 0000200000000340 R15: 00007ffcd1ad0918 [ 24.384794][ T377] [ 25.019695][ T65] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 25.109495][ T9] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 25.265167][ T9] usb 4-1: device descriptor read/64, error -71 [ 25.268699][ T65] usb 3-1: Using ep0 maxpacket: 32 [ 25.323800][ T408] kvm: requested 181028 ns i8254 timer period limited to 200000 ns [ 25.333149][ T408] kvm: requested 65371 ns i8254 timer period limited to 200000 ns [ 25.344111][ T408] kvm: requested 116495 ns i8254 timer period limited to 200000 ns [ 25.352621][ T408] kvm: requested 110628 ns i8254 timer period limited to 200000 ns [ 25.365114][ T408] kvm: requested 179352 ns i8254 timer period limited to 200000 ns [ 25.374689][ T408] kvm: requested 187733 ns i8254 timer period limited to 200000 ns [ 25.383128][ T408] kvm: requested 140800 ns i8254 timer period limited to 200000 ns [ 25.391551][ T408] kvm: requested 34361 ns i8254 timer period limited to 200000 ns [ 25.400168][ T408] kvm: requested 155885 ns i8254 timer period limited to 200000 ns [ 25.408550][ T408] kvm: requested 188571 ns i8254 timer period limited to 200000 ns [ 25.537410][ T65] usb 3-1: config 0 has an invalid interface number: 67 but max is 0 [ 25.545549][ T65] usb 3-1: config 0 has no interface number 0 [ 25.551754][ T65] usb 3-1: config 0 interface 67 altsetting 0 has a duplicate endpoint with address 0x82, skipping [ 25.559470][ T9] usb 4-1: device descriptor read/64, error -71 [ 25.564035][ T65] usb 3-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 25.577848][ T65] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 25.586155][ T65] usb 3-1: Product: syz [ 25.590644][ T65] usb 3-1: Manufacturer: syz [ 25.595260][ T65] usb 3-1: SerialNumber: syz [ 25.600889][ T65] usb 3-1: config 0 descriptor?? [ 25.606567][ T65] smsc95xx v2.0.0 [ 25.610293][ T65] smsc95xx 3-1:0.67 (unnamed net_device) (uninitialized): usbnet_get_endpoints failed: -22 [ 25.620487][ T65] smsc95xx 3-1:0.67: probe with driver smsc95xx failed with error -22 [ 25.799479][ T9] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 25.811907][ T65] usb 3-1: USB disconnect, device number 2 [ 25.939508][ T9] usb 4-1: device descriptor read/64, error -71 [ 26.074849][ T36] kauditd_printk_skb: 92 callbacks suppressed [ 26.074865][ T36] audit: type=1400 audit(1791071170.619:166): avc: denied { map } for pid=427 comm="syz.1.33" path="/dev/binderfs/binder0" dev="binder" ino=4 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 26.104408][ T36] audit: type=1400 audit(1791071170.619:167): avc: denied { call } for pid=427 comm="syz.1.33" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 26.179472][ T9] usb 4-1: device descriptor read/64, error -71 [ 26.289552][ T9] usb usb4-port1: attempt power cycle [ 26.328201][ T36] audit: type=1400 audit(1791071170.869:168): avc: denied { mount } for pid=430 comm="syz.2.34" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 26.350209][ T36] audit: type=1400 audit(1791071170.869:169): avc: denied { write } for pid=430 comm="syz.2.34" name="uprobe_events" dev="tracefs" ino=18 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=file permissive=1 [ 26.373045][ T36] audit: type=1400 audit(1791071170.869:170): avc: denied { open } for pid=430 comm="syz.2.34" path="/4/tracing/uprobe_events" dev="tracefs" ino=18 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=file permissive=1 [ 26.396905][ T36] audit: type=1400 audit(1791071170.899:171): avc: denied { unmount } for pid=296 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 26.417269][ T36] audit: type=1400 audit(1791071170.919:172): avc: denied { create } for pid=432 comm="syz.2.35" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 26.436887][ T36] audit: type=1400 audit(1791071170.929:173): avc: denied { write } for pid=432 comm="syz.2.35" lport=255 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 26.459181][ T36] audit: type=1400 audit(1791071170.939:174): avc: denied { read write } for pid=434 comm="syz.2.36" name="vga_arbiter" dev="devtmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1 [ 26.499514][ T36] audit: type=1400 audit(1791071170.939:175): avc: denied { open } for pid=434 comm="syz.2.36" path="/dev/vga_arbiter" dev="devtmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1 [ 26.642720][ T9] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 26.684042][ T9] usb 4-1: device descriptor read/8, error -71 [ 26.995281][ T9] usb 4-1: device descriptor read/8, error -71 [ 27.242008][ T9] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 27.317072][ T9] usb 4-1: device descriptor read/8, error -71 [ 27.630494][ T9] usb 4-1: device descriptor read/8, error -71 [ 27.739738][ T9] usb usb4-port1: unable to enumerate USB device [ 28.069480][ T322] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 28.219474][ T322] usb 3-1: Using ep0 maxpacket: 32 [ 28.225763][ T322] usb 3-1: config 0 has an invalid interface number: 184 but max is 0 [ 28.234016][ T322] usb 3-1: config 0 has no interface number 0 [ 28.240162][ T322] usb 3-1: config 0 interface 184 has no altsetting 0 [ 28.248331][ T322] usb 3-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 28.257454][ T322] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 28.265515][ T322] usb 3-1: Product: syz [ 28.269744][ T322] usb 3-1: Manufacturer: syz [ 28.274378][ T322] usb 3-1: SerialNumber: syz [ 28.279654][ T322] usb 3-1: config 0 descriptor?? [ 28.285309][ T322] smsc75xx v1.0.0 [ 28.929485][ T9] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 28.968626][ T510] FAULT_INJECTION: forcing a failure. [ 28.968626][ T510] name fail_page_alloc, interval 1, probability 0, space 0, times 1 [ 28.981958][ T510] CPU: 1 UID: 0 PID: 510 Comm: syz.1.64 Not tainted syzkaller #0 60889c1c5e6bdc1f3cb1b6a230ba908545dccc71 [ 28.981985][ T510] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 28.981994][ T510] Call Trace: [ 28.981997][ T510] [ 28.982002][ T510] __dump_stack+0x21/0x30 [ 28.982027][ T510] dump_stack_lvl+0x140/0x1c0 [ 28.982042][ T510] ? __cfi_dump_stack_lvl+0x10/0x10 [ 28.982057][ T510] ? futex_wait+0x2b8/0x7c0 [ 28.982068][ T510] dump_stack+0x19/0x20 [ 28.982081][ T510] should_fail_ex+0x3c2/0x510 [ 28.982095][ T510] should_fail_alloc_page+0xec/0x110 [ 28.982109][ T510] __alloc_pages_noprof+0x1c0/0x7e0 [ 28.982124][ T510] ? __cfi___alloc_pages_noprof+0x10/0x10 [ 28.982138][ T510] ? do_futex+0x32a/0x510 [ 28.982155][ T510] ___kmalloc_large_node+0x81/0x220 [ 28.982167][ T510] ? security_capable+0x44/0x130 [ 28.982180][ T510] __kmalloc_large_noprof+0x1e/0xe0 [ 28.982191][ T510] ksys_ioperm+0x174/0x7d0 [ 28.982202][ T510] __x64_sys_ioperm+0x7e/0x90 [ 28.982212][ T510] x64_sys_call+0x2129/0x2ee0 [ 28.982222][ T510] do_syscall_64+0x57/0xf0 [ 28.982234][ T510] ? clear_bhb_loop+0x50/0xa0 [ 28.982247][ T510] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 28.982260][ T510] RIP: 0033:0x7f943939e159 [ 28.982270][ T510] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 28.982279][ T510] RSP: 002b:00007f943a242028 EFLAGS: 00000246 ORIG_RAX: 00000000000000ad [ 28.982292][ T510] RAX: ffffffffffffffda RBX: 00007f9439625fa0 RCX: 00007f943939e159 [ 28.982301][ T510] RDX: 0000000000000009 RSI: 0000000000000005 RDI: 0000000000000000 [ 28.982307][ T510] RBP: 00007f943943506b R08: 0000000000000000 R09: 0000000000000000 [ 28.982314][ T510] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 28.982321][ T510] R13: 00007f9439626038 R14: 00007f9439625fa0 R15: 00007ffcd1ad0918 [ 28.982329][ T510] [ 29.081912][ T9] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 29.096643][ T322] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Failed to write reg index 0x00000040: -71 [ 29.102101][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 29.103590][ T322] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Error writing E2P_CMD [ 29.109469][ T9] usb 1-1: Product: syz [ 29.113827][ T322] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -71 [ 29.134433][ T9] usb 1-1: Manufacturer: syz [ 29.141302][ T322] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -71 [ 29.150213][ T9] usb 1-1: SerialNumber: syz [ 29.157260][ T322] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_reset [ 29.266847][ T322] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -71 [ 29.277825][ T322] smsc75xx 3-1:0.184: probe with driver smsc75xx failed with error -71 [ 29.289232][ T322] usb 3-1: USB disconnect, device number 3 [ 29.321626][ T520] kvm: vcpu 0: requested 128 ns lapic timer period limited to 200000 ns [ 29.707283][ T541] tipc: Started in network mode [ 29.712479][ T541] tipc: Node identity ac1414aa, cluster identity 4711 [ 29.719631][ T541] tipc: New replicast peer: 172.20.20.187 [ 29.726069][ T541] tipc: Enabled bearer , priority 10 [ 29.881302][ T554] raw_sendmsg: syz.2.84 forgot to set AF_INET. Fix it! [ 29.896311][ T556] FAULT_INJECTION: forcing a failure. [ 29.896311][ T556] name failslab, interval 1, probability 0, space 0, times 0 [ 29.909214][ T556] CPU: 0 UID: 0 PID: 556 Comm: syz.2.85 Not tainted syzkaller #0 60889c1c5e6bdc1f3cb1b6a230ba908545dccc71 [ 29.909245][ T556] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 29.909258][ T556] Call Trace: [ 29.909264][ T556] [ 29.909272][ T556] __dump_stack+0x21/0x30 [ 29.909303][ T556] dump_stack_lvl+0x140/0x1c0 [ 29.909337][ T556] ? __cfi_dump_stack_lvl+0x10/0x10 [ 29.909366][ T556] dump_stack+0x19/0x20 [ 29.909380][ T556] should_fail_ex+0x3c2/0x510 [ 29.909394][ T556] ? security_prepare_creds+0x66/0x260 [ 29.909410][ T556] should_failslab+0xac/0x100 [ 29.909433][ T556] __kmalloc_noprof+0x69/0x510 [ 29.909454][ T556] ? kasan_save_alloc_info+0x3a/0x50 [ 29.909473][ T556] ? security_prepare_creds+0x66/0x260 [ 29.909488][ T556] ? __kasan_slab_alloc+0x73/0x90 [ 29.909502][ T556] security_prepare_creds+0x66/0x260 [ 29.909514][ T556] prepare_creds+0x46d/0x6b0 [ 29.909526][ T556] lookup_user_key+0x359/0x1230 [ 29.909540][ T556] ? __cfi_lookup_user_key+0x10/0x10 [ 29.909554][ T556] ? __cfi_lookup_user_key_possessed+0x10/0x10 [ 29.909568][ T556] ? memdup_user+0xb1/0x170 [ 29.909577][ T556] ? strndup_user+0x40/0xd0 [ 29.909587][ T556] __se_sys_add_key+0x317/0x4b0 [ 29.909599][ T556] ? __x64_sys_add_key+0xf0/0xf0 [ 29.909610][ T556] ? __kasan_check_write+0x18/0x20 [ 29.909621][ T556] ? fpregs_restore_userregs+0x11c/0x260 [ 29.909634][ T556] __x64_sys_add_key+0xc3/0xf0 [ 29.909645][ T556] x64_sys_call+0x195f/0x2ee0 [ 29.909655][ T556] do_syscall_64+0x57/0xf0 [ 29.909666][ T556] ? clear_bhb_loop+0x50/0xa0 [ 29.909680][ T556] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 29.909693][ T556] RIP: 0033:0x7f6326d9e159 [ 29.909703][ T556] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 29.909712][ T556] RSP: 002b:00007f6327c1f028 EFLAGS: 00000246 ORIG_RAX: 00000000000000f8 [ 29.909724][ T556] RAX: ffffffffffffffda RBX: 00007f6327025fa0 RCX: 00007f6326d9e159 [ 29.909732][ T556] RDX: 0000000000000000 RSI: 0000200000000300 RDI: 00002000000002c0 [ 29.909740][ T556] RBP: 00007f6326e3506b R08: fffffffffffffffe R09: 0000000000000000 [ 29.909747][ T556] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 29.909753][ T556] R13: 00007f6327026038 R14: 00007f6327025fa0 R15: 00007fffc48c3d58 [ 29.909762][ T556] [ 30.199869][ T566] rust_binder: 565:566 error while translating object: EBADF [ 30.207432][ T566] rust_binder: Failure in copy_transaction_data: EBADF [ 30.207464][ T566] rust_binder: 565:566 transaction call to 565:0 failed EBADF, code 0 size 88-24 [ 30.224281][ T31] rust_binder: 565: undelivered TRANSACTION_ERROR: 29201 [ 30.287134][ T574] rust_binder: 571:574 no such ref 0 [ 30.408268][ T597] FAULT_INJECTION: forcing a failure. [ 30.408268][ T597] name failslab, interval 1, probability 0, space 0, times 0 [ 30.421058][ T597] CPU: 0 UID: 0 PID: 597 Comm: syz.3.103 Not tainted syzkaller #0 60889c1c5e6bdc1f3cb1b6a230ba908545dccc71 [ 30.421092][ T597] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 30.421105][ T597] Call Trace: [ 30.421112][ T597] [ 30.421119][ T597] __dump_stack+0x21/0x30 [ 30.421152][ T597] dump_stack_lvl+0x140/0x1c0 [ 30.421178][ T597] ? __cfi_dump_stack_lvl+0x10/0x10 [ 30.421204][ T597] ? dequeue_entity+0x88a/0x13b0 [ 30.421230][ T597] dump_stack+0x19/0x20 [ 30.421255][ T597] should_fail_ex+0x3c2/0x510 [ 30.421286][ T597] should_failslab+0xac/0x100 [ 30.421313][ T597] kmem_cache_alloc_noprof+0x42/0x410 [ 30.421335][ T597] ? mas_wr_store_type+0x13f3/0x1b40 [ 30.421360][ T597] ? mas_alloc_nodes+0x254/0x9d0 [ 30.421387][ T597] mas_alloc_nodes+0x254/0x9d0 [ 30.421415][ T597] mas_preallocate+0x79b/0xc90 [ 30.421441][ T597] ? __cfi_mas_preallocate+0x10/0x10 [ 30.421468][ T597] commit_merge+0x4c6/0xee0 [ 30.421491][ T597] ? vma_expand+0x5b0/0x5b0 [ 30.421512][ T597] ? __kasan_check_write+0x18/0x20 [ 30.421533][ T597] vma_modify+0x1056/0x1540 [ 30.421554][ T597] ? vma_modify+0x681/0x1540 [ 30.421575][ T597] ? vma_modify+0x681/0x1540 [ 30.421597][ T597] vma_modify_flags_uffd+0x17d/0x1b0 [ 30.421622][ T597] userfaultfd_clear_vma+0x2ac/0x330 [ 30.421643][ T597] ? __cfi_userfaultfd_clear_vma+0x10/0x10 [ 30.421666][ T597] ? mas_find+0x415/0x620 [ 30.421691][ T597] userfaultfd_release_all+0x291/0x4b0 [ 30.421712][ T597] ? __cfi_userfaultfd_release_all+0x10/0x10 [ 30.421732][ T597] ? vfs_write+0xbcf/0xfd0 [ 30.421753][ T597] ? __asan_memset+0x39/0x50 [ 30.421773][ T597] ? locks_remove_posix+0x358/0x570 [ 30.421796][ T597] userfaultfd_release+0xea/0x1b0 [ 30.421818][ T597] ? __cfi_userfaultfd_release+0x10/0x10 [ 30.421841][ T597] ? __cfi_userfaultfd_release+0x10/0x10 [ 30.421863][ T597] __fput+0x208/0xa30 [ 30.421889][ T597] __fput_sync+0x4a/0x70 [ 30.421914][ T597] __se_sys_close+0x172/0x1f0 [ 30.421932][ T597] __x64_sys_close+0x3c/0x60 [ 30.421950][ T597] x64_sys_call+0x2560/0x2ee0 [ 30.421969][ T597] do_syscall_64+0x57/0xf0 [ 30.421989][ T597] ? clear_bhb_loop+0x50/0xa0 [ 30.422015][ T597] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 30.422043][ T597] RIP: 0033:0x7f38aa59e159 [ 30.422060][ T597] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 30.422077][ T597] RSP: 002b:00007f38ab524028 EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 30.422099][ T597] RAX: ffffffffffffffda RBX: 00007f38aa825fa0 RCX: 00007f38aa59e159 [ 30.422115][ T597] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 [ 30.422127][ T597] RBP: 00007f38aa63506b R08: 0000000000000000 R09: 0000000000000000 [ 30.422141][ T597] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 30.422153][ T597] R13: 00007f38aa826038 R14: 00007f38aa825fa0 R15: 00007ffd165c2df8 [ 30.422171][ T597] [ 30.729486][ T31] tipc: Node number set to 2886997162 [ 30.754039][ T608] FAULT_INJECTION: forcing a failure. [ 30.754039][ T608] name fail_futex, interval 1, probability 0, space 0, times 1 [ 30.766985][ T608] CPU: 1 UID: 0 PID: 608 Comm: syz.3.108 Not tainted syzkaller #0 60889c1c5e6bdc1f3cb1b6a230ba908545dccc71 [ 30.767020][ T608] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 30.767028][ T608] Call Trace: [ 30.767033][ T608] [ 30.767038][ T608] __dump_stack+0x21/0x30 [ 30.767061][ T608] dump_stack_lvl+0x140/0x1c0 [ 30.767076][ T608] ? __cfi_dump_stack_lvl+0x10/0x10 [ 30.767091][ T608] ? __kasan_check_write+0x18/0x20 [ 30.767104][ T608] dump_stack+0x19/0x20 [ 30.767117][ T608] should_fail_ex+0x3c2/0x510 [ 30.767137][ T608] should_fail+0xf/0x20 [ 30.767149][ T608] get_futex_key+0x178/0x940 [ 30.767170][ T608] ? ttwu_queue_wakelist+0x30f/0x4d0 [ 30.767186][ T608] ? __cfi_get_futex_key+0x10/0x10 [ 30.767201][ T608] ? __smp_call_single_queue+0xd8/0x380 [ 30.767213][ T608] ? ttwu_do_activate+0x620/0x620 [ 30.767226][ T608] ? ttwu_queue_wakelist+0x30f/0x4d0 [ 30.767239][ T608] futex_wait_setup+0xae/0x260 [ 30.767249][ T608] ? __cfi___futex_queue+0x10/0x10 [ 30.767263][ T608] ? __cfi_futex_wait_setup+0x10/0x10 [ 30.767274][ T608] ? __asan_memcpy+0x5a/0x80 [ 30.767286][ T608] __futex_wait+0x12c/0x3d0 [ 30.767296][ T608] ? __cfi___futex_wait+0x10/0x10 [ 30.767306][ T608] ? __cfi_futex_wake_mark+0x10/0x10 [ 30.767317][ T608] ? futex_wake+0x666/0x950 [ 30.767327][ T608] futex_wait+0x128/0x7c0 [ 30.767337][ T608] ? __cfi_futex_wait+0x10/0x10 [ 30.767348][ T608] do_futex+0x32a/0x510 [ 30.767366][ T608] ? __cfi_do_futex+0x10/0x10 [ 30.767379][ T608] __se_sys_futex+0x13c/0x320 [ 30.767393][ T608] ? __x64_sys_futex+0x110/0x110 [ 30.767408][ T608] __x64_sys_futex+0xe9/0x110 [ 30.767421][ T608] x64_sys_call+0x227f/0x2ee0 [ 30.767431][ T608] do_syscall_64+0x57/0xf0 [ 30.767442][ T608] ? clear_bhb_loop+0x50/0xa0 [ 30.767455][ T608] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 30.767469][ T608] RIP: 0033:0x7f38aa59e159 [ 30.767478][ T608] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 30.767488][ T608] RSP: 002b:00007f38ab5240e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 30.767500][ T608] RAX: ffffffffffffffda RBX: 00007f38aa825fa8 RCX: 00007f38aa59e159 [ 30.767508][ T608] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f38aa825fa8 [ 30.767515][ T608] RBP: 00007f38aa825fa0 R08: 0000000000000000 R09: 0000000000000000 [ 30.767522][ T608] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 30.767528][ T608] R13: 00007f38aa826038 R14: 00007ffd165c2d10 R15: 00007ffd165c2df8 [ 30.767537][ T608] [ 31.529483][ T9] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 31.679466][ T9] usb 2-1: Using ep0 maxpacket: 32 [ 31.685723][ T9] usb 2-1: config 155 has an invalid descriptor of length 0, skipping remainder of the config [ 31.699643][ T10] usb 1-1: USB disconnect, device number 2 [ 31.707645][ T9] usb 2-1: config 155 interface 0 altsetting 0 has an endpoint descriptor with address 0xE2, changing to 0x82 [ 31.719386][ T9] usb 2-1: config 155 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 31.730499][ T9] usb 2-1: config 155 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 11 [ 31.745192][ T9] usb 2-1: New USB device found, idVendor=15c2, idProduct=ffdc, bcdDevice=bd.30 [ 31.754353][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 31.763375][ T9] usb 2-1: Product: syz [ 31.767612][ T9] usb 2-1: Manufacturer: syz [ 31.772462][ T9] usb 2-1: SerialNumber: syz [ 31.901760][ T36] kauditd_printk_skb: 26 callbacks suppressed [ 31.901836][ T36] audit: type=1400 audit(1791071176.439:202): avc: denied { write } for pid=629 comm="syz.0.117" name="001" dev="devtmpfs" ino=117 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 32.733388][ T650] netlink: 'syz.0.124': attribute type 10 has an invalid length. [ 32.741199][ T650] netlink: 40 bytes leftover after parsing attributes in process `syz.0.124'. [ 32.750175][ T650] veth1: entered promiscuous mode [ 33.733548][ T36] audit: type=1400 audit(1791071178.279:203): avc: denied { read write } for pid=659 comm="syz.2.127" name="uhid" dev="devtmpfs" ino=199 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:uhid_device_t tclass=chr_file permissive=1 [ 33.803771][ T36] audit: type=1400 audit(1791071178.279:204): avc: denied { open } for pid=659 comm="syz.2.127" path="/dev/uhid" dev="devtmpfs" ino=199 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:uhid_device_t tclass=chr_file permissive=1 [ 33.855241][ T36] audit: type=1400 audit(1791071178.329:205): avc: denied { create } for pid=661 comm="syz.2.128" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 33.877433][ T36] audit: type=1400 audit(1791071178.329:206): avc: denied { write } for pid=661 comm="syz.2.128" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 33.898101][ T36] audit: type=1400 audit(1791071178.389:207): avc: denied { map } for pid=665 comm="syz.0.130" path="socket:[4883]" dev="sockfs" ino=4883 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 33.921099][ T36] audit: type=1400 audit(1791071178.389:208): avc: denied { read } for pid=665 comm="syz.0.130" path="socket:[4883]" dev="sockfs" ino=4883 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 34.008526][ T681] caif0: tun_chr_ioctl cmd 2148553947 [ 34.182304][ T36] audit: type=1400 audit(1791071178.559:209): avc: denied { read write } for pid=667 comm="syz.2.131" name="vhost-vsock" dev="devtmpfs" ino=200 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 34.206175][ T36] audit: type=1400 audit(1791071178.559:210): avc: denied { open } for pid=667 comm="syz.2.131" path="/dev/vhost-vsock" dev="devtmpfs" ino=200 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 34.230630][ T31] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 34.238294][ T36] audit: type=1400 audit(1791071178.559:211): avc: denied { ioctl } for pid=667 comm="syz.2.131" path="/dev/vhost-vsock" dev="devtmpfs" ino=200 ioctlcmd=0xaf01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 34.304651][ T10] usb 2-1: USB disconnect, device number 2 [ 34.440212][ T31] usb 4-1: Using ep0 maxpacket: 8 [ 34.446537][ T31] usb 4-1: config 168 descriptor has 1 excess byte, ignoring [ 34.453993][ T31] usb 4-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 34.465195][ T31] usb 4-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 34.570144][ T705] capability: warning: `syz.1.144' uses 32-bit capabilities (legacy support in use) [ 34.583881][ T31] usb 4-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 34.595997][ T31] usb 4-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 34.607426][ T31] usb 4-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 34.619166][ T31] usb 4-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 34.632771][ T31] usb 4-1: config 168 interface 0 has no altsetting 0 [ 34.642045][ T31] usb 4-1: config 168 descriptor has 1 excess byte, ignoring [ 34.649496][ T31] usb 4-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 34.660715][ T31] usb 4-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 34.672135][ T31] usb 4-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 34.684050][ T31] usb 4-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 34.699239][ T31] usb 4-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 34.711049][ T31] usb 4-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 34.724789][ T31] usb 4-1: config 168 interface 0 has no altsetting 0 [ 34.732870][ T31] usb 4-1: config 168 descriptor has 1 excess byte, ignoring [ 34.740337][ T31] usb 4-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 34.751504][ T31] usb 4-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 34.762916][ T31] usb 4-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 34.774761][ T31] usb 4-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 34.792741][ T31] usb 4-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 34.804572][ T31] usb 4-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 34.818518][ T31] usb 4-1: config 168 interface 0 has no altsetting 0 [ 34.827645][ T31] usb 4-1: string descriptor 0 read error: -22 [ 34.834242][ T31] usb 4-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 34.843340][ T31] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 34.859477][ T10] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 35.600880][ T10] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 35.601128][ T31] usb 4-1: USB disconnect, device number 6 [ 35.619536][ T10] usb 2-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 35.628787][ T10] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 35.673114][ T10] usb 2-1: config 0 descriptor?? [ 36.225763][ T768] syz.3.155 uses obsolete (PF_INET,SOCK_PACKET) [ 36.759514][ T10] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 36.920841][ T10] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 36.931168][ T10] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 36.941021][ T10] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 0 [ 36.950880][ T10] usb 1-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 36.965560][ T10] usb 1-1: New USB device found, idVendor=18d1, idProduct=1eaf, bcdDevice= 0.00 [ 36.974745][ T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 36.982825][ T10] usb 1-1: Product: syz [ 36.987062][ T10] usb 1-1: Manufacturer: syz [ 36.991774][ T10] usb 1-1: SerialNumber: syz [ 37.633225][ T31] usb 2-1: USB disconnect, device number 3 [ 37.655342][ T36] kauditd_printk_skb: 8 callbacks suppressed [ 37.655357][ T36] audit: type=1400 audit(1791071182.199:220): avc: denied { ioctl } for pid=813 comm="syz.1.171" path="socket:[5095]" dev="sockfs" ino=5095 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 37.686060][ T36] audit: type=1400 audit(1791071182.219:221): avc: denied { write } for pid=813 comm="syz.1.171" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 37.704910][ T820] netlink: 1752 bytes leftover after parsing attributes in process `syz.3.174'. [ 37.744959][ T36] audit: type=1400 audit(1791071182.289:222): avc: denied { connect } for pid=826 comm="syz.1.177" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 37.796384][ T36] audit: type=1400 audit(1791071182.339:223): avc: denied { shutdown } for pid=826 comm="syz.1.177" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 38.601260][ T841] overlayfs: failed to create directory ./bus/work (errno: 13); mounting read-only [ 38.620837][ T36] audit: type=1400 audit(1791071183.169:224): avc: denied { mounton } for pid=842 comm="syz.1.184" path="/proc/128/task" dev="proc" ino=6194 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=dir permissive=1 [ 38.744401][ T36] audit: type=1400 audit(1791071183.289:225): avc: denied { getopt } for pid=864 comm="syz.1.194" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 39.608445][ T778] usb 1-1: USB disconnect, device number 3 [ 39.775748][ T891] netlink: 8 bytes leftover after parsing attributes in process `syz.3.204'. [ 39.963084][ T903] FAULT_INJECTION: forcing a failure. [ 39.963084][ T903] name fail_futex, interval 1, probability 0, space 0, times 0 [ 39.976728][ T903] CPU: 1 UID: 0 PID: 903 Comm: syz.0.210 Not tainted syzkaller #0 60889c1c5e6bdc1f3cb1b6a230ba908545dccc71 [ 39.976764][ T903] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 39.976777][ T903] Call Trace: [ 39.976784][ T903] [ 39.976791][ T903] __dump_stack+0x21/0x30 [ 39.976825][ T903] dump_stack_lvl+0x140/0x1c0 [ 39.976853][ T903] ? __cfi_dump_stack_lvl+0x10/0x10 [ 39.976883][ T903] dump_stack+0x19/0x20 [ 39.976909][ T903] should_fail_ex+0x3c2/0x510 [ 39.976935][ T903] should_fail+0xf/0x20 [ 39.976957][ T903] get_futex_key+0x178/0x940 [ 39.976981][ T903] ? __cfi___futex_wait+0x10/0x10 [ 39.977000][ T903] ? __cfi_get_futex_key+0x10/0x10 [ 39.977024][ T903] ? __cfi_futex_wake_mark+0x10/0x10 [ 39.977043][ T903] futex_wake+0x150/0x950 [ 39.977059][ T903] ? futex_wait+0x2b8/0x7c0 [ 39.977077][ T903] ? __cfi_futex_wake+0x10/0x10 [ 39.977096][ T903] ? _raw_spin_unlock+0x45/0x60 [ 39.977117][ T903] ? finish_task_switch+0x139/0x770 [ 39.977143][ T903] do_futex+0x37d/0x510 [ 39.977169][ T903] ? __cfi_do_futex+0x10/0x10 [ 39.977194][ T903] __se_sys_futex+0x13c/0x320 [ 39.977220][ T903] ? fput+0x1a4/0x230 [ 39.977245][ T903] ? __x64_sys_futex+0x110/0x110 [ 39.977271][ T903] ? __cfi_ksys_write+0x10/0x10 [ 39.977293][ T903] __x64_sys_futex+0xe9/0x110 [ 39.977319][ T903] x64_sys_call+0x227f/0x2ee0 [ 39.977338][ T903] do_syscall_64+0x57/0xf0 [ 39.977357][ T903] ? clear_bhb_loop+0x50/0xa0 [ 39.977383][ T903] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 39.977407][ T903] RIP: 0033:0x7ff840f9e159 [ 39.977425][ T903] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 39.977442][ T903] RSP: 002b:00007ff841de00e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 39.977464][ T903] RAX: ffffffffffffffda RBX: 00007ff841225fa8 RCX: 00007ff840f9e159 [ 39.977480][ T903] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007ff841225fac [ 39.977493][ T903] RBP: 00007ff841225fa0 R08: 4000000000000000 R09: 0000000000000000 [ 39.977507][ T903] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 [ 39.977521][ T903] R13: 00007ff841226038 R14: 00007fff5d47ee90 R15: 00007fff5d47ef78 [ 39.977542][ T903] [ 40.429505][ T31] usb 4-1: new full-speed USB device number 7 using dummy_hcd [ 40.463355][ T36] audit: type=1400 audit(1791071185.009:226): avc: denied { create } for pid=906 comm="syz.0.211" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 40.580543][ T31] usb 4-1: config 4 has an invalid interface number: 44 but max is 0 [ 40.588690][ T31] usb 4-1: config 4 has an invalid descriptor of length 0, skipping remainder of the config [ 40.590320][ T36] audit: type=1400 audit(1791071185.129:227): avc: denied { ioctl } for pid=919 comm="syz.1.217" path="socket:[5748]" dev="sockfs" ino=5748 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 40.598980][ T31] usb 4-1: config 4 has no interface number 0 [ 40.624056][ T920] batadv_slave_0: entered promiscuous mode [ 40.634422][ T31] usb 4-1: config 4 interface 44 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 40.637501][ T919] batadv_slave_0: left promiscuous mode [ 40.649546][ T31] usb 4-1: New USB device found, idVendor=1044, idProduct=7001, bcdDevice= 5.20 [ 40.662694][ T31] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 40.670718][ T31] usb 4-1: Product: syz [ 40.675017][ T31] usb 4-1: Manufacturer: syz [ 40.681888][ T31] usb 4-1: SerialNumber: syz [ 40.688226][ T36] audit: type=1400 audit(1791071185.229:228): avc: denied { setopt } for pid=921 comm="syz.1.218" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 40.708020][ T36] audit: type=1400 audit(1791071185.229:229): avc: denied { name_bind } for pid=922 comm="syz.2.219" src=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:reserved_port_t tclass=tcp_socket permissive=1 [ 40.759480][ T778] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 40.920492][ T778] usb 1-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 40.929657][ T778] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 40.942601][ T778] usb 1-1: config 0 descriptor?? [ 42.488861][ T956] FAULT_INJECTION: forcing a failure. [ 42.488861][ T956] name failslab, interval 1, probability 0, space 0, times 0 [ 42.501550][ T956] CPU: 0 UID: 0 PID: 956 Comm: syz.2.231 Not tainted syzkaller #0 60889c1c5e6bdc1f3cb1b6a230ba908545dccc71 [ 42.501583][ T956] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 42.501594][ T956] Call Trace: [ 42.501598][ T956] [ 42.501604][ T956] __dump_stack+0x21/0x30 [ 42.501626][ T956] dump_stack_lvl+0x140/0x1c0 [ 42.501642][ T956] ? __cfi_dump_stack_lvl+0x10/0x10 [ 42.501668][ T956] dump_stack+0x19/0x20 [ 42.501682][ T956] should_fail_ex+0x3c2/0x510 [ 42.501696][ T956] should_failslab+0xac/0x100 [ 42.501711][ T956] kmem_cache_alloc_noprof+0x42/0x410 [ 42.501724][ T956] ? alloc_empty_file+0xbf/0x270 [ 42.501738][ T956] ? _raw_spin_unlock+0x45/0x60 [ 42.501749][ T956] alloc_empty_file+0xbf/0x270 [ 42.501762][ T956] ? _raw_spin_unlock+0x45/0x60 [ 42.501773][ T956] alloc_file_pseudo+0x142/0x1f0 [ 42.501786][ T956] ? security_inode_init_security_anon+0x3e/0x110 [ 42.501801][ T956] ? __cfi_alloc_file_pseudo+0x10/0x10 [ 42.501819][ T956] ? anon_inode_make_secure_inode+0xf5/0x150 [ 42.501834][ T956] ? __cfi_anon_inode_make_secure_inode+0x10/0x10 [ 42.501850][ T956] __anon_inode_getfile+0x12e/0x200 [ 42.501865][ T956] anon_inode_create_getfile+0x3f/0x50 [ 42.501879][ T956] new_userfaultfd+0x1f6/0x410 [ 42.501891][ T956] __x64_sys_userfaultfd+0x89/0xb0 [ 42.501903][ T956] x64_sys_call+0x2950/0x2ee0 [ 42.501913][ T956] do_syscall_64+0x57/0xf0 [ 42.501924][ T956] ? clear_bhb_loop+0x50/0xa0 [ 42.501938][ T956] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 42.501951][ T956] RIP: 0033:0x7f6326d9e159 [ 42.501961][ T956] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 42.501970][ T956] RSP: 002b:00007f6327c1f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000143 [ 42.501983][ T956] RAX: ffffffffffffffda RBX: 00007f6327025fa0 RCX: 00007f6326d9e159 [ 42.501991][ T956] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000080001 [ 42.501997][ T956] RBP: 00007f6326e3506b R08: 0000000000000000 R09: 0000000000000000 [ 42.502004][ T956] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 42.502010][ T956] R13: 00007f6327026038 R14: 00007f6327025fa0 R15: 00007fffc48c3d58 [ 42.502019][ T956] [ 42.735249][ T36] kauditd_printk_skb: 9 callbacks suppressed [ 42.735339][ T36] audit: type=1400 audit(1791071187.279:239): avc: denied { write } for pid=957 comm="syz.2.232" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=key permissive=1 [ 42.844661][ T905] usb 4-1: USB disconnect, device number 7 [ 42.860495][ T36] audit: type=1400 audit(1791071187.409:240): avc: denied { create } for pid=972 comm="syz.3.238" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 42.885739][ T36] audit: type=1400 audit(1791071187.429:241): avc: denied { ioctl } for pid=974 comm="syz.3.239" path="/dev/fuse" dev="devtmpfs" ino=23 ioctlcmd=0xe500 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 43.019703][ T967] FAULT_INJECTION: forcing a failure. [ 43.019703][ T967] name failslab, interval 1, probability 0, space 0, times 0 [ 43.039671][ T967] CPU: 1 UID: 0 PID: 967 Comm: syz.1.236 Not tainted syzkaller #0 60889c1c5e6bdc1f3cb1b6a230ba908545dccc71 [ 43.039706][ T967] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 43.039719][ T967] Call Trace: [ 43.039726][ T967] [ 43.039734][ T967] __dump_stack+0x21/0x30 [ 43.039765][ T967] dump_stack_lvl+0x140/0x1c0 [ 43.039791][ T967] ? __cfi_dump_stack_lvl+0x10/0x10 [ 43.039816][ T967] ? skb_append_pagefrags+0x2e2/0x660 [ 43.039839][ T967] dump_stack+0x19/0x20 [ 43.039861][ T967] should_fail_ex+0x3c2/0x510 [ 43.039883][ T967] should_failslab+0xac/0x100 [ 43.039909][ T967] kmem_cache_alloc_node_noprof+0x45/0x420 [ 43.039929][ T967] ? __alloc_skb+0x10c/0x360 [ 43.039951][ T967] __alloc_skb+0x10c/0x360 [ 43.039974][ T967] ? tcp_current_mss+0x539/0x8b0 [ 43.040001][ T967] tcp_stream_alloc_skb+0x43/0x370 [ 43.040028][ T967] ? __kasan_check_write+0x18/0x20 [ 43.040047][ T967] tcp_sendmsg_locked+0xcbc/0x4ac0 [ 43.040077][ T967] ? __kasan_check_write+0x18/0x20 [ 43.040097][ T967] ? __cfi__raw_spin_lock_bh+0x10/0x10 [ 43.040121][ T967] ? __cfi_tcp_sendmsg_locked+0x10/0x10 [ 43.040148][ T967] ? _raw_spin_lock_bh+0x96/0x130 [ 43.040169][ T967] ? dequeue_entity+0x88a/0x13b0 [ 43.040195][ T967] ? release_sock+0x171/0x1f0 [ 43.040218][ T967] ? __cfi_tcp_sendmsg+0x10/0x10 [ 43.040245][ T967] tcp_sendmsg+0x3e/0xd0 [ 43.040272][ T967] ? __cfi_tcp_sendmsg+0x10/0x10 [ 43.040299][ T967] inet_sendmsg+0xb7/0x120 [ 43.040320][ T967] ? __cfi_inet_sendmsg+0x10/0x10 [ 43.040340][ T967] sock_sendmsg+0x383/0x470 [ 43.040364][ T967] ? __cfi_sock_sendmsg+0x10/0x10 [ 43.040385][ T967] ? unwind_get_return_address+0x51/0x90 [ 43.040413][ T967] ? __asan_memset+0x39/0x50 [ 43.040442][ T967] ? iov_iter_bvec+0xc0/0x180 [ 43.040472][ T967] splice_to_socket+0xb8c/0x1290 [ 43.040504][ T967] ? __cfi_splice_to_socket+0x10/0x10 [ 43.040538][ T967] ? __cfi_splice_to_socket+0x10/0x10 [ 43.040564][ T967] direct_splice_actor+0x279/0x4b0 [ 43.040591][ T967] splice_direct_to_actor+0x4fa/0xbf0 [ 43.040619][ T967] ? __cfi_direct_splice_actor+0x10/0x10 [ 43.040642][ T967] ? __cfi_splice_direct_to_actor+0x10/0x10 [ 43.040666][ T967] do_splice_direct+0x196/0x290 [ 43.040693][ T967] ? __cfi_do_splice_direct+0x10/0x10 [ 43.040719][ T967] ? __cfi_direct_file_splice_eof+0x10/0x10 [ 43.040746][ T967] ? security_file_permission+0x38/0xf0 [ 43.040767][ T967] ? rw_verify_area+0xac/0x230 [ 43.040789][ T967] do_sendfile+0x511/0xed0 [ 43.040812][ T967] ? notify_change+0xc09/0xef0 [ 43.040833][ T967] ? vfs_writev+0xe90/0xe90 [ 43.040858][ T967] ? __se_sys_futex+0x13c/0x320 [ 43.040885][ T967] __x64_sys_sendfile64+0x19d/0x200 [ 43.040911][ T967] ? __cfi___x64_sys_sendfile64+0x10/0x10 [ 43.040935][ T967] ? switch_fpu_return+0x12/0x20 [ 43.040960][ T967] x64_sys_call+0xa26/0x2ee0 [ 43.040979][ T967] do_syscall_64+0x57/0xf0 [ 43.040999][ T967] ? clear_bhb_loop+0x50/0xa0 [ 43.041024][ T967] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 43.041049][ T967] RIP: 0033:0x7f943939e159 [ 43.041067][ T967] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 43.041084][ T967] RSP: 002b:00007f943a242028 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 43.041106][ T967] RAX: ffffffffffffffda RBX: 00007f9439625fa0 RCX: 00007f943939e159 [ 43.041121][ T967] RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000004 [ 43.041134][ T967] RBP: 00007f943943506b R08: 0000000000000000 R09: 0000000000000000 [ 43.041148][ T967] R10: 000000007ffff004 R11: 0000000000000246 R12: 0000000000000000 [ 43.041161][ T967] R13: 00007f9439626038 R14: 00007f9439625fa0 R15: 00007ffcd1ad0918 [ 43.041178][ T967] [ 43.617228][ T778] usb 1-1: USB disconnect, device number 4 [ 44.989483][ T36] audit: type=1400 audit(1791071189.529:242): avc: denied { write } for pid=1023 comm="syz.3.259" name="unix" dev="proc" ino=4026532492 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_net_t tclass=file permissive=1 [ 45.114756][ T1017] kvm: Disabled LAPIC found during irq injection [ 45.121149][ T1017] kvm: apic: phys broadcast and lowest prio [ 45.312582][ T36] audit: type=1400 audit(1791071189.859:243): avc: denied { create } for pid=1043 comm="syz.3.266" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 45.540937][ T905] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 45.711730][ T905] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 45.723031][ T905] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 45.733220][ T1054] FAULT_INJECTION: forcing a failure. [ 45.733220][ T1054] name fail_futex, interval 1, probability 0, space 0, times 0 [ 45.733561][ T36] audit: type=1400 audit(1791071190.279:244): avc: denied { append } for pid=1053 comm="syz.0.270" name="ptp0" dev="devtmpfs" ino=196 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 45.770709][ T1054] CPU: 0 UID: 0 PID: 1054 Comm: syz.0.270 Not tainted syzkaller #0 60889c1c5e6bdc1f3cb1b6a230ba908545dccc71 [ 45.770741][ T1054] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 45.770752][ T1054] Call Trace: [ 45.770758][ T1054] [ 45.770766][ T1054] __dump_stack+0x21/0x30 [ 45.770798][ T1054] dump_stack_lvl+0x140/0x1c0 [ 45.770822][ T1054] ? __cfi_dump_stack_lvl+0x10/0x10 [ 45.770848][ T1054] dump_stack+0x19/0x20 [ 45.770863][ T905] usb 3-1: New USB device found, idVendor=9710, idProduct=7810, bcdDevice= 1.00 [ 45.770872][ T1054] should_fail_ex+0x3c2/0x510 [ 45.770896][ T1054] should_fail+0xf/0x20 [ 45.770914][ T1054] get_futex_key+0x178/0x940 [ 45.770938][ T1054] ? __cfi_get_futex_key+0x10/0x10 [ 45.770963][ T1054] ? preempt_schedule_common+0x2d/0x60 [ 45.770987][ T1054] ? preempt_schedule+0xc5/0xe0 [ 45.771008][ T1054] ? __cfi_preempt_schedule+0x10/0x10 [ 45.771030][ T1054] futex_wait_setup+0xae/0x260 [ 45.771047][ T1054] ? preempt_schedule_thunk+0x1a/0x40 [ 45.771068][ T1054] ? __cfi_futex_wait_setup+0x10/0x10 [ 45.771086][ T1054] ? __asan_memcpy+0x5a/0x80 [ 45.771106][ T1054] __futex_wait+0x12c/0x3d0 [ 45.771123][ T1054] ? __cfi___futex_wait+0x10/0x10 [ 45.771141][ T1054] ? __cfi_futex_wake_mark+0x10/0x10 [ 45.771169][ T1054] ? futex_wake+0x666/0x950 [ 45.771187][ T1054] futex_wait+0x128/0x7c0 [ 45.771205][ T1054] ? __cfi_futex_wait+0x10/0x10 [ 45.771228][ T1054] do_futex+0x32a/0x510 [ 45.771254][ T1054] ? __cfi_do_futex+0x10/0x10 [ 45.771280][ T1054] __se_sys_futex+0x13c/0x320 [ 45.771305][ T1054] ? __cfi_arch_do_signal_or_restart+0x10/0x10 [ 45.771326][ T1054] ? __x64_sys_futex+0x110/0x110 [ 45.771350][ T1054] ? __kasan_check_write+0x18/0x20 [ 45.771370][ T1054] __x64_sys_futex+0xe9/0x110 [ 45.771394][ T1054] x64_sys_call+0x227f/0x2ee0 [ 45.771411][ T1054] do_syscall_64+0x57/0xf0 [ 45.771430][ T1054] ? clear_bhb_loop+0x50/0xa0 [ 45.771453][ T1054] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 45.771477][ T1054] RIP: 0033:0x7ff840f9e159 [ 45.771493][ T1054] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 45.771509][ T1054] RSP: 002b:00007ff841de00e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 45.771529][ T1054] RAX: ffffffffffffffda RBX: 00007ff841225fa8 RCX: 00007ff840f9e159 [ 45.771543][ T1054] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007ff841225fa8 [ 45.771555][ T1054] RBP: 00007ff841225fa0 R08: 0000000000000000 R09: 0000000000000000 [ 45.771567][ T1054] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 45.771579][ T1054] R13: 00007ff841226038 R14: 00007fff5d47ee90 R15: 00007fff5d47ef78 [ 45.771595][ T1054] [ 46.144161][ T1056] netlink: 4 bytes leftover after parsing attributes in process `syz.0.271'. [ 46.166486][ T36] audit: type=1400 audit(1791071190.649:245): avc: denied { bind } for pid=1055 comm="syz.0.271" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 46.173815][ T905] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 46.215065][ T36] audit: type=1400 audit(1791071190.649:246): avc: denied { setopt } for pid=1055 comm="syz.0.271" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 46.244903][ T905] usb 3-1: Product: syz [ 46.249190][ T905] usb 3-1: Manufacturer: syz [ 46.815630][ T1079] caif0: tun_chr_ioctl cmd 2148553947 [ 47.132550][ T1089] netlink: 8 bytes leftover after parsing attributes in process `syz.3.284'. [ 47.159658][ T36] audit: type=1400 audit(1791071191.699:247): avc: denied { bind } for pid=1090 comm="syz.1.285" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 47.178875][ T36] audit: type=1400 audit(1791071191.709:248): avc: denied { setopt } for pid=1090 comm="syz.1.285" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 47.206953][ T1095] netlink: 24 bytes leftover after parsing attributes in process `syz.0.287'. [ 47.215911][ T1095] netlink: 16 bytes leftover after parsing attributes in process `syz.0.287'. [ 47.289788][ T1104] Unsupported ieee802154 address type: 0 [ 47.549471][ T778] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 47.699476][ T778] usb 2-1: Using ep0 maxpacket: 8 [ 47.705788][ T778] usb 2-1: config 0 has no interfaces? [ 47.712641][ T778] usb 2-1: New USB device found, idVendor=082d, idProduct=0100, bcdDevice=70.4b [ 47.721806][ T778] usb 2-1: New USB device strings: Mfr=44, Product=2, SerialNumber=3 [ 47.729900][ T778] usb 2-1: Product: syz [ 47.734104][ T778] usb 2-1: Manufacturer: syz [ 47.738698][ T778] usb 2-1: SerialNumber: syz [ 47.743899][ T778] usb 2-1: config 0 descriptor?? [ 47.950864][ T778] usb 2-1: USB disconnect, device number 4 [ 48.278353][ T905] usb 3-1: USB disconnect, device number 4 [ 48.331194][ T1153] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 48.457798][ T1165] netlink: 8 bytes leftover after parsing attributes in process `syz.0.313'. [ 48.557735][ T1172] netlink: 16 bytes leftover after parsing attributes in process `syz.1.316'. [ 48.668347][ T36] kauditd_printk_skb: 3 callbacks suppressed [ 48.668365][ T36] audit: type=1400 audit(1791071193.209:252): avc: denied { bind } for pid=1173 comm="syz.1.317" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 48.727138][ T1174] netlink: 64 bytes leftover after parsing attributes in process `syz.1.317'. [ 48.828545][ T1179] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=198462431 (396924862 ns) > initial count (200000 ns). Using initial count to start timer. [ 48.971519][ T1190] FAULT_INJECTION: forcing a failure. [ 48.971519][ T1190] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 48.984661][ T1190] CPU: 0 UID: 0 PID: 1190 Comm: syz.0.323 Not tainted syzkaller #0 60889c1c5e6bdc1f3cb1b6a230ba908545dccc71 [ 48.984692][ T1190] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 48.984704][ T1190] Call Trace: [ 48.984710][ T1190] [ 48.984716][ T1190] __dump_stack+0x21/0x30 [ 48.984746][ T1190] dump_stack_lvl+0x140/0x1c0 [ 48.984769][ T1190] ? __cfi_dump_stack_lvl+0x10/0x10 [ 48.984793][ T1190] dump_stack+0x19/0x20 [ 48.984815][ T1190] should_fail_ex+0x3c2/0x510 [ 48.984837][ T1190] should_fail+0xf/0x20 [ 48.984854][ T1190] should_fail_usercopy+0x1e/0x30 [ 48.984874][ T1190] _copy_to_iter+0x3b6/0x1520 [ 48.984897][ T1190] ? __cfi__copy_to_iter+0x10/0x10 [ 48.984920][ T1190] ? preempt_schedule+0xc5/0xe0 [ 48.984940][ T1190] get_random_bytes_user+0x1d1/0x3d0 [ 48.984957][ T1190] ? mix_interrupt_randomness+0x240/0x240 [ 48.984976][ T1190] ? __cfi_try_to_wake_up+0x10/0x10 [ 48.984994][ T1190] ? avc_policy_seqno+0xd/0x30 [ 48.985014][ T1190] ? selinux_file_permission+0x318/0xb60 [ 48.985031][ T1190] urandom_read_iter+0x2b/0x170 [ 48.985046][ T1190] do_iter_readv_writev+0x62c/0x820 [ 48.985066][ T1190] ? vfs_iter_read+0x5e0/0x5e0 [ 48.985084][ T1190] ? bpf_lsm_file_permission+0xd/0x20 [ 48.985106][ T1190] vfs_readv+0x301/0xa00 [ 48.985127][ T1190] ? do_readv+0x2e0/0x2e0 [ 48.985146][ T1190] ? vfs_write+0xbcf/0xfd0 [ 48.985166][ T1190] do_readv+0x151/0x2e0 [ 48.985186][ T1190] ? generic_atomic_write_valid+0x1d0/0x1d0 [ 48.985207][ T1190] ? __kasan_check_write+0x18/0x20 [ 48.985224][ T1190] ? fpregs_restore_userregs+0x11c/0x260 [ 48.985245][ T1190] __x64_sys_readv+0x81/0x90 [ 48.985263][ T1190] x64_sys_call+0x2a64/0x2ee0 [ 48.985278][ T1190] do_syscall_64+0x57/0xf0 [ 48.985294][ T1190] ? clear_bhb_loop+0x50/0xa0 [ 48.985315][ T1190] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 48.985335][ T1190] RIP: 0033:0x7ff840f9e159 [ 48.985349][ T1190] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 48.985363][ T1190] RSP: 002b:00007ff841de0028 EFLAGS: 00000246 ORIG_RAX: 0000000000000013 [ 48.985382][ T1190] RAX: ffffffffffffffda RBX: 00007ff841225fa0 RCX: 00007ff840f9e159 [ 48.985394][ T1190] RDX: 0000000000000002 RSI: 0000200000001340 RDI: 0000000000000003 [ 48.985412][ T1190] RBP: 00007ff84103506b R08: 0000000000000000 R09: 0000000000000000 [ 48.985425][ T1190] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 48.985436][ T1190] R13: 00007ff841226038 R14: 00007ff841225fa0 R15: 00007fff5d47ef78 [ 48.985451][ T1190] [ 49.291555][ T36] audit: type=1400 audit(1791071193.829:253): avc: denied { read } for pid=1199 comm="syz.1.328" name="ppp" dev="devtmpfs" ino=86 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 49.314072][ T36] audit: type=1400 audit(1791071193.829:254): avc: denied { open } for pid=1199 comm="syz.1.328" path="/dev/ppp" dev="devtmpfs" ino=86 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 49.337609][ T36] audit: type=1400 audit(1791071193.839:255): avc: denied { ioctl } for pid=1199 comm="syz.1.328" path="/dev/ppp" dev="devtmpfs" ino=86 ioctlcmd=0x7438 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 49.385000][ T36] audit: type=1400 audit(1791071193.929:256): avc: denied { remount } for pid=1206 comm="syz.3.332" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 49.504922][ T36] audit: type=1400 audit(1791071194.049:257): avc: denied { connect } for pid=1215 comm="syz.2.335" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 49.518316][ T1218] ------------[ cut here ]------------ [ 49.529891][ T1218] WARNING: CPU: 1 PID: 1218 at crypto/rsa-pkcs1pad.c:560 pkcs1pad_verify+0x4e4/0x700 [ 49.539350][ T1218] Modules linked in: [ 49.543260][ T1218] CPU: 1 UID: 0 PID: 1218 Comm: syz.1.336 Not tainted syzkaller #0 60889c1c5e6bdc1f3cb1b6a230ba908545dccc71 [ 49.554846][ T1218] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 49.565056][ T1218] RIP: 0010:pkcs1pad_verify+0x4e4/0x700 [ 49.570649][ T1218] Code: 11 00 00 48 83 c4 20 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc e8 2a 19 06 ff 0f 0b b8 ea ff ff ff eb de e8 1c 19 06 ff <0f> 0b b8 ea ff ff ff eb d0 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 5d [ 49.590284][ T1218] RSP: 0018:ffffc9000eab7728 EFLAGS: 00010287 [ 49.596358][ T1218] RAX: ffffffff82815f84 RBX: ffff88811f460000 RCX: 0000000000080000 [ 49.604346][ T1218] RDX: ffffc90001ad2000 RSI: 0000000000000c9e RDI: 0000000000000c9f [ 49.612439][ T1218] RBP: ffffc9000eab7770 R08: ffffc9000eab782f R09: 0000000000000000 [ 49.620470][ T1218] R10: 0000000000000000 R11: ffffffff82815aa0 R12: ffff88811f5cd008 [ 49.628449][ T1218] R13: 0000000000000000 R14: dffffc0000000000 R15: ffff88811f460038 [ 49.636433][ T1218] FS: 00007f943a2426c0(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 49.645394][ T1218] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 49.651998][ T1218] CR2: 000000110c2fa7b9 CR3: 000000010cfae000 CR4: 00000000003526b0 [ 49.660054][ T1218] Call Trace: [ 49.663323][ T1218] [ 49.666265][ T1218] ? __asan_memcpy+0x5a/0x80 [ 49.671040][ T1218] crypto_sig_verify+0x1cd/0x260 [ 49.675996][ T1218] ? __cfi_crypto_sig_verify+0x10/0x10 [ 49.679479][ T778] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 49.681483][ T1218] ? crypto_sig_set_pubkey+0x9a/0xb0 [ 49.694198][ T1218] public_key_verify_signature+0x654/0xa40 [ 49.700032][ T1218] ? __se_sys_keyctl+0x743/0xe40 [ 49.704976][ T1218] ? __x64_sys_keyctl+0xc3/0xf0 [ 49.709870][ T1218] ? x64_sys_call+0x996/0x2ee0 [ 49.714634][ T1218] ? __cfi_public_key_verify_signature+0x10/0x10 [ 49.720987][ T1218] ? __cfi_public_key_verify_signature_2+0x10/0x10 [ 49.727496][ T1218] public_key_verify_signature_2+0x47/0x60 [ 49.733313][ T1218] verify_signature+0xf0/0x120 [ 49.738086][ T1218] asymmetric_key_verify_signature+0x160/0x200 [ 49.744307][ T1218] ? __cfi_asymmetric_key_verify_signature+0x10/0x10 [ 49.751035][ T1218] ? __kasan_check_write+0x18/0x20 [ 49.756149][ T1218] ? _copy_from_user+0x87/0xa0 [ 49.760938][ T1218] ? memdup_user+0xb1/0x170 [ 49.765448][ T1218] keyctl_pkey_verify+0x200/0x290 [ 49.770482][ T1218] ? __cfi_keyctl_pkey_verify+0x10/0x10 [ 49.776028][ T1218] __se_sys_keyctl+0x743/0xe40 [ 49.780816][ T1218] ? __x64_sys_keyctl+0xf0/0xf0 [ 49.785682][ T1218] ? __cfi_do_futex+0x10/0x10 [ 49.790372][ T1218] ? kvfree_sensitive+0x51/0x70 [ 49.795222][ T1218] ? __se_sys_futex+0x13c/0x320 [ 49.800094][ T1218] ? xfd_validate_state+0x68/0x140 [ 49.805229][ T1218] ? __kasan_check_write+0x18/0x20 [ 49.810483][ T1218] ? fpregs_restore_userregs+0x11c/0x260 [ 49.816147][ T1218] __x64_sys_keyctl+0xc3/0xf0 [ 49.820842][ T1218] x64_sys_call+0x996/0x2ee0 [ 49.825443][ T1218] do_syscall_64+0x57/0xf0 [ 49.829869][ T1218] ? clear_bhb_loop+0x50/0xa0 [ 49.834573][ T1218] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 49.839452][ T778] usb 4-1: Using ep0 maxpacket: 32 [ 49.840483][ T1218] RIP: 0033:0x7f943939e159 [ 49.847369][ T778] usb 4-1: unable to get BOS descriptor or descriptor too short [ 49.849997][ T1218] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 49.850018][ T1218] RSP: 002b:00007f943a242028 EFLAGS: 00000246 [ 49.858682][ T778] usb 4-1: config 14 has an invalid interface number: 57 but max is 1 [ 49.877269][ T1218] ORIG_RAX: 00000000000000fa [ 49.877282][ T1218] RAX: ffffffffffffffda RBX: 00007f9439625fa0 RCX: 00007f943939e159 [ 49.883695][ T778] usb 4-1: config 14 has an invalid interface number: 228 but max is 1 [ 49.891493][ T1218] RDX: 0000200000000180 RSI: 0000200000000000 RDI: 000000000000001c [ 49.891511][ T1218] RBP: 00007f943943506b R08: 0000200000000840 R09: 0000000000000000 [ 49.896526][ T778] usb 4-1: config 14 has no interface number 0 [ 49.904174][ T1218] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 49.912670][ T778] usb 4-1: config 14 has no interface number 1 [ 49.920391][ T1218] R13: 00007f9439626038 R14: 00007f9439625fa0 R15: 00007ffcd1ad0918 [ 49.920412][ T1218] [ 49.928718][ T778] usb 4-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 49.934537][ T1218] ---[ end trace 0000000000000000 ]--- [ 49.976302][ T778] usb 4-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 49.988094][ T778] usb 4-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 49.999586][ T778] usb 4-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 50.011021][ T778] usb 4-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 50.022388][ T778] usb 4-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 50.035534][ T778] usb 4-1: config 14 interface 57 has no altsetting 0 [ 50.042364][ T778] usb 4-1: config 14 interface 228 has no altsetting 0 [ 50.050791][ T778] usb 4-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 50.060053][ T778] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 50.068072][ T778] usb 4-1: Product: syz [ 50.072471][ T778] usb 4-1: Manufacturer: syz [ 50.077077][ T778] usb 4-1: SerialNumber: syz [ 52.605475][ T31] usb 4-1: USB disconnect, device number 8