last executing test programs: 2.394744028s ago: executing program 0 (id=1): r0 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x40, 0x458, 0x5005, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0xf0, 0x7e, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x0, 0x2, 0x0, {0x9, 0x21, 0x7ffd, 0x0, 0x1, {0x22, 0xeb}}, {{{0x9, 0x5, 0x81, 0x3, 0x10, 0xfc}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, 0x0, &(0x7f00000001c0)={0x0, 0x22, 0x371, {0x9}}}, &(0x7f0000000080)={0xffffffffffffffeb, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = syz_open_dev$evdev(&(0x7f00000000c0), 0x40, 0x0) ioctl$EVIOCGKEYCODE_V2(r1, 0x80284504, 0x0) 2.353449596s ago: executing program 2 (id=3): r0 = add_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000100)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffc) add_key(&(0x7f0000000040)='asymmetric\x00', 0x0, &(0x7f0000000200)="308205553082033da00302010202147398ea982dd02ea8b1cf57c7f297b3e61afc8c0a300d06092a864886f70d01010b050030343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b65793020170d3232303531383232333234315a180f32313232303432343232333234315a30343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b657a30820222300d06092a864886f70d01010105000382020f003082020a0282020100ccac49dd3bcab0157e846ab20a695f1c0a61823b4f2ca3952c08584bb15d99e0c3c179c2b3ebc01e6d3e541dbdb7927b4db59558b2522ec6244b7163803277a7385edb72ae6e0decfbb66d017fe95566dfbf1d76780231e8e507f8b7825c0dd4bbfba2590d2e3a78953a8b4606474446d7cd066a4113e319f6bb6e38f48301a3bf4a394fd70ae938b3f594144eddf743fd24b2493ca5f77a7cd4453d977568f1ed4c420b70ca85f3dee5882cc5beb69734ba2402cd8b869fa973ca73cf9281ee7555bb18675cff3fb5dd331b0ce978db5ccfaa5c4342df5ea96decd7d7ffe6a13a921adaaef68c6f7bd5b46e06e98fe8de093189ed0e11a1fa8ae9e964596253dad170be11d4999711cf99de0b9d947eaab852ea37db907e35bdd9fe6d0a487028ddd50d7f03809314238fb922cd7c29fef172b55c0b12cf9c15f6114c7a45258c450a34ac2d9a81ca0b1322cdeb1a38881897960881aacc8f0f8a327b7668036843bf11ba5560fd801c0d9b69b60972bc0f412f0782c6e3b21391c46d149531be19bdbcede14c74a2e0780bbb94ec4c533aa2b5841d4b657edcf7db367dbe9e3b366642667635bfbef0c13c7ce9425c24530305a86724500275ff24463b358976e670dac5518c9ae505b00bd02dd47d5775946bf90aad0e410015d04fc07f902d18488f28fe5da7cd999ebd026c8a31f31cc74be693cd42a2e46810479dfc210203010001a35d305b300c0603551d130101ff04023000300b0603551d0f040403020780301d0603551d0e04160414f58703bb33ce1b73ee02eccdee5b8817518fe3db301f0603551d23041830168014f58703bb33ce1b73ee02eccdee5b8817518fe3db300d06092a864886f70d01010b05000382020100c02e12417b738516c8db8679e8f5cd44f4c6e281235e47cbab25f11e583e317f78ad85ebfe148860f77fd226a2f4982afdba050c203312cc4d1461648193d333edc8fff178cc5f519f09d7be0d5c74fd9bdf524ac9a871253304106736d0b30bc9a14072ae417b68e6e47bd028f76de73f50fc917c9156d4dfa6bbe84d1b58aa28fac119eb112f248b7cc5a98626aa6eb79bd5f806fb02527b9c9ea1e0078b5ee4b85529f648521c1b542d46d8e571b960d145b592898a63582ab3c6b276e23c825904ae5ac4997b2e4b4657b82924b2fdee2c0da483fa652a07358b97cfbd962ed17e6cc21e87b66c7665b5b262da8be973e3db33dd133a17636a76de8d8fe04761283a83ff8fe7c7e04aa3e507cfe98c35352ee7806631bf91580ae1253d38d3a4f059344707620fbe30dd818858f028b096e582f805b71301bcfac61f8672ccf9ee8ed9d6048c246cbf0f5d3739cf45c1933ad2ed5c5879748662307e8ebbdd7aa9edca40cb6247f4b49f527f7263a8f02baf452a48196de3fbf9196669c8cc62876c532b2d6e906c543a822541cb186aa422a8a1c447d781001c15510f1aafef9fa6618cbd6b8bede6ac0eb63a4c92e60f910a0f71c7a0b90d3a175a6f35c8e7504f46e870604806828b6658e673919c123d358e46ad5af5b3db692104fdd31cdf949d56b00ad195768dec9edd0b159764ade5f26202fc9e5f56423905b3", 0x559, r0) (async) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x8000, 0x83) (async) r2 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0) write(r2, &(0x7f0000000300)='0', 0x1) (async) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_SET_LBT_MODE(r4, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000740)=ANY=[@ANYBLOB="14000000", @ANYRES16=0x0, @ANYBLOB="04"], 0x14}, 0x1, 0x0, 0x0, 0x44}, 0x0) openat$rnullb(0xffffffffffffff9c, &(0x7f0000000380), 0x14dd82, 0x0) (async) socket(0x10, 0x3, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cgroup.kill\x00', 0x275a, 0x0) (async) r5 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0xc, &(0x7f0000000040)={0x802, 0x0, 0x0, 0x7}, 0x10) sendmsg$nl_generic(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYRES16=r5, @ANYRES32=r5], 0x20}}, 0x0) (async) r6 = add_key(&(0x7f0000000180)='ceph\x00', &(0x7f00000001c0)={'syz', 0x2}, &(0x7f0000001300)="8061316156e3c27e5aef239f38d653a93c4c99b25d056203c6853ebd9a6d9dc35cbe2cbc9ecf4f352d211cca036807eb4ea8c192761096c9a126e4a5ebd6c46b04108faad799785851aa19305bb64d0e8a3b4e05d2d2e67a3883dc6dec72e857494eda558a69d3672ad395831e8988b37210be99f23dfcaa67cd28195f1736c4bd27db1197a98fcba16c61473f4c9d610eabdd2d8e63de1245b45429ce351122faa323f35cdc420d3bc064fb6119683194ee9c0f19f30ec5f44e089e82c4f45c16935c7efb15137df4244bb84a84ee8c7e0466ad45a551bc2933d036624cd02481e30ab36b9b1803dfdf91ef8e1f8c4f1552d22f4b963bc71a77f46a381d08effe48484b95a2889a8ef29459f1b5192e6375da95dac9fe1eb4a916173bff78b80047721e96c5a1d1fc7ff218066aa1be9a5910d627c497fef7f93d2af855a1f5680b85f5ec0583992d20a80a5c6b2fa17c779d966327bdb213f3ea8a864c210999c875082790d55ee8d8c2aaa993cda17f53c64f6724d84fcc91e9333c150041804eb0b7e4d11b9dcddc590b87764fbb10db9920c8cdf0ed66890b5ceb1106bc5bccc32ca9ecab02c7d14b74a1d2c23889e67f22b9e9b97118523fb2386c0468c5b759173d0c773bd662fc12e8a2fce2d8a79ca1a44779cd6ed6a3d4d9ccdb011f8d02781397c9021e38dce972a84a8ee21754ebe60859a1aa2d1ac3176e48adb47b069a7ea38e672190488027058d508017a0e94499a11f596a1c7d33376dd2f1797c40cf0b473420e5a5aadd973b09e9c8c553aa4f8c21bd52809bd699cfaee09c609356d3b7459443e807ada17386210ecf4ce7f9682b16fdba76e032a4af02add9f47a26a517a237932261daf65d56337bd20d8a939ce426965d1846562a5fab10641fb7590570e85ced9c44004fe941e027c77a9bbcc3b28244e14be153cb9f8670b9412642987fb96612391f90f8aad295fe9066e486a33f38e6892a0c87643c0a8b8c50e344aed65d3cc01f777884504b543ab7de09fe7c5c291e66b90ab4b8334a33121b3ad01ee220762ee9adfcbb90dcf1aa0fb77361ab1e84ca4431050ab1c7291595620e297cdc809fdc9c508a1f8e8c6983b52a2fcb441c62a3e4dc959cfe58169644a522660221c4ecd75827c1e620c77168f01c07f7adbbbcedf47c31efc3536c004e420eba63e9e500b3cbab29929bd1bc89ae2025b69172cf695965ef6f93f61dab57ac2cfa600725dd42b3be78445ac0b84fcf22da93f6a4c9511298af5c901bd63f9dc7ba05f18370823829b6b551feae1355423d3a695b6f37cd2c4b14c8dd6cbddfb011ec5ecb6936e99876f33a36830a40b33342b8596db2f925d3ee4ebd494ee8cbb32ba95f4db3a32e64db1d752de112733c029fc5293b341d70d785ba620a03d378d97695a3d481013b2179a4462c09f4273389b67028657d88f471e003e8027ee1bd542ab127c39a819a2ee8a1c161e8e0e86593f668c82c05c83fe5b23c176d40ff3b4b807e39e37825856ce77afc33dd22e37ad9d03b59b023e6aa44d98eb0413b9dd341df633a4865fe991b11597d02109d61064e4a4eb8f9bc620509d626b207118970539efe908fed613a298ae399cd5281a11e11bf06ad643f65632c665de47dbf6a1cfc6224d019e29c7215379768e68de304d90ce0fb4a94e6b5c1f6b5c45b772abb1ec694772bc698e29e1154c0ef0ba45eb00f3e8e9572c9a66c1aa99099ecd440bf84b970d37554a6672f22dd8b5570b2d25a88694c05d21a7d57748bebe1a65003afb82d9b373da7ec4eb5cca4161b138ec2287dbaf95eac3e4213b72b33880527f5e36c7a15203bce8ca8ed44b866bbb350eb64dedcbefffd22075860e9e442bc02e4e3d13e610f6636d3fa09ef04b4c86df69460558bca9b7361c7d0e0356aad2c03bfdb5a0beff8137b866da3ddf3a78c50dec70dc297edd91ddeadeeec26dcd6b73bafe792d04df28856ebee1f0d51f61426d49284a12baca785a4aaa9620432877715555b6d5ad92219d1713b9b0cc0b590d16724ab2c78207d689a598e2d6ca7b2b8d34207db77872894c5d190aa8e5a8b95d61e440f98715ce6cc4e581c2954984e4ec198c846ae9f35623ee6d96ee0498caab4f26e21351361fbd8a8dc8810d968fb19275dba92dde65a18737c4fc3810a07f51c58fd3a13970e4c04ab05b662b43d039e607285cc1098e5822bfae4322ac364080682b8524d926c0aea172c08da0cbdd0723a24a71d8925195f2dd9699e344864e2df0f4a8facc385b6048f6f38a68194bfc2a6ea7d40099ae7352175a0de420e6ddad0cfb01fcaa18e28277ec669ce2380cec18272a356b453e19ff7216223a93e8ef1c4a16c6d58f0ca1c9a93bc0d80d409cf8bff7d7be4bcb5566d215a2fea1e9b15bfed13509fd55425b429ec797e292f89bdde6fe8a3dde6656414bedd192e8d7f99b104186f8e3b1e47edcfffa927a865c4de87ea5f1723d6b8d8b4b1edfe252a2b5e9f7e3a48fd3ef92c281cca29058a1ca144ffb2b4bc845b6e4fb1da1e137fed551116373911c6ee48a2ea932dacbe291e3c6cfd14e9934cd47de36fb909021eb9e5d9a506e56ab7a87e6acb38296043a8be453f657281790eac273b28e7c50f89c4d928c8185a74a1dbdb34b297abb461aabf5248de8249689653c0d7d27ad11e05463090caa19b8ac019119b16c8158817da7ef1798d055b8468cc458826226c56e513b637c57135827189e01288fab3a62135c6e75e7cef1e86a8f436d09f6b35e72811bf7431c72d4927fe99218362cb06f82c2632edc1ec846758470e36abca96c5799422144ba68f2b0bb7e46a88d0116a65a362f2da71712a55cf2d0a6f87eaef929e9aeb0e34220bc7203ffc9c9a3b8afbfe8e106151d448434982f2b6fad22d1e5b6f3d2eb1578c52a63b13b326a1c1c6939c5cc466e6f92c9f09a4f66c9488266881e29a9616abb667a83780f7ccb213e62ef7615c70d8ec6e3cc13e816621c8754cea7427d384f5bac4ac6aa13756778b9a647c96f73332edab43c3aeaf6b57fe4036866c35b3325c9f8a6a0487712b74fdcc5feec92093536915a8f522c5951d8167121955db06692f44ac926f454090a163a57de65468f05d18a6772bd73a5556972371b2456b9a204edf74cfce5d3234150f0a3cb701cf69d2a22d6c942053a4f9569010043619ca80da027fe9a6198b43766f50cdb9fc7b86d7f5290235813df5aee7f24534245a2d87ea6ba6a4e80cbc453d1f40a6dde02c0fed3911df20b3b8fcdbcffe78cc0760629f9daf1484c084fb0bca8519d13fed18cc962ffde4db8a2bc4100ea29163e82ce1ccacabfc215a974c8315d0e19207d7ff3214af52e05b1f7e279add778ade053d331bde4dd1bb392502f19775a81abd81d971673e7ae307662925e0f017c97f2fabc454ea4a15b369dceebd357b587043a98e57952ba54acaba024af49612d3ed3587381796901339547dc3cc79b90985ba385d9a05433f81b299ec14a5bec366c973b5bc9ebf2e77328a18e56b3f5325a45f99ffcebfd5291bd7cec9e4f2ea7dab5e0ead59ff7dbf5d558c5d3c36d7bf1536216c8ac1c6e8f831e042f62e2cf82befea93fe2d133590e67b04c4c6626f137c661919d3ea8f641ddac86043f816e56537120d74a4804227458603b32bf864174436980b2a8a37d53cfe3cc7be2a37fbd35fd6b5fb9cee65ded09bd26f16d05e4b46e82f8eb9574b360fde2fa1128a2d133e6241acf4c76ae4606941d8d86a52774d8aff6c90b15497d3895c405f439f04049a3f49ee6055c4ea950d3614b8d22cd6cde5abca159355656dfb4f3cf5bd74858d8d02bba2a77087b6d5933a0efdfd84010bb7e7bd4a388778e45b40dc32c4f8ff81d936b4e4879758686c72d12072f6f2252c632b64e6b870d543db97cfd496cb2eae9f4aaf2b37df8ce70c42417c90156b18d29b63bfbca2e8c8470456c6c3cf2f3fad3c61213d5b9da658cf6545412b229ec67bfb819c52a43a323e71ae9b2e29de264666ec439a027065ab06b8db0b6405b48578410f06ddb5abe10b30d07a0f7a7b58f0d1b78413bde72d6c7d1154849deee2238a39fd23bddbbd754657032e6cadfafe28163cee1cda236a4dc6f65f1c7cf33f37ebc1cbe076887fd637d1860b3616cb25d7c0a128d68e4083e08ec6035afd02e728d2c2ee02c164cf4e3064312fdfe574e86d44fb8251a50f54e1ac0b2956801efa65bc12c756ec4bce403a31bad955bfe0a1366534b143713edb06e8035b95d59e61d8971836260bbd0ba58e0852e8996210e019ed6aee65ff3c16f868a194a3c149b3791d947a58132029a46d4f5e303975ab6e837f62f1cb060eb0f1462976c6fb1e036fcc8521e4005a99d05093e0eddca6cadf92d8707d5b0452f9fe1430d136857f1cc4b9b411db8823620a11d57e46de9dcbe10377ba9141f873ac3833c8e6b10ce8d717007b3e68ba2dd55e274fff6093d057248f5f2bedbdd1cbd4c6885a3504023f5a7d5b3b9ae05fa338c53b9eedc4458ecdb56f43fc11420c52ca619f7ecc60d2629f59968a63f2bfdbd283fb42d9bf610caab87dbf1d887a15f552170e5785af64e372968da1d2943ae1883c3d957d1acd39d5ceaccbe20e7028483de295a9d3b6470b7d25f5485920806bab97ec4feb63fcd8a2b76fa39ba84e075e601c0eaade74f28d3ed29b0f111b5a96dcee881a92ff5a1ed81062b788e6a91dd0eb4ab6435bf04ddf4565d6cec0ce2e6890d5903e7b13092cbdc435374c50c21f8261af666f3cab09a39da8294c105d1e92c25e4049c97df45bbfc6c9cd77660f25a222a8c647ead1ee35d5ce758e668d09dc4d1d582b9ddc2f352856fa7af33a92d24206bfbe8909140438b718618bcb9ab008f83688bf404f65d8e548cc195498a550be9d307fbd786933de0a4f755c66facc4f73f4de337845154a15d0a7b81d9635a763aee6ea6c1887a32c324034e87aeffd2bd9d2b3099411cc25a2541db41dfcf0050b5cdae3e2ae3348e8ea66b924e95796d6d2817ff24b4148522d999aaeb3bab12d3cd4e74f891091bb4b59e26eb3ba33569f9868281b2d0c8116a9a4447465613f954f92e9b7766988df83059c8e278236f735e3a0faac6c21a7c581c7fb9cfc87b9983510adcf9a5c30dc0dec501566ab53a37144314cea95c4d73b263cb6536af22161aa1ef6024323d592a4051374cc559ac2355e4b9471ac69fdd6616e01598537ad80c90843d721bd1a25aab3841ac2db02121968884ee70ae75e6abd0a1211e3a35976ae638eaab7207aa8c8792f71773124a167a7f10081443d11cccbb15c98604ea43d9915303a8975bac4078f9ca3bb38ec4e2c8667453728d56c586674b212adcdd708c48f186242eab26048076d1df0347895e767b6c68c8689b12c6035733fce1ec443950659fcba5e722fec5a5d62647f63a9c9a3de91d2972cc9e3416bfc63fcb548bfab27be12ae3b2fec6032a05adfbfa66b742cd853d633005bec7e3dc17b1717b993156c2af7749e3e293cd1b8fbd6f8bd4deab7cbc507f3ea253e81564da68172b26056b93b10724203831833049f20130e1f49e86004c1ac9b0098031e1ac3da3d3e8d14dc810b8643fce2b8155906f6a41fc98b1af02f236678ab3c6578e66c79cc459fb48787066ca269224425ca9dcf5942226f0f630060ac06f317f60d7e0a5d915a6af8698e8cce89a49eb78d4fc30dcb7c7a829098b0a8f3ef05b0b75102f540210cf518a7c317ea9215a3211927bd", 0x1000, r0) (async, rerun: 64) syz_genetlink_get_family_id$nfc(&(0x7f0000000cc0), r4) (async, rerun: 64) r7 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f00000012c0), r4) sendmsg$NLBL_MGMT_C_LISTALL(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="01002bbd7000fcdbdf25030000000d0001006e6c38783231353440000000"], 0x24}, 0x1, 0x0, 0x0, 0x1}, 0x0) (async, rerun: 32) openat(r1, &(0x7f00000000c0)='./file0\x00', 0x1c9042, 0x84) (rerun: 32) keyctl$KEYCTL_PKEY_SIGN(0x1b, &(0x7f0000000780)={r6}, &(0x7f0000000140)=ANY=[], 0x0, 0x0) 2.3333287s ago: executing program 1 (id=2): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000100)=0x9, 0x4) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000009c0)={'veth0_to_bond\x00', 0x0}) sendto$packet(r0, &(0x7f0000000180)="0b032211e0ff25000200475400f6a13bb10000a8880043054803", 0x10000, 0x0, &(0x7f0000000140)={0x11, 0x0, r1}, 0x14) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x109000, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000006c0)='./proc_mnt\x00', 0x1e9) mount(0x0, &(0x7f0000000640)='./proc_mnt/irq/12/smp_affinity\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc_mnt/irq/12/smp_affinity\x00', 0x1, 0x6) write$cgroup_netprio_ifpriomap(r3, &(0x7f0000002640)=ANY=[@ANYRESHEX=0x0], 0x8) ioctl$TIOCSETD(r2, 0x5423, &(0x7f00000000c0)=0xf) ioctl$TCFLSH(r2, 0x400455c8, 0x2000000000000004) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r4, 0x800448f0, &(0x7f0000000100)) syz_usb_connect$uac2(0x3, 0x0, 0x0, 0x0) prctl$PR_SET_MM_AUXV(0x23, 0xc, &(0x7f00000000c0)="f51c1c16d70f68a9fab0cbdebfedc5e0732dfebe2721532adf", 0x19) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) writev(r5, &(0x7f0000000140)=[{&(0x7f0000000100)="2e9b3d0007e03dd65193df163e75963f86dd", 0x12}, {0x0}], 0x2) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) ioctl$TIOCSTI(r2, 0x5412, &(0x7f0000000100)=0x7) r6 = socket$tipc(0x1e, 0x2, 0x0) getsockopt$TIPC_CONN_TIMEOUT(r6, 0x10f, 0x82, 0x0, &(0x7f0000001200)) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dev/ttyUSB0\x00', 0xf7) mount(0x0, &(0x7f0000000040)='./dev\x00', &(0x7f0000000200)='devtmpfs\x00', 0x0, 0x0) r7 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r7, &(0x7f0000000040)={0x1f, 0x0, @any, 0x4, 0x2}, 0xe) ioctl$XFS_IOC_PATH_TO_FSHANDLE(0xffffffffffffffff, 0xc0385868, 0x0) setsockopt$bt_BT_RCVMTU(r7, 0x112, 0xd, 0x0, 0x0) ioctl$KVM_SET_LAPIC(r3, 0x4400ae8f, &(0x7f0000000240)={"78d374d23bce201cc61727470a48f516b7cd768c2e1a0b082484a1f1064f230b1524c11de8e7302c4691e46ea1ab58aa1ac0ff8f98de6d8b80650f0117271cfb16aeaea81c4832e4b58da1df306572200908ad9a62f441efa0eac79c49f1372c60af2b8ae5fa0eafda31117b6623e7d9beb024db522c0a41a8bc101ad9db169736917a3c7af84db1f029b5126dcc97dd4d317d5f9a32e3acb87c736eac540787d95b4e3f3334114d9553257de080beba32accde83c2c7bf4f6b18b66a62f9426f8dcca85cd27e8ffd15d72bb38038cf605ee32efa5a841a3373eaf4b89af1a844b59169d7e2b2f7e168ff938b360372f1e550ca3753c748a6adabbd0a4f6478702e972ac2d6f567da31f4e35435f1b9509a35568139d750e3da1d1c6fac459807eb720934b72d5cea49de5d05b8c614b9c0653686b8f43e253e2246563fecb363737bacfb5a0da839ba50195929987e143c80b7a2ddaa7f2204341267525b156cea45ccb81561eb31d2f4d016027fbe54a4cc10c0993992dfa886c117695d210bd8c10fbfbbd70c50e4de269a530b0b0e0c049964f3f131c50bb278892117fe498e13b1538ed79d0b82974f24976656ba5f3516b5b4a0c214c537a46d10bb794b38f309d5245c61b61a9901f15d0cb76b0c8cf5bbd3b46aefe1cced2c17988a064e39d6b21f6394792ae7525c36460719158b050c74425b00ba1253058e0909989fbfbb3623b4c2e81d5f846260d9f4237cec789d0bbb6bdaa2b85482a3bfe3bd3ec2a0d55d48991b2934deb25c32c7a7cac6ab8a524efe3524f84dc9d9cf0a58848b52f494188d62a3677d585cdbc5b06bd22b35fa4a84c2c6acbabe0af71ffb5b79a47494df66d0a488b4c6f6a3b692345308ae68c5e4337be2154518333110a0b6aa9f339c0dfbfdef60ebdce40edd0bc1ba8d96948f12a1d4ff990c22cc75e8e6866de8224c9aaf19b57ee053289ed457b9d0a79dd19ba80c5bde381a2c51bd07d36656af9e7525dcfe16ab8e57644d76a82ca5c866fd771c469fb2c6702082b054a540bed36d8b42f3b9e5857d6d1e142379e05a3f2c4061c2179cbec3acce097e485d991ba03311f06b1169ac34656e338dfdd3042df0c3c9e76bb34971f025395b0b9ba871a1ce7be4cb632042905dbd0b69677c1d062ded79b404878d4924ae8e4d4a306724c87373cd4cc0ffb95ec2b6cbecbf2b0e5061bcbcd55bf44786a5023b6214b6c7aa00e0afc447aa30a20ade5be5c340fdb0e8510c9ebba2043d87cfcbb5b03e01d8e7ce0b2cecf175e74d639361c13c1e4435a0c890578248b8cd148b4ece3972cb3e19317a36f8f6a0996418574440deb18107d9f5b002d4911fdf3292cfa49088126e5df66ec12dddc86cafe97f370bf6f45773cc8a20254d2663f3a2294bcb9da699aabdd47c252c1548a67273df2ff3dc24d1e3def"}) syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407b0603230001000000010902270001010080320904000003ff000000070581024000000705020240000007058303"], 0x0) 2.247357288s ago: executing program 2 (id=5): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000002080)={0xffffffffffffffff}) close(r0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./proc_mnt\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./proc_mnt\x00', &(0x7f00000001c0)='proc\x00', 0x0, 0x0) capset(&(0x7f0000000040)={0x20080522}, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x81, 0xffffffff, 0x10000}) openat(0xffffffffffffff9c, &(0x7f00000002c0)='./proc_mnt/sys/net/ipv4/conf/lo/forwarding\x00', 0x1, 0x0) io_setup(0x7, &(0x7f0000000280)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000540)={0x4c5, 0x0, 0x0, 0x800000000001, 0x0, r0, 0x0}]) r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) r3 = fsopen(&(0x7f0000000140)='ext3\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r3, 0x1, &(0x7f0000000100)='test_dummy_encryption', &(0x7f0000000240)='v2\x00ul\x00\x00\x00\x00\x00loc\x8d\x8b#\xe0\xb9\xbd\"\xeb.\xc7]\xa67\x97 \xc9\xfc|\x85o7Z\xdc}U\x8c\xdd\n\xaa?4\xafq\x1d\xf6(\xe6\x9em_\x1a\xbfDi\x15\x81\xd47\x8e\x86\xa2u~FC\x9c\xe3\x98\x87\x98\xf7\xa2\xb5\x12\x8cv\xe4_\x91\xa8G!mm\f\xcf\xfb[\xd5Qf\x15\xfe\xc80\xad\xaa\xe9', 0x0) ioctl$AUTOFS_IOC_EXPIRE(r3, 0x810c9365, &(0x7f0000000580)={{0xa38d, 0x3ff}, 0x100, './proc\x00'}) r4 = open(&(0x7f0000000180)='./bus\x00', 0x14d27e, 0x0) ioctl$EXT4_IOC_GET_ES_CACHE(r4, 0xc020660b, 0x0) r5 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921000000012201000905810308"], 0x0) syz_usb_control_io(r5, &(0x7f00000002c0)={0x2c, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x6, 0x1, 0x10, 0xc, 0x0, 0x2, 0x6}}}, 0x0) syz_usb_disconnect(r5) r6 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120110010000004058040350"], 0x0) syz_usb_control_io(r6, 0x0, 0x0) syz_usb_control_io$hid(r6, 0x0, 0x0) syz_usb_connect$cdc_ecm(0x1, 0x78, &(0x7f0000000300)={{0x12, 0x1, 0x200, 0x2, 0x0, 0x0, 0x20, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x66, 0x1, 0x1, 0x7, 0xd0, 0x1, "", [{{0x9, 0x4, 0x0, 0x6, 0x3, 0x2, 0x6, 0x0, 0x4, {{0x8, 0x24, 0x6, 0x0, 0x0, "f1d3cc"}, {0x5, 0x24, 0x0, 0x1}, {0xd, 0x24, 0xf, 0x1, 0xfffffffc, 0x0, 0xd4b, 0x7f}, [@country_functional={0x6, 0x24, 0x7, 0xbc, 0xc00}, @mdlm_detail={0x4, 0x24, 0x13, 0x1}, @mdlm={0x15}]}, {[{{0x9, 0x5, 0x81, 0x3, 0x3ff, 0x5, 0x2, 0x5}}], {{0x9, 0x5, 0x82, 0x2, 0x440, 0x1, 0x6, 0x5}}, {{0x9, 0x5, 0x3, 0x2, 0x20, 0x2, 0x7}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r6, 0x0, 0x0) syz_usb_ep_write(r5, 0x81, 0xffffffffffffff6d, &(0x7f0000000100)="019a18370cfb661ba08c228ce6ca19b6a99a071ca34c72c891f8a260fa00000080977dae8d64a30e92cd51117c4a71e26518e804c00058e6c7c0c363027251668bb650d90000000000") write(r2, &(0x7f0000000000)='3', 0x4e) r7 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_NEW_KEY(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)={0x1c, 0x0, 0x0, 0x0, 0x0, {{}, {@val={0x8}, @void}}}, 0x1c}}, 0x4000004) ioctl$sock_SIOCBRDELBR(r7, 0x89a2, &(0x7f0000000000)='bridge0\x00') 1.779362086s ago: executing program 3 (id=8): mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) (async) socketpair$unix(0x1, 0x3, 0x0, 0x0) (async) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x101000, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f00000001c0)={0x205, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) (async) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f0000000280)={0x0, 0x0, @pic={0x4, 0x7, 0xe1, 0x81, 0x9, 0xd9, 0x40, 0x41, 0xfb, 0x1, 0xc, 0x2, 0x2, 0x41, 0x1, 0xf0}}) (async) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000180)={0x42, 0x0, 0x2}, 0x10) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)={0x14, 0x3, 0x2, 0x101, 0x0, 0x0, {0x2, 0x0, 0x1}}, 0x14}, 0x1, 0x0, 0x0, 0x4}, 0x10) (async) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000000)={[0x6e, 0x0, 0x5, 0x20, 0x3, 0x2, 0x106c, 0x100, 0x8000000000000001, 0x80000004000080, 0x380000, 0x2000008, 0x8, 0x4, 0x0, 0x8000], 0x1, 0x3c4210}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) (async) write$tun(r4, &(0x7f0000000200)=ANY=[@ANYBLOB="0a000010ffff"], 0x62) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) socket$inet(0x2, 0x2, 0x1) socket$nl_generic(0x10, 0x3, 0x10) unshare(0x62040200) (async) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$FS_IOC_RESVSP(r2, 0x40305828, &(0x7f0000000540)={0x0, 0x3, 0x1, 0x7}) (async) sendmsg$inet(r6, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) (async) recvmsg$unix(r5, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000340)=[@cred={{0x1c}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x10}}, @rights={{0x10}}], 0x70}, 0x80) (async) r7 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) r9 = ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x0) ioctl$KVM_GET_MSRS_cpu(r9, 0xc008ae88, &(0x7f0000000000)={0x2, 0x0, [{0x4b564d02, 0x0, 0x6c}, {0xa45, 0x0, 0x8}]}) (async) socketpair$unix(0x1, 0x2, 0x0, 0x0) (async) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x60, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000001c0)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)) 1.601308464s ago: executing program 3 (id=9): mkdirat(0xffffffffffffff9c, &(0x7f00000021c0)='./proc\x00', 0x180) (async) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) (async) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='task\x00') lseek(r0, 0x800000008401, 0x1) (async) r1 = openat(r0, &(0x7f0000000140)='./proc\x00', 0x105640, 0x0) write(r1, &(0x7f0000000000)='7', 0x1) 1.601041014s ago: executing program 3 (id=10): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socket$netlink(0x10, 0x3, 0x0) socket(0x1e, 0x4, 0x0) syz_open_procfs$pagemap(0x0, &(0x7f0000000240)) socket(0x10, 0x3, 0x4) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="1201e10000000040050be0170000000000010902"], 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc, 0x2000002, 0x401d031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./dev\x00', 0x8a) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt\x00', 0x1ff) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f0000000100)='ext4\x00', 0x8410, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x40286608, 0x0) 781.315636ms ago: executing program 0 (id=11): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_GET_MSRS_cpu(r2, 0xc008ae88, &(0x7f00000002c0)={0x1, 0x0, [{0xc0010112, 0x0, 0x20000002}]}) ioctl$BTRFS_IOC_SNAP_DESTROY(0xffffffffffffffff, 0x5000940f, &(0x7f0000000240)={{}, "6615aa80ab4f1018d03939dc1f4913d0b36393a7be890b8c8099d2d6295faaa576da3ac725bbe24e2506810811945b36a8a17c0e7dfebe3be6ddeb3ad05f7c4840260edb7cca0b7a830bc2b416a8c190a79261cb10f5bb9ecac876ca938296132b5b983dbdacd8a7820690867dabb04f8478961b1f0a6b0674a49afe5b4cf32e5db4d5dd5ae1f7bba29cd1842c565bcabe22ee32e6d04e5b75ff1c993090ab50c99fc1378ef4b40c089ef1afb858135ede6ec48a2176c4f439cff10b011be3b4fba9d22929033987633eb65063b09882717439bff29ca760cecc0f00a2f1ef3a601dbde81814b176520158a6d1c7be176595fd5b8a8fe98743d5322ccb4d08d7d78145d0123f02c534476546068177aaf8ca4d843fc15e357f030f005f5a9e1a3a80116522babc1531479e706ab2e07281f14530cfa96bc74198b83c2c3e0d38cf431afc7da39d5b26135c4a6436001009abe66caa01db2f69ac06fe6cb2ff32b026c6575a5031c00fb6a4b6494143642d7b74a241b553ec53694f5f48f5f15b286fdb64c65e3923d309200082788f8c3082808625c1c097cb16ec1743bb5ee8c2402e1bda1414539696fea6557887ebc60e54549283364fe9aa238e86531f8186323b6b89ceffc219139133e93cfe933e7dfb337591815908880ccce1b8dccfcf18cbb657b6d0467cc26d3079ebb8a9ce1b88ecec2240d2eba7aaf1dd9b5089225d850adeab8d53da7b938bbd71e381441ab433e105f87c3a27d65c4cc0c6635923923a9d8bf716bc3e0a393bab0005380d184f4e4bcd2ee8288ba0d852b8d5ed1d4fcf7962c630a18b92e06cb777246362e3b58bae372bb8b51c64250f5f6725b42b91bcba1aab68a28826478083b29544cd85e165dcb159e28ccd16f3e7ba3e6843995e230478f3d47160f4a32b99fca47d586285991f00bf43f15ffec1d0b23f5efd51313c43a38ecb03bf054c057b240b3f1095b3de1b0c609229eb8bb2465e4c11016b2ab8557a30a03a36a2a3f91d4d5a76f5d47466b411ec7fdd6b5c48145b55146d4c24f6da0c38233c829bf2bd4bb286a5114546995c9dc0243c8249905317e0a12f4970dd576349f1fa2ef8e7e8a780a39fc723cb8794a6a126de2a1644de371b8d5bbaf0783a0de54338d892e284d645ebc6e3cc3fad2a2be56023f6f53164ffc11f3041cf5d6897691e6beb79d95f63ea0905d4b85d2d758f4fa5a933f6f58d746c731efc22e59cb9583273386b531af099af77a3e880e69abe32a7a9ef3f9d7b0ef9f852f77ff66668ab84981242c9eb4511ac119e9f01dbfbdd17a1fbfcffe1c0335d09a727600fca7b99ac08ff2c61a5efaa8c38b5bf37fc2c427b668f4156c294bfc2aad46c4fb92eba008dc754587e21a4d978962c92cb13d58214b8af19a87d87b493650f699cdec89a8117d505173be2f250f4812545db21d925c69bf9a8dc453fb116481002909ee4e69a17f018f3946bddb669728160335272757f65b9dab4ff71d1a534645c2549b96fb97496e4c6bc5af2eab51250a448393ba68c688851fcb899e2d5b37cabe2e253a5d2adc7da32adf8b8208c7cf0f55785edb7c585996076ce10f6d3695add14fbed09ae93497b48e3ac00137bc4add6f64b31add8b9b1df9381ebd3cb4bf6f83b0ccb643784992b4938cc5485fb53127508f98dd0a38c7e5616263f5ec0cc2caa332b9a754fc22fb787c8347fa72a69c31ad8c94878d1d4b83871cc41f9c75ccb6cf3b0a5218cd99ebb268e2272545fb1cbcd4b539305ce1cc2c68f6f902de49952cf1a67c078149226df1cdc3cc6ecb25318a8a606e6b2554087a169e760eabb797914b43dd7699ca2fb5660dcafe551c5cf46922435a614590c6b9fae8ec9684af4cc6eeca17e4e3c017d78b77b5e27bbdd6a70f0ffe0977585a7cf9b56cfdf4decd301e5efbdddd5651e43d0c2c38383ef428a1f3d7c9ef2e61973649875fa25b4da910c2d0617f4ef21eaae38142f8849c49f0c84882e27e4d9a55e49841ce11115791767db0a79e20fc9c17c5bf7fd2cfba506e101c2b357373fffd5b3756012ff628800b9f4e665cbe991b6c2b91e9f9eb87172a7cc71e0faa8b7127e83b3b38741eb6052ba53f6a373eae906f9477beca9f7180ccf0423d212bb8596289d11dff76432a4d0f8bea4a6108c2ae47b12027771689f74a1f15bb68944c51813f90853333e9b718c3db3e3e54df02c113c0ed477e7abd5ec5b2910616a773aaa43f1ea6c9ccbd3a7241f4021c2467881f37154237f068db8d9df46123893332cd3184d6341f362bcbb61c8a9c01d6ad8f5c91841960505edd8f5bc28b75dda749be2d7f5fcf4e51174474cc6d60ef560de8f8e907dffac4c584c473468a7cda41f2d8b5c667673e339347eee98842ba9499a6675cf00bedf2d5ebaaca3d000caaaf4d6d7b4dabae340d32834575aa02c269798c2fecfcaeab9cf26c6a6b2afc3cd33e833ba5654cd845cbf558e08c9b5608c41f2caf4d3a626c2ee6ae22512c5abb270422262459c58a9cd66cdfb9f222be28284e389bbf6381c64733d365d0f15885139a01f273dd67002e1f208dff1dd41802407f7d4e2597eadaa41195c1fc2e12f60508567fc7a7e9c64c01c4308f59684ef3bb98e993694b06e055c99479b5a32cc37112d6dd5b51c0cfeebe64cd4791f33169634e95e254929937c97e4eca906f0aa33a7014339d16c0e0822aaba2e060c9c114df27c13f5da8f3e58e92d4d7b2f0ecc3cadc9d103c2928f63ab0f8f1e8a3cfdecf88b09d0d5be77d2177c4b7f5533add623fe702f7d6f2753ef0c3413135452cda0fcb437c0a951805406b7a3c6c916c3ba0ca47e5edbd53bf9876c406cbce97d38a629ba08d9aaeadacad9a3a8cdd56db5b5ef846ac5da223fc151b95244e5169cd397a8a319425bb1218d6b823ed76f20c221ad1b35f654fdaecdfac4e16c9107387e27155f76bb93781e2de176c24acb86cd6997b13b61d80b6bd9476d20898ace8d3a21fbe9b954e7edfbb7940bb14c3ddca53c99e9d7ac4912cb9a6cacb31ec88b3e60d217fedf5428ad5ecf8823719d420a9619bf8dd4f2c021ed9c7f1f032a549b3ce448b2669ba59ba3d86fb87112bd34b72108c04c5a8170fb369c85158d0fe33b56c6bb36c45cf35f7e9ebaa85a54b291f22850c8e0958c155b399aae18bb99e6da4a9beed2e32a10083a6341e8487b0ece9eb25ee3944721c575621c0653d8e606a97a5a2712c9a6e32fccb76d2518538d04543474314f73a98cb49a14709b283ac6a4cc3397286d2dfec8566ffbcbfffeb96e8148ba506a5109c229f0e8e854cde5b922319601b51b353a1563f7d4b61e282b1c20ba11f8d64969718d75384cbdc4010c8a7caefcaab3bce2349cf3071c9a0be5376a71de404f02e968a24fe273f6f8ec359b4c6cba93e98a8ecb6c3168b208dc21d54cb455a36b7df04bed4cb076df50b521217172037b9a82c6b95c582751a8fc2094d65c6609ee05c32c3914bb4f5ba68d4da80d640a5acaa91be2263c1390afe39009f6b28819cda37d460d8a0d3d72e6853648033adee8ea28a7effdf5551dd9f0c621552de054dd230b4d2788dfac5fc456ee01222bed0a166b75695589ea469d05a4d02857c03dfad6ca601cd17ff38683207fafb30b43ed0b4f8eb6b10146ab7dc0fa9fc40ba7bb75517e0e7538ec81198015c3cecd6e47c42a09de418f7103bd9e986ee03f1d00ae610903f6f6c362dfcd43ff1e6012e0fe27df03c25d44cff2e1c04f907add3f0d4a774b2d72a2ecafb5b06fc50a16bd84d8c7f4a7ba2f602ed94b9a2108b6e1cca7244681fa4fb7c377a06ef14b5ae39e87114eebbb8f698f91fc8e4927bce8b445127c3995f8d728e10db347caaa00c522eb67996e7227ba55c082d3e5090aeefa251c67b85c425f921a24265bd83a97069b5efffd93d421b66806643283270cf0a26390fab87dc836d9c73f9e889544130d73e3611d5afbf37317b03ad1456c31319f19e6dea61ba45f7982ab73ceedff1a28fd660b09e2bcbb2ec86ea529c856eb7d88952b56b3b7233c870d87b68a1404ddf20a800e478fe232ca21a6544d6ea46406535818e7ec6a50db0658708db3b53d772745360b6b82de138efc3a1bc4cbac375986b1fcf1a916bf8b45dd3dc7b9f994e8c30c3eb877d960aef36a8b6992e9253dbbe57b631361fd19dd6dfff4d340663b0c478d0de112fc6783a7a062881ed9676a8b13424edec2e51bc3044f51f7b3a307d61777e4f71ce9198d73bc1bd89d34bbdee24e3e4a119e523a72a002013d3d05119803fd9815714824ea0ee5eb14211f0446253102892becdf7f34414a5fb08f8ed92e40c7cd03cac2a9ff63691970afc5675ffdcde15956b46ca944c14ffd76e89dcd2c78462629b9db770c579ae4ec4252e5f69916b3964c18c54b419a6285f27809e4049165309204b19ce48951ced7fc48b20d20d43811cab6c32d4e4cf05ebcb715c21019002e3bedcf86bc6baec9578a1b36ea567c088aa97a7dad7e050472f7906d226747bb2fbbd52e328069dc8c547c45a7cff5b7949548d4799641798314d2f4a11b198bce08f7c936299eeb15d10cff730e4781ce80664b7c1e375c6cd392de58a025280e7c9b7f6a5590b68bc8e7a90232a79e663bb0c393cd94e9b72ee86053c87f1ee197e684fc8cf5c8893971eee36f55e6acfc5dd0a7a38baf9642b37b294513a12591b07be05787b870e7e28892780390e59567fcd78c97691b28e2d0b3eb6344ae92c5ac7aac40d67ab8f152d41f60c0c077d60c552db80ef8baec5bcc9adaa33cba28dc3b52df4d2951d024a219fa75a612248045a7abcaca6f606248f21aa543fb56dd132cf30b021c30976e84e8ed2e5615cdecc874908512b9e3a48f80445e75260312d9d5b8bc9534187aa91ed1d03398c738b38fb06c6e8746674d24422539f94e27d1af2865ee64adfaf98ca63e83456ff17c60a95698b01f8e6f4962469a2d9ea503cf344d15ea52699e7d62efc77530672d62cf6f03a14857f59d3307f925d6004eb2104ccb90e67930357f13b4d74dc009d482d56a4b6e566716f549351b3738112f9ff1e4217661450918f07689641ee72e9f3055defe72ac05774c016e0431926a7ab75973f46f0625d6e5b19403ea7fbed8d9775007c41c444bcfa562eb2e7532fe332abc7587b87a5ad77e05888dcbe1b87c69199e276ddca4750a7b3ef0f46d132ac73d42bb9ea6864e88bda5db891490d92f9577be973ec4653baeb0b1d90bc7757cacd0973bdb9909aab7c16598cb4dc2a19ac57dab3c22836c172218078a8bf91e7ca81ba05eeef9e966489b182f6be07bb174c7fb28c8940d0902db9f45b73471ce9a760b78d40cc117da1caa07412cde830db9b15aac1ec5f5a8b1d109ee24eb4949174dad32c850cd9e6d42c736241ebf310293bc03880b7e0e775ef4e954e16abe7d9de9e576b0809755706d9b7384c27916866e17948cf5f3baaf9eba6718fee030194a6bb2fdc401d1c67c22a8a0bac6bcef24076dcc359190df4748114a6634761903f0482c76098eba24c841e6a6e6ba9b599fec88f9e5e0158352a05ef1ab162bfec139dc0653cb875d883b0c98f02d1fe35419133537521b5f8f48cb8269971e58fe3b3b4804dd69e7038161d7786a71de18533287f21445e6f49e93c53ddf7820e234a8ec5cc9c4d154fb5980c59a3545a1ea4fc67a758e24328811131ff9afe8561eaadaf6cb502fcbcaee557229f64fd74a33c52ab3f163"}) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000003280)={0x73622a85, 0x100b, 0x4}) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000180)=[@acquire], 0xffffffffffffff47, 0x0, 0x0}) dup3(r4, r3, 0x0) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r5, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r5, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0xffffffffffffff67, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000940)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000400)={@ptr={0x66642a85, 0x0, 0x0, 0x0, 0x80000001, 0x3e}, @ptr={0x70742a85, 0x20000000, &(0x7f0000000580)=""/226, 0xe2, 0x1, 0x30}, @fda={0x66646185, 0x9, 0x1, 0xb4}}, &(0x7f0000000240)={0x0, 0x28, 0x50}}, 0x1040}], 0x0, 0x0, 0x0}) 622.971769ms ago: executing program 0 (id=12): syz_usb_connect$uac1(0x3, 0x91, &(0x7f0000000a00)={{0x12, 0x1, 0x250, 0x0, 0x0, 0x0, 0x40, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x7f, 0x3, 0x1, 0x8, 0x60, 0x4, "", {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0xe, 0x22}, [@input_terminal={0xc, 0x24, 0x2, 0x1, 0x200, 0x3, 0x0, 0x7, 0x81, 0xd}, @input_terminal={0xc, 0x24, 0x2, 0x6, 0x402, 0x1, 0xfa, 0x3, 0x0, 0x80}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x400, 0x33, 0x5, 0x8, {0x7, 0x25, 0x1, 0xc, 0x8, 0x2}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@as_header={0x7, 0x24, 0x1, 0x6, 0x9, 0x1}]}, {{0x9, 0x5, 0x82, 0x9, 0x20, 0x9, 0x0, 0x8, {0x7, 0x25, 0x1, 0x0, 0xc, 0x88}}}}}}}}]}}, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x5, [{0x4, &(0x7f0000000000)=@lang_id={0x4, 0x3, 0x1007}}, {0x4, &(0x7f0000000040)=@lang_id={0x4, 0x3, 0x81a}}, {0x4, &(0x7f0000000080)=@lang_id={0x4, 0x3, 0x40d}}, {0x4, &(0x7f00000000c0)=@lang_id={0x4, 0x3, 0x411}}, {0x4, &(0x7f0000000100)=@lang_id={0x4, 0x3, 0x2c09}}]}) 258.617466ms ago: executing program 3 (id=13): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x22003, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CAP_SPLIT_IRQCHIP(r1, 0x4068aea3, &(0x7f0000000240)) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='dev_mnt/zram0\x00', 0x2, 0x0) ioctl$BLKRRPART(r3, 0x125f, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r3, 0x541c, &(0x7f0000000000)) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000000c0)=[@text64={0x40, &(0x7f0000000140)="0f30c402fd3eecae660f38800a66b80c010f00d0662e3646d87213460f09b98c0900000f32b8010000000f01c12e644c0fc72f", 0x33}], 0x1, 0x41, 0x0, 0x0) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000380)={[0xa, 0x6, 0x8, 0xff, 0x8, 0x8000040000000001, 0xb3, 0x8, 0x4b1d, 0x4000000000000008, 0xb7, 0xec, 0x6, 0x1ff, 0xe6, 0xb286], 0x4, 0x383fc2}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 147.254089ms ago: executing program 3 (id=14): r0 = creat(&(0x7f0000000080)='./file0\x00', 0xc7) close(r0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)) r1 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r1, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000), 0x101000, 0x800, 0x3, 0x1}, 0x20) setsockopt$XDP_TX_RING(r1, 0x11b, 0x3, &(0x7f00000003c0)=0x800, 0x4) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'veth1_to_batadv\x00', 0x0}) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) r5 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$inet_buf(r5, 0x0, 0x4, &(0x7f0000000040)="610910bc996c301c8107070408", 0xd) getsockopt$inet_opts(r5, 0x0, 0x4, 0x0, &(0x7f0000000240)) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r4, 0x0) setsockopt$netlink_NETLINK_PKTINFO(r4, 0x10e, 0x3, &(0x7f00000002c0)=0x3, 0x4) setsockopt$XDP_UMEM_COMPLETION_RING(r1, 0x11b, 0x6, &(0x7f0000000180)=0x20, 0x4) setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, &(0x7f0000000140)=0x4000, 0x4) bind$xdp(r1, &(0x7f00000001c0)={0x2c, 0x8, r3}, 0x10) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000100), 0x4440, &(0x7f0000000400)=ANY=[@ANYBLOB="7472616e733d66642c726616e46e6f", @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r1]) r6 = socket$pptp(0x18, 0x1, 0x2) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r5, 0xc0c89425, &(0x7f0000000140)={"50fd1d02f6188c53182527455293030b", 0x0, 0x0, {0x7, 0x3}, {0x5761a32, 0x6aac}, 0x5, [0x4, 0x4, 0x1, 0x7, 0x8, 0x3, 0x2, 0x8, 0x0, 0x8f8, 0x100000, 0x1, 0x7, 0x5, 0x2346, 0x200]}) write$ppp(0xffffffffffffffff, &(0x7f0000000080)="efe555cce4caaad7d37d14c6e84278f7895629db2b6837ec4c688bfce96b7110e6eeb4d8", 0x24) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r6, 0x84009422, &(0x7f0000000840)={0x0, 0x0, {0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}}) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x410001, 0x0) ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x4000002, 0x14032, 0xffffffffffffffff, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000300)='./dev/sda\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000240)='./dev\x00', &(0x7f0000000280)='devtmpfs\x00', 0x0, 0x0) r8 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev/sda\x00', 0x101042, 0x5) ioctl$IOC_PR_CLEAR(r8, 0x401070cd, 0x0) 0s ago: executing program 3 (id=15): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cgroup.kill\x00', 0x275a, 0x0) fcntl$lock(r0, 0x7, &(0x7f0000000000)={0x0, 0x2, 0x1b9, 0x7fffffff}) fcntl$lock(r0, 0x24, &(0x7f0000000180)={0x2, 0x0, 0x4000000089}) setxattr$incfs_metadata(&(0x7f0000000080)='./cgroup.cpu/cpuset.cpus\x00', &(0x7f00000000c0), 0x0, 0x0, 0x0) syz_genetlink_get_family_id$wireguard(&(0x7f0000000000), 0xffffffffffffffff) r1 = socket$inet_udp(0x2, 0x2, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000000)=0x9, 0x4) lremovexattr(&(0x7f0000000040)='./cgroup.cpu/cpuset.cpus\x00', &(0x7f0000000100)=@known='user.incfs.metadata\x00') syz_usb_connect$midi(0x0, 0x24, &(0x7f0000000040)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x10, 0xd8c, 0x102, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x1, 0x60, 0x60, 0x1, "", {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x3, 0x30, 0x2}}}}}]}}, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.43' (ED25519) to the list of known hosts. [ 21.196985][ T36] audit: type=1400 audit(1790739984.770:64): avc: denied { mounton } for pid=286 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 21.198519][ T286] cgroup: Unknown subsys name 'net' [ 21.219662][ T36] audit: type=1400 audit(1790739984.770:65): avc: denied { mount } for pid=286 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 21.247160][ T36] audit: type=1400 audit(1790739984.810:66): avc: denied { unmount } for pid=286 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 21.247351][ T286] cgroup: Unknown subsys name 'devices' [ 21.372176][ T286] cgroup: Unknown subsys name 'hugetlb' [ 21.377789][ T286] cgroup: Unknown subsys name 'rlimit' [ 21.469853][ T36] audit: type=1400 audit(1790739985.040:67): avc: denied { setattr } for pid=286 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 21.493095][ T36] audit: type=1400 audit(1790739985.040:68): avc: denied { mounton } for pid=286 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 21.501293][ T288] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 21.517968][ T36] audit: type=1400 audit(1790739985.040:69): avc: denied { mount } for pid=286 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 21.549487][ T36] audit: type=1400 audit(1790739985.110:70): avc: denied { relabelto } for pid=288 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.574916][ T36] audit: type=1400 audit(1790739985.110:71): avc: denied { write } for pid=288 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.603807][ T36] audit: type=1400 audit(1790739985.180:72): avc: denied { read } for pid=286 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.629433][ T36] audit: type=1400 audit(1790739985.180:73): avc: denied { open } for pid=286 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.629726][ T286] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 23.145388][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.152467][ T294] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.159505][ T294] bridge_slave_0: entered allmulticast mode [ 23.165888][ T294] bridge_slave_0: entered promiscuous mode [ 23.176310][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.183408][ T294] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.190471][ T294] bridge_slave_1: entered allmulticast mode [ 23.196585][ T294] bridge_slave_1: entered promiscuous mode [ 23.215715][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.222779][ T295] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.229818][ T295] bridge_slave_0: entered allmulticast mode [ 23.236084][ T295] bridge_slave_0: entered promiscuous mode [ 23.245044][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.252151][ T295] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.259218][ T295] bridge_slave_1: entered allmulticast mode [ 23.265474][ T295] bridge_slave_1: entered promiscuous mode [ 23.298579][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.305649][ T296] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.312719][ T296] bridge_slave_0: entered allmulticast mode [ 23.318885][ T296] bridge_slave_0: entered promiscuous mode [ 23.327627][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.334715][ T296] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.341849][ T296] bridge_slave_1: entered allmulticast mode [ 23.348069][ T296] bridge_slave_1: entered promiscuous mode [ 23.354184][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.361248][ T293] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.368322][ T293] bridge_slave_0: entered allmulticast mode [ 23.374580][ T293] bridge_slave_0: entered promiscuous mode [ 23.383406][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.390486][ T293] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.397584][ T293] bridge_slave_1: entered allmulticast mode [ 23.403821][ T293] bridge_slave_1: entered promiscuous mode [ 23.530718][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.537765][ T295] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.545091][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.552125][ T295] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.563052][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.570145][ T296] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.577419][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.584462][ T296] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.613312][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.620376][ T294] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.627625][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.634670][ T294] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.649017][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.656078][ T293] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.663345][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.670383][ T293] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.696864][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.704315][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.711918][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.719090][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.726842][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.734060][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.741516][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.748690][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.762102][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.769154][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.776860][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.783913][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.800910][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.807941][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.815502][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.822543][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.848236][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.855310][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.865428][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.872483][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.881525][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.888557][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.912863][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.919897][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.931167][ T295] veth0_vlan: entered promiscuous mode [ 23.953611][ T295] veth1_macvtap: entered promiscuous mode [ 23.963734][ T296] veth0_vlan: entered promiscuous mode [ 23.980003][ T293] veth0_vlan: entered promiscuous mode [ 24.002195][ T296] veth1_macvtap: entered promiscuous mode [ 24.016075][ T293] veth1_macvtap: entered promiscuous mode [ 24.023481][ T295] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 24.043538][ T294] veth0_vlan: entered promiscuous mode [ 24.066758][ T312] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 24.074161][ T294] veth1_macvtap: entered promiscuous mode [ 24.148417][ T46] Bluetooth: hci0: Frame reassembly failed (-84) [ 24.155001][ T327] Bluetooth: hci0: Frame reassembly failed (-84) [ 24.162960][ T46] Bluetooth: hci0: Frame reassembly failed (-84) [ 24.182968][ T333] usb usb8: usbfs: process 333 (syz.3.6) did not claim interface 0 before use [ 24.219937][ T10] hid-generic 0200:000B:BA76.0001: unknown main item tag 0x0 [ 24.228523][ T10] hid-generic 0200:000B:BA76.0001: unknown main item tag 0x0 [ 24.236233][ T10] hid-generic 0200:000B:BA76.0001: unknown main item tag 0x0 [ 24.244161][ T10] hid-generic 0200:000B:BA76.0001: unknown main item tag 0x0 [ 24.251952][ T10] hid-generic 0200:000B:BA76.0001: unknown main item tag 0x0 [ 24.259413][ T10] hid-generic 0200:000B:BA76.0001: unknown main item tag 0x0 [ 24.268369][ T10] hid-generic 0200:000B:BA76.0001: unknown main item tag 0x0 [ 24.276459][ T10] hid-generic 0200:000B:BA76.0001: item fetching failed at offset 10/92 [ 24.281349][ T338] process 'syz.3.7' launched './file1' with NULL argv: empty string added [ 24.285171][ T10] hid-generic 0200:000B:BA76.0001: probe with driver hid-generic failed with error -22 [ 24.330628][ T45] usb 1-1: new full-speed USB device number 2 using dummy_hcd [ 24.430882][ T31] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 24.455354][ T310] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 24.491924][ T45] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 24.510469][ T45] usb 1-1: New USB device found, idVendor=0458, idProduct=5005, bcdDevice= 0.00 [ 24.525565][ T45] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 24.544050][ T45] usb 1-1: config 0 descriptor?? [ 24.610335][ T310] usb 2-1: device descriptor read/64, error -71 [ 24.617582][ T31] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 24.628496][ T31] usb 3-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 24.637706][ T31] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 24.649232][ T31] usb 3-1: config 0 descriptor?? [ 24.880328][ T310] usb 2-1: device descriptor read/64, error -71 [ 24.957057][ T45] input: HID 0458:5005 as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/0003:0458:5005.0002/input/input4 [ 24.978439][ T45] input: HID 0458:5005 as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/0003:0458:5005.0002/input/input5 [ 24.992094][ T45] kye 0003:0458:5005.0002: input,hiddev96,hidraw0: USB HID v7f.fd Device [HID 0458:5005] on usb-dummy_hcd.0-1/input0 [ 25.065116][ T31] usbhid 3-1:0.0: can't add hid device: -71 [ 25.071149][ T31] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 25.079680][ T31] usb 3-1: USB disconnect, device number 2 [ 25.110308][ T337] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 25.120352][ T310] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 25.162077][ T10] usb 1-1: USB disconnect, device number 2 [ 25.250363][ T310] usb 2-1: device descriptor read/64, error -71 [ 25.271503][ T337] usb 4-1: config 0 has no interfaces? [ 25.276992][ T337] usb 4-1: New USB device found, idVendor=0b05, idProduct=17e0, bcdDevice= 0.00 [ 25.286302][ T337] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 25.294994][ T337] usb 4-1: config 0 descriptor?? [ 25.490362][ T310] usb 2-1: device descriptor read/64, error -71 [ 25.500359][ T322] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 25.503128][ T351] EXT4-fs warning (device sda1): verify_group_input:137: Cannot add at group 10 (only 8 groups) [ 25.600504][ T310] usb usb2-port1: attempt power cycle [ 25.644675][ T337] usb 4-1: USB disconnect, device number 2 [ 25.653252][ T322] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 25.664464][ T322] usb 3-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.40 [ 25.673540][ T322] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 25.686148][ T322] usb 3-1: config 0 descriptor?? [ 25.697980][ T357] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 25.697999][ T357] rust_binder: Read failure Err(EFAULT) in pid:4 [ 25.707288][ T357] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 25.713709][ T357] rust_binder: Read failure Err(EFAULT) in pid:4 [ 25.722448][ T357] rust_binder: 356:357 error while translating object: EBADF [ 25.736385][ T357] rust_binder: Failure in copy_transaction_data: EBADF [ 25.736440][ T357] rust_binder: 356:357 transaction call to 356:0 failed EBADF, code 0 size 112-24 [ 25.753330][ T31] rust_binder: 356: undelivered TRANSACTION_ERROR: 29201 [ 25.950305][ T310] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 25.971359][ T310] usb 2-1: device descriptor read/8, error -71 [ 26.030305][ T31] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 26.101367][ T310] usb 2-1: device descriptor read/8, error -71 [ 26.160362][ T329] Bluetooth: hci0: command 0x1003 tx timeout [ 26.160406][ T54] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 26.191827][ T31] usb 1-1: unable to get BOS descriptor or descriptor too short [ 26.200416][ T31] usb 1-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 51, changing to 7 [ 26.211844][ T36] kauditd_printk_skb: 67 callbacks suppressed [ 26.211859][ T36] audit: type=1400 audit(1790739989.790:141): avc: denied { unmount } for pid=295 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 26.238943][ T36] audit: type=1400 audit(1790739989.790:142): avc: denied { write } for pid=360 comm="syz.3.13" name="kvm" dev="devtmpfs" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 26.262564][ T31] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 26.271662][ T31] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 26.279693][ T31] usb 1-1: Product: Ѝ [ 26.284494][ T31] usb 1-1: Manufacturer: ࠚ [ 26.289102][ T31] usb 1-1: SerialNumber: Б [ 26.294277][ T331] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 26.303444][ T331] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 26.322088][ T36] audit: type=1400 audit(1790739989.900:143): avc: denied { create } for pid=363 comm="syz.3.14" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 26.327198][ T364] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 26.341276][ T36] audit: type=1400 audit(1790739989.900:144): avc: denied { setopt } for pid=363 comm="syz.3.14" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 26.352903][ T310] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 26.372230][ T36] audit: type=1400 audit(1790739989.900:145): avc: denied { create } for pid=363 comm="syz.3.14" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 26.398679][ T36] audit: type=1400 audit(1790739989.950:146): avc: denied { getopt } for pid=363 comm="syz.3.14" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 26.418225][ T36] audit: type=1400 audit(1790739989.950:147): avc: denied { create } for pid=363 comm="syz.3.14" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 26.437588][ T36] audit: type=1400 audit(1790739989.950:148): avc: denied { ioctl } for pid=363 comm="syz.3.14" path="socket:[4360]" dev="sockfs" ino=4360 ioctlcmd=0x9425 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 26.438260][ T310] usb 2-1: device descriptor read/8, error -71 [ 26.462185][ T36] audit: type=1400 audit(1790739989.950:149): avc: denied { ioctl } for pid=363 comm="syz.3.14" path="socket:[4361]" dev="sockfs" ino=4361 ioctlcmd=0x9422 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 26.492750][ T36] audit: type=1400 audit(1790739989.990:150): avc: denied { write } for pid=366 comm="syz.3.15" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 26.513173][ T322] aiptek 3-1:0.0: Aiptek using 400 ms programming speed [ 26.515881][ T31] usb 1-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 26.521113][ T322] input: Aiptek as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/input/input6 [ 26.531860][ T31] usb 1-1: 2:1 : no UAC_FORMAT_TYPE desc [ 26.552140][ T31] usb 1-1: USB disconnect, device number 3 [ 26.552157][ C0] ------------[ cut here ]------------ [ 26.552168][ C0] UBSAN: array-index-out-of-bounds in drivers/input/tablet/aiptek.c:741:31 [ 26.570486][ T354] udevd[354]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 26.571995][ C0] index 43007 is out of range for type 'const int[34]' [ 26.594451][ C0] CPU: 0 UID: 0 PID: 316 Comm: udevd Not tainted syzkaller #0 90688e1ceab05e74867d9ba7556f72450a710f26 [ 26.594480][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 26.594499][ C0] Call Trace: [ 26.594506][ C0] [ 26.594514][ C0] __dump_stack+0x21/0x30 [ 26.594551][ C0] dump_stack_lvl+0x140/0x1c0 [ 26.594568][ C0] ? __cfi_dump_stack_lvl+0x10/0x10 [ 26.594582][ C0] ? call_rcu+0x14/0x20 [ 26.594593][ C0] ? __se_sys_close+0x172/0x1f0 [ 26.594604][ C0] ? x64_sys_call+0x2560/0x2ee0 [ 26.594614][ C0] dump_stack+0x19/0x20 [ 26.594627][ C0] ubsan_epilogue+0xe/0x40 [ 26.594636][ C0] __ubsan_handle_out_of_bounds+0xe8/0xf0 [ 26.594653][ C0] aiptek_irq+0x208d/0x2a00 [ 26.594670][ C0] ? _raw_spin_unlock+0x45/0x60 [ 26.594681][ C0] ? kcov_remote_start+0x1d2/0x3c0 [ 26.594694][ C0] __usb_hcd_giveback_urb+0x36e/0x530 [ 26.594706][ C0] usb_hcd_giveback_urb+0x12b/0x400 [ 26.594716][ C0] dummy_timer+0xa3f/0x4900 [ 26.594732][ C0] ? __cfi_dummy_timer+0x10/0x10 [ 26.594743][ C0] ? timerqueue_del+0xd7/0x130 [ 26.594758][ C0] ? __hrtimer_run_queues+0x2bd/0x8e0 [ 26.594774][ C0] ? __cfi_dummy_timer+0x10/0x10 [ 26.594784][ C0] __hrtimer_run_queues+0x3ae/0x8e0 [ 26.594799][ C0] ? hrtimer_interrupt+0xf30/0xf30 [ 26.594813][ C0] ? read_tsc+0xd/0x20 [ 26.594827][ C0] ? ktime_get_update_offsets_now+0x3c0/0x3e0 [ 26.594841][ C0] hrtimer_run_softirq+0x159/0x560 [ 26.594850][ C0] ? irqtime_account_irq+0x51/0x1c0 [ 26.594865][ C0] handle_softirqs+0x1aa/0x620 [ 26.594877][ C0] __irq_exit_rcu+0x47/0xb0 [ 26.594887][ C0] irq_exit_rcu+0xd/0x30 [ 26.594896][ C0] sysvec_apic_timer_interrupt+0x82/0x90 [ 26.594910][ C0] [ 26.594914][ C0] [ 26.594918][ C0] asm_sysvec_apic_timer_interrupt+0x1f/0x30 [ 26.594931][ C0] RIP: 0010:unwind_next_frame+0x541/0x6b0 [ 26.594948][ C0] Code: 06 00 74 35 48 89 df e8 7d 06 00 00 48 8b 45 b0 42 0f b6 04 30 84 c0 0f 85 a8 00 00 00 c7 03 00 00 00 00 31 c0 48 83 c4 28 5b <41> 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc c6 05 9a d3 a0 06 01 [ 26.594956][ C0] RSP: 0018:ffffc9000b84f8d8 EFLAGS: 00000292 [ 26.594973][ C0] RAX: 1ffff92001709f01 RBX: ffffc9000b84f9c0 RCX: 0000000001709f01 [ 26.594981][ C0] RDX: ffffc9000b84fdc8 RSI: 1ffff92001709f22 RDI: ffffc9000b84f930 [ 26.594989][ C0] RBP: ffffc9000b84f8f8 R08: ffffc9000b84f9d0 R09: ffffc9000b84f9c8 [ 26.594997][ C0] R10: 0000000000000003 R11: ffffffff8175a6a0 R12: ffffc9000b84fcb0 [ 26.595005][ C0] R13: ffffc9000b84f930 R14: dffffc0000000000 R15: 0000000000000000 [ 26.595013][ C0] ? __cfi_stack_trace_consume_entry+0x10/0x10 [ 26.595033][ C0] ? __cfi_stack_trace_consume_entry+0x10/0x10 [ 26.595045][ C0] arch_stack_walk+0x138/0x170 [ 26.595056][ C0] ? call_rcu+0x14/0x20 [ 26.595067][ C0] stack_trace_save+0xaa/0x100 [ 26.595078][ C0] ? __cfi_stack_trace_save+0x10/0x10 [ 26.595091][ C0] kasan_save_stack+0x3e/0x60 [ 26.595103][ C0] ? kasan_save_stack+0x3e/0x60 [ 26.595114][ C0] ? __kasan_record_aux_stack+0xb2/0xd0 [ 26.595124][ C0] ? kasan_record_aux_stack_noalloc+0xf/0x20 [ 26.595134][ C0] ? __call_rcu_common+0xd5/0x710 [ 26.595148][ C0] __kasan_record_aux_stack+0xb2/0xd0 [ 26.595158][ C0] ? __cfi_put_cred_rcu+0x10/0x10 [ 26.595170][ C0] kasan_record_aux_stack_noalloc+0xf/0x20 [ 26.595180][ C0] __call_rcu_common+0xd5/0x710 [ 26.595192][ C0] ? call_rcu_hurry+0x30/0x30 [ 26.595202][ C0] ? __kasan_slab_free+0x6a/0x80 [ 26.595215][ C0] ? kmem_cache_free+0x1bd/0x4f0 [ 26.595226][ C0] ? security_file_free+0x98/0x100 [ 26.595237][ C0] call_rcu+0x14/0x20 [ 26.595248][ C0] __put_cred+0xf6/0x130 [ 26.595260][ C0] __fput+0x6c3/0xa30 [ 26.595274][ C0] __fput_sync+0x4a/0x70 [ 26.595292][ C0] __se_sys_close+0x172/0x1f0 [ 26.595302][ C0] __x64_sys_close+0x3c/0x60 [ 26.595311][ C0] x64_sys_call+0x2560/0x2ee0 [ 26.595320][ C0] do_syscall_64+0x57/0xf0 [ 26.595333][ C0] ? clear_bhb_loop+0x50/0xa0 [ 26.595345][ C0] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 26.595357][ C0] RIP: 0033:0x7f46914a7407 [ 26.595370][ C0] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 26.595378][ C0] RSP: 002b:00007ffc34017c60 EFLAGS: 00000202 ORIG_RAX: 0000000000000003 [ 26.595389][ C0] RAX: ffffffffffffffda RBX: 00007f4691b65880 RCX: 00007f46914a7407 [ 26.595397][ C0] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000008 [ 26.595403][ C0] RBP: 0000556eda64f8c0 R08: 0000000000000000 R09: 0000000000000000 [ 26.595410][ C0] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000008 [ 26.595416][ C0] R13: 00007f4691b65770 R14: 0000000000000011 R15: 000000000000000a [ 26.595425][ C0] [ 26.595428][ C0] ---[ end trace ]--- [ 26.671535][ T310] usb 2-1: device descriptor read/8, error -71 [ 26.673948][ C0] ================================================================== [ 26.790669][ T310] usb usb2-port1: unable to enumerate USB device [ 26.800588][ C0] BUG: KASAN: global-out-of-bounds in aiptek_irq+0x20ab/0x2a00 [ 26.867021][ T369] bridge0: port 3(syz_tun) entered blocking state [ 26.867473][ C0] Read of size 4 at addr ffffffff8672fadc by task udevd/316 [ 26.867494][ C0] [ 26.867503][ C0] CPU: 0 UID: 0 PID: 316 Comm: udevd Not tainted syzkaller #0 90688e1ceab05e74867d9ba7556f72450a710f26 [ 26.867525][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 26.867537][ C0] Call Trace: [ 26.867545][ C0] [ 26.867553][ C0] __dump_stack+0x21/0x30 [ 26.867587][ C0] dump_stack_lvl+0x140/0x1c0 [ 26.867615][ C0] ? __cfi_dump_stack_lvl+0x10/0x10 [ 26.867641][ C0] ? __cfi__printk+0x10/0x10 [ 26.867667][ C0] print_address_description+0x71/0x210 [ 26.867694][ C0] print_report+0x4a/0x70 [ 26.867720][ C0] kasan_report+0x162/0x1a0 [ 26.867756][ C0] ? aiptek_irq+0x20ab/0x2a00 [ 26.867786][ C0] ? aiptek_irq+0x20ab/0x2a00 [ 26.867813][ C0] __asan_report_load4_noabort+0x18/0x20 [ 26.867834][ C0] aiptek_irq+0x20ab/0x2a00 [ 26.867861][ C0] ? _raw_spin_unlock+0x45/0x60 [ 26.867882][ C0] ? kcov_remote_start+0x1d2/0x3c0 [ 26.867903][ C0] __usb_hcd_giveback_urb+0x36e/0x530 [ 26.867926][ C0] usb_hcd_giveback_urb+0x12b/0x400 [ 26.867952][ C0] dummy_timer+0xa3f/0x4900 [ 26.867982][ C0] ? __cfi_dummy_timer+0x10/0x10 [ 26.868002][ C0] ? timerqueue_del+0xd7/0x130 [ 26.868030][ C0] ? __hrtimer_run_queues+0x2bd/0x8e0 [ 26.868059][ C0] ? __cfi_dummy_timer+0x10/0x10 [ 26.868080][ C0] __hrtimer_run_queues+0x3ae/0x8e0 [ 26.868110][ C0] ? hrtimer_interrupt+0xf30/0xf30 [ 26.868137][ C0] ? read_tsc+0xd/0x20 [ 26.868162][ C0] ? ktime_get_update_offsets_now+0x3c0/0x3e0 [ 26.868188][ C0] hrtimer_run_softirq+0x159/0x560 [ 26.868206][ C0] ? irqtime_account_irq+0x51/0x1c0 [ 26.868235][ C0] handle_softirqs+0x1aa/0x620 [ 26.868257][ C0] __irq_exit_rcu+0x47/0xb0 [ 26.868277][ C0] irq_exit_rcu+0xd/0x30 [ 26.868295][ C0] sysvec_apic_timer_interrupt+0x82/0x90 [ 26.868321][ C0] [ 26.868327][ C0] [ 26.868334][ C0] asm_sysvec_apic_timer_interrupt+0x1f/0x30 [ 26.868361][ C0] RIP: 0010:unwind_next_frame+0x541/0x6b0 [ 26.868388][ C0] Code: 06 00 74 35 48 89 df e8 7d 06 00 00 48 8b 45 b0 42 0f b6 04 30 84 c0 0f 85 a8 00 00 00 c7 03 00 00 00 00 31 c0 48 83 c4 28 5b <41> 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc c6 05 9a d3 a0 06 01 [ 26.868404][ C0] RSP: 0018:ffffc9000b84f8d8 EFLAGS: 00000292 [ 26.868423][ C0] RAX: 1ffff92001709f01 RBX: ffffc9000b84f9c0 RCX: 0000000001709f01 [ 26.868439][ C0] RDX: ffffc9000b84fdc8 RSI: 1ffff92001709f22 RDI: ffffc9000b84f930 [ 26.868454][ C0] RBP: ffffc9000b84f8f8 R08: ffffc9000b84f9d0 R09: ffffc9000b84f9c8 [ 26.868469][ C0] R10: 0000000000000003 R11: ffffffff8175a6a0 R12: ffffc9000b84fcb0 [ 26.868484][ C0] R13: ffffc9000b84f930 R14: dffffc0000000000 R15: 0000000000000000 [ 26.868499][ C0] ? __cfi_stack_trace_consume_entry+0x10/0x10 [ 26.868525][ C0] ? __cfi_stack_trace_consume_entry+0x10/0x10 [ 26.868549][ C0] arch_stack_walk+0x138/0x170 [ 26.868569][ C0] ? call_rcu+0x14/0x20 [ 26.868591][ C0] stack_trace_save+0xaa/0x100 [ 26.868612][ C0] ? __cfi_stack_trace_save+0x10/0x10 [ 26.868636][ C0] kasan_save_stack+0x3e/0x60 [ 26.868658][ C0] ? kasan_save_stack+0x3e/0x60 [ 26.868679][ C0] ? __kasan_record_aux_stack+0xb2/0xd0 [ 26.868698][ C0] ? kasan_record_aux_stack_noalloc+0xf/0x20 [ 26.868717][ C0] ? __call_rcu_common+0xd5/0x710 [ 26.868745][ C0] __kasan_record_aux_stack+0xb2/0xd0 [ 26.868764][ C0] ? __cfi_put_cred_rcu+0x10/0x10 [ 26.868786][ C0] kasan_record_aux_stack_noalloc+0xf/0x20 [ 26.868806][ C0] __call_rcu_common+0xd5/0x710 [ 26.868828][ C0] ? call_rcu_hurry+0x30/0x30 [ 26.868849][ C0] ? __kasan_slab_free+0x6a/0x80 [ 26.868873][ C0] ? kmem_cache_free+0x1bd/0x4f0 [ 26.868895][ C0] ? security_file_free+0x98/0x100 [ 26.868915][ C0] call_rcu+0x14/0x20 [ 26.868940][ C0] __put_cred+0xf6/0x130 [ 26.868962][ C0] __fput+0x6c3/0xa30 [ 26.868992][ C0] __fput_sync+0x4a/0x70 [ 26.869018][ C0] __se_sys_close+0x172/0x1f0 [ 26.869037][ C0] __x64_sys_close+0x3c/0x60 [ 26.869055][ C0] x64_sys_call+0x2560/0x2ee0 [ 26.869074][ C0] do_syscall_64+0x57/0xf0 [ 26.869093][ C0] ? clear_bhb_loop+0x50/0xa0 [ 26.869117][ C0] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 26.869141][ C0] RIP: 0033:0x7f46914a7407 [ 26.869157][ C0] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 26.869173][ C0] RSP: 002b:00007ffc34017c60 EFLAGS: 00000202 ORIG_RAX: 0000000000000003 [ 26.869192][ C0] RAX: ffffffffffffffda RBX: 00007f4691b65880 RCX: 00007f46914a7407 [ 26.869208][ C0] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000008 [ 26.869219][ C0] RBP: 0000556eda64f8c0 R08: 0000000000000000 R09: 0000000000000000 [ 26.869232][ C0] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000008 [ 26.869245][ C0] R13: 00007f4691b65770 R14: 0000000000000011 R15: 000000000000000a [ 26.869260][ C0] [ 26.869267][ C0] [ 26.872372][ T369] bridge0: port 3(syz_tun) entered disabled state [ 26.877599][ C0] The buggy address belongs to the variable: [ 26.877609][ C0] .str.637+0x3c/0x40 [ 26.882507][ T369] syz_tun: entered allmulticast mode [ 26.887090][ C0] [ 26.887099][ C0] The buggy address belongs to the physical page: [ 26.897022][ T369] syz_tun: entered promiscuous mode [ 26.898581][ C0] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x672f [ 26.903866][ T369] bridge0: port 3(syz_tun) entered blocking state [ 26.908917][ C0] flags: 0x4000(reserved|zone=0) [ 26.908947][ C0] raw: 0000000000004000 ffffea000019cbc8 ffffea000019cbc8 0000000000000000 [ 26.908966][ C0] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 26.913990][ T369] bridge0: port 3(syz_tun) entered forwarding state [ 26.919751][ C0] page dumped because: kasan: bad access detected [ 27.101692][ T372] Zero length message leads to an empty skb [ 27.102697][ C0] page_owner info is not present (never set?) [ 27.687778][ C0] [ 27.690112][ C0] Memory state around the buggy address: [ 27.695741][ C0] ffffffff8672f980: 00 00 03 f9 f9 f9 f9 f9 00 00 06 f9 f9 f9 f9 f9 [ 27.703806][ C0] ffffffff8672fa00: 00 00 04 f9 f9 f9 f9 f9 00 00 02 f9 f9 f9 f9 f9 [ 27.711871][ C0] >ffffffff8672fa80: 00 07 f9 f9 00 00 00 01 f9 f9 f9 f9 00 00 01 f9 [ 27.719906][ C0] ^ [ 27.726821][ C0] ffffffff8672fb00: f9 f9 f9 f9 00 00 f9 f9 00 00 00 04 f9 f9 f9 f9 [ 27.734860][ C0] ffffffff8672fb80: 00 00 00 03 f9 f9 f9 f9 00 00 04 f9 f9 f9 f9 f9 [ 27.742896][ C0] ================================================================== [ 27.750932][ C0] Disabling lock debugging due to kernel taint [ 27.757060][ C0] ------------[ cut here ]------------ [ 27.762488][ C0] UBSAN: array-index-out-of-bounds in drivers/input/tablet/aiptek.c:763:30 [ 27.771051][ C0] index 43008 is out of range for type 'const int[34]' [ 27.777876][ C0] CPU: 0 UID: 0 PID: 316 Comm: udevd Tainted: G B syzkaller #0 90688e1ceab05e74867d9ba7556f72450a710f26 [ 27.777895][ C0] Tainted: [B]=BAD_PAGE [ 27.777899][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 27.777906][ C0] Call Trace: [ 27.777911][ C0] [ 27.777916][ C0] __dump_stack+0x21/0x30 [ 27.777936][ C0] dump_stack_lvl+0x140/0x1c0 [ 27.777950][ C0] ? __cfi_dump_stack_lvl+0x10/0x10 [ 27.777964][ C0] ? _raw_spin_lock_irqsave+0xc1/0x160 [ 27.777976][ C0] dump_stack+0x19/0x20 [ 27.777989][ C0] ubsan_epilogue+0xe/0x40 [ 27.777998][ C0] __ubsan_handle_out_of_bounds+0xe8/0xf0 [ 27.778015][ C0] aiptek_irq+0x1f3c/0x2a00 [ 27.778030][ C0] ? _raw_spin_unlock+0x45/0x60 [ 27.778040][ C0] ? kcov_remote_start+0x1d2/0x3c0 [ 27.778052][ C0] __usb_hcd_giveback_urb+0x36e/0x530 [ 27.778064][ C0] usb_hcd_giveback_urb+0x12b/0x400 [ 27.778074][ C0] dummy_timer+0xa3f/0x4900 [ 27.778089][ C0] ? __cfi_dummy_timer+0x10/0x10 [ 27.778100][ C0] ? timerqueue_del+0xd7/0x130 [ 27.778115][ C0] ? __hrtimer_run_queues+0x2bd/0x8e0 [ 27.778130][ C0] ? __cfi_dummy_timer+0x10/0x10 [ 27.778141][ C0] __hrtimer_run_queues+0x3ae/0x8e0 [ 27.778156][ C0] ? hrtimer_interrupt+0xf30/0xf30 [ 27.778170][ C0] ? read_tsc+0xd/0x20 [ 27.778184][ C0] ? ktime_get_update_offsets_now+0x3c0/0x3e0 [ 27.778197][ C0] hrtimer_run_softirq+0x159/0x560 [ 27.778207][ C0] ? irqtime_account_irq+0x51/0x1c0 [ 27.778222][ C0] handle_softirqs+0x1aa/0x620 [ 27.778234][ C0] __irq_exit_rcu+0x47/0xb0 [ 27.778244][ C0] irq_exit_rcu+0xd/0x30 [ 27.778254][ C0] sysvec_apic_timer_interrupt+0x82/0x90 [ 27.778267][ C0] [ 27.778270][ C0] [ 27.778274][ C0] asm_sysvec_apic_timer_interrupt+0x1f/0x30 [ 27.778288][ C0] RIP: 0010:unwind_next_frame+0x541/0x6b0 [ 27.778304][ C0] Code: 06 00 74 35 48 89 df e8 7d 06 00 00 48 8b 45 b0 42 0f b6 04 30 84 c0 0f 85 a8 00 00 00 c7 03 00 00 00 00 31 c0 48 83 c4 28 5b <41> 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc c6 05 9a d3 a0 06 01 [ 27.778318][ C0] RSP: 0018:ffffc9000b84f8d8 EFLAGS: 00000292 [ 27.778336][ C0] RAX: 1ffff92001709f01 RBX: ffffc9000b84f9c0 RCX: 0000000001709f01 [ 27.778351][ C0] RDX: ffffc9000b84fdc8 RSI: 1ffff92001709f22 RDI: ffffc9000b84f930 [ 27.778366][ C0] RBP: ffffc9000b84f8f8 R08: ffffc9000b84f9d0 R09: ffffc9000b84f9c8 [ 27.778380][ C0] R10: 0000000000000003 R11: ffffffff8175a6a0 R12: ffffc9000b84fcb0 [ 27.778388][ C0] R13: ffffc9000b84f930 R14: dffffc0000000000 R15: 0000000000000000 [ 27.778396][ C0] ? __cfi_stack_trace_consume_entry+0x10/0x10 [ 27.778411][ C0] ? __cfi_stack_trace_consume_entry+0x10/0x10 [ 27.778423][ C0] arch_stack_walk+0x138/0x170 [ 27.778434][ C0] ? call_rcu+0x14/0x20 [ 27.778445][ C0] stack_trace_save+0xaa/0x100 [ 27.778456][ C0] ? __cfi_stack_trace_save+0x10/0x10 [ 27.778469][ C0] kasan_save_stack+0x3e/0x60 [ 27.778481][ C0] ? kasan_save_stack+0x3e/0x60 [ 27.778492][ C0] ? __kasan_record_aux_stack+0xb2/0xd0 [ 27.778502][ C0] ? kasan_record_aux_stack_noalloc+0xf/0x20 [ 27.778511][ C0] ? __call_rcu_common+0xd5/0x710 [ 27.778526][ C0] __kasan_record_aux_stack+0xb2/0xd0 [ 27.778535][ C0] ? __cfi_put_cred_rcu+0x10/0x10 [ 27.778547][ C0] kasan_record_aux_stack_noalloc+0xf/0x20 [ 27.778557][ C0] __call_rcu_common+0xd5/0x710 [ 27.778569][ C0] ? call_rcu_hurry+0x30/0x30 [ 27.778579][ C0] ? __kasan_slab_free+0x6a/0x80 [ 27.778591][ C0] ? kmem_cache_free+0x1bd/0x4f0 [ 27.778603][ C0] ? security_file_free+0x98/0x100 [ 27.778614][ C0] call_rcu+0x14/0x20 [ 27.778624][ C0] __put_cred+0xf6/0x130 [ 27.778635][ C0] __fput+0x6c3/0xa30 [ 27.778650][ C0] __fput_sync+0x4a/0x70 [ 27.778663][ C0] __se_sys_close+0x172/0x1f0 [ 27.778673][ C0] __x64_sys_close+0x3c/0x60 [ 27.778682][ C0] x64_sys_call+0x2560/0x2ee0 [ 27.778691][ C0] do_syscall_64+0x57/0xf0 [ 27.778701][ C0] ? clear_bhb_loop+0x50/0xa0 [ 27.778714][ C0] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 27.778726][ C0] RIP: 0033:0x7f46914a7407 [ 27.778735][ C0] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 27.778744][ C0] RSP: 002b:00007ffc34017c60 EFLAGS: 00000202 ORIG_RAX: 0000000000000003 [ 27.778754][ C0] RAX: ffffffffffffffda RBX: 00007f4691b65880 RCX: 00007f46914a7407 [ 27.778762][ C0] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000008 [ 27.778768][ C0] RBP: 0000556eda64f8c0 R08: 0000000000000000 R09: 0000000000000000 [ 27.778775][ C0] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000008 [ 27.778781][ C0] R13: 00007f4691b65770 R14: 0000000000000011 R15: 000000000000000a [ 27.778789][ C0] [ 27.778793][ C0] ---[ end trace ]--- [ 28.310322][ T10] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 28.317409][ T310] usb 3-1: USB disconnect, device number 3 [ 28.317880][ C0] aiptek 3-1:0.0: aiptek_irq - usb_submit_urb failed with result -19 [ 28.480297][ T10] usb 4-1: device descriptor read/64, error -71 [ 28.720502][ T10] usb 4-1: device descriptor read/64, error -71 [ 28.970461][ T10] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 29.100328][ T10] usb 4-1: device descriptor read/64, error -71 [ 29.340330][ T10] usb 4-1: device descriptor read/64, error -71 [ 29.460384][ T10] usb usb4-port1: attempt power cycle