last executing test programs: 3.676273561s ago: executing program 2 (id=438): r0 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffe) r1 = request_key(&(0x7f0000000080)='asymmetric\x00', &(0x7f0000000100)={'syz', 0x2}, &(0x7f0000000180)='*\x00', r0) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r0, &(0x7f00000000c0)='asymmetric\x00', &(0x7f0000000280)=@chain={'key_or_keyring:', r1}) add_key(&(0x7f0000000040)='asymmetric\x00', 0x0, &(0x7f0000000780)="308205553082033da00302010202147398ea982dd02ea8b1cf57c7f297b3e61afc8c0a300d06092a864886f70d010152050030343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b65793020170d3232303531383232333234315a180f32313232303432343232333234315a30343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b657a30820222300d06092a864886f70d01010105000382020f003082020a0282020100ccac49dd3bcab0157e846ab20a695f1c0a61823b4f2ca3952c08584bb15d99e0c3c179c2b3ebc01e6d3e541dbdb7927b4db59558b2522ec6244b7163803277a7385edb72ae6e0decfbb66d017fe95566dfbf1d76780231e8e507f8b7825c0dd4bbfba2590d2e3a78953a8b4606474446d7cd066a4113e319f6bb6e38f48301a3bf4a394fd70ae938b3f594144eddf743fd24b2493ca5f77a7cd4453d977568f1ed4c420b70ca85f3dee5882cc5beb69734ba2402cd8b869fa973ca73cf9281ee7555bb18675cff3fb5dd331b0ce978db5ccfaa5c4342df5ea96decd7d7ffe6a13a921adaaef68c6f7bd5b46e06e98fe8de093189ed0e11a1fa8ae9e964596253dad170be11d4999711cf99de0b9d947eaab852ea37db907e35bdd9fe6d0a487028ddd50d7f03809314238fb922cd7c29fef172b55c0b12cf9c15f6114c7a45258c450a34ac2d9a81ca0b1322cdeb1a38881897960881aacc8f0f8a327b7668036843bf11ba5560fd801c0d9b69b60972bc0f412f0782c6e3b21391c46d149531be19bdbcede14c74a2e0780bbb94ec4c533aa2b5841d4b657edcf7db367dbe9e3b366642667635bfbef0c13c7ce9425c24530305a86724500275ff24463b358976e670dac5518c9ae505b00bd02dd47d5775946bf90aad0e410015d04fc07f902d18488f28fe5da7cd999ebd026c8a31f31cc74be693cd42a2e46810479dfc210203010001a35d305b300c0603551d130101ff04023000300b0603551d0f040403020780301d0603551d0e04160414f58703bb33ce1b73ee02eccdee5b8817518fe3db301f0603551d23041830168014f58703bb33ce1b73ee02eccdee5b8817518fe3db300d06092a864886f70d01010b05000382020100c02e12417b738516c8db8679e8f5cd44f4c6e281235e47cbab25f11e583e317f78ad85ebfe148860f77fd226a2f4982afdba050c203312cc4d1461648193d333edc8fff178cc5f519f09d7be0d5c74fd9bdf524ac9a871253304106736d0b30bc9a14072ae417b68e6e47bd028f76de73f50fc917c9156d4dfa6bbe84d1b58aa28fac119eb112f248b7cc5a98626aa6eb79bd5f806fb02527b9c9ea1e0078b5ee4b85529f648521c1b542d46d8e571b960d145b592898a63582ab3c6b276e23c825904ae5ac4997b2e4b4657b82924b2fdee2c0da483fa652a07358b97cfbd962ed17e6cc21e87b66c7665b5b262da8be973e3db33dd133a17636a76de8d8fe04761283a83ff8fe7c7e04aa3e507cfe98c35352ee7806631bf91580ae1253d38d3a4f059344707620fbe30dd818858f028b096e582f805b71301bcfac61f8672ccf9ee8ed9d6048c246cbf0f5d3739cf45c1933ad2ed5c5879748662307e8ebbdd7aa9edca40cb6247f4b49f527f7263a8f02baf452a48196de3fbf9196669c8cc62876c532b2d6e906c543a822541cb186aa422a8a1c447d781001c15510f1aafef9fa6618cbd6b8bede6ac0eb63a4c92e60f910a0f71c7a0b90d3a175a6f35c8e7504f46e870604806828b6658e673919c123d358e46ad5af5b3db692104fdd31cdf949d56b00ad195768dec9edd0b159764ade5f26202fc9e5f56423905b3", 0x559, r0) 3.676180161s ago: executing program 2 (id=439): mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000002, 0x2000000000032, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM(0x23, 0x5, &(0x7f0000ffb000/0x3000)=nil) r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000002180), 0x40, 0x0) ioctl$BTRFS_IOC_DEFRAG_RANGE(r0, 0x7706, 0x0) mprotect(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0xc) 3.676101001s ago: executing program 2 (id=440): openat(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x20) socket(0x80000000000000a, 0x2, 0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)) r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000080), 0x10) sendmsg$can_bcm(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000400)=ANY=[@ANYBLOB="05"], 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000440)=ANY=[@ANYBLOB="0500000000e0ffffffffffff", @ANYRES64=0x77359400, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="0000008001"], 0x48}}, 0x40000) sendmsg$can_bcm(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000140)=ANY=[@ANYRES32=r0], 0x48}, 0x1, 0x0, 0xf4ffffffffffffff}, 0x0) 3.433416178s ago: executing program 2 (id=441): r0 = openat$kvm(0xffffff9c, &(0x7f0000000540), 0x8000, 0x0) openat$uinput(0xffffffffffffff9c, 0x0, 0x802, 0x0) unshare(0x62040200) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) socket$inet6_tcp(0xa, 0x1, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000000)={0x1, &(0x7f0000000080)=[{0x6, 0x20, 0xfb, 0x6}]}) sendmsg$NL80211_CMD_GET_REG(0xffffffffffffffff, 0x0, 0x0) close_range(r1, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000000)='my_sys\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='my_sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='my_sys/bus/pci/devices/0000:00:03.0/resource1\x00', 0x2, 0x0) mmap(&(0x7f0000800000)=nil, 0x1000, 0x3, 0x11, r2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x3a8bc000) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)={0xfffff34, 0x0, [{0xf88e470f, 0xed}]}) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f00000002c0)={[0x2, 0x9, 0xfffffffffffffffd, 0x77, 0x0, 0x3, 0xc002004c4, 0x4000001004, 0x6, 0x8, 0x4000000000000000, 0x1, 0x366817b8, 0x2800000000000000, 0x5, 0x2000d30], 0xffffffff, 0x3042d3}) mount$tmpfs(0x0, 0x0, &(0x7f0000000000), 0x8c03, &(0x7f0000000100)={[{@huge_advise}]}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 3.138977986s ago: executing program 1 (id=447): r0 = fsopen(&(0x7f0000000000)='squashfs\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x4) r2 = openat$cgroup_ro(r1, &(0x7f0000001200)='cgroup.controllers\x00', 0x5000000, 0x0) readv(r2, &(0x7f00000012c0)=[{&(0x7f0000000100)=""/4080, 0xff0}], 0x1) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r3, 0x0, 0x50, 0x20000845, &(0x7f0000b63fe4), 0x1c) 3.138450355s ago: executing program 1 (id=450): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f00000001c0)="d8df7e23b3b9ce000000b807000000ba000000000f301b8154fea900b9b60a000080320000c4e21cdc8dcd000000c182fd3f0000c8b950020000b801000000b9a6080000b800000100ba000000000f300f300fc79d53bf0000c4b9e16dc301012202", 0x62}], 0x1, 0x9, 0x0, 0x0) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe7000/0x18000)=nil, &(0x7f0000000900)=[@text16={0x10, 0x0}], 0x1, 0x13, 0x0, 0x0) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000040)={[0x3, 0x0, 0x14, 0xfffffffffffff000, 0x1, 0x2, 0x455, 0x4a, 0x3, 0xffffffff, 0xfffffffffffffffc, 0x9, 0x4, 0x0, 0x80000000, 0x9], 0xeeee0000, 0x1}) ioctl$KVM_RUN(r2, 0xae80, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x80082, 0x0) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) r4 = openat$binfmt_register(0xffffffffffffff9c, &(0x7f0000000140), 0x1, 0x0) write$binfmt_register(r4, &(0x7f0000002300)={0x3a, 'syz2', 0x3a, 'M', 0x3a, 0x3ff, 0x3a, '.', 0x3a, '#:', 0x3a, './file0'}, 0x2a) syz_usb_connect(0x0, 0x6b, &(0x7f0000000240)=ANY=[@ANYBLOB="1201000385352608f20446b76e8e01020301090259000104e9000909049300000e0100ff0a240102000502010209240703040001a53011240606040508000400050006000100050924030506030501f909240702020005cbad0924030601010303df092403fb020303"], &(0x7f0000001240)={0x0, 0x0, 0x0, 0x0}) ioctl$KVM_CREATE_VM(r3, 0xae03, 0x1e) 3.095992727s ago: executing program 2 (id=451): r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) fcntl$F_GET_FILE_RW_HINT(r0, 0x40d, &(0x7f0000000040)) (async) r1 = accept4(0xffffffffffffffff, &(0x7f0000000080)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, &(0x7f0000000100)=0x80, 0x40000) ioctl$FICLONERANGE(r1, 0x4020940d, &(0x7f0000000140)={{r0}, 0x8c, 0x0, 0x6}) (async) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001540)={0x94, 0x0, &(0x7f0000001380)=[@increfs, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000200)={@fda={0x66646185, 0x5, 0x1, 0xc}, @flat=@weak_binder={0x77622a85, 0x1000, 0x3}, @ptr={0x70742a85, 0x0, &(0x7f0000000180)=""/93, 0x5d, 0x2, 0x3}}, &(0x7f0000000280)={0x0, 0x20, 0x38}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x30, 0x0, 0x0, 0x60, 0x18, &(0x7f00000012c0)={@ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/4096, 0x1000, 0x2, 0x10}, @fda={0x66646185, 0x5, 0x0, 0x26}, @flat=@binder={0x73622a85, 0x1000, 0x2}}, &(0x7f0000001340)={0x0, 0x28, 0x48}}}, @exit_looper], 0xf8, 0x0, &(0x7f0000001440)="704499bf6673433ab282bff390b6ac48d65b28197128cea23d90136f70961587dcdce06a185685f4e0676b170e1f783696ecc150fefb1b62ece8d4788b7467fbf39c106ce6939028f43b3e6249a2f24301e3a2ff58eea44004fe4203839b690d5f86a22d2f31210539a0754856906960d7f33bb1989e577a13a9074234a98b8586345908c2a993a1382bf42521c3933c799aaa9d5caf44a30fd8adc7245afd6016cc9a0d882752dcba6be68bd4748e4b81bea31f16ed8bb5867f0fb43b26cbc66a65d56dfb4fbd069090315f50cd3f354716a03fe933fc1239a28bd71096258075499c9775dccc7fe88e2af8372ba2705630b3556e06b089"}) (async) r3 = fcntl$dupfd(r0, 0x0, r1) write$P9_RXATTRCREATE(r3, &(0x7f0000001580)={0x7, 0x21, 0x1}, 0x7) (async) ioctl$BTRFS_IOC_SNAP_DESTROY(r3, 0x5000940f, &(0x7f00000015c0)={{r3}, "2f279a2f19f792b1a584705a268b8fe1020e651c3231c71a0a38b0807caec91fff6a4533f50d63872325ca18bb95a49c607aaacce80b48cfa94a329d9e68efe44dc69f3edee9461c5eec2be7a4e85dc8117a834bde688ebd818f13cb917dd2875c1b4f58f1676778d414006fc671e369d3c2cafc053a408b2a565ce1d5621f5bae5f2914c315d815727cef922031485a53aea5dae6fdbd1e0ec37cb5163dbbf3f8bb90ea38da436c491b66424a50ed1647a72d26bd595b9f704ad73e750f4a4f2afabee1feb41ddde86de126860508168ccd47177f31634e86bcecf10da74093bf8b7b9b64b7dbf4ff1ceed1a9e4d6b149ec6cfdeb233a2024d3cbb82db28def5f5372327edf892b2837cddc1ba4ae4d60681d712c15ecfc93e019c3b31a041e54b5278583977e010a7820ab8b45f3aec0adff18205a989edb831e3a5c54550a10a3b45c4ea8ffd985569309f9c782610c1c69dccef158b7b3737407c48552751e976f64b24a809ddcf9c6aab853cdd083787d3c40c6dff2ed3c10f40cd7ddcafc63ebbe38439d892e1c995dc577627849539f2d1306195bb0dc894f18c35f788b74b3df7b5c4613ae772354a951ef54925036a494401c7715d4a0ec76a458afc0da496652b27e7d62038651d920aca6ff6f9dcebaac7c4138e6cef7f32013913edfa9028266bc38c214076dafb1c656804a40011b736b161bcae258377e52d10007f3fd8e1c828aed630913cecef277235c65acd409b79ac14db74226b83b242a2ce706ff570d2428365170f467707224053ecaa2a4e67b63cce4423df0377c6c86d5d71815202b9a75f065b3f03167a29c6560fbe426223d444373e14ad9b188a64b83d460a3fd3b23ce9a935467548484b3a1957a648ad68d7a43588173cc3ac8ab7249a34d0317b854cc89b0743e44a730d3ca801247d461ba38c6b55bb03fe9917e1659237748dbc42e37768b70f20ec092470a19c7a3c143b4d17bd84c6fe1a8270bfbb8f18c1544665e5a0e2c718ad74ea0923da8d3bfe55cb3f87c5b05298361e393c1efbd2878ee293b7b663fe3ba90004084cafb3fca1dab6ba5bf12113579db5fe0b531810d2da8249499792e2db056e9bbf2d4c4a17f22191e1d72e13e6360f2e6a008a3743d482ecec8f17244673763a593e014275e1834fb2ffd9fa1a2817d99e597529e8d2613a28168d884c0fa523544ff662d1e1841e091bb15cee340850f4e5a0a205e178f973a19a6177898c05d37de55e682b59772bb0aac0a3738147b6e03f73805884c3034793ae1cbcde142298736f3b020dfbb84e2f9037f7cc959989d676ab3ff481668cca8c660706f11d6ebbde388b38aecaa07617273dcc7a8f6c06a6cfb089f4c5cc4ec1de9eeebeea62d9d09513e3b240a905c490f913d1c6cc56d1daad31671c6aea5569767fcee71cc477790b188b307dbf2c335ec475433421f93746f9abf370f48b5cab9f7d6f58ad16e83d101d35574c2948063d4661ef65b167aa0cebf1e8c0fb0f80fdd341f86d69b675e5bbf0ca79a75c6cdf39c68a8e782d710df8b7b7a3ea0bc16ed93b4af7aaad50c79e5a2885cd512dd7cdc22a80979fced0ab903ed20c1a3ecf71fd19c124d461653b3c26601ac17d0a5e5856d2fc6dae9260a97c14876acdb1e8fdf3ae73976f6c0c89cba4f12f9e1ed0cdd9f789ba6a152465e20475aff63a2ec97dce0db4bfdd9fa9f0f182b9ac1146d4df9b95776dc1adf702ebb0308ed40527e833badc47d7b6b87246f5f668d3cef065f81699302b27a69b1c0301390a484f1cd7fa6e3602fc6b0af40246cf18a74374d9076ae073df9a6159b850a3f050ef7f585d465ef47e62e19b870c1c672e9630bce38ccdedf2d44df4b103512a07d3adddbb7c9731c2ac4471070938bd0ccf147ffc5c4a2dac2fef0622a760752be98a873052d42b59e9d8db0b77c1bf6a3c435bda753f9a1125ed0b60d2bfc996fb1e74a889b150b282be52b842296d397277410509574e41ba434aa69e47a7639c599948ede0fe455083762ebf82a75032731d975608a984131743f100c4c17320c43cc97b4e782e40173ef2a9a8473f146a2fd3ef2da951314462691c35b1e4b4ba2e03b0d0d4fd6e91c38f23b1d68af5675bc403511adafe5c2053a2c47cf65763c52328a72bd365c62b53facdcea3c22593733a62b7697925975a194dc02605ff430192938f3e70108880e61d2e8fccf626181dc043ca3aa1b37a15eadb4181600151f770803eabda1295ba2722f0c43a8fa868ae0e4e2d86a9da7d7907a429939be8f774d56e19df1b39717bd5b8501b73ce774c802edaee5437a7074f2ec2d96a4417954ccf686216536700063b7650cfdc5286ad52ab53a95249300caf21efe1078aef033f1c33fa97136d817dfe2ad1b6c9ebd9a60d046d81e02e5be29b3a1dcae81d9703bc98d4952ed89293adb15bcc984bea085d12234931692a3448e59ef4355458e577a16f23e616940a3b97b69bb253418e6973193e5ce5aac47ea3daf3236f6d9496a34d4ff1c1a54ac05eed7f8d3ddb91b57a3bcb4a34fc98219023483307f2515a6ab850f62a9494f5a184ca7f544176316bd0b91fba12566800a0f26fe5770c4c81a7b9e2e9a9cba77986aa92129826c9c7ed13cec46f720dac34edee6baa69592198e0a996204b29029af6d97b446fdf73976bed71dcb537a868ba1d7bcaf310666560440e25d56f8fbcf701f598211d5d2319a48117e9e9541c3c73845949a71c5ab29af64cdbc391dc3d51a89b332e2266a1f788996af8755b349af545c37ed80fe543af888835f70482fa722ebce0c7f9a754e86f9da21259e58df90e7cc6bfda65729ea29cbb99ea984b83a61328c247fd7b9d7a2053d4e0948ca0a89201efa1d8b10435ed479c3b20fbdcf370bbda945e14b334d61f0d2868be055c1bb8e46cd573816410f241641275dc6933a5bcd3c496a81f495f23b545ab5451b01804fb047ae64507bdc3c4b4537ab075586ce55a8e6fe0013f6c9caf51bdf5fdece51be7e19d7821a7911f6f4095c5239ef07ba23e69bc364a6c142d9a68a9c48058047d790bf199bb5db0867a613605a4c3e07b4b2f4fb74570d1b4678224340b3fe2dd30d771dc14690c74ea71d286d040e6d83b92aa766f5f8ad3b22716a502395bd81dcd30e9866c33c2712b1420a1d30fa6ec82de5b61903b2c184741872ef71b60b76b23e5ee61febc6c2b4ba9c0700213a57f4dc48cac9175875ec2b25713595b6afd0b684b359baa806656a5a66f6191f71ce6d1175557134e82d0a019807fc326b756d2976ac9b0a4a80db93ddc3dae4e9dc5bcf68135a976ceb1e0d504e0c9db2aa25ad105bf6798ecd2cb33313347ea15bac3bb98b6f813b11f5728a5bcd71c33aab0502cec29ed2d5fbb7828b0661cee2599c1cae9527742f72f9e474171dcc30ea1d7df368381dbeedb20510114379b62699a6c50206bf16d82974c8dc354f4faf730cc1b63c70fb8edfbe843b1a1a0598f885956ead094eb3ba87931906e5bedc378fa56544f0696e618a9954959ea827891ef26514e4c1e2497073353b512683ddb1e973d11a0785ee45210bfe1cf451d39faae7230b574e2b62b22ad19e24b016658e9e31e1281e0e4bdc550e3f467f3eda66a269fd629d58da644a5318fa51cc82be841856d4fc1681337c4ab9644f8f4e15047a9a324d4691841b04ce13a8146e129812d1ce1eaa31cf25c57555b063fc1aa4c18318ed4aad509e44c2ff3025fe6c9b2c51731cb21bcf3d19a4109c9bd7885aa2f4949089fe50e23f780ff27eb25ed5f3ed0769cdc720bd829ec1c5dd59d14e1e7d39bf6d01b557c0a8ca3203d6f10b39b2c76b5ef7c970c2345062a63dd7b7d21cd0da5d317c0354f19c1f110a7b89780a5b87a2c241b6ffa2a92383f9d27e0bce8cb173e2d171e555b844dd65275a0b28451b2f877728e7304d9adaeacd30ecf45e4738ed73f518763ab6986366f98f4133c5533acf36e3fb468aa60f12c9c1a34b7942a4095d32e24edee601178eb41a406cba88d5d31380fdb06bd03480098c6f47eb87373ef2fdf7c236af39dbc72f55ce5447b2be72f8ab5b72dd856a0dfefdf390e0c785d5952bda63bcb6c2aa27ee725440c66f0f123011a57a6fa084595b74b4b91702a88e123913477392a523cf286e4dd835cb1cd3de5b910cf541df0c14ba1cd3be702dc46fd5394f4adceba9ecf2813534f91c5405eb8f4573464aa739f6bac53a33fddf566475007589a817875ce838ded1364b393bbf9fa3fea77c556c16d95f83308cc6a076620b9cc9bc3eb684f415ea9b7b51eaa2672d1a21006e90f763ad7837dfc1a79ca10aa0e7823e05bd288d0f1d0f323b2dd21402def4ee4de653d61ca2d77e1a4b7457b92a12ad03dcf89efcdb09d7fdd8662b7276fd89dd2ebe10253a04da625444069b10125d8c0d93365ae74ecb62e1975de71f7d80310771845d97a9c2c1007cb74b351d0b3e6c35d5c51b1569b4c95f20c00cc4464db98b1a870a63fd9464ff88f6585572f6e83662bb0ddea188284cee2dd87016b9f368dd04dfc4e84d6d2a1fc710fdb64689429833c5dd276befdd11cef5d9f499421f7af7f84c7903572a72c4b9665a55c6f7dedf44997a2eedd0a2691e39a185acca7757e129c9eb9a95929105114a1c8dd45bfd44f56a1f71c48088d5882a406cdcb4bdb5cd7f28dbada0dfe18d5f65596725e1c99985ff7e53732670c2e07082c17d7eac3c213cb7b74a1e5e6596b08f9d5378c5c55b77edca802546dc868fd54dddf3b41fe63d24337253b7922c105557a64073d4dfc42f8530faf9574b4bff02acad949ee62ec9da269f1be5d0bb003d557fa42250d1d3ca3d5a97ae5faf47c967b713f9fc6bcb57143b00797fcf228d9f9a85bacecdc8e40815669f41fa2d262960b3d01450c204141d82a6c55e6bb2dbd6af3a37c5d2d7371dc4038d960e0f172e5f9f40e321b28738bd672e3460b22f8d2709f2f373f7aecb202e1b146dc89f6df17dacc2a28075c63946a8ef5ee196942bc0845bf88fd6719d1acc66f04b4488c2b3caa36fbca16b32c17bab76a0d5d011bab90e6d4ef4eb871b83192a949b22c11ffefbfff4dd1c3df71ec8a86193b4cae578e1db5ab5f29bb3d2ad8aee2083058c66d1d9f86749e185920a83ea38786f060989a4514d93542622237402cfdd1f347b7b663925187d385d08738d11c9bcc6d91401dddd04930932b70ed759f857223d9b462b83686c44b13ba7e6c642c1ebf7d4d2f6ca8a388956ae8e32b2d99f5f1c2311cf7f1927c32c4f8d648111af7e32f6e820eb339b03d7ccd0f00f737f72fb374289226d3bd041facbe4d43244c9540a43427294fd04b4e7c07a3a39f1249d56f2fbee07219225034ad084ad4b9206d50e90ad4d3750ff9b583be57558130df1851757e66e536155a9897f0a66e91eba80818b9645265bbdcbf097ce1d8bbe1039df12ae52e17049100973dfbc3b4eebcba25efb55df7dcb9320b874dd93d013766decbb03e6d05f81e6ec64786facd79659813cd20bc5ffe738a8ed46ef2ee43745312e21b38b7b8b9ae49976a533facfda5f96da5da9e0c9f00bbd06dd0291cb4bfc3c6a2ab9c154624f1fbeb29a2a66c650ca44f2d4878985da7a62a8281b07444a821c649aab05347226ae7e244ba942c97971720e2c51391115af95adfbd00ebf06196bbed8092670b395cf43cf0180e4b91c9a8089c4339ce72c40341f62577d720e7cd3d6745f15bff4c0f2663a"}) (async) r4 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f00000025c0)='/proc/sys/net/ipv4/tcp_wmem\x00', 0x1, 0x0) writev(r4, &(0x7f00000029c0)=[{&(0x7f0000002600)="ae30f4fcaf6b4d331195b08fd9dfc8bc351beafcea7065c0b7deaaa7cd406c08ba48", 0x22}, {&(0x7f0000002640)="bb70fa7ebfd80f7f3108e7ab32dd6ef5dd12b076645c68fdf06b41689742fdcedbad2ab4e43461eec8a34cde89d6cf4cc0aac66eae1743121c9438c5b3fe4db73b9fbc09baa8fffd9b332b31b949a4ccb60f26bca6b875a133eeac", 0x5b}, {&(0x7f00000026c0)="f92651415da5d6a37fbedeec813d98f03cd844b074e555ab24847422cd10324fd7fd5871c1fe4a806b31cd6d54d89fa83e880eaed512925a29fa8a85ce5b47b1cf7b82b96303cedc89a9aed9ae1353104c22cdb0631fc7d6d36b89fa85e851feced6286f8a765dd3241506162ce1b5fc642a62092738b41f11e40436b9153818d3b21ab7ab85dfb6af56cbe9c456", 0x8e}, {&(0x7f0000002780)="c87f5b5da79008abc71b69eb2a70ec2cf7b55439f3fca7feb11082df9cb74cb25a1b35ab346fe47665712df6efcdc5027140ae965dc2f7633d0c81198f9fe84198261693a00df7425274e0fa334ddd3725f64929d1d59836fd929d1fce0bda5a0b822c378b26456610367b45da839bbaeeddc0830579e107616cd54ca84b7d0bc5ba72fad182697492344bd83c417ec09c592a9cd85ec457fc1bcea30ae23e14d6e59119af4539af4f69129f83f95233ba13a8936e89388e24c964e56536a45aaf4573c52109abdf1a75f9d6", 0xcc}, {&(0x7f0000002880)="ca0e772f0082dd7a71fdd2504b502c44d3555fad4a04d805fb3f1c4b60aefe1a97102f977c4de733435c8d47ff3386ab27000453c8c1347563ab27daa9cb70b5f3a5d1a6cb113d604b7bc99b4ea4460a6cb5bbe9f021203cdc1d13670052aa332089cf7a4a6a282fd7dc9f6d3e4b963052559cb5deceda22da2c162e2f4a", 0x7e}, {&(0x7f0000002900)="ade65a2729509cd0221b3115161e4ac7a88ab601087b7c65776a9b5867cc7e35167c7caaf76335c498181e2778b7f29198018d37e762e2def7ccad3ee4ea484be672e427de06e4583c35812a621310cb814620984af0a2d773905393570930f55076a19ad45744364b82944459cd9e1feaca39653927fed9c212765b82f32fcbacf0a2189bc48869bd07f6376edbbb560ebeeb15552d02", 0x97}], 0x6) (async) mkdirat$cgroup(r3, &(0x7f0000002a40)='syz1\x00', 0x1ff) read$FUSE(r0, &(0x7f0000002a80)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2020) (async) ioctl$XFS_IOC_EXCHANGE_RANGE(r4, 0x40285881, &(0x7f0000004ac0)={r1, 0x0, 0x5, 0x5, 0x3, 0x1}) getsockopt$ARPT_SO_GET_INFO(r3, 0x0, 0x60, &(0x7f0000004b00)={'filter\x00', 0x0, [0x81, 0x8, 0x5]}, &(0x7f0000004b80)=0x44) (async) r7 = accept$unix(r0, 0x0, &(0x7f0000004bc0)) (async) rmdir(&(0x7f0000004c00)='./file0\x00') r8 = openat$make_it_fail(0xffffffffffffff9c, &(0x7f0000004c40)='/proc/self/make-it-fail\x00', 0x1, 0x0) ioctl$VFAT_IOCTL_READDIR_BOTH(r8, 0x82307201, &(0x7f0000004c80)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}]) (async) ioctl$PTP_EXTTS_REQUEST(r3, 0x40103d02, &(0x7f0000004ec0)={0x1, 0x4}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r3, 0xc0502100, &(0x7f0000004f00)={0x0}) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r3, 0x40182103, &(0x7f0000004f80)={r9, 0x2, r7, 0xda0b, 0x80000}) r10 = open(&(0x7f0000004fc0)='./file0\x00', 0x440080, 0x15) writev(r10, &(0x7f0000005280)=[{&(0x7f0000005000)="b0385ac3741a84fe1ab3c4aa43bdb4d927bde0cff0cd3594a0db4cf51c528af7b64e537332463635f732c7c1d8eb3f056c1c7e8960427dd8940c5bc06c7ba5ca4ff156b6a30e580e9d26c19fb0e4766940426f4a3953ef", 0x57}, {&(0x7f0000005080)="94ee47d0e5208d1a0f449a32cd96a122128c09238b6ae8c0d5096f33e7359f80c0a6f62e72f636bdd4543f197d77", 0x2e}, {&(0x7f00000050c0)="aba1906ffffd67ece5ca3a8c9741ddfa9be343d509a8cb9692da49b2b63ba4045ba525900e00862565c51cb9f23619a830c07a64d9c7cd252fd5d1a66b52fd3245d3c307f3c177cc796cea489e0a056917ef1d677ab8f426a590f7dd556e8cee4126ba851f8e8ae235a1c1fa262cf3d6430aef4be5676a46c97b7f5d75501f34424689b81d9ed0d1a5b417f1f88f6d471bb473b20450c957b42735048017351fa5c2ba7275c1efb48c9b3120f8476e8e49b408b6ecf50e35194ee9ac3bdf8b43ca9c28d1b4883a06abe4a50d3e2e3e86403eb326a23060ee03", 0xd9}, {&(0x7f00000051c0)="b831e051944584738be093c31decac5f9b78fcc559725f4a342450176ca72d52faba756fbd82b206334b6a82683c50e452ed7c0c794eb571042543c73ada0e8b6fcb8126b0eaf2a1579d9f7f961b145d8ec995277cbf0f09fc1b47c1e3ea50956009129f21af11de7be20bcfde60d13592f75959b7481d0584ef8522ca29e618be98543d79cc6ff6b8c6e0", 0x8b}], 0x4) (async) setxattr$trusted_overlay_redirect(&(0x7f00000052c0)='./file0\x00', &(0x7f0000005300), &(0x7f0000005340)='./file0\x00', 0x8, 0x0) (async) fchown(r4, r5, r6) (async) close(r3) (async) write$P9_RSYMLINK(r1, &(0x7f0000005380)={0x14, 0x11, 0x1, {0x4, 0x0, 0x5}}, 0x14) (async) openat$tcp_mem(0xffffffffffffff9c, &(0x7f00000053c0)='/proc/sys/net/ipv4/tcp_wmem\x00', 0x1, 0x0) (async) r11 = accept$nfc_llcp(r2, &(0x7f0000005400), &(0x7f0000005480)=0x60) sendfile(r1, r11, 0x0, 0x9) 3.013816529s ago: executing program 2 (id=452): r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000001640), 0x0, 0x0) capset(&(0x7f0000000040)={0x20071026}, &(0x7f0000000080)={0x0, 0x2}) io_setup(0x2, &(0x7f00000001c0)=0x0) io_submit(r1, 0x1, &(0x7f00000012c0)=[&(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x2004, r0, 0x0, 0x0, 0x800, 0x0, 0x6, r0}]) r2 = syz_open_dev$hidraw(&(0x7f00000004c0), 0x0, 0xbb42) r3 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000140)='/sys/power/wakeup_count', 0x1, 0x20) io_setup(0x4fe, &(0x7f00000009c0)=0x0) r5 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r5, 0x29, 0xf3, &(0x7f0000311ffc)=0x1, 0x4) setsockopt$inet6_buf(r5, 0x29, 0x3e, &(0x7f00002cef88)="d84f7398", 0x4) sendto$inet6(r5, &(0x7f0000001380)="51e251578851f74182a74b89b27df427aeef44966d202e4138b5a18e75a0424e7fe93b0d32c7abba87b65f97aba1c26a06b6d94c4aefd8fdca10e744391062c8e612721c20051608d9aa6dacf61e1eb331a4daad402b9885599d56130f7149fb1111fa116e94324d585a0569fbd311dad54cb4e32ff7f02216844ec3d526c878d5135ad1c9262239339c18885e2a0a95854d6cde3dd2feeaa50216af6c5760923413af81199a65a6332b02ec7bbf79d557c033cbe032fdc44f66a5c59cc4a3c5d218f5896b359d1efd60baf98df6396567478f7b817ce6e11d59a7def452a068e9607f57f626a5b8d476636ef1ee76307524009ae49be402000000000000001e80fed632155e14da1f7324d97bc61a3c1edc4431ee8a6caa2ed9f85cea5a2a9b263630c7d6fc35dda6002da571a2e51917e7c1019d8ce21a608147e408074c7c5f444fab931bda86d977d7c9ccefd881e5ef05b287f41eea526862885881c2cdc687dfff01a9b70a9b08734ac4d62c7f34465c34aa9e9f136c7f796d9eea41aa37f61830508338bb1f887089070567a1dd96cd700e7a098dabedb60f31acd17d487bc8be1a3101d2b5ac1715003793596c6daa93a27f4adb4d6fbea5669cabc206c944317ea18a2c762457f1bc945fec8f849641d44e7e2a24faeee28f3f266395fe18b0dce20c1f64e8896c8ff0e4a44a116fb32462471a0fcde143e551723d57339722765673b4163d66f473ac10f988cb252f106632f9884a47866d284b4efc6bb1aa74ed48d4a6535795f0873a99907ebc22be2337364cf9acc063e32f7d2e02fad64d04aa405d2dbdee1128ab1e4761d2dd30885ad37dd168478f10789d172feef4c817a5cd372caade57f23300e45f47e001e3ea093680ffffff802477368b9910f4e24037c871cb8251568c792287a6f49fa61b7c2600accaa0e7b40c59d88a29af5886c1f5dfc6837c58aaef12a9e100225c70441144ffa82927fa4802ed9ebb03eea8e945af5f4993f21a7f53baf7ec5bb6cc96b917dde82c18840c3500e9565f68f687b1c73d834c0d99d4acb002dc5682dbcdb1217a98f6c3ef8318b7fa93894e8a097b4511ba5c035e27c9fe8bfe7754741ac21bbc0303b81672e3117e5590fe2d92f912759b9937f64204ec5caa92e2cccb31016b13ed8d7bcabb03e176b1c9bda3bf1c1256ab74ab6f42ed9bafbbd0096263be1a7da1e1c88deec55a653d170e1e13c77dacaa60a37a6ba2383e661ebc9f13dbaade2dd884c9951819fb4608e19e70cd2496ccfb12f24c710400cfe90400fe1bbea1e9a24b1d4664fb0776aca6269b396779680e52f86877d9209988d12ccb137be01ab7496d00547a7d4849d365a18dbb55c429cde87d33c4b74ad2273cdfee88b5418866ef327f25e9cbcd5a64d97107339f7e4cb5f8de171d2779c0f68884ae835e398f982d5749f085628d3608986656ea04b721f828202e9342bd7d19dfa091e772aebf9718030167a8c029df7c58b7f40029d7cfcaf26fd1900d8775ef373e8e2c5bf3525f907add3be426cd5a079c49abffe933e9ee213a3baf34f932d1299312691e1c53e6247ae0989ad66070d51fad22856a8b6b28954e7d41189b11c5321789eec8670de9e8db0b0473ba2e02731e60e7222697d61e052c18d4bcc6d1572fdf426f7b2fee6c1dee66c85c497b90facaf63b8ec5cde4a73400f9180bcfc0f81eca9580a7c81462a077f9034026bf72aa7c6de4b3c15d4a2dbd6fd7d87084aea9f25fb4bf5ec83eb56874a760533792dff2695407ccdd6a7375e0007230fd3f6501c152f1c1ff279b1d67cc95f2820762b7927659368e41657bdef2dd15b63498a93b787bdb26809d734aaf98b86fcf9fc643a34d03ebbe09000000000000004d66c5ae270adade5b8f6242a059b926221ee3d677487471c432b0d6d64dad030703475bb3ecac39b204a814f5ece5961621358e36f8a2", 0x575, 0x0, &(0x7f0000000080)={0xa, 0x5e28, 0x9, @mcast2, 0x7}, 0x1c) r6 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r6) ptrace$pokeuser(0x6, r6, 0x108, 0x4) ptrace$pokeuser(0x6, r6, 0x4, 0x3) r7 = syz_open_procfs(r6, &(0x7f00000001c0)='smaps\x00') getdents64(r7, 0x0, 0x0) readv(r5, &(0x7f0000000000)=[{&(0x7f00000000c0)=""/140, 0x8c}], 0x1) sendmsg$inet6(r3, &(0x7f0000001e00)={&(0x7f0000000000)={0xa, 0x4e23, 0x4, @dev={0xfe, 0x80, '\x00', 0x47}, 0x8}, 0x1c, &(0x7f0000000280)=[{&(0x7f0000000a00)="caa16774646ea06be236de7d8c63ec7640e94917a271fb292207e4636bb36094047a65f8890f9b30e8018d92eeb04564ef6cf5f8d808786542bc6b14a64c97eb50a22ec62370a40a6e072b45a7245468881ab81cfa8919736857ba1035f1a40f19a6b37beb1490f950774197258c47312bcd0345309c1d044cf480b3324979a74234cd573a46ea16c8f06b0442557a71ee664a7cd2a97c39d0ed8df7b1e362fe96109a621075513c39612f3c39379833979f3905566d32f8c6db003fd31ffd10dbfbf881439b752f4688bf08534992e8100bba5ce2a27ba9bf6963c60fa227b3db9e8d0db4fe31bcdd7aa451df3f9ee5f599a1b8902815f2ee57f2c49d2da29b5a4e972a4f4628ffe61858bab348d3fc58461d86e9cf9505b28e836a9b786c1eadd1314e0c478b1e3c5c92ee5aa489735d7bd85bb35eaa1063bb3b101aae26270e80d4e3671050dbb2268516c422bdb68eef1d474bf79cf76e0a8e180d6735162eb023a530fd5194feffe322df1a6b34e5947d24d7700c20b4c29b2a95065579e8a362996d9d3d5a8f4648164853f12a7a77e1f86dec0cb4738d66795514cda54ead618c81b6e216cbff09d6fff0f416d38bbce38e463440757d05a4c64be6e26b58ddbfee67554f1add82f3b9bbef7f8a92850b2ef47bff43310ce623898b08ee205c81422f48ff7daf4f87580617232d0f7c427e05d970f6f66801b1214ea0fe77dfa1ba4ca41e458213cbb9017667998f7e80c26c41e461180828adb03aa5649bbd94a04f5009e12ad530c69b8f812ab426d439f631462e17c294c53e3bbc778efa6deb06e1d9c789b2f447edbff9f0c4c79c0e001e336a39564365f7e68858f66482b6eb627e2e4c881a7bfadd760077c8c6172b26749be3634ed640ae70ae4b8c073373a1f52241558adada6a45e6de9b3ba1e5038016fb5bef63e03e41cca93d046911f67bbb9fd20d9eaa7c56bf07c95b169a2a4b6e850f3fc7a3ff0dbd8606a7f81e3f84b8b6152a300d7c11b06f9d0e5c0c6ba2449a90b43c336331b357eabf51190a44f0ae364f3b9efa796f389c2e2abe6919ed0aa7006aba05ae33c8718db8d04113d22532a2394955e63f377d360eec456af945c1e7eab61152629111c11b389c886d20205b7240994bb11ef79f371bf80f7245f1e5d2ed4f6b20b7c1dad26bb30ec1d268a2d46324315519478a9600f9d030ba4d4f21e9891a4887ef17e23700044bc3f40a8c38f33fcf767c4d524cf1150cb1b72393e7188b4832c5d50da24963d02ed1bdf25fb30ceb86a63f65de8404b15d526f38000279c6bac1034cf1c1b5a69c1120112197cc31eaf189fc050964854ab7e074d4c0aa06e3acf959682f294b52a8ef5932d7e5a13aabde18043ff44753e0aa31868665b512080aac9966fbe88db1d9082d5edda8955057ab5ecd7ed156288c6309434926d0c51ee50dd53418f7e1a6f15ed0d939f0abffd3ec10b691d7caf9ed1f2cc13e1df76c9e643c60487c397ba2da359ce4e79d3fb69638dfba790644e5fd48876c0d9f3acf801b75bfc1cc49ebe9107c7a9dfa40dfabdca90529d41ac3220323a935bb01d73a1e3e5343850650985022a9c607b183241b611d53eba2bac7de57db8d0b1c9da255d33fe2e17ebf236943406e06ffcb3fe9787a93c296fc2e1c2b9be5f4914547b74c8e6352995cf7faf23d8d57d0046a252ceffde07617f8aaefc3966ca8745f8437b10e6432da524ac122cea9c32480dcca0caea17e3008a286302e42de52bafa61359dddbb859bcc6c43504eaaf0b01a7df6437c14b9466f2b87e699b968a2d9891da464c636e05f0251ef2cdcb9105844ba2736a84af16c8d5f4097a31e1371c86ca702fa076930dc30db2c53780a0680fbd83175af050ce9f3cea6ef58c0da288ef0c842e2df77b7bf093cc9f83899088066c23603f1984444eb2ab21121bfaecf37cb0d631808435a266cc9ee1da51884142a70bc62ebb3b4ba8723ea1fac89813eaf5ee253128f75d32d423895b2c81830c7b36b0e8e89fb0148d86a7e4eaa4be33596fa20607244e26f8a913f18e807dcb37483e612427a2da53a07046f71efe3086caf0a3779663fe4bff4667491e86831f81af3de92f3e7a3b7666ee3adf8de6c94dee3158d0cd76da8bdd7bfabbf870c16bb8715922705549a9cb165c11908648d365013a115786f95bf72065fd3d585d99af78a66e6fee98544e839a497621790db21d70ec80b1fb0a85d08b91c4d5133818dcee5ef39e6d8edde05ef0eacb239a30de3b57e4326524d263fac7eb67d2c4c26299e87852721d7ce6db1ff610db495d3cad234f0ebfe9f21d750869930b82c8fda476052930a2e2a7ded95bd90cd4af2fed09a51fa3db922ff66028882945c2bdb7e9d140dfcc2530a7189e579b29d7c8b0827f6422884462853d31ffdf8b9fe4309a7ffe446c4b07d6b2b8ce2030cd408bb0881de285e23658dc4db85c3338e621307715c81614a39b373cae7f11b84361e01f9e76ff64fe75e40bb7568c2fa0fb0730169b3f075234d0f1120690eb67a53207ed55805c1de55bef97f7b85e040d6378220e4f443a9b86d3808602ce5b8ad358fc10e0520b3465238e047997ea7073c0aea716aa2be3d56fa08d7cf4dfa12363de3d788075bfc338ac16c8012396a9b18fc8ff426af5d51e37db30cac297a8db361e131301327d9360a57a502612a12cc93091210ea44f7899437225d6c0a238ca50b1434ab79c6c73340d357dcf19f414053fe944a8e57cbca6574d3e29a88d9de06355c5b8bd84c1c7ca436c1d0f451a8534943f4f78b9f2d6111c2419e3013c9d2636ac9028056fd9f65f887bd7690a4c8480bace6cb743a6817461dd7e634b39416141252e43a7e5200a90e312049d251ed45f9324175527089226c5393e28bfbf2085d2a29c285a44f20f8f480c5b8dd5d7532cd38c7662f86bd5aa6161c41154a69d492219f3022530a78ab95d846287de9ceac24beccbf2bae0cb4dfa9b3a748294e7dc46311c45fe4e022178bd88089eec875059718f7bd94b44ee30aadbb01fb858332d6bc18aa97130f787739a6ca6ad4aa8af1c7e6797d102935317c3c661aca079149bd15c5f1435b44096592ea1a24b9257901d64eb70c5a35c5948e793e40c945d4f7178c9d716a20affab6d4a20e5bede500b2506f08f5c0df50487521937b90bc575af1eb09a1f0c31ef7fde1585fc01123489264c8220e71ce5eea4871af6e4e099693f2c5baecf43176e721869c375ded1ccf8cb23528627157971598cd523f6e0c6ecd2c1453772950ab707489b70cc5927858dc01765eee1701c202f7a9be8a9abde8d06118729da360841c485c08914ca68a2979a57c483d7764470e689a278fb93a5f7fb6485da31d6c775d8ee5cd1f7ad93701a1ede4de416743876f84139dd8fe6becd104efa2ffaab3f3bc3a36e9fd6244489e3a853ec77db127e26b38606521844c341fa3e7de245721019a208c63c0037a9928e1ee9a46165744e7e581e98722a772315488b4299b92acc38804c3b517ff1e81912ce6e8cae792f73ca6b4b1991bc254e9625960658b0424f479b85df62c2e96cf322ca85a1e26f351f79f6e5568634fc4ccf235d6c97a39b47d69768d4d93cbfa66d243ad5ee954da9152915ca686d0b5bb9a8c0d236c7fa17fceaf6c5c281d4a8dbb7573f5e0b5ab2b8aff1553911a273722aea9ce6ce326a2e0dabfb695cb07b4b772d70082db5b91f6b4bc49c377cd358271978984ba0ab1b2268ef262414350ac7b97a01f148a1d4073ceb7c65acb415474357c4ed5b3995b32a5820813193a0bd33dd493ed5c8af4760ed921e56202279529d5e5af2a640f71d564f6e7c7ec102ca21c84135f7f7144e31a0572a86adc63bc1cef5cdfa3169dd605b220ed56833aaccd6869db329bd6c4907657285b97bb9254d959deb523c4dbcf4c3f904f7c2367f7d4c13ab96afbb93a369328ba4c5062809727ca9faeacc88a2df7dd3d0b33fe1c9d7250401bdbe0adfc8e81cf09e09e9a44e9062a015b871d86d6192adc2e089ddfc4da926bd7515c204615476e13d4330603fd3e8f532124c45f781280945d171c7579ba94a595acaac642eed63d0f0e5e70f72a1da8eae4ac35ce654b1b3eeac8f2c7787ede3ae26a8b92efc020054eace5a602751c744416b571cc03576bde3ad96f71812b93bdf5a5b679be281c99dc243903141defb3566923da676fa492700d3ee49e6ef18bac538be558878a31025132d959a9458408ea50e9d120ea2ba002fab8a18189a709a2c3ec01372e68079f53d995df1f63cafc95efd848e274bf12ba43d6a8100feff0266f74d4446992f44e9e7a6e7652621781c20063a8a6677da9b327d0533bbc82809267a6c5abdf267614f633dafe2f8eba68b7d3c830928090badc9a7649716f39728a41b90cc2d33d92f061047ff2ef7841f0c831fa2758fa9dace5bb8573882c6b47565dd851d0f3e33021f22977a52d1531839cf86238024abb7a4f70b561f069f2583eab6a6a729528eb3b62ffb5184d653415e503581131018b6f055e3eed947aad25d8c2617b504b41e12989fc596eec95299e7537b52fb8d066b32a239fa54bfff8284d7abef00a2d6053cdf0a33760ef28aa458c6f724d27610cdfd32ba55d069c3901549b55ea460492bb23dccfc03e0bc1556429474fa3b940492dfebd84021ec723ea76c9b5ac0c06f7b6dc379c17f1c97cf174bfe25d887cc40a815e25bd7f98034720bf50fdd6065caad804cd14732d15ba5811ebbac3515557e952234928a18a7036b37eb76ac38802bfb696f2398ecefd8da88ea99c3a121baac5925349c922f1f8a9497570e97d51c6379e4673fb4aa1110ebf10cfefb7f97436f6d01de0e2686303a54397d647ce8ccc98faf61e6f44fcdd6d79475ba914fc876039681ce90196a18523b03465d7516d28d8c4414d3b1b10f5e1ee8cefcbeb2facfca4870e6d62d3d8a2b412e8f989eac18ae9c11b14f23dcf440fcbdf60df6458653ed48fec8ee58fc16b78c150a02ffcc9e5d71371c51d807e04f937729d9bf8dcd8e8e58f683d643f560fa96c07662c28958ed562ce1537a638b959839b35bf2648f41bafcbce6927e2916615f4527e10e8209afdffc241daa5e0a92097d93bfc7d7bcd6894eef10a1e8e4deb46c29a05bee8b445b30d5c8ec759b3ae71348bda5bcb831c9b081604fbff5294deab293bf9b147cba41f799db12c6cfde42edd64f25221c1b60742990efe7d72612c0abe01af6172233f9e1b8c09468040170e5207b9f2add6ed3f71f83a4a2256ed5091348f74e49e438641a824bd914398c485b01612411f4c31e80a66321ce11cb249f407c011b71e4e27136974d8637c430035532b8da91a280aa70e80f8ad44986e4b412da11e9070ffc6cab6aee41adc21a2a7398ec1115e62a78df591e08930217b4d209bbf210dcbf28133481253652451e2089353d84298fa06a9fdbafc24e7d08e818a2118f5ca33c16491ba52591a4aea753652ea08456c600385ef581746bdd3dff6afe392ab4a67bb4ca8cbc5b9cde2d22a0e68ba6995bf0f90e60e4b7ca4d8bdf7dc7d669f80c00ad3f20468a8d3fcf8678af51d50a30dd64401b1425192070c7ad3a1c206eb645667c4847532608b1f9725a1f708de140c0537d60948e0d5b780556496dcac0b56f5e7e940995b56816d8de7b8f62a257584c9e2df3781fbb72450de5c01d7c25fa653d7ecd029d67024145d61e6fe5b3801a5fb763a1fa597286b1794706551", 0x1000}, {&(0x7f0000000300)="0d7e008a3442c442a3b420332ca2071b0df3a163f0e3559fb7f34cef9759e0c18d85d5a98aba826f97c4c2deda7bbd33d3dd4ee66cf6fbd1221d5164d9668862136163bc607b106fb1d96142f51204c1b71c3ef25d5b3a53d3680c3ea4d3a120e735ef2fa36247331423e9bbf4d3c3b2d5f45a47a244a03f460ff222ef42ab", 0x7f}, {&(0x7f0000000200)="9471bf8788c645a54930e6d6fe26701450c86dfaf82acbd0c3304d2e6e1e3cadbfcc5f6fa168c5ace094394f9c295f8a341a14d0", 0x34}, {&(0x7f0000001ac0)="30bf6192c37e3ac2b1651463f252896c6992dbfea034a010243a4aa222268d07846a2396235ab2a746d189a2bd6e2c92786bff5534c1d25d96ee7f8a489364b278eeef44dc7818b44e7ef411526e15aa898dabb073796bcf9fb390ff18e108c8e55d45f1bde5a0df93a4b7763102a1d09ffdb221b33afd74d67add6a9b72a1bdbfd8", 0x82}, {&(0x7f0000001b80)="de3977d313a211faa015f92dc560e4d213cdfa81aca4e90199a0e0b0a02cf9a3f71f9dd8bee52bec1d4cb235109a3435b32a5109b03d4f3f216941df156aef3de51618fa453c4f36987981de09f9cbecfda7ea8c0523f24aa9a1bc10d80a957891517f8b5f3a3da34de233113c2333d21dc636836b92ac551f85fa70f7475085f868ee185716ed3fdf3c5febc57e7122a98c863e563ed15bced0ef0ce953e5d1923808b9f837420aac1baa572878fadb240cf5", 0xb3}, {&(0x7f0000001c40)="961c9010ee9864d055bcf946488ff7799f226e345bba5703fc4a134f22fd2e53ab92a7d3ac87359801a55b63ab69fb0a116da5c8c0bf0f83ba7586c7801614a06f9a81e1fed277bf12c70712ea4400504d8eafcf03a3bd33645359dab0b2f2b83a3a65b7aa6a9316836252214bfb0ce0e7ae443d5501e4ccce01bf05133f3caec8808bd440ff24a7f314f641b026b23bf7d2aeb92d03bdf0e5ad71b9f466e0b2324b07bb96d342e35f534f10094d48669e02ba5a7a1d52cd1d9a39486dbd7dbc9678f7204b404fe1f6d4f305fb26b20ff5f48933a8e32ceb", 0xd8}], 0x6, &(0x7f0000001dc0)=ANY=[@ANYRESHEX=r6], 0x38}, 0x40000) io_submit(r4, 0x1, &(0x7f0000000400)=[&(0x7f0000000080)={0x1000000, 0x0, 0x0, 0x1, 0x3f, r3, &(0x7f0000000240)='\x00j', 0x2, 0x10000000005971}]) sched_getparam(r6, &(0x7f0000000040)) r8 = getpgrp(0x0) wait4(r8, 0x0, 0x20000000, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) pwritev(r2, &(0x7f0000000180)=[{&(0x7f0000000080)="1d542f0868", 0x5}], 0x1, 0x7, 0x2) 2.656348408s ago: executing program 0 (id=456): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x1e, &(0x7f0000000200)=0x1, 0x4) sendto$inet6(r0, 0x0, 0x0, 0x24008084, &(0x7f00000001c0)={0xa, 0x2, 0xdfff, @loopback={0x2900}, 0x2}, 0x1c) 2.632325829s ago: executing program 0 (id=457): r0 = socket(0x28, 0x5, 0x1) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x0, 0x6}, &(0x7f0000000080)) setsockopt$WPAN_SECURITY_LEVEL(r0, 0x0, 0x2, &(0x7f0000000000)=0x3, 0x4) 2.540170932s ago: executing program 0 (id=458): r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000600)={0x28, 0x11, 0x1, 0x2, 0x25dfdbf6, "", [@typed={0x7, 0x0, 0x0, 0x0, @str='\x13\x00\x00'}, @typed={0x8, 0x3fff, 0x0, 0x0, @fd=r0}, @nested={0x8, 0x1a, 0x0, 0x1, [@nested={0x4}]}]}, 0x28}], 0x1}, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000002c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r1, 0xaf01, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$VHOST_SET_VRING_BASE(r1, 0x4008af12, &(0x7f0000000080)={0x1, 0x7f}) ioctl$VHOST_SET_LOG_FD(r1, 0x4004af07, &(0x7f0000000240)=r2) ioctl$VHOST_SET_VRING_KICK(r1, 0x4008af20, &(0x7f0000000040)={0x1, r2}) ioctl$VHOST_SET_VRING_ADDR(r1, 0x4028af11, &(0x7f0000000140)={0x0, 0x1, 0x0, &(0x7f00000001c0)=""/43, 0x0}) ioctl$VHOST_SET_VRING_ADDR(r1, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, &(0x7f0000000380)=""/245, &(0x7f0000000780)=""/87, &(0x7f0000000800)=""/90}) ioctl$VHOST_SET_MEM_TABLE(r1, 0x4008af03, &(0x7f0000001cc0)={0x2, 0x0, [{0x0, 0x24, &(0x7f0000000000)=""/36}, {0x200000, 0xffb, &(0x7f0000001d80)=""/4091}]}) ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000340)=0x1) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r1, 0xc400941d, &(0x7f0000000380)={0x0, 0x3ff, 0x5}) 2.539806712s ago: executing program 0 (id=459): r0 = socket$inet6(0xa, 0x2, 0x0) sendto$inet6(r0, 0x0, 0x0, 0xfe80ffffffffffff, &(0x7f0000000400)={0xa, 0x1234, 0x0, @loopback={0x0, 0x7ffffffe}}, 0x1c) 2.537491332s ago: executing program 0 (id=460): r0 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_SET_FEATURE(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)={0x20, 0x3fa, 0x800, 0x50bd2b, 0x25dfdbfd, {0x1, 0x1, 0x1}}, 0x20}, 0x1, 0x0, 0x0, 0x80}, 0x80) landlock_create_ruleset(0x0, 0x0, 0x0) r1 = landlock_create_ruleset(&(0x7f0000000040)={0xc015, 0x3}, 0x18, 0x0) landlock_add_rule$LANDLOCK_RULE_NET_PORT(r1, 0x2, &(0x7f0000000240)={0x3, 0x3}, 0x0) landlock_add_rule$LANDLOCK_RULE_NET_PORT(r1, 0x2, &(0x7f00000000c0)={0x1, 0x2}, 0x0) close_range(r1, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) pselect6(0x40, &(0x7f0000000100)={0x7, 0x5, 0x1c000000, 0x3, 0x81, 0x5f, 0x620, 0x7}, &(0x7f0000000140)={0xba, 0xab8, 0x5cd5496f, 0x4, 0xcd, 0x0, 0x2, 0x5}, &(0x7f0000000180)={0x0, 0x1, 0x6, 0x200, 0x2, 0xffffffff, 0x5a, 0x3}, &(0x7f00000001c0)={0x0, 0x989680}, &(0x7f0000000340)={&(0x7f00000002c0)={[0x2]}, 0x8}) capset(&(0x7f0000000380)={0x20080522}, &(0x7f0000000040)={0x200000, 0x40200003, 0x0, 0x6, 0x7}) prlimit64(0x0, 0x7, &(0x7f0000000300), 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r4, 0xae60) ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x1) r5 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./tracefs_dir/free_buffer\x00', 0x1, 0x0) close(r5) ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x1) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2) ioctl$KVM_RUN(r5, 0xae80, 0x0) ioctl$KVM_SET_IRQCHIP(r4, 0x8208ae63, &(0x7f0000000380)={0x2, 0x0, @ioapic={0x60000, 0x9, 0x10001, 0xfffffffd, 0x0, [{0x2, 0x4, 0x87, '\x00', 0x8}, {0x9, 0x8, 0x2, '\x00', 0xb}, {0xff, 0xcb, 0xd3, '\x00', 0x67}, {0x6, 0x2, 0xf5, '\x00', 0xf}, {0x1, 0x9, 0xc, '\x00', 0xfb}, {0x0, 0x4, 0x5c, '\x00', 0xff}, {0x71, 0xd5, 0xf1, '\x00', 0x7f}, {0x3, 0x4, 0xc}, {0x7f, 0x5, 0x79, '\x00', 0xb}, {0xd7, 0xd, 0xc, '\x00', 0x6}, {0x1, 0x28, 0xa, '\x00', 0x6}, {0x40, 0x1, 0x5, '\x00', 0x81}, {0x0, 0x5, 0x26}, {0xcf, 0x3, 0x1, '\x00', 0x6}, {0xf, 0xee, 0xa, '\x00', 0x6}, {0x39, 0x2, 0x6, '\x00', 0xb}, {0x9, 0x6, 0x40, '\x00', 0x6}, {0x5, 0x7, 0x5, '\x00', 0xc}, {0x7, 0x6b, 0x7}, {0x2, 0x80, 0x1, '\x00', 0x7f}, {0x1, 0xc, 0x80, '\x00', 0x7f}, {0x10, 0x6, 0x3, '\x00', 0x10}, {0x0, 0x23, 0xf3, '\x00', 0x4}, {0x7, 0x6, 0x4, '\x00', 0x8}]}}) sendmmsg$unix(r2, &(0x7f0000001fc0)=[{{0x0, 0x0, &(0x7f0000000cc0)=[{&(0x7f0000000bc0)="8c", 0x1}], 0x1, &(0x7f0000000080)=ANY=[@ANYBLOB="14000000000000000100000001"], 0x18}}, {{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f00000000c0)="b0", 0x1}], 0x1, &(0x7f0000000280)=ANY=[@ANYBLOB="14000000000000000100000001"], 0x18, 0x841}}], 0x2, 0x11) syz_usb_connect$uac3(0x5, 0x80, &(0x7f00000005c0)=ANY=[@ANYBLOB="12010000000000083512138240000102030109026e0003010ab081080b0203012330e50904010000010130000a2401060a00070400000904010000010230000904010101010230000905010920011e04000a252503006e0050feff00ffffff000102300009040201010102300009058209400006e3010a2525000000000d0100cdad8aba6081c3ca5130f6e2c723efd9af0cf1015274181555c7c2a24730326e3976cc3de5d6fd6fd6fe05dcbc088e8236f9a1cc98319ecb35a4ba6aa0eb365fb60892fb593e87711f16448baa1b9adef8b5e11d23aa6875b9deaa5536b1206ddc565d4b501d2e2a49f111b0a9d97567537473dee1d0b2ff14c605e8ccc30ed2b8fa84103ca29d02"], 0x0) 2.014874466s ago: executing program 0 (id=461): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0) r0 = syz_usb_connect(0x0, 0x55, &(0x7f0000000180)=ANY=[@ANYBLOB="12010002020000402505a7a400010000000109024300020100c001090400000102020100052400100104240202052401000105240600010705810308000a09040100020a00000007058202000200070503020002"], 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x1) mkdir(&(0x7f00000004c0)='./bus\x00', 0x0) capset(&(0x7f0000000500)={0x20080522}, &(0x7f0000000180)={0x200003, 0x200027, 0x801, 0x4, 0x5}) mount$overlay(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000b80), 0x8, &(0x7f0000000040)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@nfs_export_on}]}) syz_usb_control_io(r0, 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/ttyACM0\x00', 0x2, 0x1) syz_usb_control_io(r0, 0x0, 0x0) ioctl$sock_bt_hci(r1, 0x400448df, 0x0) 2.008583876s ago: executing program 1 (id=462): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$TIPC_NL_MEDIA_SET(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000140)={0x2c, r1, 0x1, 0x70bd28, 0x25dfdbfd, {}, [@TIPC_NLA_MEDIA={0x18, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x800}]}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40d8}, 0x50) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x100}) ioctl$XFS_IOC_OPEN_BY_HANDLE(r2, 0xc038586b, &(0x7f0000000240)={r2, &(0x7f0000000000)='./binderfs/binder0\x00', 0x200, &(0x7f0000000040)={@_ha_fsid={[0x15c, 0x47]}, {0x4, 0xfc17, 0x6, 0x3}}, 0x2d4, &(0x7f00000001c0)={@_ha_fsid}, &(0x7f0000000200)=0xfff}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x2, 0x0) sendmsg$NL80211_CMD_RELOAD_REGDB(0xffffffffffffffff, 0x0, 0x20000000) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000380)={0x4c, 0x68000000, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000440)={@ptr={0x77622a85, 0x1, 0x0, 0x0, 0x1, 0x3c}, @ptr={0x73622a85, 0x0, 0x0, 0x0, 0x4, 0xb}, @flat=@weak_handle={0x77682a85, 0x10b, 0x2}}, &(0x7f0000000280)={0x0, 0x28, 0x50}}, 0x400}], 0x0, 0x0, 0x0}) openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x143042, 0x58) read$FUSE(0xffffffffffffffff, &(0x7f0000002d40)={0x2020}, 0x2020) openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) 1.948175818s ago: executing program 1 (id=463): r0 = open(&(0x7f0000000000)='./file0\x00', 0x1607c0, 0x78e22799f4a46ffe) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) ioctl$TUNGETFEATURES(r1, 0x800454cf, &(0x7f0000000040)) r2 = open(&(0x7f00000000c0)='./file0\x00', 0x108843, 0x98) r3 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r3, 0x10e, 0xc, &(0x7f0000000040)={0x9, 0xffffffff, 0x4e, 0x567}, 0x13) sendmsg$nl_generic(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)=ANY=[@ANYBLOB="2c0000001600010a00000000fbdbdf250a0000001800ca801400018004000480a0c5021f3bb002e71269599844d377f2"], 0x2c}}, 0x0) fcntl$setlease(r2, 0x400, 0x0) fcntl$setlease(r0, 0x400, 0x0) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000200)='fdinfo/4\x00') read$FUSE(r4, &(0x7f0000000700)={0x2020}, 0x2020) r5 = syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12011001000000086a055700000000000001090224000100008008090400fe300300030009218100030122280009058103400002c101"], 0x0) r6 = openat$ttynull(0xffffffffffffff9c, &(0x7f0000000140), 0x82084, 0x0) ioctl$TCSETSF2(r6, 0x402c542d, &(0x7f0000000000)={0x80020002, 0x8002, 0x5b8, 0x10001, 0x59, "d10900000000000000ffff0900000000000005", 0x2800, 0x6}) ioctl$TIOCSTI(r6, 0x5412, &(0x7f0000000040)=0x9) syz_usb_control_io$hid(r5, 0x0, 0x0) syz_usb_control_io(r5, &(0x7f0000000300)={0x2c, &(0x7f0000000040)=ANY=[@ANYBLOB="000f280000000b313aa0799298ee7c246dc3d11f2d418935d11861d888fe0fa33900000004000000000000000000"], 0x0, 0x0, 0x0, 0x0}, 0x0) connect$inet6(0xffffffffffffffff, 0x0, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) r7 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r7, &(0x7f0000000000)={0x28, 0x0, 0x0, @local}, 0x10) listen(r7, 0x73) socket$packet(0x11, 0x2, 0x300) 322.673891ms ago: executing program 3 (id=465): socket$nl_xfrm(0x10, 0x3, 0x6) openat(0xffffffffffffff9c, &(0x7f0000000580)='./file0\x00', 0x2c41, 0x20) openat$fuse(0xffffffffffffff9c, &(0x7f0000002040), 0x2, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000540), 0x82, 0x0) r0 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000340)={0x0, 0x0, 0x1000, 0x40002, 0x1e5}, &(0x7f0000000000)=0x0, &(0x7f0000000040)=0x0, &(0x7f0000000140)=0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) socket$inet_udp(0x2, 0x2, 0x0) syz_ublk_add_dev(0xffffffffffffffff, r1, r2, r3, &(0x7f00000002c0)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0xf6c4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000000c0)=@new_dev={0x3, 0xf14, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x164}}}, &(0x7f0000000280)=0x0) socket$nl_netfilter(0x10, 0x3, 0xc) sendto$packet(0xffffffffffffffff, &(0x7f00000000c0)="37031c00", 0x4, 0x4000800, 0x0, 0x0) syz_ublk_setup_queues(r0, r5, &(0x7f0000000200)={0x0, 0x906, 0x0, 0x2, 0xb5}, &(0x7f0000000480)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4485, 0x10, 0x200000, 0x319, 0x0, r0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7682, 0x8000, 0x4, 0x2000008, 0x0, r0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xffffffff, 0x20, 0x1, 0x902c4, 0x0, r0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3a0b, 0x4, 0x2, 0x1040021d, 0x0, r0}}], 0x4, &(0x7f0000001540)={0x2e, 0x4, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x6}, 0x0, r4, '\x00', {0x0, 0x48b, 0x0, 0x0}}, 0x0) 124.205667ms ago: executing program 3 (id=466): socket$nl_audit(0x10, 0x3, 0x9) (async) r0 = socket$nl_audit(0x10, 0x3, 0x9) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000040)={0xa, 0x0, &(0x7f0000000340)={&(0x7f0000000200)={0x2, 0x3, 0x0, 0x2, 0xc, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6}, @sadb_sa={0x2, 0x1, 0x0, 0x5, 0x0, 0x9, 0x7, 0xffffff7f}, @sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0x0, @local}}, @sadb_key={0x2, 0x8, 0x8, 0x0, '4'}]}, 0x60}, 0x1, 0x7}, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f00000000c0)={'vlan0\x00', &(0x7f0000000040)=@ethtool_gstrings={0x1b, 0x1}}) 123.735667ms ago: executing program 1 (id=467): eventfd2(0x1, 0x80000) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/devices/0000:00:00.0/rescan\x00', 0x1, 0x0) io_setup(0x80000000, &(0x7f0000000080)=0x0) io_getevents(r1, 0xfffffffffffff5df, 0x2, &(0x7f0000000240)=[{}, {}], &(0x7f00000002c0)={0x77359400}) ioctl$VHOST_SET_OWNER(r0, 0xaf01, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = dup(r3) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) writev(r2, &(0x7f0000000440)=[{&(0x7f0000000140)="2e1221b23bb601c493d3df163e75963d86dd606712e9000d2f8db0049d90491c3248041200dbb8a10000", 0x2a}, {&(0x7f0000000280)="8bcceb216f624c06f5ff84087509000000000800", 0x14}], 0x2) 123.453567ms ago: executing program 3 (id=468): r0 = eventfd2(0x1, 0x80000) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/devices/0000:00:00.0/rescan\x00', 0x1, 0x0) io_setup(0x80000000, &(0x7f0000000080)=0x0) io_getevents(r2, 0xfffffffffffff5df, 0x2, &(0x7f0000000240)=[{}, {}], &(0x7f00000002c0)={0x77359400}) r3 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000000300)='./binderfs2/binder-control\x00', 0x2, 0x0) prctl$PR_MCE_KILL(0x35, 0x1, 0x8) prctl$PR_MCE_KILL(0x35, 0x1, 0x2) io_submit(0x0, 0x2, &(0x7f0000000480)=[&(0x7f00000001c0)={0x0, 0x0, 0x0, 0x6, 0x1, r1, &(0x7f0000000180)="731d9bf02e4d4620aad47550d883d0ed76f55e07d59ef6", 0x17, 0x8, 0x0, 0x3, r0}, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x6, 0x101, r3, &(0x7f0000000380)="fbccf1a4f4ae0fdd4c5762b0c71adedd512453e97406d33436f1537458a35a9c946761082acb23fc0d28feee635029da761d2617838a36e3cd88aed783cd382465e05fd46b0c7f1662e7fcab8f168c8a01055b5455cd2179b787c9d306bd", 0x5e, 0x3, 0x0, 0x1, r1}]) ioctl$BTRFS_IOC_SUBVOL_GETFLAGS(r1, 0x80089419, &(0x7f0000000440)) ioctl$VHOST_SET_OWNER(r1, 0xaf01, 0x0) r4 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r4, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000100)={0x2, 0x3, 0x0, 0x3, 0xc, 0x0, 0x70bd2c, 0x25dfdbfb, [@sadb_key={0x2, 0x9, 0x40, 0x0, "1cdc0dca1d9f6884"}, @sadb_address={0x3, 0x6, 0x0, 0x0, 0x0, @in={0x2, 0x4e22, @remote}}, @sadb_sa={0x2, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, 0x1}, @sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0x4e21, @initdev={0xac, 0x1e, 0x1, 0x0}}}]}, 0x60}, 0x1, 0x7}, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r6 = socket$packet(0x11, 0x3, 0x300) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$packet_int(r6, 0x107, 0xf, &(0x7f0000000040)=0x10000, 0x4) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000180)={'veth0_to_batadv\x00', 0x0}) sendto$packet(r6, &(0x7f0000000080)="330320000a00140000007ef52f555f2a0c0900000000000000f786dd3baa4b1f0f858c4632f47042195e", 0x2a, 0x40008c1, &(0x7f0000000480)={0x11, 0x0, r8, 0x1, 0x62, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x11}}, 0x14) r9 = socket$inet6_tcp(0xa, 0x1, 0x0) r10 = dup(r9) ioctl$SIOCSIFHWADDR(r10, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) writev(r5, &(0x7f0000000640)=[{&(0x7f0000000140)="2e1221b23bb601c493d3df163e75963d86dd606712e9000d2f8db0049d90491c3248040000dbb8a10000", 0x2a}, {&(0x7f0000000280)="8bcceb216f624c06f5ff84087509000000000800", 0x14}, {&(0x7f0000000500)="244ad509b3c6297511e88eaecec450d91dd8b222ad85701d4f4a52743579b9b6b462f83ecf42298eb3d839096e8e97fb69cd3d65affdf8a1b66ff12e3217382073453f7dd7c9ae9f5975721553691df0fadc8acbe69ff3fcb7fb7e15edc65c99c77002cb55ee6e52c284d211c467a5b05305e88e38e5976ef3cae7ba6ee324ef1dee22b90cc23965db5047654de8d8e2c1", 0x91}, {&(0x7f00000005c0)="543cc22ee8cac88122261092e37188396954586052c952ff064fbc4aebd1493238fb766ffa3023342123ac5b044a25256d29c36c164a340e712204d4fd19265efc67d977", 0x44}], 0x4) 89.830708ms ago: executing program 1 (id=469): r0 = add_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000100)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffc) r1 = add_key(&(0x7f0000000040)='asymmetric\x00', 0x0, &(0x7f0000000200)="308205553082033da00302010202147398ea982dd02ea8b1cf57c7f297b3e61afc8c0a300d06092a864886f70d01010b050030343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b65793020170d3232303531383232333234315a180f32313232303432343232333234315a30343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b657a30820222300d06092a864886f70d01010105000382020f003082020a0282020100ccac49dd3bcab0157e846ab20a695f1c0a61823b4f2ca3952c08584bb15d99e0c3c179c2b3ebc01e6d3e541dbdb7927b4db59558b2522ec6244b7163803277a7385edb72ae6e0decfbb66d017fe95566dfbf1d76780231e8e507f8b7825c0dd4bbfba2590d2e3a78953a8b4606474446d7cd066a4113e319f6bb6e38f48301a3bf4a394fd70ae938b3f594144eddf743fd24b2493ca5f77a7cd4453d977568f1ed4c420b70ca85f3dee5882cc5beb69734ba2402cd8b869fa973ca73cf9281ee7555bb18675cff3fb5dd331b0ce978db5ccfaa5c4342df5ea96decd7d7ffe6a13a921adaaef68c6f7bd5b46e06e98fe8de093189ed0e11a1fa8ae9e964596253dad170be11d4999711cf99de0b9d947eaab852ea37db907e35bdd9fe6d0a487028ddd50d7f03809314238fb922cd7c29fef172b55c0b12cf9c15f6114c7a45258c450a34ac2d9a81ca0b1322cdeb1a38881897960881aacc8f0f8a327b7668036843bf11ba5560fd801c0d9b69b60972bc0f412f0782c6e3b21391c46d149531be19bdbcede14c74a2e0780bbb94ec4c533aa2b5841d4b657edcf7db367dbe9e3b366642667635bfbef0c13c7ce9425c24530305a86724500275ff24463b358976e670dac5518c9ae505b00bd02dd47d5775946bf90aad0e410015d04fc07f902d18488f28fe5da7cd999ebd026c8a31f31cc74be693cd42a2e46810479dfc210203010001a35d305b300c0603551d130101ff04023000300b0603551d0f040403020780301d0603551d0e04160414f58703bb33ce1b73ee02eccdee5b8817518fe3db301f0603551d23041830168014f58703bb33ce1b73ee02eccdee5b8817518fe3db300d06092a864886f70d01010b05000382020100c02e12417b738516c8db8679e8f5cd44f4c6e281235e47cbab25f11e583e317f78ad85ebfe148860f77fd226a2f4982afdba050c203312cc4d1461648193d333edc8fff178cc5f519f09d7be0d5c74fd9bdf524ac9a871253304106736d0b30bc9a14072ae417b68e6e47bd028f76de73f50fc917c9156d4dfa6bbe84d1b58aa28fac119eb112f248b7cc5a98626aa6eb79bd5f806fb02527b9c9ea1e0078b5ee4b85529f648521c1b542d46d8e571b960d145b592898a63582ab3c6b276e23c825904ae5ac4997b2e4b4657b82924b2fdee2c0da483fa652a07358b97cfbd962ed17e6cc21e87b66c7665b5b262da8be973e3db33dd133a17636a76de8d8fe04761283a83ff8fe7c7e04aa3e507cfe98c35352ee7806631bf91580ae1253d38d3a4f059344707620fbe30dd818858f028b096e582f805b71301bcfac61f8672ccf9ee8ed9d6048c246cbf0f5d3739cf45c1933ad2ed5c5879748662307e8ebbdd7aa9edca40cb6247f4b49f527f7263a8f02baf452a48196de3fbf9196669c8cc62876c532b2d6e906c543a822541cb186aa422a8a1c447d781001c15510f1aafef9fa6618cbd6b8bede6ac0eb63a4c92e60f910a0f71c7a0b90d3a175a6f35c8e7504f46e870604806828b6658e673919c123d358e46ad5af5b3db692104fdd31cdf949d56b00ad195768dec9edd0b159764ade5f26202fc9e5f56423905b3", 0x559, r0) keyctl$KEYCTL_PKEY_VERIFY(0x1c, &(0x7f0000000080)={r1, 0x11, 0x300}, &(0x7f0000000140)=ANY=[], 0x0, 0x0) syz_usb_connect$midi(0x5, 0x24, &(0x7f0000000100)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x40, 0x1430, 0x474b, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x1, 0x15, 0x0, 0x0, "", {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x3, 0x20, 0x4}}}}}]}}, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x2, [{0x4, &(0x7f0000000240)=@lang_id={0x4, 0x3, 0x100c}}, {0xca, &(0x7f0000000280)=@string={0xca, 0x3, "65ba4dcd5d2d682a8a0b0b7e9b338f8f1b611c3499be508b0d0384197589ba37fe51d98622c4f9bd69d03923cedd43834e13b211c2c2f2b548aef2d4953c59867af2459d72c99debd35dd78e59c133f1066469beae6626fe45361b7f5879b744566e36d5920d2c38e1cd70898d6f6823ea044204ec8bee06d7682726dd5af47e402120221417d11c97b119b8e6fcd0e4dc38f147f50116449242bab4b5ffa5c94db74ad0e9e5950c4b12984eb733fae555c786a725353ce706047e3154df09e60b84b5f615eef5dd"}}]}) (async) syz_usb_connect$midi(0x5, 0x24, &(0x7f0000000100)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x40, 0x1430, 0x474b, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x1, 0x15, 0x0, 0x0, "", {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x3, 0x20, 0x4}}}}}]}}, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x2, [{0x4, &(0x7f0000000240)=@lang_id={0x4, 0x3, 0x100c}}, {0xca, &(0x7f0000000280)=@string={0xca, 0x3, "65ba4dcd5d2d682a8a0b0b7e9b338f8f1b611c3499be508b0d0384197589ba37fe51d98622c4f9bd69d03923cedd43834e13b211c2c2f2b548aef2d4953c59867af2459d72c99debd35dd78e59c133f1066469beae6626fe45361b7f5879b744566e36d5920d2c38e1cd70898d6f6823ea044204ec8bee06d7682726dd5af47e402120221417d11c97b119b8e6fcd0e4dc38f147f50116449242bab4b5ffa5c94db74ad0e9e5950c4b12984eb733fae555c786a725353ce706047e3154df09e60b84b5f615eef5dd"}}]}) 56.617668ms ago: executing program 3 (id=470): r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000200)={0x700, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB="020d000014000000f0ffffff0000000005000600038000000a0080ff00000000fc0100000000000000ffffffff000000000000000000000005000500000000000a00000000000000000000000000000000000000000008000000000000000000080012"], 0xa0}}, 0x20009800) 152.13µs ago: executing program 3 (id=471): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mount$incfs(&(0x7f0000000440)='./file0\x00', &(0x7f0000000140)='./file0\x00', &(0x7f0000000200), 0x80, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)}) setresgid(0xee00, 0x0, 0x0) tee(0xffffffffffffffff, 0xffffffffffffffff, 0xe5, 0x12) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$null(0xffffffffffffff9c, &(0x7f00000001c0), 0x101401, 0x0) pwritev2(r2, &(0x7f00000014c0)=[{&(0x7f0000000180)='=', 0x1}], 0x1, 0xff, 0x1, 0x24) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000280)={0x0, 0x0}, &(0x7f00000013c0)=0xc) sendmmsg$unix(r1, &(0x7f00000001c0)=[{{0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000580)='[', 0x1}], 0x1, &(0x7f0000001480)=[@cred={{0x1c, 0x1, 0x2, {r3, r4}}}], 0x20, 0x48044}}], 0x1, 0x4) setsockopt$sock_int(r0, 0x1, 0x10, &(0x7f00000002c0)=0x8001, 0x4) write$binfmt_elf64(r1, &(0x7f0000000600)=ANY=[], 0x78) modify_ldt$write(0x1, &(0x7f0000000900)={0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1}, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x2a) mount$bind(&(0x7f0000000100)='./file0\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) chroot(&(0x7f0000000580)='./file0/../file0\x00') mount$bind(&(0x7f0000000040)='.\x00', &(0x7f00000008c0)='./file0\x00', 0x0, 0x2a05004, 0x0) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000080)='./file0/../file0\x00') recvmmsg(r0, &(0x7f00000010c0)=[{{0x0, 0x0, 0x0}, 0x41}], 0x1, 0x382, 0x0) write$tcp_mem(r2, &(0x7f0000000300)={0x1ff, 0x20, 0x76eb, 0x20, 0x4}, 0x48) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x21) fsetxattr$security_evm(r5, &(0x7f0000000240), &(0x7f0000000380)=@md5={0x1, "4c048c58098b6a5c0da353494f085d74"}, 0x11, 0x2) r6 = openat$incfs(r5, &(0x7f0000000280)='.pending_reads\x00', 0x1, 0x130) ioctl$TIOCL_GETKMSGREDIRECT(r6, 0xc058671e, &(0x7f00000000c0)) 0s ago: executing program 3 (id=472): r0 = creat(&(0x7f0000000280)='./file0\x00', 0xecf86c37d53049cc) write$binfmt_elf64(r0, &(0x7f0000000180)={{0x7f, 0x45, 0x4c, 0x46, 0x5, 0xd, 0x7, 0x8, 0x405, 0x3, 0x6, 0xfffffff9, 0x1fe, 0x40, 0x88, 0xd2c, 0x5, 0x38, 0x2, 0x78, 0x107, 0x4}, [{0x5, 0x0, 0x6, 0x9, 0x8, 0x4, 0x269, 0x8}, {0x1, 0x8, 0x4, 0xfffffffffffffff8, 0xa, 0x5, 0x1, 0x5}]}, 0xb0) close(r0) execve(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) kernel console output (not intermixed with test programs): now attached to ttyUSB0 [ 29.366824][ T31] usb 2-1: device descriptor read/64, error -71 [ 29.426710][ T310] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 29.442919][ T66] usb 3-1: USB disconnect, device number 5 [ 29.446718][ T344] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 29.450435][ T66] generic ttyUSB0: generic converter now disconnected from ttyUSB0 [ 29.465072][ T66] usbserial_generic 3-1:1.0: device disconnected [ 29.556702][ T310] usb 1-1: device descriptor read/64, error -71 [ 29.587204][ T344] usb 4-1: device descriptor read/64, error -71 [ 29.606742][ T31] usb 2-1: device descriptor read/64, error -71 [ 29.796704][ T310] usb 1-1: device descriptor read/64, error -71 [ 29.826818][ T344] usb 4-1: device descriptor read/64, error -71 [ 29.846728][ T31] usb 2-1: new full-speed USB device number 5 using dummy_hcd [ 29.976778][ T31] usb 2-1: device descriptor read/64, error -71 [ 30.036717][ T310] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 30.066703][ T344] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 30.166768][ T310] usb 1-1: device descriptor read/64, error -71 [ 30.196694][ T344] usb 4-1: device descriptor read/64, error -71 [ 30.206697][ T348] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 30.226695][ T31] usb 2-1: device descriptor read/64, error -71 [ 30.336812][ T31] usb usb2-port1: attempt power cycle [ 30.356685][ T348] usb 3-1: Using ep0 maxpacket: 16 [ 30.362936][ T348] usb 3-1: too many endpoints for config 0 interface 0 altsetting 16: 250, using maximum allowed: 30 [ 30.373858][ T348] usb 3-1: config 0 interface 0 altsetting 16 has 1 endpoint descriptor, different from the interface descriptor's value: 250 [ 30.386998][ T348] usb 3-1: config 0 interface 0 has no altsetting 0 [ 30.393600][ T348] usb 3-1: New USB device found, idVendor=1a34, idProduct=0802, bcdDevice= 0.00 [ 30.402734][ T348] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 30.410974][ T310] usb 1-1: device descriptor read/64, error -71 [ 30.417847][ T348] usb 3-1: config 0 descriptor?? [ 30.456662][ T344] usb 4-1: device descriptor read/64, error -71 [ 30.526770][ T310] usb usb1-port1: attempt power cycle [ 30.566765][ T344] usb usb4-port1: attempt power cycle [ 30.676697][ T31] usb 2-1: new full-speed USB device number 6 using dummy_hcd [ 30.697873][ T31] usb 2-1: device descriptor read/8, error -71 [ 30.709816][ T348] usbhid 3-1:0.0: can't add hid device: -71 [ 30.715844][ T348] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 30.721768][ T500] FAULT_INJECTION: forcing a failure. [ 30.721768][ T500] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 30.724658][ T348] usb 3-1: USB disconnect, device number 6 [ 30.739344][ T500] CPU: 0 UID: 0 PID: 500 Comm: syz.2.53 Not tainted syzkaller #0 67f5df147bfe8fe71cdb2f404f013e40b3f12e05 [ 30.739373][ T500] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 30.739383][ T500] Call Trace: [ 30.739389][ T500] [ 30.739395][ T500] __dump_stack+0x21/0x30 [ 30.739424][ T500] dump_stack_lvl+0x140/0x1c0 [ 30.739448][ T500] ? __cfi_dump_stack_lvl+0x10/0x10 [ 30.739472][ T500] ? check_stack_object+0x138/0x150 [ 30.739491][ T500] dump_stack+0x19/0x20 [ 30.739513][ T500] should_fail_ex+0x3c2/0x510 [ 30.739533][ T500] should_fail+0xf/0x20 [ 30.739550][ T500] should_fail_usercopy+0x1e/0x30 [ 30.739571][ T500] _copy_to_user+0x24/0xa0 [ 30.739594][ T500] simple_read_from_buffer+0xed/0x160 [ 30.739617][ T500] proc_fail_nth_read+0x1aa/0x220 [ 30.739643][ T500] ? __cfi_proc_fail_nth_read+0x10/0x10 [ 30.739667][ T500] ? bpf_lsm_file_permission+0xd/0x20 [ 30.739689][ T500] ? __cfi_proc_fail_nth_read+0x10/0x10 [ 30.739712][ T500] vfs_read+0x288/0xc70 [ 30.739738][ T500] ? fput+0x1a4/0x230 [ 30.739760][ T500] ? __cfi_vfs_read+0x10/0x10 [ 30.739777][ T500] ? __kasan_check_write+0x18/0x20 [ 30.739794][ T500] ? mutex_lock+0x97/0x1d0 [ 30.739817][ T500] ? __cfi_mutex_lock+0x10/0x10 [ 30.739841][ T500] ksys_read+0x145/0x260 [ 30.739859][ T500] ? __cfi_ksys_read+0x10/0x10 [ 30.739877][ T500] ? __kasan_check_read+0x15/0x20 [ 30.739894][ T500] __x64_sys_read+0x7f/0x90 [ 30.739911][ T500] x64_sys_call+0x2638/0x2ee0 [ 30.739928][ T500] do_syscall_64+0x57/0xf0 [ 30.739946][ T500] ? clear_bhb_loop+0x50/0xa0 [ 30.739967][ T500] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 30.739987][ T500] RIP: 0033:0x7f645f75e90e [ 30.740004][ T500] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 30.740018][ T500] RSP: 002b:00007f646068efe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 30.740039][ T500] RAX: ffffffffffffffda RBX: 00007f646068f6c0 RCX: 00007f645f75e90e [ 30.740051][ T500] RDX: 000000000000000f RSI: 00007f646068f0a0 RDI: 0000000000000003 [ 30.740062][ T500] RBP: 00007f646068f090 R08: 0000000000000000 R09: 0000000000000000 [ 30.740071][ T500] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 30.740082][ T500] R13: 00007f645fa26038 R14: 00007f645fa25fa0 R15: 00007ffc425648c8 [ 30.740097][ T500] [ 30.997698][ T31] usb 2-1: device descriptor read/8, error -71 [ 31.036692][ T310] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 31.044284][ T344] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 31.067772][ T310] usb 1-1: device descriptor read/8, error -71 [ 31.073993][ T344] usb 4-1: device descriptor read/8, error -71 [ 31.197716][ T310] usb 1-1: device descriptor read/8, error -71 [ 31.207723][ T344] usb 4-1: device descriptor read/8, error -71 [ 31.236706][ T31] usb 2-1: new full-speed USB device number 7 using dummy_hcd [ 31.257733][ T31] usb 2-1: device descriptor read/8, error -71 [ 31.387696][ T31] usb 2-1: device descriptor read/8, error -71 [ 31.436684][ T310] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 31.446752][ T344] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 31.457749][ T310] usb 1-1: device descriptor read/8, error -71 [ 31.467752][ T344] usb 4-1: device descriptor read/8, error -71 [ 31.496773][ T31] usb usb2-port1: unable to enumerate USB device [ 31.587717][ T310] usb 1-1: device descriptor read/8, error -71 [ 31.597841][ T344] usb 4-1: device descriptor read/8, error -71 [ 31.625484][ T507] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 31.696797][ T310] usb usb1-port1: unable to enumerate USB device [ 31.706874][ T344] usb usb4-port1: unable to enumerate USB device [ 31.815360][ T36] kauditd_printk_skb: 29 callbacks suppressed [ 31.815379][ T36] audit: type=1400 audit(1786043488.670:184): avc: denied { append } for pid=515 comm="syz.2.59" name="kvm" dev="devtmpfs" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 31.856387][ T516] capability: warning: `syz.2.59' uses 32-bit capabilities (legacy support in use) [ 31.980903][ T36] audit: type=1400 audit(1786043488.840:185): avc: denied { ioctl } for pid=520 comm="syz.1.61" path="socket:[4945]" dev="sockfs" ino=4945 ioctlcmd=0x8955 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 32.005693][ T521] netlink: 'syz.1.61': attribute type 9 has an invalid length. [ 32.073899][ T36] audit: type=1400 audit(1786043488.930:186): avc: denied { ioctl } for pid=527 comm="syz.2.63" path="socket:[5024]" dev="sockfs" ino=5024 ioctlcmd=0x89e1 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 32.150593][ T36] audit: type=1400 audit(1786043489.010:187): avc: denied { mount } for pid=534 comm="syz.3.66" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 32.180795][ T36] audit: type=1400 audit(1786043489.010:188): avc: denied { write } for pid=534 comm="syz.3.66" name="uprobe_events" dev="tracefs" ino=1053 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=file permissive=1 [ 32.221077][ T36] audit: type=1400 audit(1786043489.010:189): avc: denied { open } for pid=534 comm="syz.3.66" path="/7/tracing/uprobe_events" dev="tracefs" ino=1053 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=file permissive=1 [ 32.250266][ T36] audit: type=1400 audit(1786043489.040:190): avc: denied { unmount } for pid=299 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 32.322736][ T36] audit: type=1400 audit(1786043489.110:191): avc: denied { read write } for pid=531 comm="syz.2.65" name="control" dev="devtmpfs" ino=198 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 32.364353][ T36] audit: type=1400 audit(1786043489.110:192): avc: denied { open } for pid=531 comm="syz.2.65" path="/25/dev/mapper/control" dev="devtmpfs" ino=198 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 32.394142][ T36] audit: type=1400 audit(1786043489.110:193): avc: denied { ioctl } for pid=531 comm="syz.2.65" path="/25/dev/mapper/control" dev="devtmpfs" ino=198 ioctlcmd=0xfd00 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 32.518554][ T561] Zero length message leads to an empty skb [ 32.585840][ T564] netlink: 'syz.3.77': attribute type 4 has an invalid length. [ 32.595105][ T564] netlink: 'syz.3.77': attribute type 6 has an invalid length. [ 32.607860][ T564] netlink: 3657 bytes leftover after parsing attributes in process `syz.3.77'. [ 32.755386][ T573] FAULT_INJECTION: forcing a failure. [ 32.755386][ T573] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 32.782950][ T31] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 32.806499][ T573] CPU: 1 UID: 0 PID: 573 Comm: syz.2.80 Not tainted syzkaller #0 67f5df147bfe8fe71cdb2f404f013e40b3f12e05 [ 32.806533][ T573] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 32.806545][ T573] Call Trace: [ 32.806551][ T573] [ 32.806559][ T573] __dump_stack+0x21/0x30 [ 32.806590][ T573] dump_stack_lvl+0x140/0x1c0 [ 32.806615][ T573] ? __cfi_dump_stack_lvl+0x10/0x10 [ 32.806641][ T573] ? __kasan_check_write+0x18/0x20 [ 32.806661][ T573] ? kvm_arch_vcpu_load+0x665/0x8d0 [ 32.806681][ T573] dump_stack+0x19/0x20 [ 32.806704][ T573] should_fail_ex+0x3c2/0x510 [ 32.806727][ T573] should_fail+0xf/0x20 [ 32.806746][ T573] should_fail_usercopy+0x1e/0x30 [ 32.806767][ T573] _copy_from_user+0x20/0xa0 [ 32.806792][ T573] kvm_arch_vcpu_ioctl+0x43b/0x3120 [ 32.806811][ T573] ? avc_has_perm+0x155/0x240 [ 32.806833][ T573] ? __cfi_avc_has_perm+0x10/0x10 [ 32.806854][ T573] ? __cfi_kvm_arch_vcpu_ioctl+0x10/0x10 [ 32.806875][ T573] ? selinux_file_open+0x46c/0x630 [ 32.806894][ T573] ? __cfi_selinux_file_open+0x10/0x10 [ 32.806916][ T573] ? is_bpf_text_address+0x17b/0x1a0 [ 32.806945][ T573] ? kernel_text_address+0xa9/0xe0 [ 32.806971][ T573] ? __kernel_text_address+0x11/0x40 [ 32.806996][ T573] ? __asan_set_shadow_00+0x12/0x20 [ 32.807022][ T573] ? do_vfs_ioctl+0x182d/0x2010 [ 32.807046][ T573] ? arch_stack_walk+0x10a/0x170 [ 32.807065][ T573] ? __ia32_compat_sys_ioctl+0x920/0x920 [ 32.807089][ T573] ? _parse_integer_limit+0x195/0x1e0 [ 32.807109][ T573] ? _parse_integer+0x2e/0x40 [ 32.807127][ T573] ? kstrtoull+0x13b/0x1e0 [ 32.807146][ T573] ? kstrtouint+0x78/0xf0 [ 32.807164][ T573] ? ioctl_has_perm+0x1bc/0x500 [ 32.807183][ T573] ? __asan_memcpy+0x5a/0x80 [ 32.807202][ T573] ? ioctl_has_perm+0x408/0x500 [ 32.807219][ T573] ? has_cap_mac_admin+0xd0/0xd0 [ 32.807238][ T573] ? __kasan_check_write+0x18/0x20 [ 32.807256][ T573] ? mutex_lock_killable+0x97/0x1d0 [ 32.807283][ T573] ? __cfi_mutex_lock_killable+0x10/0x10 [ 32.807308][ T573] ? proc_fail_nth_write+0x184/0x220 [ 32.807333][ T573] ? __cfi_proc_fail_nth_write+0x10/0x10 [ 32.807359][ T573] kvm_vcpu_ioctl+0x7da/0x1000 [ 32.807378][ T573] ? __cfi_kvm_vcpu_ioctl+0x10/0x10 [ 32.807396][ T573] ? __cfi_vfs_write+0x10/0x10 [ 32.807424][ T573] ? __kasan_check_write+0x18/0x20 [ 32.807442][ T573] ? mutex_unlock+0x90/0x240 [ 32.807466][ T573] ? __cfi_mutex_unlock+0x10/0x10 [ 32.807490][ T573] ? bpf_lsm_file_ioctl+0xd/0x20 [ 32.807509][ T573] ? security_file_ioctl+0x3e/0x110 [ 32.807531][ T573] ? __cfi_kvm_vcpu_ioctl+0x10/0x10 [ 32.807545][ T573] __se_sys_ioctl+0x135/0x1b0 [ 32.807563][ T573] __x64_sys_ioctl+0x7f/0xa0 [ 32.807581][ T573] x64_sys_call+0x1878/0x2ee0 [ 32.807595][ T573] do_syscall_64+0x57/0xf0 [ 32.807612][ T573] ? clear_bhb_loop+0x50/0xa0 [ 32.807633][ T573] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 32.807652][ T573] RIP: 0033:0x7f645f79e0d9 [ 32.807666][ T573] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 32.807679][ T573] RSP: 002b:00007f646068f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 32.807697][ T573] RAX: ffffffffffffffda RBX: 00007f645fa25fa0 RCX: 00007f645f79e0d9 [ 32.807710][ T573] RDX: 0000200000000000 RSI: 000000004008ae89 RDI: 0000000000000005 [ 32.807721][ T573] RBP: 00007f646068f090 R08: 0000000000000000 R09: 0000000000000000 [ 32.807731][ T573] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 32.807741][ T573] R13: 00007f645fa26038 R14: 00007f645fa25fa0 R15: 00007ffc425648c8 [ 32.807754][ T573] [ 32.876458][ T581] netlink: 4 bytes leftover after parsing attributes in process `syz.3.82'. [ 33.016692][ T31] usb 1-1: device descriptor read/64, error -71 [ 33.028562][ T581] netlink: 4292 bytes leftover after parsing attributes in process `syz.3.82'. [ 33.214119][ T585] netlink: 8 bytes leftover after parsing attributes in process `syz.3.83'. [ 33.278674][ T31] usb 1-1: device descriptor read/64, error -71 [ 33.536713][ T31] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 33.596690][ T10] usb 4-1: new full-speed USB device number 9 using dummy_hcd [ 33.676701][ T31] usb 1-1: device descriptor read/64, error -71 [ 33.748183][ T10] usb 4-1: unable to get BOS descriptor or descriptor too short [ 33.756215][ T10] usb 4-1: not running at top speed; connect to a high speed hub [ 33.764732][ T10] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 33.774871][ T10] usb 4-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 33.783842][ T10] usb 4-1: config 1 interface 1 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 33.798753][ T10] usb 4-1: string descriptor 0 read error: -22 [ 33.804949][ T10] usb 4-1: New USB device found, idVendor=0582, idProduct=003b, bcdDevice= 0.40 [ 33.814065][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 33.824666][ T10] usb 4-1: BAAD HEADSET ADAPTER c_chmask mismatch [ 33.832769][ T10] snd-usb-audio 4-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 33.870454][ T320] udevd[320]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 33.906332][ T607] rust_binder: 606:607 error while translating object: EPERM [ 33.913832][ T607] rust_binder: Failure in copy_transaction_data: EPERM [ 33.913862][ T607] rust_binder: 606:607 transaction call to 606:0 failed EPERM, code 0 size 96-24 [ 33.931476][ T10] rust_binder: 606: undelivered TRANSACTION_ERROR: 29201 [ 33.936689][ T31] usb 1-1: device descriptor read/64, error -71 [ 33.951470][ T609] FAULT_INJECTION: forcing a failure. [ 33.951470][ T609] name failslab, interval 1, probability 0, space 0, times 0 [ 33.964168][ T66] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 33.971664][ T609] CPU: 0 UID: 0 PID: 609 Comm: syz.2.93 Not tainted syzkaller #0 67f5df147bfe8fe71cdb2f404f013e40b3f12e05 [ 33.971683][ T609] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 33.971690][ T609] Call Trace: [ 33.971694][ T609] [ 33.971699][ T609] __dump_stack+0x21/0x30 [ 33.971724][ T609] dump_stack_lvl+0x140/0x1c0 [ 33.971738][ T609] ? __cfi_dump_stack_lvl+0x10/0x10 [ 33.971754][ T609] dump_stack+0x19/0x20 [ 33.971767][ T609] should_fail_ex+0x3c2/0x510 [ 33.971780][ T609] should_failslab+0xac/0x100 [ 33.971794][ T609] __kmalloc_node_track_caller_noprof+0x65/0x4f0 [ 33.971806][ T609] ? __kasan_check_write+0x18/0x20 [ 33.971817][ T609] ? _raw_spin_lock+0x92/0x120 [ 33.971830][ T609] ? _RNvMs4_NtCswPamI0U300_11rust_binder7processNtB5_7Process18get_current_thread+0x469/0x1a60 [ 33.971851][ T609] ? __cfi__raw_spin_lock+0x10/0x10 [ 33.971863][ T609] krealloc_noprof+0x8d/0x130 [ 33.971875][ T609] _RNvMs4_NtCswPamI0U300_11rust_binder7processNtB5_7Process18get_current_thread+0x469/0x1a60 [ 33.971893][ T609] ? __cfi_selinux_file_open+0x10/0x10 [ 33.971905][ T609] ? __cfi__RNvMs4_NtCswPamI0U300_11rust_binder7processNtB5_7Process18get_current_thread+0x10/0x10 [ 33.971923][ T609] ? avc_has_extended_perms+0x7fb/0xe60 [ 33.971936][ T609] ? __asan_memcpy+0x5a/0x80 [ 33.971947][ T609] _RNvCswPamI0U300_11rust_binder17rust_binder_ioctl+0x379/0x3fe0 [ 33.971966][ T609] ? __asan_set_shadow_00+0x12/0x20 [ 33.971981][ T609] ? do_vfs_ioctl+0x182d/0x2010 [ 33.971994][ T609] ? arch_stack_walk+0x10a/0x170 [ 33.972004][ T609] ? __ia32_compat_sys_ioctl+0x920/0x920 [ 33.972018][ T609] ? __cfi__RNvCswPamI0U300_11rust_binder17rust_binder_ioctl+0x10/0x10 [ 33.972033][ T609] ? _parse_integer+0x2e/0x40 [ 33.972046][ T609] ? ioctl_has_perm+0x39a/0x500 [ 33.972057][ T609] ? has_cap_mac_admin+0xd0/0xd0 [ 33.972068][ T609] ? proc_fail_nth_write+0x184/0x220 [ 33.972083][ T609] ? __cfi_proc_fail_nth_write+0x10/0x10 [ 33.972098][ T609] ? selinux_file_ioctl+0x732/0x1480 [ 33.972109][ T609] ? vfs_write+0xbcf/0xfd0 [ 33.972120][ T609] ? __cfi_selinux_file_ioctl+0x10/0x10 [ 33.972131][ T609] ? __cfi_vfs_write+0x10/0x10 [ 33.972142][ T609] ? __kasan_check_write+0x18/0x20 [ 33.972152][ T609] ? mutex_unlock+0x90/0x240 [ 33.972167][ T609] ? __cfi_mutex_unlock+0x10/0x10 [ 33.972182][ T609] ? bpf_lsm_file_ioctl+0xd/0x20 [ 33.972195][ T609] ? security_file_ioctl+0x3e/0x110 [ 33.972211][ T609] ? __cfi__RNvCswPamI0U300_11rust_binder17rust_binder_ioctl+0x10/0x10 [ 33.972226][ T609] __se_sys_ioctl+0x135/0x1b0 [ 33.972238][ T609] __x64_sys_ioctl+0x7f/0xa0 [ 33.972251][ T609] x64_sys_call+0x1878/0x2ee0 [ 33.972262][ T609] do_syscall_64+0x57/0xf0 [ 33.972273][ T609] ? clear_bhb_loop+0x50/0xa0 [ 33.972287][ T609] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 33.972301][ T609] RIP: 0033:0x7f645f79e0d9 [ 33.972312][ T609] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 33.972322][ T609] RSP: 002b:00007f646068f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 33.972336][ T609] RAX: ffffffffffffffda RBX: 00007f645fa25fa0 RCX: 00007f645f79e0d9 [ 33.972344][ T609] RDX: 0000200000000100 RSI: 00000000c0306201 RDI: 0000000000000004 [ 33.972352][ T609] RBP: 00007f646068f090 R08: 0000000000000000 R09: 0000000000000000 [ 33.972360][ T609] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 33.972367][ T609] R13: 00007f645fa26038 R14: 00007f645fa25fa0 R15: 00007ffc425648c8 [ 33.972376][ T609] [ 34.046769][ T31] usb usb1-port1: attempt power cycle [ 34.137777][ T66] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 34.276668][ T344] usb 3-1: new full-speed USB device number 7 using dummy_hcd [ 34.281499][ T66] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 34.357847][ T66] usb 2-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.80 [ 34.366937][ T66] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 34.375504][ T66] usb 2-1: config 0 descriptor?? [ 34.404595][ T612] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 34.413264][ T612] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 34.424758][ T362] usb 4-1: USB disconnect, device number 9 [ 34.437376][ T344] usb 3-1: not running at top speed; connect to a high speed hub [ 34.447278][ T344] usb 3-1: config 1 interface 0 altsetting 6 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 34.460324][ T344] usb 3-1: config 1 interface 0 has no altsetting 0 [ 34.468769][ T344] usb 3-1: New USB device found, idVendor=04b8, idProduct=0202, bcdDevice= 0.40 [ 34.477988][ T31] usb 1-1: new high-speed USB device number 11 using dummy_hcd [ 34.485646][ T344] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 34.493795][ T344] usb 3-1: Product: ⠊ [ 34.498010][ T344] usb 3-1: Manufacturer: 뎬໲箞箒鵤驖顧ꝰ멇媣焻ꮽ봱䤋㎑ט㰨犹㔒䭰鵄树Ȣ캣肗⭴瘙껛ࣟ級酅Ẽ釦戧ꄠ戟؄䰰貞숼鬒牋姥粋䍕뉍ᶤ䰃䜉싮폴甥譢鹁茬晲Ꞑ琝揵㹝뀣칭䠲疡Ν㙤곶⃕쒄裰䫿萏翻ᡓ﵏郗ꍫ訓愣꼘⮳洩ᵶ鰠똏ꌱ쐪ռ굡ﵸ誗ᒬ튌绺鬵╌Ꞿ [ 34.531158][ T344] usb 3-1: SerialNumber: syz [ 34.536272][ T31] usb 1-1: device descriptor read/8, error -71 [ 34.543263][ T611] raw-gadget.3 gadget.2: fail, usb_ep_enable returned -22 [ 34.646705][ T629] netlink: 12 bytes leftover after parsing attributes in process `syz.3.97'. [ 34.667874][ T31] usb 1-1: device descriptor read/8, error -71 [ 34.675703][ T629] netlink: 20 bytes leftover after parsing attributes in process `syz.3.97'. [ 34.755400][ T344] usblp 3-1:1.0: usblp0: USB Unidirectional printer dev 7 if 0 alt 6 proto 1 vid 0x04B8 pid 0x0202 [ 34.767623][ T344] usb 3-1: USB disconnect, device number 7 [ 34.775148][ T344] usblp0: removed [ 34.787341][ T66] cp2112 0003:10C4:EA90.0003: unknown main item tag 0x0 [ 34.795333][ T66] cp2112 0003:10C4:EA90.0003: hidraw0: USB HID v0.00 Device [HID 10c4:ea90] on usb-dummy_hcd.1-1/input0 [ 34.867083][ T66] cp2112 0003:10C4:EA90.0003: Part Number: 0x82 Device Version: 0xFE [ 34.906712][ T31] usb 1-1: new high-speed USB device number 12 using dummy_hcd [ 34.927754][ T31] usb 1-1: device descriptor read/8, error -71 [ 34.946664][ T362] usb 4-1: new high-speed USB device number 10 using dummy_hcd [ 35.057702][ T31] usb 1-1: device descriptor read/8, error -71 [ 35.076087][ T66] cp2112 0003:10C4:EA90.0003: error setting SMBus config [ 35.083823][ T66] cp2112 0003:10C4:EA90.0003: probe with driver cp2112 failed with error -71 [ 35.094659][ T66] usb 2-1: USB disconnect, device number 8 [ 35.103118][ T362] usb 4-1: config 24 has too many interfaces: 158, using maximum allowed: 32 [ 35.112026][ T362] usb 4-1: config 24 has an invalid descriptor of length 0, skipping remainder of the config [ 35.122297][ T362] usb 4-1: config 24 has 1 interface, different from the descriptor's value: 158 [ 35.132877][ T362] usb 4-1: New USB device found, idVendor=0ccd, idProduct=0014, bcdDevice= 0.40 [ 35.141937][ T362] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 35.150129][ T362] usb 4-1: Product: syz [ 35.154295][ T362] usb 4-1: Manufacturer: syz [ 35.158927][ T362] usb 4-1: SerialNumber: syz [ 35.166791][ T31] usb usb1-port1: unable to enumerate USB device [ 35.322576][ T634] 9pnet: p9_errstr2errno: server reported unknown error 0x00000000 [ 35.369600][ T362] usb 4-1: 0:1 : does not exist [ 35.384951][ T362] usb 4-1: unit 80 not found! [ 35.393781][ T362] usb 4-1: USB disconnect, device number 10 [ 35.406461][ T320] udevd[320]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:24.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 35.622400][ T652] FAULT_INJECTION: forcing a failure. [ 35.622400][ T652] name failslab, interval 1, probability 0, space 0, times 0 [ 35.636467][ T652] CPU: 0 UID: 0 PID: 652 Comm: syz.1.104 Not tainted syzkaller #0 67f5df147bfe8fe71cdb2f404f013e40b3f12e05 [ 35.636499][ T652] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 35.636511][ T652] Call Trace: [ 35.636518][ T652] [ 35.636525][ T652] __dump_stack+0x21/0x30 [ 35.636558][ T652] dump_stack_lvl+0x140/0x1c0 [ 35.636582][ T652] ? __cfi_dump_stack_lvl+0x10/0x10 [ 35.636607][ T652] ? avc_has_perm+0x155/0x240 [ 35.636634][ T652] ? __cfi_avc_has_perm+0x10/0x10 [ 35.636654][ T652] dump_stack+0x19/0x20 [ 35.636677][ T652] should_fail_ex+0x3c2/0x510 [ 35.636699][ T652] should_failslab+0xac/0x100 [ 35.636722][ T652] __kmalloc_cache_noprof+0x41/0x470 [ 35.636742][ T652] ? vhost_task_create+0x12c/0x3f0 [ 35.636763][ T652] ? __cfi_kvm_nx_huge_page_recovery_worker+0x10/0x10 [ 35.636786][ T652] vhost_task_create+0x12c/0x3f0 [ 35.636797][ T652] ? __cfi_kvm_nx_huge_page_recovery_worker_kill+0x10/0x10 [ 35.636811][ T652] ? __cfi_vhost_task_create+0x10/0x10 [ 35.636823][ T652] ? __cfi_vhost_task_fn+0x10/0x10 [ 35.636834][ T652] ? __kasan_check_write+0x18/0x20 [ 35.636845][ T652] ? mutex_lock+0x97/0x1d0 [ 35.636860][ T652] ? __cfi_mutex_lock+0x10/0x10 [ 35.636874][ T652] ? kernel_text_address+0xa9/0xe0 [ 35.636889][ T652] kvm_mmu_post_init_vm+0x161/0x300 [ 35.636904][ T652] kvm_arch_vcpu_ioctl_run+0xf3/0x1bc0 [ 35.636920][ T652] ? _parse_integer_limit+0x195/0x1e0 [ 35.636932][ T652] ? __cfi_kvm_arch_vcpu_ioctl_run+0x10/0x10 [ 35.636947][ T652] ? kstrtoull+0x13b/0x1e0 [ 35.636957][ T652] ? kstrtouint+0x78/0xf0 [ 35.636968][ T652] ? ioctl_has_perm+0x1bc/0x500 [ 35.636979][ T652] ? __asan_memcpy+0x5a/0x80 [ 35.636990][ T652] ? ioctl_has_perm+0x408/0x500 [ 35.637007][ T652] ? has_cap_mac_admin+0xd0/0xd0 [ 35.637026][ T652] ? __kasan_check_write+0x18/0x20 [ 35.637043][ T652] ? mutex_lock_killable+0x97/0x1d0 [ 35.637065][ T652] ? __cfi_mutex_lock_killable+0x10/0x10 [ 35.637079][ T652] ? proc_fail_nth_write+0x184/0x220 [ 35.637095][ T652] kvm_vcpu_ioctl+0xa43/0x1000 [ 35.637107][ T652] ? __cfi_kvm_vcpu_ioctl+0x10/0x10 [ 35.637117][ T652] ? __cfi_vfs_write+0x10/0x10 [ 35.637129][ T652] ? __kasan_check_write+0x18/0x20 [ 35.637139][ T652] ? mutex_unlock+0x90/0x240 [ 35.637153][ T652] ? __cfi_mutex_unlock+0x10/0x10 [ 35.637169][ T652] ? bpf_lsm_file_ioctl+0xd/0x20 [ 35.637191][ T652] ? security_file_ioctl+0x3e/0x110 [ 35.637206][ T652] ? __cfi_kvm_vcpu_ioctl+0x10/0x10 [ 35.637217][ T652] __se_sys_ioctl+0x135/0x1b0 [ 35.637230][ T652] __x64_sys_ioctl+0x7f/0xa0 [ 35.637243][ T652] x64_sys_call+0x1878/0x2ee0 [ 35.637253][ T652] do_syscall_64+0x57/0xf0 [ 35.637265][ T652] ? clear_bhb_loop+0x50/0xa0 [ 35.637280][ T652] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 35.637294][ T652] RIP: 0033:0x7f45cd79e0d9 [ 35.637305][ T652] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 35.637315][ T652] RSP: 002b:00007f45ce66b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 35.637330][ T652] RAX: ffffffffffffffda RBX: 00007f45cda25fa0 RCX: 00007f45cd79e0d9 [ 35.637338][ T652] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005 [ 35.637346][ T652] RBP: 00007f45ce66b090 R08: 0000000000000000 R09: 0000000000000000 [ 35.637353][ T652] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 35.637360][ T652] R13: 00007f45cda26038 R14: 00007f45cda25fa0 R15: 00007ffcbb8f8f68 [ 35.637370][ T652] [ 36.049136][ T31] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 36.060820][ T661] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 36.060842][ T661] rust_binder: Read failure Err(EFAULT) in pid:87 [ 36.069872][ T661] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 36.076516][ T661] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 36.083076][ T661] rust_binder: Read failure Err(EFAULT) in pid:87 [ 36.148137][ T665] netlink: 'syz.3.110': attribute type 11 has an invalid length. [ 36.206864][ T31] usb 3-1: Using ep0 maxpacket: 32 [ 36.212996][ T31] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 36.224545][ T31] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 75, changing to 10 [ 36.236814][ T31] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 36.250989][ T31] usb 3-1: New USB device found, idVendor=084e, idProduct=1001, bcdDevice=33.f9 [ 36.260137][ T31] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 36.268273][ T31] usb 3-1: Product: syz [ 36.272040][ T66] usb 1-1: new low-speed USB device number 13 using dummy_hcd [ 36.272462][ T31] usb 3-1: Manufacturer: syz [ 36.284698][ T31] usb 3-1: SerialNumber: syz [ 36.289923][ T31] usb 3-1: config 0 descriptor?? [ 36.295188][ T657] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 36.303452][ T31] input: KB Gear Tablet as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/input/input5 [ 36.336690][ T344] usb 2-1: new full-speed USB device number 9 using dummy_hcd [ 36.406677][ T66] usb 1-1: device descriptor read/64, error -71 [ 36.487680][ T344] usb 2-1: config 0 has an invalid interface number: 199 but max is 1 [ 36.495881][ T344] usb 2-1: config 0 has no interface number 1 [ 36.502006][ T344] usb 2-1: config 0 interface 199 altsetting 0 endpoint 0xA has invalid wMaxPacketSize 0 [ 36.507734][ T352] usb 3-1: USB disconnect, device number 8 [ 36.511875][ T344] usb 2-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 36.529394][ T344] usb 2-1: New USB device found, idVendor=0002, idProduct=0000, bcdDevice= 0.00 [ 36.538492][ T344] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 36.546493][ T344] usb 2-1: SerialNumber: syz [ 36.551883][ T344] usb 2-1: config 0 descriptor?? [ 36.656681][ T66] usb 1-1: device descriptor read/64, error -71 [ 36.758685][ T663] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 36.767432][ T663] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 36.838850][ T36] kauditd_printk_skb: 33 callbacks suppressed [ 36.838869][ T36] audit: type=1400 audit(1786043493.690:227): avc: denied { map } for pid=662 comm="syz.1.109" path="socket:[5961]" dev="sockfs" ino=5961 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 36.867868][ T36] audit: type=1400 audit(1786043493.690:228): avc: denied { read } for pid=662 comm="syz.1.109" path="socket:[5961]" dev="sockfs" ino=5961 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 36.890827][ T36] audit: type=1400 audit(1786043493.700:229): avc: denied { write } for pid=671 comm="syz.3.113" name="001" dev="devtmpfs" ino=96 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 36.913743][ T66] usb 1-1: new low-speed USB device number 14 using dummy_hcd [ 37.051641][ T66] usb 1-1: device descriptor read/64, error -71 [ 37.326688][ T66] usb 1-1: device descriptor read/64, error -71 [ 37.436738][ T66] usb usb1-port1: attempt power cycle [ 37.786671][ T66] usb 1-1: new low-speed USB device number 15 using dummy_hcd [ 37.817645][ T66] usb 1-1: device descriptor read/8, error -71 [ 37.947633][ T66] usb 1-1: device descriptor read/8, error -71 [ 38.142037][ T686] netlink: 'syz.2.118': attribute type 16 has an invalid length. [ 38.149849][ T686] netlink: 'syz.2.118': attribute type 3 has an invalid length. [ 38.157553][ T686] netlink: 31362 bytes leftover after parsing attributes in process `syz.2.118'. [ 38.167320][ T686] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 38.174533][ T686] IPv6: NLM_F_CREATE should be set when creating new route [ 38.181812][ T686] IPv6: NLM_F_CREATE should be set when creating new route [ 38.189321][ T66] usb 1-1: new low-speed USB device number 16 using dummy_hcd [ 38.219485][ T66] usb 1-1: device descriptor read/8, error -71 [ 38.347739][ T66] usb 1-1: device descriptor read/8, error -71 [ 38.456820][ T66] usb usb1-port1: unable to enumerate USB device [ 38.686749][ T36] audit: type=1400 audit(1786043495.540:230): avc: denied { read } for pid=701 comm="syz.2.124" name="usbmon7" dev="devtmpfs" ino=112 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 38.722267][ T704] FAULT_INJECTION: forcing a failure. [ 38.722267][ T704] name failslab, interval 1, probability 0, space 0, times 0 [ 38.735094][ T36] audit: type=1400 audit(1786043495.540:231): avc: denied { open } for pid=701 comm="syz.2.124" path="/dev/usbmon7" dev="devtmpfs" ino=112 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 38.739602][ T704] CPU: 1 UID: 0 PID: 704 Comm: syz.3.125 Not tainted syzkaller #0 67f5df147bfe8fe71cdb2f404f013e40b3f12e05 [ 38.739631][ T704] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 38.739641][ T704] Call Trace: [ 38.739647][ T704] [ 38.739654][ T704] __dump_stack+0x21/0x30 [ 38.739682][ T704] dump_stack_lvl+0x140/0x1c0 [ 38.739705][ T704] ? __cfi_dump_stack_lvl+0x10/0x10 [ 38.739732][ T704] ? avc_has_perm+0x155/0x240 [ 38.739752][ T704] ? __cfi_avc_has_perm+0x10/0x10 [ 38.739772][ T704] dump_stack+0x19/0x20 [ 38.739794][ T704] should_fail_ex+0x3c2/0x510 [ 38.739813][ T704] should_failslab+0xac/0x100 [ 38.739835][ T704] __kmalloc_cache_noprof+0x41/0x470 [ 38.739854][ T704] ? vhost_task_create+0x12c/0x3f0 [ 38.739873][ T704] ? __cfi_kvm_nx_huge_page_recovery_worker+0x10/0x10 [ 38.739894][ T704] vhost_task_create+0x12c/0x3f0 [ 38.739912][ T704] ? __cfi_kvm_nx_huge_page_recovery_worker_kill+0x10/0x10 [ 38.739932][ T704] ? __cfi_vhost_task_create+0x10/0x10 [ 38.739951][ T704] ? __cfi_vhost_task_fn+0x10/0x10 [ 38.739969][ T704] ? __kasan_check_write+0x18/0x20 [ 38.739986][ T704] ? mutex_lock+0x97/0x1d0 [ 38.740008][ T704] ? __cfi_mutex_lock+0x10/0x10 [ 38.740030][ T704] ? kernel_text_address+0xa9/0xe0 [ 38.740054][ T704] kvm_mmu_post_init_vm+0x161/0x300 [ 38.740078][ T704] kvm_arch_vcpu_ioctl_run+0xf3/0x1bc0 [ 38.740101][ T704] ? _parse_integer_limit+0x195/0x1e0 [ 38.740121][ T704] ? __cfi_kvm_arch_vcpu_ioctl_run+0x10/0x10 [ 38.740143][ T704] ? kstrtoull+0x13b/0x1e0 [ 38.740160][ T704] ? kstrtouint+0x78/0xf0 [ 38.740177][ T704] ? ioctl_has_perm+0x1bc/0x500 [ 38.740194][ T704] ? __asan_memcpy+0x5a/0x80 [ 38.740211][ T704] ? ioctl_has_perm+0x408/0x500 [ 38.740236][ T704] ? has_cap_mac_admin+0xd0/0xd0 [ 38.740253][ T704] ? __kasan_check_write+0x18/0x20 [ 38.740269][ T704] ? mutex_lock_killable+0x97/0x1d0 [ 38.740292][ T704] ? __cfi_mutex_lock_killable+0x10/0x10 [ 38.740316][ T704] ? proc_fail_nth_write+0x184/0x220 [ 38.740342][ T704] kvm_vcpu_ioctl+0xa43/0x1000 [ 38.740359][ T704] ? __cfi_kvm_vcpu_ioctl+0x10/0x10 [ 38.740376][ T704] ? __cfi_vfs_write+0x10/0x10 [ 38.740395][ T704] ? __kasan_check_write+0x18/0x20 [ 38.740411][ T704] ? mutex_unlock+0x90/0x240 [ 38.740434][ T704] ? __cfi_mutex_unlock+0x10/0x10 [ 38.740459][ T704] ? bpf_lsm_file_ioctl+0xd/0x20 [ 38.740480][ T704] ? security_file_ioctl+0x3e/0x110 [ 38.740504][ T704] ? __cfi_kvm_vcpu_ioctl+0x10/0x10 [ 38.740521][ T704] __se_sys_ioctl+0x135/0x1b0 [ 38.740542][ T704] __x64_sys_ioctl+0x7f/0xa0 [ 38.740562][ T704] x64_sys_call+0x1878/0x2ee0 [ 38.740578][ T704] do_syscall_64+0x57/0xf0 [ 38.740597][ T704] ? clear_bhb_loop+0x50/0xa0 [ 38.740620][ T704] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 38.740643][ T704] RIP: 0033:0x7f1bcc99e0d9 [ 38.740659][ T704] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 38.740673][ T704] RSP: 002b:00007f1bcd7c1028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 38.740694][ T704] RAX: ffffffffffffffda RBX: 00007f1bccc25fa0 RCX: 00007f1bcc99e0d9 [ 38.740707][ T704] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005 [ 38.740719][ T704] RBP: 00007f1bcd7c1090 R08: 0000000000000000 R09: 0000000000000000 [ 38.740731][ T704] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 38.740742][ T704] R13: 00007f1bccc26038 R14: 00007f1bccc25fa0 R15: 00007ffdf7d8dca8 [ 38.740757][ T704] [ 38.776213][ T707] FAULT_INJECTION: forcing a failure. [ 38.776213][ T707] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 38.781237][ T708] usb usb7: usbfs: process 708 (syz.2.124) did not claim interface 0 before use [ 38.785378][ T707] CPU: 1 UID: 0 PID: 707 Comm: syz.0.126 Not tainted syzkaller #0 67f5df147bfe8fe71cdb2f404f013e40b3f12e05 [ 38.785405][ T707] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 38.785416][ T707] Call Trace: [ 38.785422][ T707] [ 38.785429][ T707] __dump_stack+0x21/0x30 [ 38.785457][ T707] dump_stack_lvl+0x140/0x1c0 [ 38.785480][ T707] ? __cfi_dump_stack_lvl+0x10/0x10 [ 38.785508][ T707] dump_stack+0x19/0x20 [ 38.785529][ T707] should_fail_ex+0x3c2/0x510 [ 38.785550][ T707] should_fail+0xf/0x20 [ 38.785567][ T707] should_fail_usercopy+0x1e/0x30 [ 38.785588][ T707] _copy_from_iter+0x1a6/0x1520 [ 38.785609][ T707] ? __kasan_check_write+0x18/0x20 [ 38.785628][ T707] ? skb_set_owner_w+0x280/0x3d0 [ 38.785646][ T707] ? __virt_addr_valid+0x2a1/0x370 [ 38.785666][ T707] ? __cfi__copy_from_iter+0x10/0x10 [ 38.785687][ T707] ? __check_object_size+0x54c/0x870 [ 38.785707][ T707] ? __cfi___check_object_size+0x10/0x10 [ 38.785725][ T707] ? __cfi_sock_alloc_send_pskb+0x10/0x10 [ 38.785744][ T707] skb_copy_datagram_from_iter+0xf4/0x6f0 [ 38.785763][ T707] tun_get_user+0xd99/0x3720 [ 38.785782][ T707] ? ptr_ring_consume+0x430/0x430 [ 38.785799][ T707] ? _parse_integer+0x2e/0x40 [ 38.785816][ T707] ? kstrtoull+0x13b/0x1e0 [ 38.785834][ T707] ? __kasan_check_write+0x18/0x20 [ 38.785850][ T707] ? ref_tracker_alloc+0x32b/0x5b0 [ 38.785871][ T707] ? __cfi_ref_tracker_alloc+0x10/0x10 [ 38.785891][ T707] ? selinux_file_permission+0x318/0xb60 [ 38.785910][ T707] ? __kasan_check_write+0x18/0x20 [ 38.785927][ T707] ? proc_fail_nth_write+0x184/0x220 [ 38.785952][ T707] tun_chr_write_iter+0x1fa/0x310 [ 38.785977][ T707] vfs_write+0x75f/0xfd0 [ 38.785996][ T707] ? __cfi_vfs_write+0x10/0x10 [ 38.786016][ T707] ksys_write+0x145/0x260 [ 38.786034][ T707] ? __cfi_ksys_write+0x10/0x10 [ 38.786053][ T707] ? __kasan_check_read+0x15/0x20 [ 38.786070][ T707] __x64_sys_write+0x7f/0x90 [ 38.786087][ T707] x64_sys_call+0x271c/0x2ee0 [ 38.786104][ T707] do_syscall_64+0x57/0xf0 [ 38.786123][ T707] ? clear_bhb_loop+0x50/0xa0 [ 38.786146][ T707] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 38.786168][ T707] RIP: 0033:0x7f7d8db9e0d9 [ 38.786184][ T707] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 38.786198][ T707] RSP: 002b:00007f7d8ea1f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 38.786243][ T707] RAX: ffffffffffffffda RBX: 00007f7d8de25fa0 RCX: 00007f7d8db9e0d9 [ 38.786257][ T707] RDX: 0000000000000028 RSI: 0000200000000500 RDI: 0000000000000003 [ 38.786269][ T707] RBP: 00007f7d8ea1f090 R08: 0000000000000000 R09: 0000000000000000 [ 38.786280][ T707] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 38.786290][ T707] R13: 00007f7d8de26038 R14: 00007f7d8de25fa0 R15: 00007ffdae97b068 [ 38.786305][ T707] [ 39.492769][ T344] usb 2-1: Found UVC 0.00 device (0002:0000) [ 39.504632][ T344] usb 2-1: No valid video chain found. [ 39.517865][ T344] usb 2-1: USB disconnect, device number 9 [ 39.548112][ T722] netlink: 32 bytes leftover after parsing attributes in process `syz.3.131'. [ 39.561479][ T36] audit: type=1400 audit(1786043502.413:232): avc: denied { ioctl } for pid=721 comm="syz.3.131" path="/dev/fuse" dev="devtmpfs" ino=23 ioctlcmd=0x942e scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 39.586217][ T722] fuse: Unknown parameter 'f' [ 39.597053][ T36] audit: type=1400 audit(1786043502.453:233): avc: denied { remount } for pid=721 comm="syz.3.131" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=filesystem permissive=1 [ 39.672339][ T36] audit: type=1400 audit(1786043502.513:234): avc: denied { write } for pid=719 comm="syz.0.130" lport=2 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 39.698566][ T36] audit: type=1400 audit(1786043502.523:235): avc: denied { write } for pid=728 comm="syz.3.133" name="hwrng" dev="devtmpfs" ino=12 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:random_device_t tclass=chr_file permissive=1 [ 39.754324][ T740] ======================================================= [ 39.754324][ T740] WARNING: The mand mount option has been deprecated and [ 39.754324][ T740] and is ignored by this kernel. Remove the mand [ 39.754324][ T740] option from the mount to silence this warning. [ 39.754324][ T740] ======================================================= [ 39.798813][ T744] fuse: Unknown parameter 'fd0x0000000000000003' [ 39.902600][ T36] audit: type=1400 audit(1786043502.753:236): avc: denied { sqpoll } for pid=751 comm="syz.1.142" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 40.266700][ T9] usb 1-1: new high-speed USB device number 17 using dummy_hcd [ 40.323889][ T782] kvm: kvm [781]: vcpu2, guest rIP: 0x9114 Unhandled WRMSR(0xc2) = 0x7 [ 40.332474][ T782] kvm: kvm [781]: vcpu2, guest rIP: 0x9114 Unhandled WRMSR(0xc1) = 0x7 [ 40.403780][ T791] SELinux: Context system_u:object_r:tzdata_exec_t:s0 is not valid (left unmapped). [ 40.426660][ T9] usb 1-1: Using ep0 maxpacket: 8 [ 40.437685][ T9] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 40.449483][ T9] usb 1-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 40.468081][ T9] usb 1-1: New USB device found, idVendor=07fd, idProduct=0004, bcdDevice= 0.40 [ 40.477658][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 40.485915][ T9] usb 1-1: Product: syz [ 40.495721][ T9] usb 1-1: Manufacturer: syz [ 40.502388][ T9] usb 1-1: SerialNumber: syz [ 40.521979][ T796] netlink: 44 bytes leftover after parsing attributes in process `syz.3.159'. [ 40.530968][ T796] netlink: 43 bytes leftover after parsing attributes in process `syz.3.159'. [ 40.540214][ T796] netlink: 'syz.3.159': attribute type 6 has an invalid length. [ 40.548124][ T796] netlink: 'syz.3.159': attribute type 5 has an invalid length. [ 40.555828][ T796] netlink: 43 bytes leftover after parsing attributes in process `syz.3.159'. [ 40.726820][ T9] usb 1-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 40.743847][ T9] usb 1-1: 2:1 : no or invalid class specific endpoint descriptor [ 40.763912][ T9] usb 1-1: 2:1 : invalid UAC_FORMAT_TYPE desc [ 40.793289][ T9] usb 1-1: USB disconnect, device number 17 [ 40.819182][ T320] udevd[320]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 41.356686][ T352] usb 3-1: new high-speed USB device number 9 using dummy_hcd [ 41.376691][ T9] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 41.466685][ T66] usb 1-1: new high-speed USB device number 18 using dummy_hcd [ 41.506688][ T352] usb 3-1: Using ep0 maxpacket: 8 [ 41.512922][ T352] usb 3-1: config index 0 descriptor too short (expected 1307, got 27) [ 41.521344][ T352] usb 3-1: config 0 has an invalid interface number: 0 but max is -1 [ 41.529472][ T9] usb 2-1: Using ep0 maxpacket: 16 [ 41.534627][ T352] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 0 [ 41.543624][ T352] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x84 has an invalid bInterval 0, changing to 7 [ 41.554976][ T352] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 41.570817][ T9] usb 2-1: New USB device found, idVendor=0d8c, idProduct=0102, bcdDevice= 0.40 [ 41.580039][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 41.588193][ T352] usb 3-1: New USB device found, idVendor=0460, idProduct=0008, bcdDevice=c3.de [ 41.597380][ T352] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 41.605394][ T352] usb 3-1: Product: syz [ 41.610044][ T9] usb 2-1: Product: syz [ 41.614244][ T9] usb 2-1: Manufacturer: syz [ 41.618932][ T9] usb 2-1: SerialNumber: syz [ 41.623865][ T352] usb 3-1: Manufacturer: syz [ 41.628535][ T66] usb 1-1: Using ep0 maxpacket: 8 [ 41.634052][ T352] usb 3-1: SerialNumber: syz [ 41.639269][ T66] usb 1-1: too many endpoints for config 0 interface 0 altsetting 4: 254, using maximum allowed: 30 [ 41.650448][ T66] usb 1-1: config 0 interface 0 altsetting 4 endpoint 0x81 has invalid maxpacket 1056, setting to 1024 [ 41.662017][ T352] usb 3-1: config 0 descriptor?? [ 41.667393][ T66] usb 1-1: config 0 interface 0 altsetting 4 has 1 endpoint descriptor, different from the interface descriptor's value: 254 [ 41.680558][ T66] usb 1-1: config 0 interface 0 has no altsetting 0 [ 41.681128][ T352] hub 3-1:0.0: bad descriptor, ignoring hub [ 41.694030][ T66] usb 1-1: New USB device found, idVendor=056a, idProduct=00bc, bcdDevice= 0.00 [ 41.703147][ T352] hub 3-1:0.0: probe with driver hub failed with error -5 [ 41.710363][ T66] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 41.719568][ T352] input: syz syz as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/input/input6 [ 41.729717][ T66] usb 1-1: config 0 descriptor?? [ 41.735007][ T834] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22 [ 41.897349][ T350] usb 3-1: USB disconnect, device number 9 [ 41.956693][ T344] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 42.086670][ T344] usb 4-1: device descriptor read/64, error -71 [ 42.147442][ T66] wacom 0003:056A:00BC.0004: unknown main item tag 0x2 [ 42.154541][ T66] wacom 0003:056A:00BC.0004: unknown main item tag 0x6 [ 42.161452][ T66] wacom 0003:056A:00BC.0004: unknown main item tag 0x0 [ 42.168393][ T66] wacom 0003:056A:00BC.0004: unknown main item tag 0x0 [ 42.175279][ T66] wacom 0003:056A:00BC.0004: unknown main item tag 0x0 [ 42.182169][ T66] wacom 0003:056A:00BC.0004: unknown main item tag 0x0 [ 42.189061][ T66] wacom 0003:056A:00BC.0004: unknown main item tag 0x0 [ 42.195932][ T66] wacom 0003:056A:00BC.0004: unknown main item tag 0x0 [ 42.202862][ T66] wacom 0003:056A:00BC.0004: unknown main item tag 0x0 [ 42.209781][ T66] wacom 0003:056A:00BC.0004: unknown main item tag 0x0 [ 42.216692][ T66] wacom 0003:056A:00BC.0004: unknown main item tag 0x0 [ 42.223574][ T66] wacom 0003:056A:00BC.0004: unknown main item tag 0x0 [ 42.230670][ T66] wacom 0003:056A:00BC.0004: Unknown device_type for 'HID 056a:00bc'. Assuming pen. [ 42.240820][ T66] wacom 0003:056A:00BC.0004: hidraw0: USB HID v0.01 Device [HID 056a:00bc] on usb-dummy_hcd.0-1/input0 [ 42.253255][ T66] input: Wacom Intuos4 WL Pen as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/0003:056A:00BC.0004/input/input7 [ 42.326671][ T344] usb 4-1: device descriptor read/64, error -71 [ 42.349071][ T36] kauditd_printk_skb: 16 callbacks suppressed [ 42.349122][ T36] audit: type=1400 audit(1786043761.201:253): avc: denied { bind } for pid=833 comm="syz.0.174" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 42.374817][ T66] usb 1-1: USB disconnect, device number 18 [ 42.421569][ T36] audit: type=1400 audit(1786043761.271:254): avc: denied { watch watch_reads } for pid=843 comm="syz.2.177" path="/57" dev="tmpfs" ino=317 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 42.553069][ T36] audit: type=1400 audit(1786043761.401:255): avc: denied { connect } for pid=849 comm="syz.2.180" lport=60 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 42.576697][ T344] usb 4-1: new high-speed USB device number 12 using dummy_hcd [ 42.706676][ T344] usb 4-1: device descriptor read/64, error -71 [ 42.786668][ T350] usb 3-1: new full-speed USB device number 10 using dummy_hcd [ 42.900739][ T36] audit: type=1400 audit(1786043761.751:256): avc: denied { setopt } for pid=851 comm="syz.0.181" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 42.937705][ T350] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 42.947960][ T344] usb 4-1: device descriptor read/64, error -71 [ 42.954247][ T350] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 42.964591][ T350] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 42.973699][ T350] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 42.982135][ T350] usb 3-1: Product: syz [ 42.986321][ T350] usb 3-1: Manufacturer: syz [ 42.991164][ T350] usb 3-1: SerialNumber: syz [ 43.066786][ T344] usb usb4-port1: attempt power cycle [ 43.089291][ T36] audit: type=1400 audit(1786043761.941:257): avc: denied { read write } for pid=860 comm="syz.0.185" name="ppp" dev="devtmpfs" ino=86 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 43.112512][ T36] audit: type=1400 audit(1786043761.941:258): avc: denied { open } for pid=860 comm="syz.0.185" path="/dev/ppp" dev="devtmpfs" ino=86 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 43.135375][ T36] audit: type=1400 audit(1786043761.941:259): avc: denied { ioctl } for pid=860 comm="syz.0.185" path="/dev/ppp" dev="devtmpfs" ino=86 ioctlcmd=0x743e scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 43.201305][ T850] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=55 sclass=netlink_route_socket pid=850 comm=syz.2.180 [ 43.214204][ T36] audit: type=1400 audit(1786043762.061:260): avc: denied { write } for pid=849 comm="syz.2.180" name="rtc0" dev="devtmpfs" ino=195 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 43.216720][ T350] usb 3-1: 0:2 : does not exist [ 43.241899][ T350] usb 3-1: unit 9 not found! [ 43.248390][ T350] usb 3-1: 4:0: cannot get min/max values for control 1 (id 4) [ 43.256835][ T9] snd-usb-audio 2-1:1.0: probe with driver snd-usb-audio failed with error -71 [ 43.258080][ T350] usb 3-1: 4:0: cannot get min/max values for control 2 (id 4) [ 43.269417][ T9] usb 2-1: USB disconnect, device number 10 [ 43.277416][ T350] usb 3-1: 4:0: cannot get min/max values for control 4 (id 4) [ 43.288559][ T350] usb 3-1: 4:0: cannot get min/max values for control 7 (id 4) [ 43.297890][ T350] usb 3-1: 4:0: cannot get min/max values for control 8 (id 4) [ 43.307224][ T350] usb 3-1: 4:0: cannot get min/max values for control 9 (id 4) [ 43.317222][ T350] usb 3-1: 4:0: cannot get min/max values for control 10 (id 4) [ 43.327741][ T350] usb 3-1: USB disconnect, device number 10 [ 43.426745][ T344] usb 4-1: new high-speed USB device number 13 using dummy_hcd [ 43.447764][ T344] usb 4-1: device descriptor read/8, error -71 [ 43.546721][ T66] usb 1-1: new high-speed USB device number 19 using dummy_hcd [ 43.577749][ T344] usb 4-1: device descriptor read/8, error -71 [ 43.697778][ T66] usb 1-1: config index 0 descriptor too short (expected 45, got 28) [ 43.705907][ T66] usb 1-1: config 1 descriptor has 1 excess byte, ignoring [ 43.713333][ T66] usb 1-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 43.727772][ T66] usb 1-1: New USB device found, idVendor=0bda, idProduct=8150, bcdDevice= 0.00 [ 43.742856][ T66] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 43.756735][ T66] usb 1-1: Product: syz [ 43.760943][ T66] usb 1-1: Manufacturer: syz [ 43.765687][ T66] usb 1-1: SerialNumber: syz [ 43.782587][ T66] rtl8150 1-1:1.0: couldn't find required endpoints [ 43.789983][ T66] rtl8150 1-1:1.0: probe with driver rtl8150 failed with error -5 [ 43.816690][ T344] usb 4-1: new high-speed USB device number 14 using dummy_hcd [ 43.847703][ T344] usb 4-1: device descriptor read/8, error -71 [ 43.977915][ T344] usb 4-1: device descriptor read/8, error -71 [ 43.984913][ T36] audit: type=1400 audit(1786043762.831:261): avc: denied { block_suspend } for pid=860 comm="syz.0.185" capability=36 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 44.007253][ T310] usb 1-1: USB disconnect, device number 19 [ 44.066671][ T350] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 44.096676][ T31] usb 3-1: new full-speed USB device number 11 using dummy_hcd [ 44.104402][ T344] usb usb4-port1: unable to enumerate USB device [ 44.216676][ T350] usb 2-1: Using ep0 maxpacket: 32 [ 44.222921][ T350] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 44.233833][ T350] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 44.243621][ T350] usb 2-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 44.252764][ T350] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 44.261737][ T350] usb 2-1: config 0 descriptor?? [ 44.267725][ T350] hub 2-1:0.0: USB hub found [ 44.277730][ T31] usb 3-1: config 0 has an invalid interface number: 251 but max is 0 [ 44.285928][ T31] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 44.296068][ T31] usb 3-1: config 0 has no interface number 0 [ 44.303607][ T31] usb 3-1: New USB device found, idVendor=0b95, idProduct=172a, bcdDevice=f7.f4 [ 44.312688][ T31] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 44.320706][ T31] usb 3-1: Product: syz [ 44.324882][ T31] usb 3-1: Manufacturer: syz [ 44.329495][ T31] usb 3-1: SerialNumber: syz [ 44.334809][ T31] usb 3-1: config 0 descriptor?? [ 44.340664][ T31] asix 3-1:0.251: probe with driver asix failed with error -22 [ 44.468359][ T350] hub 2-1:0.0: 1 port detected [ 44.585540][ T570] Bluetooth: hci0: Frame reassembly failed (-84) [ 44.629609][ T66] usb 3-1: USB disconnect, device number 11 [ 44.669317][ T871] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 44.670868][ T36] audit: type=1400 audit(1786043763.521:262): avc: denied { create } for pid=884 comm="syz.3.195" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 44.679389][ T871] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 44.721559][ T887] sit0: entered promiscuous mode [ 44.728796][ T887] netlink: 'syz.3.196': attribute type 1 has an invalid length. [ 44.736458][ T887] netlink: 1 bytes leftover after parsing attributes in process `syz.3.196'. trylock mem[ 45.026722][ T352] usb 4-1: new high-speed USB device number 15 using dummy_hcd [ 45.156692][ T352] usb 4-1: device descriptor read/64, error -71 [ 45.163853][ T900] FAULT_INJECTION: forcing a failure. [ 45.163853][ T900] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 45.176996][ T900] CPU: 0 UID: 0 PID: 900 Comm: syz.2.200 Not tainted syzkaller #0 67f5df147bfe8fe71cdb2f404f013e40b3f12e05 [ 45.177026][ T900] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 45.177037][ T900] Call Trace: [ 45.177044][ T900] [ 45.177052][ T900] __dump_stack+0x21/0x30 [ 45.177082][ T900] dump_stack_lvl+0x140/0x1c0 [ 45.177106][ T900] ? __cfi_dump_stack_lvl+0x10/0x10 [ 45.177131][ T900] dump_stack+0x19/0x20 [ 45.177155][ T900] should_fail_ex+0x3c2/0x510 [ 45.177181][ T900] should_fail+0xf/0x20 [ 45.177199][ T900] should_fail_usercopy+0x1e/0x30 [ 45.177215][ T900] _copy_from_iter+0x1a6/0x1520 [ 45.177230][ T900] ? __kasan_check_write+0x18/0x20 [ 45.177242][ T900] ? ldsem_down_read+0x18a/0x740 [ 45.177255][ T900] ? __virt_addr_valid+0x2a1/0x370 [ 45.177274][ T900] ? __cfi__copy_from_iter+0x10/0x10 [ 45.177297][ T900] ? __check_object_size+0x54c/0x870 [ 45.177317][ T900] ? __cfi___check_object_size+0x10/0x10 [ 45.177337][ T900] file_tty_write+0x4b2/0xa50 [ 45.177355][ T900] tty_write+0x40/0x50 [ 45.177366][ T900] vfs_write+0x75f/0xfd0 [ 45.177377][ T900] ? __cfi_vfs_write+0x10/0x10 [ 45.177390][ T900] ksys_write+0x145/0x260 [ 45.177401][ T900] ? __cfi_ksys_write+0x10/0x10 [ 45.177415][ T900] ? __kasan_check_read+0x15/0x20 [ 45.177433][ T900] __x64_sys_write+0x7f/0x90 [ 45.177452][ T900] x64_sys_call+0x271c/0x2ee0 [ 45.177469][ T900] do_syscall_64+0x57/0xf0 [ 45.177490][ T900] ? clear_bhb_loop+0x50/0xa0 [ 45.177510][ T900] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 45.177524][ T900] RIP: 0033:0x7f645f79e0d9 [ 45.177535][ T900] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 45.177545][ T900] RSP: 002b:00007f646068f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 45.177560][ T900] RAX: ffffffffffffffda RBX: 00007f645fa25fa0 RCX: 00007f645f79e0d9 [ 45.177575][ T900] RDX: 000000000000000c RSI: 0000200000000080 RDI: 0000000000000003 [ 45.177587][ T900] RBP: 00007f646068f090 R08: 0000000000000000 R09: 0000000000000000 [ 45.177608][ T900] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 45.177620][ T900] R13: 00007f645fa26038 R14: 00007f645fa25fa0 R15: 00007ffc425648c8 [ 45.177637][ T900] [ 45.546670][ T352] usb 4-1: device descriptor read/64, error -71 [ 45.668985][ T908] netlink: 'syz.2.204': attribute type 4 has an invalid length. [ 45.676793][ T908] netlink: 8 bytes leftover after parsing attributes in process `syz.2.204'. [ 45.786673][ T352] usb 4-1: new high-speed USB device number 16 using dummy_hcd [ 45.827187][ T350] hub 2-1:0.0: hub_hub_status failed (err = -32) [ 45.833571][ T350] hub 2-1:0.0: config failed, can't get hub status (err -32) [ 45.842214][ T350] usbhid 2-1:0.0: can't add hid device: -32 [ 45.848180][ T350] usbhid 2-1:0.0: probe with driver usbhid failed with error -32 [ 45.916680][ T352] usb 4-1: device descriptor read/64, error -71 [ 45.926691][ T9] usb 3-1: new high-speed USB device number 12 using dummy_hcd [ 46.076673][ T9] usb 3-1: Using ep0 maxpacket: 16 [ 46.082949][ T9] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 46.093098][ T9] usb 3-1: config 0 has no interfaces? [ 46.099382][ T9] usb 3-1: New USB device found, idVendor=05d1, idProduct=2001, bcdDevice= 2.00 [ 46.108451][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=8 [ 46.116442][ T9] usb 3-1: SerialNumber: syz [ 46.121937][ T9] usb 3-1: config 0 descriptor?? [ 46.156680][ T352] usb 4-1: device descriptor read/64, error -71 [ 46.266771][ T352] usb usb4-port1: attempt power cycle [ 46.333494][ T908] device-mapper: ioctl: Invalid ioctl structure: name t@, dev fc00 [ 46.379455][ T350] usb 3-1: USB disconnect, device number 12 [ 46.616715][ T352] usb 4-1: new high-speed USB device number 17 using dummy_hcd [ 46.626695][ T53] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 46.639024][ T352] usb 4-1: device descriptor read/8, error -71 [ 46.777658][ T352] usb 4-1: device descriptor read/8, error -71 [ 46.954447][ T938] syzkaller1: entered promiscuous mode [ 46.959996][ T938] syzkaller1: entered allmulticast mode [ 47.016699][ T352] usb 4-1: new high-speed USB device number 18 using dummy_hcd [ 47.033633][ T940] netlink: 328 bytes leftover after parsing attributes in process `syz.2.214'. [ 47.043881][ T352] usb 4-1: device descriptor read/8, error -71 [ 47.056972][ T310] usb 1-1: new high-speed USB device number 20 using dummy_hcd [ 47.094333][ T940] af_packet: tpacket_rcv: packet too big, clamped from 40 to 4294967272. macoff=96 [ 47.136859][ T9] usb 2-1: reset high-speed USB device number 11 using dummy_hcd [ 47.184219][ T352] usb 4-1: device descriptor read/8, error -71 [ 47.216673][ T310] usb 1-1: Using ep0 maxpacket: 32 [ 47.222849][ T310] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 47.233377][ T310] usb 1-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 47.242441][ T310] usb 1-1: too many endpoints for config 1 interface 1 altsetting 239: 255, using maximum allowed: 30 [ 47.253429][ T310] usb 1-1: config 1 interface 1 altsetting 239 has 0 endpoint descriptors, different from the interface descriptor's value: 255 [ 47.266672][ T310] usb 1-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 47.278444][ T310] usb 1-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0 [ 47.288102][ T310] usb 1-1: config 1 interface 1 has no altsetting 0 [ 47.295992][ T310] usb 1-1: New USB device found, idVendor=0582, idProduct=0025, bcdDevice=9c.40 [ 47.306148][ T310] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 47.306864][ T352] usb usb4-port1: unable to enumerate USB device [ 47.314184][ T310] usb 1-1: Product: syz [ 47.321674][ T9] usb 2-1: device firmware changed [ 47.324688][ T310] usb 1-1: Manufacturer: syz [ 47.324707][ T310] usb 1-1: SerialNumber: syz [ 47.330190][ T9] usb 2-1: USB disconnect, device number 11 [ 47.547809][ T310] usb 1-1: selecting invalid altsetting 0 [ 47.553802][ T310] usb 1-1: 1:1: cannot get freq (v2/v3): err -71 [ 47.560475][ T310] usb 1-1: 1:1: cannot set freq 44100 (v2/v3): err -71 [ 47.570628][ T310] usb 1-1: USB disconnect, device number 20 [ 47.636680][ T9] usb 2-1: new high-speed USB device number 12 using dummy_hcd [ 47.786670][ T9] usb 2-1: Using ep0 maxpacket: 32 [ 47.792889][ T9] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 47.805487][ T9] usb 2-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 47.815031][ T9] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 47.824057][ T9] usb 2-1: config 0 descriptor?? [ 47.829996][ T9] hub 2-1:0.0: USB hub found [ 48.034545][ T9] hub 2-1:0.0: 1 port detected [ 48.067231][ T36] kauditd_printk_skb: 16 callbacks suppressed [ 48.067248][ T36] audit: type=1400 audit(1786043766.921:279): avc: denied { write } for pid=955 comm="syz.0.221" name="rnullb0" dev="devtmpfs" ino=31 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 48.114222][ T36] audit: type=1400 audit(1786043766.951:280): avc: denied { ioctl } for pid=955 comm="syz.0.221" path="/dev/rnullb0" dev="devtmpfs" ino=31 ioctlcmd=0x1261 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 48.186698][ T310] usb 4-1: new high-speed USB device number 19 using dummy_hcd [ 48.316678][ T310] usb 4-1: device descriptor read/64, error -71 [ 48.446766][ T9] usb 2-1: USB disconnect, device number 12 [ 48.566664][ T310] usb 4-1: device descriptor read/64, error -71 [ 48.816678][ T310] usb 4-1: new high-speed USB device number 20 using dummy_hcd [ 48.956710][ T310] usb 4-1: device descriptor read/64, error -71 [ 49.068943][ T968] syz.1.223 uses obsolete (PF_INET,SOCK_PACKET) [ 49.143894][ T971] fuse: Bad value for 'fd' [ 49.216671][ T310] usb 4-1: device descriptor read/64, error -71 [ 49.290724][ T970] netlink: 'syz.2.225': attribute type 10 has an invalid length. [ 49.327377][ T310] usb usb4-port1: attempt power cycle [ 49.377984][ T973] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 49.378007][ T973] rust_binder: Read failure Err(EFAULT) in pid:111 [ 49.387571][ T973] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 49.394099][ T973] rust_binder: Read failure Err(EFAULT) in pid:111 [ 49.462684][ T36] audit: type=1400 audit(1786043768.311:281): avc: denied { ioctl } for pid=976 comm="syz.1.226" path="socket:[10102]" dev="sockfs" ino=10102 ioctlcmd=0x8914 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 49.524590][ T979] capability: warning: `syz.1.226' uses deprecated v2 capabilities in a way that may be insecure [ 49.538733][ T36] audit: type=1400 audit(1786043768.391:282): avc: denied { read } for pid=976 comm="syz.1.226" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 49.559977][ T36] audit: type=1400 audit(1786043768.421:283): avc: denied { sqpoll } for pid=978 comm="syz.0.229" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 49.606442][ T36] audit: type=1400 audit(1786043768.451:284): avc: denied { create } for pid=978 comm="syz.0.229" name="file5" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 49.642170][ T36] audit: type=1400 audit(1786043768.451:285): avc: denied { rename } for pid=978 comm="syz.0.229" name="file5" dev="tmpfs" ino=268 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 49.665143][ T36] audit: type=1400 audit(1786043768.481:286): avc: denied { unlink } for pid=295 comm="syz-executor" name="file7" dev="tmpfs" ino=268 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 49.688112][ T36] audit: type=1400 audit(1786043768.481:287): avc: denied { unmount } for pid=295 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 49.708773][ T36] audit: type=1400 audit(1786043768.491:288): avc: denied { read write } for pid=982 comm="syz.1.230" name="vhost-vsock" dev="devtmpfs" ino=200 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 49.716704][ T310] usb 4-1: new high-speed USB device number 21 using dummy_hcd [ 49.759208][ T310] usb 4-1: device descriptor read/8, error -71 [ 49.896705][ T344] usb 2-1: new high-speed USB device number 13 using dummy_hcd [ 49.905409][ T310] usb 4-1: device descriptor read/8, error -71 [ 50.047824][ T344] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 50.058808][ T344] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 50.069116][ T344] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 50.082011][ T344] usb 2-1: New USB device found, idVendor=05ac, idProduct=0251, bcdDevice= 0.00 [ 50.091193][ T344] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 50.099387][ T350] usb 3-1: new full-speed USB device number 13 using dummy_hcd [ 50.110247][ T344] usb 2-1: config 0 descriptor?? [ 50.156704][ T310] usb 4-1: new high-speed USB device number 22 using dummy_hcd [ 50.177791][ T310] usb 4-1: device descriptor read/8, error -71 [ 50.257666][ T350] usb 3-1: config 1 has an invalid descriptor of length 183, skipping remainder of the config [ 50.268088][ T350] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 50.277668][ T350] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.00 [ 50.286767][ T350] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 50.294760][ T350] usb 3-1: SerialNumber: syz [ 50.302406][ T350] usb 3-1: 0:2 : does not exist [ 50.307346][ T350] usb 3-1: unit 174 not found! [ 50.313034][ T310] usb 4-1: device descriptor read/8, error -71 [ 50.426775][ T310] usb usb4-port1: unable to enumerate USB device [ 50.505613][ T995] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 50.515161][ T995] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 50.527353][ T310] usb 3-1: USB disconnect, device number 13 [ 50.559292][ T344] usbhid 2-1:0.0: can't add hid device: -71 [ 50.565607][ T344] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 50.578005][ T344] usb 2-1: USB disconnect, device number 13 [ 50.770572][ T1019] netlink: 60 bytes leftover after parsing attributes in process `syz.0.246'. [ 51.016698][ T344] usb 1-1: new high-speed USB device number 21 using dummy_hcd [ 51.171587][ T344] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 51.182564][ T344] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 51.192394][ T344] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 51.205451][ T344] usb 1-1: New USB device found, idVendor=05ac, idProduct=0251, bcdDevice= 0.00 [ 51.214546][ T344] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 51.225376][ T344] usb 1-1: config 0 descriptor?? [ 51.226672][ T352] usb 4-1: new full-speed USB device number 23 using dummy_hcd [ 51.388348][ T352] usb 4-1: config index 0 descriptor too short (expected 164, got 36) [ 51.396665][ T352] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 51.407696][ T352] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 51.417969][ T352] usb 4-1: New USB device found, idVendor=046d, idProduct=c29c, bcdDevice= 0.00 [ 51.428673][ T352] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 51.440539][ T352] usb 4-1: config 0 descriptor?? [ 51.586688][ T350] usb 2-1: new high-speed USB device number 14 using dummy_hcd [ 51.719307][ T344] usbhid 1-1:0.0: can't add hid device: -71 [ 51.725292][ T344] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 51.734093][ T344] usb 1-1: USB disconnect, device number 21 [ 51.742819][ T350] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 51.754033][ T350] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 51.763846][ T350] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 51.776834][ T350] usb 2-1: New USB device found, idVendor=05ac, idProduct=0251, bcdDevice= 0.00 [ 51.785895][ T350] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 51.797012][ T350] usb 2-1: config 0 descriptor?? [ 51.862456][ T352] logitech 0003:046D:C29C.0005: hidraw0: USB HID v0.00 Device [HID 046d:c29c] on usb-dummy_hcd.3-1/input0 [ 52.060833][ T352] logitech 0003:046D:C29C.0005: no inputs found [ 52.069363][ T352] usb 4-1: USB disconnect, device number 23 [ 52.204009][ T1053] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 52.212637][ T1053] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 52.222363][ T350] apple 0003:05AC:0251.0006: report_id 4901 is invalid [ 52.229325][ T350] apple 0003:05AC:0251.0006: item 0 2 1 8 parsing failed [ 52.237056][ T350] apple 0003:05AC:0251.0006: parse failed [ 52.242964][ T350] apple 0003:05AC:0251.0006: probe with driver apple failed with error -22 [ 52.424061][ T350] usb 2-1: USB disconnect, device number 14 [ 52.476680][ T352] usb 1-1: new high-speed USB device number 22 using dummy_hcd [ 52.606711][ T352] usb 1-1: device descriptor read/64, error -71 [ 52.677192][ T1078] 9pnet_fd: Insufficient options for proto=fd [ 52.866688][ T352] usb 1-1: device descriptor read/64, error -71 [ 52.939970][ T1086] 9p: Unknown uid 00000000004294967295 [ 53.106754][ T352] usb 1-1: new high-speed USB device number 23 using dummy_hcd [ 53.130913][ T36] kauditd_printk_skb: 13 callbacks suppressed [ 53.130932][ T36] audit: type=1400 audit(1786043771.981:302): avc: denied { watch watch_reads } for pid=1096 comm="syz.3.269" path="/58/file0" dev="tmpfs" ino=337 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 53.246672][ T352] usb 1-1: device descriptor read/64, error -71 [ 53.336717][ T66] usb 2-1: new high-speed USB device number 15 using dummy_hcd [ 53.366677][ T9] usb 4-1: new high-speed USB device number 24 using dummy_hcd [ 53.487718][ T66] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 53.497885][ T9] usb 4-1: device descriptor read/64, error -71 [ 53.504136][ T66] usb 2-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 53.513129][ T352] usb 1-1: device descriptor read/64, error -71 [ 53.520958][ T66] usb 2-1: New USB device found, idVendor=174c, idProduct=55aa, bcdDevice= 1.00 [ 53.530050][ T66] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 53.538061][ T66] usb 2-1: Product: syz [ 53.542211][ T66] usb 2-1: Manufacturer: syz [ 53.546825][ T66] usb 2-1: SerialNumber: syz [ 53.626810][ T352] usb usb1-port1: attempt power cycle [ 53.736701][ T9] usb 4-1: device descriptor read/64, error -71 [ 53.755605][ T344] usb 2-1: USB disconnect, device number 15 [ 53.856675][ T66] usb 3-1: new high-speed USB device number 14 using dummy_hcd [ 53.966673][ T352] usb 1-1: new high-speed USB device number 24 using dummy_hcd [ 53.976761][ T9] usb 4-1: new high-speed USB device number 25 using dummy_hcd [ 53.997629][ T352] usb 1-1: device descriptor read/8, error -71 [ 54.016661][ T66] usb 3-1: Using ep0 maxpacket: 8 [ 54.024576][ T66] usb 3-1: unable to get BOS descriptor or descriptor too short [ 54.032696][ T66] usb 3-1: no configurations [ 54.037341][ T66] usb 3-1: can't read configurations, error -22 [ 54.106683][ T9] usb 4-1: device descriptor read/64, error -71 [ 54.127673][ T352] usb 1-1: device descriptor read/8, error -71 [ 54.346695][ T9] usb 4-1: device descriptor read/64, error -71 [ 54.366937][ T352] usb 1-1: new high-speed USB device number 25 using dummy_hcd [ 54.369077][ T1105] fuse: Unknown parameter 'rootb*V^00100000' [ 54.394909][ T352] usb 1-1: device descriptor read/8, error -71 [ 54.456814][ T9] usb usb4-port1: attempt power cycle [ 54.527862][ T352] usb 1-1: device descriptor read/8, error -71 [ 54.646767][ T352] usb usb1-port1: unable to enumerate USB device [ 54.657257][ T36] audit: type=1400 audit(1786043773.511:303): avc: denied { remount } for pid=1124 comm="syz.2.279" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 54.796673][ T9] usb 4-1: new high-speed USB device number 26 using dummy_hcd [ 54.816674][ T344] usb 2-1: new high-speed USB device number 16 using dummy_hcd [ 54.837641][ T9] usb 4-1: device descriptor read/8, error -71 [ 54.967752][ T9] usb 4-1: device descriptor read/8, error -71 [ 54.986681][ T344] usb 2-1: Using ep0 maxpacket: 8 [ 54.992855][ T344] usb 2-1: config 0 interface 0 has no altsetting 0 [ 54.999642][ T344] usb 2-1: New USB device found, idVendor=046d, idProduct=c534, bcdDevice= 0.00 [ 55.008723][ T344] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 55.017341][ T344] usb 2-1: config 0 descriptor?? [ 55.086685][ T66] usb 3-1: new high-speed USB device number 15 using dummy_hcd [ 55.209473][ T9] usb 4-1: new high-speed USB device number 27 using dummy_hcd [ 55.237868][ T66] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 55.248871][ T9] usb 4-1: device descriptor read/8, error -71 [ 55.261455][ T66] usb 3-1: New USB device found, idVendor=18ec, idProduct=3288, bcdDevice=69.cf [ 55.270812][ T66] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 55.279539][ T66] usb 3-1: Product: syz [ 55.283850][ T66] usb 3-1: Manufacturer: syz [ 55.288497][ T66] usb 3-1: SerialNumber: syz [ 55.296812][ T66] usb 3-1: config 0 descriptor?? [ 55.306095][ T66] usb 3-1: Found UVC 0.00 device syz (18ec:3288) [ 55.312747][ T66] usb 3-1: No valid video chain found. [ 55.315477][ T36] audit: type=1400 audit(1786043774.171:304): avc: denied { associate } for pid=1131 comm="syz.0.282" name="blkio.bfq.time" scontext=root:object_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 55.347817][ T36] audit: type=1400 audit(1786043774.201:305): avc: denied { mounton } for pid=1131 comm="syz.0.282" path="/63/bus/bus" dev="overlay" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=dir permissive=1 [ 55.388617][ T9] usb 4-1: device descriptor read/8, error -71 [ 55.411062][ T36] audit: type=1400 audit(1786043774.261:306): avc: denied { connect } for pid=1135 comm="syz.0.284" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 55.433004][ T344] logitech-djreceiver 0003:046D:C534.0007: unknown main item tag 0x4 [ 55.441232][ T344] logitech-djreceiver 0003:046D:C534.0007: item 0 1 0 8 parsing failed [ 55.449662][ T344] logitech-djreceiver 0003:046D:C534.0007: logi_dj_probe: parse failed [ 55.457969][ T344] logitech-djreceiver 0003:046D:C534.0007: probe with driver logitech-djreceiver failed with error -22 [ 55.496756][ T9] usb usb4-port1: unable to enumerate USB device [ 55.504112][ T9] usb 3-1: USB disconnect, device number 15 [ 55.634206][ T344] usb 2-1: USB disconnect, device number 16 [ 56.081174][ T1145] netlink: 'syz.2.287': attribute type 58 has an invalid length. [ 56.149350][ T36] audit: type=1400 audit(1786043775.001:307): avc: denied { create } for pid=1148 comm="syz.1.289" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_nflog_socket permissive=1 [ 56.179771][ T36] audit: type=1400 audit(1786043775.031:308): avc: denied { write } for pid=1148 comm="syz.1.289" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_nflog_socket permissive=1 [ 56.371166][ T36] audit: type=1326 audit(1786043775.221:309): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1167 comm="syz.1.295" exe="/root/ci2-android-6-12-rust/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f45cd79e0d9 code=0xffff0000 [ 56.436329][ T1171] FAULT_INJECTION: forcing a failure. [ 56.436329][ T1171] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 56.449646][ T1171] CPU: 1 UID: 0 PID: 1171 Comm: syz.0.296 Not tainted syzkaller #0 67f5df147bfe8fe71cdb2f404f013e40b3f12e05 [ 56.449680][ T1171] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 56.449692][ T1171] Call Trace: [ 56.449699][ T1171] [ 56.449707][ T1171] __dump_stack+0x21/0x30 [ 56.449740][ T1171] dump_stack_lvl+0x140/0x1c0 [ 56.449767][ T1171] ? __cfi_dump_stack_lvl+0x10/0x10 [ 56.449794][ T1171] ? __kasan_check_read+0x15/0x20 [ 56.449815][ T1171] ? vmx_read_guest_seg_ar+0x179/0x350 [ 56.449841][ T1171] dump_stack+0x19/0x20 [ 56.449866][ T1171] should_fail_ex+0x3c2/0x510 [ 56.449890][ T1171] should_fail+0xf/0x20 [ 56.449910][ T1171] should_fail_usercopy+0x1e/0x30 [ 56.449933][ T1171] __kvm_read_guest_page+0x177/0x210 [ 56.449971][ T1171] kvm_vcpu_read_guest_page+0x31c/0x400 [ 56.449995][ T1171] kvm_fetch_guest_virt+0x146/0x190 [ 56.450024][ T1171] ? __cfi_kvm_fetch_guest_virt+0x10/0x10 [ 56.450053][ T1171] __do_insn_fetch_bytes+0x57a/0x740 [ 56.450076][ T1171] ? x86_decode_insn+0x50b0/0x50b0 [ 56.450098][ T1171] x86_decode_insn+0x326/0x50b0 [ 56.450118][ T1171] ? make_mmio_spte+0x100/0x1d0 [ 56.450144][ T1171] ? __cfi_x86_decode_insn+0x10/0x10 [ 56.450164][ T1171] ? __kasan_check_write+0x18/0x20 [ 56.450184][ T1171] ? vmx_read_guest_seg_ar+0x1c8/0x350 [ 56.450209][ T1171] ? __asan_memset+0x39/0x50 [ 56.450228][ T1171] ? init_decode_cache+0x7c/0x90 [ 56.450249][ T1171] ? init_emulate_ctxt+0x403/0x540 [ 56.450273][ T1171] ? kvm_inject_realmode_interrupt+0x2d0/0x2d0 [ 56.450296][ T1171] ? __kasan_check_write+0x18/0x20 [ 56.450315][ T1171] ? kvm_release_pfn_clean+0x31/0x60 [ 56.450337][ T1171] x86_decode_emulated_instruction+0x66/0x180 [ 56.450361][ T1171] x86_emulate_instruction+0x2d7/0x19f0 [ 56.450384][ T1171] ? is_bpf_text_address+0x17b/0x1a0 [ 56.450415][ T1171] ? __kasan_check_read+0x15/0x20 [ 56.450433][ T1171] ? kvm_multiple_exception+0x4fa/0x880 [ 56.450458][ T1171] kvm_mmu_page_fault+0x341/0x9a0 [ 56.450483][ T1171] handle_ept_violation+0x256/0x450 [ 56.450505][ T1171] ? vmx_vcpu_run+0x1116/0x1f70 [ 56.450533][ T1171] ? __cfi_handle_ept_violation+0x10/0x10 [ 56.450556][ T1171] vmx_handle_exit+0x1379/0x1c00 [ 56.450585][ T1171] ? __cfi_vmx_vcpu_run+0x10/0x10 [ 56.450616][ T1171] ? inode_init_always_gfp+0x756/0x9e0 [ 56.450643][ T1171] vcpu_run+0x4c14/0x7830 [ 56.450680][ T1171] ? signal_pending+0xc0/0xc0 [ 56.450707][ T1171] ? complete_fast_pio_in+0x219/0x2f0 [ 56.450734][ T1171] ? fpregs_mark_activate+0x68/0x160 [ 56.450758][ T1171] ? __cfi_complete_fast_pio_in+0x10/0x10 [ 56.450785][ T1171] ? fpu_swap_kvm_fpstate+0x92/0x5e0 [ 56.450810][ T1171] kvm_arch_vcpu_ioctl_run+0x114c/0x1bc0 [ 56.450836][ T1171] ? _parse_integer_limit+0x195/0x1e0 [ 56.450858][ T1171] ? __cfi_kvm_arch_vcpu_ioctl_run+0x10/0x10 [ 56.450885][ T1171] ? kstrtoull+0x13b/0x1e0 [ 56.450905][ T1171] ? kstrtouint+0x78/0xf0 [ 56.450925][ T1171] ? ioctl_has_perm+0x1bc/0x500 [ 56.450946][ T1171] ? __asan_memcpy+0x5a/0x80 [ 56.450974][ T1171] ? ioctl_has_perm+0x408/0x500 [ 56.450993][ T1171] ? has_cap_mac_admin+0xd0/0xd0 [ 56.451012][ T1171] ? __kasan_check_write+0x18/0x20 [ 56.451031][ T1171] ? mutex_lock_killable+0x97/0x1d0 [ 56.451057][ T1171] ? __cfi_mutex_lock_killable+0x10/0x10 [ 56.451084][ T1171] ? proc_fail_nth_write+0x184/0x220 [ 56.451114][ T1171] kvm_vcpu_ioctl+0xa43/0x1000 [ 56.451134][ T1171] ? __cfi_kvm_vcpu_ioctl+0x10/0x10 [ 56.451154][ T1171] ? __cfi_vfs_write+0x10/0x10 [ 56.451175][ T1171] ? __secure_computing+0x2b0/0x2b0 [ 56.451200][ T1171] ? __kasan_check_write+0x18/0x20 [ 56.451219][ T1171] ? mutex_unlock+0x90/0x240 [ 56.451245][ T1171] ? __cfi_mutex_unlock+0x10/0x10 [ 56.451274][ T1171] ? bpf_lsm_file_ioctl+0xd/0x20 [ 56.451299][ T1171] ? security_file_ioctl+0x3e/0x110 [ 56.451328][ T1171] ? __cfi_kvm_vcpu_ioctl+0x10/0x10 [ 56.451348][ T1171] __se_sys_ioctl+0x135/0x1b0 [ 56.451371][ T1171] __x64_sys_ioctl+0x7f/0xa0 [ 56.451395][ T1171] x64_sys_call+0x1878/0x2ee0 [ 56.451414][ T1171] do_syscall_64+0x57/0xf0 [ 56.451437][ T1171] ? clear_bhb_loop+0x50/0xa0 [ 56.451462][ T1171] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 56.451487][ T1171] RIP: 0033:0x7f7d8db9e0d9 [ 56.451505][ T1171] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 56.451523][ T1171] RSP: 002b:00007f7d8ea1f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 56.451547][ T1171] RAX: ffffffffffffffda RBX: 00007f7d8de25fa0 RCX: 00007f7d8db9e0d9 [ 56.451563][ T1171] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000002 [ 56.451577][ T1171] RBP: 00007f7d8ea1f090 R08: 0000000000000000 R09: 0000000000000000 [ 56.451590][ T1171] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 56.451603][ T1171] R13: 00007f7d8de26038 R14: 00007f7d8de25fa0 R15: 00007ffdae97b068 [ 56.451622][ T1171] [ 56.957505][ T1180] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 56.957522][ T1180] rust_binder: Read failure Err(EFAULT) in pid:198 [ 56.988381][ T36] audit: type=1400 audit(1786043775.841:310): avc: denied { create } for pid=1183 comm="syz.1.301" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 57.030497][ T36] audit: type=1400 audit(1786043775.841:311): avc: denied { ioctl } for pid=1183 comm="syz.1.301" path="socket:[12457]" dev="sockfs" ino=12457 ioctlcmd=0x9367 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 57.170741][ T1196] overlayfs: missing 'lowerdir' [ 57.416681][ T348] usb 3-1: new high-speed USB device number 16 using dummy_hcd [ 57.466662][ T344] usb 4-1: new high-speed USB device number 28 using dummy_hcd [ 57.566679][ T348] usb 3-1: Using ep0 maxpacket: 8 [ 57.572922][ T348] usb 3-1: config 0 interface 0 has no altsetting 0 [ 57.579605][ T348] usb 3-1: New USB device found, idVendor=046d, idProduct=c534, bcdDevice= 0.00 [ 57.588687][ T348] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 57.597646][ T348] usb 3-1: config 0 descriptor?? [ 57.617918][ T344] usb 4-1: unable to get BOS descriptor or descriptor too short [ 57.626377][ T344] usb 4-1: config 3 has an invalid interface number: 207 but max is 0 [ 57.634601][ T344] usb 4-1: config 3 has no interface number 0 [ 57.640721][ T344] usb 4-1: config 3 interface 207 has no altsetting 0 [ 57.648892][ T344] usb 4-1: New USB device found, idVendor=0586, idProduct=3418, bcdDevice=5f.f6 [ 57.657996][ T344] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 57.665985][ T344] usb 4-1: Product: syz [ 57.670188][ T344] usb 4-1: Manufacturer: syz [ 57.674804][ T344] usb 4-1: SerialNumber: syz [ 57.885268][ T1200] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 57.896189][ T1200] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 57.968251][ T344] cdc_ether 4-1:3.207: More than one union descriptor, skipping ... [ 57.984224][ T344] usb 4-1: bad CDC descriptors [ 57.998076][ T344] usb 4-1: USB disconnect, device number 28 [ 58.017888][ T348] logitech-djreceiver 0003:046D:C534.0008: unknown main item tag 0x0 [ 58.028711][ T348] logitech-djreceiver 0003:046D:C534.0008: unknown main item tag 0x1 [ 58.037124][ T348] logitech-djreceiver 0003:046D:C534.0008: ignoring exceeding usage max [ 58.048782][ T348] logitech-djreceiver 0003:046D:C534.0008: hidraw0: USB HID v0.81 Device [HID 046d:c534] on usb-dummy_hcd.2-1/input0 [ 58.233028][ T1230] IPv6: A: Disabled Multicast RS [ 58.247620][ T1230] netlink: 'syz.1.316': attribute type 4 has an invalid length. [ 58.267750][ T1230] netlink: 'syz.1.316': attribute type 4 has an invalid length. [ 58.287332][ T1230] netlink: 'syz.1.316': attribute type 4 has an invalid length. [ 58.546665][ T10] usb 2-1: new high-speed USB device number 17 using dummy_hcd [ 58.676682][ T10] usb 2-1: device descriptor read/64, error -71 [ 58.730499][ T1237] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 58.739579][ T1237] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 58.865540][ T1245] netlink: 'syz.3.321': attribute type 58 has an invalid length. [ 58.874295][ T36] kauditd_printk_skb: 8 callbacks suppressed [ 58.874308][ T36] audit: type=1400 audit(1786043777.721:320): avc: denied { mount } for pid=1244 comm="syz.3.321" name="/" dev="configfs" ino=1197 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=filesystem permissive=1 [ 58.905322][ T36] audit: type=1400 audit(1786043777.721:321): avc: denied { search } for pid=1244 comm="syz.3.321" name="/" dev="configfs" ino=1197 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 58.929899][ T10] usb 2-1: device descriptor read/64, error -71 [ 58.949482][ T36] audit: type=1400 audit(1786043777.721:322): avc: denied { write } for pid=1244 comm="syz.3.321" name="usb_gadget" dev="configfs" ino=1198 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 58.978620][ T36] audit: type=1400 audit(1786043777.721:323): avc: denied { add_name } for pid=1244 comm="syz.3.321" name="g1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 58.999092][ T36] audit: type=1400 audit(1786043777.721:324): avc: denied { create } for pid=1244 comm="syz.3.321" name="g1" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:configfs_t tclass=lnk_file permissive=1 [ 59.019627][ T36] audit: type=1400 audit(1786043777.761:325): avc: denied { unmount } for pid=299 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=filesystem permissive=1 [ 59.175736][ T1264] input: syz1 as /devices/virtual/input/input10 [ 59.196673][ T10] usb 2-1: new high-speed USB device number 18 using dummy_hcd [ 59.326661][ T10] usb 2-1: device descriptor read/64, error -71 [ 59.568195][ T36] audit: type=1400 audit(1786043778.421:326): avc: denied { setopt } for pid=1278 comm="syz.2.332" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 59.584740][ T1281] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 59.596580][ T10] usb 2-1: device descriptor read/64, error -71 [ 59.603081][ T1281] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 59.617461][ T36] audit: type=1400 audit(1786043778.471:327): avc: denied { map } for pid=1280 comm="syz.2.333" path="socket:[13594]" dev="sockfs" ino=13594 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 59.640379][ T36] audit: type=1400 audit(1786043778.471:328): avc: denied { read write } for pid=1280 comm="syz.2.333" path="socket:[13594]" dev="sockfs" ino=13594 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 59.716752][ T10] usb usb2-port1: attempt power cycle [ 59.863181][ T36] audit: type=1400 audit(1786043778.711:329): avc: denied { setcurrent } for pid=1287 comm="syz.3.336" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 60.056669][ T10] usb 2-1: new high-speed USB device number 19 using dummy_hcd [ 60.077734][ T10] usb 2-1: device descriptor read/8, error -71 [ 60.133864][ T9] usb 4-1: new high-speed USB device number 29 using dummy_hcd [ 60.161772][ T1307] syzkaller0: entered promiscuous mode [ 60.167325][ T1307] syzkaller0: entered allmulticast mode [ 60.211886][ T10] usb 2-1: device descriptor read/8, error -71 [ 60.214298][ T1311] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 60.227864][ T1311] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 60.287774][ T9] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 60.297508][ T9] usb 4-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 60.312012][ T9] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 60.321126][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 60.329996][ T9] usb 4-1: Product: syz [ 60.334183][ T9] usb 4-1: Manufacturer: syz [ 60.341162][ T9] usb 4-1: SerialNumber: syz [ 60.349654][ T9] hub 4-1:1.0: bad descriptor, ignoring hub [ 60.355588][ T9] hub 4-1:1.0: probe with driver hub failed with error -5 [ 60.380161][ T1315] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 60.380178][ T1315] rust_binder: Read failure Err(EFAULT) in pid:219 [ 60.456667][ T10] usb 2-1: new high-speed USB device number 20 using dummy_hcd [ 60.487711][ T10] usb 2-1: device descriptor read/8, error -71 [ 60.551052][ T1290] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 60.559607][ T1290] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 60.617730][ T10] usb 2-1: device descriptor read/8, error -71 [ 60.636668][ T9] usb 1-1: new high-speed USB device number 26 using dummy_hcd [ 60.676731][ T66] usb 4-1: USB disconnect, device number 29 [ 60.726726][ T10] usb usb2-port1: unable to enumerate USB device [ 60.747695][ T1321] netlink: 'syz.2.350': attribute type 12 has an invalid length. [ 60.766658][ T9] usb 1-1: device descriptor read/64, error -71 [ 61.006672][ T9] usb 1-1: device descriptor read/64, error -71 [ 61.102809][ T344] hid-generic 0000:0000:0000.0009: unknown main item tag 0x0 [ 61.110778][ T344] hid-generic 0000:0000:0000.0009: hidraw1: HID v0.00 Device [syz1] on syz0 [ 61.137735][ T1333] fido_id[1333]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 61.145121][ T1335] netlink: 8 bytes leftover after parsing attributes in process `syz.2.356'. [ 61.193774][ T1340] TCP: TCP_TX_DELAY enabled [ 61.256652][ T9] usb 1-1: new high-speed USB device number 27 using dummy_hcd [ 61.396661][ T9] usb 1-1: device descriptor read/64, error -71 [ 61.636705][ T9] usb 1-1: device descriptor read/64, error -71 [ 61.636716][ T348] usb 2-1: new full-speed USB device number 21 using dummy_hcd [ 61.728694][ T1351] can0: slcan on ptm0. [ 61.762164][ T9] usb usb1-port1: attempt power cycle [ 61.785356][ T1350] can0 (unregistered): slcan off ptm0. [ 61.788463][ T348] usb 2-1: unable to get BOS descriptor or descriptor too short [ 61.800987][ T348] usb 2-1: not running at top speed; connect to a high speed hub [ 61.809581][ T348] usb 2-1: config 0 has an invalid interface number: 175 but max is 0 [ 61.817943][ T348] usb 2-1: config 0 has no interface number 0 [ 61.824113][ T348] usb 2-1: config 0 interface 175 has no altsetting 0 [ 61.835992][ T348] usb 2-1: New USB device found, idVendor=07b4, idProduct=010a, bcdDevice= 0.02 [ 61.845340][ T348] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 61.853588][ T348] usb 2-1: Product: syz [ 61.858040][ T348] usb 2-1: Manufacturer: syz [ 61.871724][ T348] usb 2-1: SerialNumber: syz [ 61.879009][ T1366] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=1366 comm=syz.2.364 [ 61.892374][ T348] usb 2-1: config 0 descriptor?? [ 62.016201][ T1386] netlink: 132 bytes leftover after parsing attributes in process `syz.3.366'. [ 62.039340][ T1388] netlink: 36 bytes leftover after parsing attributes in process `syz.3.367'. [ 62.100213][ T348] usb-storage 2-1:0.175: USB Mass Storage device detected [ 62.116670][ T9] usb 1-1: new high-speed USB device number 28 using dummy_hcd [ 62.134009][ T348] usb 2-1: USB disconnect, device number 21 [ 62.137656][ T9] usb 1-1: device descriptor read/8, error -71 [ 62.267692][ T9] usb 1-1: device descriptor read/8, error -71 [ 62.506690][ T9] usb 1-1: new high-speed USB device number 29 using dummy_hcd [ 62.527704][ T9] usb 1-1: device descriptor read/8, error -71 [ 62.657693][ T9] usb 1-1: device descriptor read/8, error -71 [ 62.767060][ T1398] vlan1: entered promiscuous mode [ 62.772181][ T1398] vlan1: entered allmulticast mode [ 62.777623][ T9] usb usb1-port1: unable to enumerate USB device [ 62.784023][ T1398] veth0_vlan: entered allmulticast mode [ 62.806644][ T344] usb 4-1: new high-speed USB device number 30 using dummy_hcd [ 62.856784][ T66] usb 2-1: new high-speed USB device number 22 using dummy_hcd [ 62.914683][ T1400] syzkaller1: entered promiscuous mode [ 62.920269][ T1400] syzkaller1: entered allmulticast mode [ 62.956661][ T344] usb 4-1: Using ep0 maxpacket: 16 [ 62.962869][ T344] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 62.973031][ T344] usb 4-1: config 1 has 0 interfaces, different from the descriptor's value: 3 [ 62.983517][ T344] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 62.992470][ T1402] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 62.992684][ T344] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 63.002090][ T1402] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 63.009034][ T344] usb 4-1: Product: syz [ 63.017795][ T66] usb 2-1: New USB device found, idVendor=0419, idProduct=0001, bcdDevice= 0.00 [ 63.021100][ T344] usb 4-1: Manufacturer: syz [ 63.033064][ T66] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 63.034820][ T344] usb 4-1: SerialNumber: syz [ 63.046195][ T66] usb 2-1: config 0 descriptor?? [ 63.052913][ T1402] bridge0: port 2(bridge_slave_1) entered disabled state [ 63.067019][ T1402] netlink: 'syz.2.373': attribute type 1 has an invalid length. [ 63.074811][ T1402] netlink: 9 bytes leftover after parsing attributes in process `syz.2.373'. [ 63.087482][ T1402] netlink: 'syz.2.373': attribute type 1 has an invalid length. [ 63.289785][ T352] usb 4-1: USB disconnect, device number 30 [ 63.450868][ T1405] rust_binder: Failed to allocate buffer. len:1160, is_oneway:false [ 63.450911][ T1405] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 63.459004][ T1405] rust_binder: Read failure Err(EFAULT) in pid:225 [ 63.475184][ T10] rust_binder: 1404: undelivered TRANSACTION_ERROR: 29189 [ 63.489712][ T66] samsung 0003:0419:0001.000A: hidraw1: USB HID vf0.00 Device [HID 0419:0001] on usb-dummy_hcd.1-1/input0 [ 63.514366][ T1409] can0: slcan on ptm0. [ 63.525262][ T1409] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 63.570178][ T1408] can0 (unregistered): slcan off ptm0. [ 63.638885][ T1428] syzkaller1: entered promiscuous mode [ 63.644425][ T1428] syzkaller1: entered allmulticast mode [ 63.654071][ T1428] FAULT_INJECTION: forcing a failure. [ 63.654071][ T1428] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 63.667362][ T1428] CPU: 1 UID: 0 PID: 1428 Comm: syz.2.377 Not tainted syzkaller #0 67f5df147bfe8fe71cdb2f404f013e40b3f12e05 [ 63.667401][ T1428] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 63.667413][ T1428] Call Trace: [ 63.667419][ T1428] [ 63.667426][ T1428] __dump_stack+0x21/0x30 [ 63.667462][ T1428] dump_stack_lvl+0x140/0x1c0 [ 63.667486][ T1428] ? __cfi_dump_stack_lvl+0x10/0x10 [ 63.667511][ T1428] ? x64_sys_call+0x271c/0x2ee0 [ 63.667529][ T1428] ? entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 63.667555][ T1428] dump_stack+0x19/0x20 [ 63.667579][ T1428] should_fail_ex+0x3c2/0x510 [ 63.667601][ T1428] should_fail+0xf/0x20 [ 63.667619][ T1428] should_fail_usercopy+0x1e/0x30 [ 63.667640][ T1428] _copy_from_iter+0x1a6/0x1520 [ 63.667665][ T1428] ? __cfi__copy_from_iter+0x10/0x10 [ 63.667689][ T1428] ? __check_object_size+0x54c/0x870 [ 63.667709][ T1428] ? __cfi___check_object_size+0x10/0x10 [ 63.667729][ T1428] ? __kasan_check_write+0x18/0x20 [ 63.667749][ T1428] ? __build_skb_around+0x2a4/0x590 [ 63.667775][ T1428] skb_copy_datagram_from_iter+0xf4/0x6f0 [ 63.667794][ T1428] ? napi_alloc_skb+0x212/0x560 [ 63.667820][ T1428] tun_get_user+0xd99/0x3720 [ 63.667842][ T1428] ? ptr_ring_consume+0x430/0x430 [ 63.667859][ T1428] ? _parse_integer+0x2e/0x40 [ 63.667877][ T1428] ? kstrtoull+0x13b/0x1e0 [ 63.667896][ T1428] ? __kasan_check_write+0x18/0x20 [ 63.667915][ T1428] ? ref_tracker_alloc+0x32b/0x5b0 [ 63.667938][ T1428] ? __cfi_ref_tracker_alloc+0x10/0x10 [ 63.667960][ T1428] ? selinux_file_permission+0x318/0xb60 [ 63.667981][ T1428] ? __kasan_check_write+0x18/0x20 [ 63.667998][ T1428] ? proc_fail_nth_write+0x184/0x220 [ 63.668026][ T1428] tun_chr_write_iter+0x1fa/0x310 [ 63.668054][ T1428] vfs_write+0x75f/0xfd0 [ 63.668074][ T1428] ? __cfi_vfs_write+0x10/0x10 [ 63.668097][ T1428] ksys_write+0x145/0x260 [ 63.668118][ T1428] ? __cfi_ksys_write+0x10/0x10 [ 63.668138][ T1428] ? __kasan_check_read+0x15/0x20 [ 63.668158][ T1428] __x64_sys_write+0x7f/0x90 [ 63.668177][ T1428] x64_sys_call+0x271c/0x2ee0 [ 63.668195][ T1428] do_syscall_64+0x57/0xf0 [ 63.668217][ T1428] ? clear_bhb_loop+0x50/0xa0 [ 63.668241][ T1428] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 63.668266][ T1428] RIP: 0033:0x7f645f79e0d9 [ 63.668283][ T1428] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 63.668299][ T1428] RSP: 002b:00007f646068f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 63.668321][ T1428] RAX: ffffffffffffffda RBX: 00007f645fa25fa0 RCX: 00007f645f79e0d9 [ 63.668335][ T1428] RDX: 0000000000000062 RSI: 0000200000000580 RDI: 0000000000000004 [ 63.668348][ T1428] RBP: 00007f646068f090 R08: 0000000000000000 R09: 0000000000000000 [ 63.668362][ T1428] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 63.668375][ T1428] R13: 00007f645fa26038 R14: 00007f645fa25fa0 R15: 00007ffc425648c8 [ 63.668401][ T1428] [ 63.673222][ T10] usb 2-1: USB disconnect, device number 22 [ 64.089672][ T1462] fuse: Unknown parameter '~d0x000000000000000400000000000000000000' [ 64.092125][ T36] kauditd_printk_skb: 12 callbacks suppressed [ 64.092140][ T36] audit: type=1400 audit(1786043782.941:342): avc: denied { cmd } for pid=1458 comm="iou-wrk-1459" path="socket:[14404]" dev="sockfs" ino=14404 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 64.114765][ T1465] tipc: Started in network mode [ 64.132158][ T1465] tipc: Node identity fe800000000000000000000000000014, cluster identity 4711 [ 64.145880][ T1465] tipc: Enabled bearer , priority 10 [ 64.248864][ T1475] syzkaller1: entered promiscuous mode [ 64.257323][ T1475] syzkaller1: entered allmulticast mode [ 64.380101][ T1482] netlink: 76 bytes leftover after parsing attributes in process `syz.2.390'. [ 64.558475][ T1495] FAULT_INJECTION: forcing a failure. [ 64.558475][ T1495] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 64.571621][ T1495] CPU: 1 UID: 0 PID: 1495 Comm: syz.0.395 Not tainted syzkaller #0 67f5df147bfe8fe71cdb2f404f013e40b3f12e05 [ 64.571644][ T1495] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 64.571652][ T1495] Call Trace: [ 64.571657][ T1495] [ 64.571661][ T1495] __dump_stack+0x21/0x30 [ 64.571682][ T1495] dump_stack_lvl+0x140/0x1c0 [ 64.571696][ T1495] ? __cfi_dump_stack_lvl+0x10/0x10 [ 64.571711][ T1495] ? __kasan_check_read+0x15/0x20 [ 64.571723][ T1495] ? vmx_read_guest_seg_ar+0x179/0x350 [ 64.571742][ T1495] dump_stack+0x19/0x20 [ 64.571756][ T1495] should_fail_ex+0x3c2/0x510 [ 64.571769][ T1495] should_fail+0xf/0x20 [ 64.571781][ T1495] should_fail_usercopy+0x1e/0x30 [ 64.571794][ T1495] __kvm_read_guest_page+0x177/0x210 [ 64.571807][ T1495] kvm_vcpu_read_guest_page+0x31c/0x400 [ 64.571819][ T1495] kvm_fetch_guest_virt+0x146/0x190 [ 64.571836][ T1495] ? __cfi_kvm_fetch_guest_virt+0x10/0x10 [ 64.571852][ T1495] __do_insn_fetch_bytes+0x57a/0x740 [ 64.571865][ T1495] ? x86_decode_insn+0x50b0/0x50b0 [ 64.571876][ T1495] ? vcpu_mmio_read+0x2d4/0x2f0 [ 64.571889][ T1495] x86_decode_insn+0x326/0x50b0 [ 64.571901][ T1495] ? is_bpf_text_address+0x17b/0x1a0 [ 64.571935][ T1495] ? kernel_text_address+0xa9/0xe0 [ 64.571951][ T1495] ? __cfi_x86_decode_insn+0x10/0x10 [ 64.571962][ T1495] ? __kasan_check_write+0x18/0x20 [ 64.571977][ T1495] ? vmx_read_guest_seg_ar+0x1c8/0x350 [ 64.571991][ T1495] ? __asan_memset+0x39/0x50 [ 64.572001][ T1495] ? init_decode_cache+0x7c/0x90 [ 64.572013][ T1495] ? init_emulate_ctxt+0x403/0x540 [ 64.572026][ T1495] ? kvm_inject_realmode_interrupt+0x2d0/0x2d0 [ 64.572040][ T1495] x86_decode_emulated_instruction+0x66/0x180 [ 64.572054][ T1495] x86_emulate_instruction+0x2d7/0x19f0 [ 64.572067][ T1495] ? __kernel_text_address+0x11/0x40 [ 64.572081][ T1495] ? unwind_get_return_address+0x51/0x90 [ 64.572095][ T1495] ? __cfi_rcu_note_context_switch+0x10/0x10 [ 64.572110][ T1495] ? arch_stack_walk+0x10a/0x170 [ 64.572122][ T1495] ? clear_bhb_loop+0x50/0xa0 [ 64.572137][ T1495] ? clear_bhb_loop+0x50/0xa0 [ 64.572151][ T1495] ? clear_bhb_loop+0x50/0xa0 [ 64.572165][ T1495] ? clear_bhb_loop+0x50/0xa0 [ 64.572179][ T1495] kvm_emulate_instruction+0x26/0x30 [ 64.572192][ T1495] handle_io+0x10f/0x150 [ 64.572203][ T1495] ? __cfi_handle_io+0x10/0x10 [ 64.572214][ T1495] vmx_handle_exit+0x1379/0x1c00 [ 64.572230][ T1495] ? __cfi_vmx_vcpu_run+0x10/0x10 [ 64.572251][ T1495] vcpu_run+0x4c14/0x7830 [ 64.572285][ T1495] ? signal_pending+0xc0/0xc0 [ 64.572310][ T1495] ? complete_emulated_mmio+0x4ef/0x790 [ 64.572329][ T1495] kvm_arch_vcpu_ioctl_run+0x114c/0x1bc0 [ 64.572344][ T1495] ? _parse_integer_limit+0x195/0x1e0 [ 64.572356][ T1495] ? __cfi_kvm_arch_vcpu_ioctl_run+0x10/0x10 [ 64.572371][ T1495] ? kstrtoull+0x13b/0x1e0 [ 64.572382][ T1495] ? kstrtouint+0x78/0xf0 [ 64.572393][ T1495] ? ioctl_has_perm+0x1bc/0x500 [ 64.572404][ T1495] ? __asan_memcpy+0x5a/0x80 [ 64.572418][ T1495] ? ioctl_has_perm+0x408/0x500 [ 64.572428][ T1495] ? has_cap_mac_admin+0xd0/0xd0 [ 64.572439][ T1495] ? __kasan_check_write+0x18/0x20 [ 64.572450][ T1495] ? mutex_lock_killable+0x97/0x1d0 [ 64.572466][ T1495] ? __cfi_mutex_lock_killable+0x10/0x10 [ 64.572482][ T1495] ? vfs_write+0x803/0xfd0 [ 64.572494][ T1495] kvm_vcpu_ioctl+0xa43/0x1000 [ 64.572506][ T1495] ? __cfi_kvm_vcpu_ioctl+0x10/0x10 [ 64.572517][ T1495] ? __cfi_vfs_write+0x10/0x10 [ 64.572528][ T1495] ? __kasan_check_write+0x18/0x20 [ 64.572539][ T1495] ? mutex_unlock+0x90/0x240 [ 64.572553][ T1495] ? __cfi_mutex_unlock+0x10/0x10 [ 64.572569][ T1495] ? bpf_lsm_file_ioctl+0xd/0x20 [ 64.572583][ T1495] ? security_file_ioctl+0x3e/0x110 [ 64.572599][ T1495] ? __cfi_kvm_vcpu_ioctl+0x10/0x10 [ 64.572609][ T1495] __se_sys_ioctl+0x135/0x1b0 [ 64.572623][ T1495] __x64_sys_ioctl+0x7f/0xa0 [ 64.572636][ T1495] x64_sys_call+0x1878/0x2ee0 [ 64.572646][ T1495] do_syscall_64+0x57/0xf0 [ 64.572658][ T1495] ? clear_bhb_loop+0x50/0xa0 [ 64.572672][ T1495] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 64.572687][ T1495] RIP: 0033:0x7f7d8db9e0d9 [ 64.572698][ T1495] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 64.572709][ T1495] RSP: 002b:00007f7d8ea1f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 64.572723][ T1495] RAX: ffffffffffffffda RBX: 00007f7d8de25fa0 RCX: 00007f7d8db9e0d9 [ 64.572733][ T1495] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005 [ 64.572741][ T1495] RBP: 00007f7d8ea1f090 R08: 0000000000000000 R09: 0000000000000000 [ 64.572748][ T1495] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 64.572756][ T1495] R13: 00007f7d8de26038 R14: 00007f7d8de25fa0 R15: 00007ffdae97b068 [ 64.572765][ T1495] [ 65.110278][ T1503] netlink: 'syz.2.398': attribute type 49 has an invalid length. [ 65.159031][ T1503] team_slave_1: entered promiscuous mode [ 65.164800][ T1503] team_slave_1: entered allmulticast mode [ 65.176726][ T310] tipc: Node number set to 4269801492 [ 65.188353][ T1503] fuse: Bad value for 'rootmode' [ 65.266659][ T36] audit: type=1400 audit(1786043784.111:343): avc: denied { name_bind } for pid=1515 comm="syz.2.402" src=3618 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=udp_socket permissive=1 [ 65.316663][ T9] usb 2-1: new full-speed USB device number 23 using dummy_hcd [ 65.416854][ T36] audit: type=1400 audit(1786043784.261:344): avc: denied { setattr } for pid=1540 comm="syz.0.409" name="/" dev="incremental-fs" ino=565 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 65.462742][ T1545] netlink: 132 bytes leftover after parsing attributes in process `syz.0.410'. [ 65.481434][ T9] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 65.500788][ T9] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 65.514062][ T9] usb 2-1: config 1 has no interface number 0 [ 65.524545][ T9] usb 2-1: config 1 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 65.541494][ T9] usb 2-1: config 1 interface 1 altsetting 0 endpoint 0x81 has invalid maxpacket 512, setting to 64 [ 65.571427][ T9] usb 2-1: Duplicate descriptor for config 1 interface 1 altsetting 0, skipping [ 65.583261][ T1556] FAULT_INJECTION: forcing a failure. [ 65.583261][ T1556] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 65.596672][ T1556] CPU: 1 UID: 0 PID: 1556 Comm: syz.0.414 Not tainted syzkaller #0 67f5df147bfe8fe71cdb2f404f013e40b3f12e05 [ 65.596703][ T1556] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 65.596714][ T1556] Call Trace: [ 65.596720][ T1556] [ 65.596728][ T1556] __dump_stack+0x21/0x30 [ 65.596758][ T1556] dump_stack_lvl+0x140/0x1c0 [ 65.596787][ T1556] ? __cfi_dump_stack_lvl+0x10/0x10 [ 65.596813][ T1556] dump_stack+0x19/0x20 [ 65.596836][ T1556] should_fail_ex+0x3c2/0x510 [ 65.596854][ T1556] should_fail+0xf/0x20 [ 65.596873][ T1556] should_fail_usercopy+0x1e/0x30 [ 65.596895][ T1556] _copy_from_iter+0x1a6/0x1520 [ 65.596919][ T1556] ? __cfi__copy_from_iter+0x10/0x10 [ 65.596942][ T1556] tun_get_user+0x50f/0x3720 [ 65.596961][ T1556] ? arch_stack_walk+0x10a/0x170 [ 65.596983][ T1556] ? ptr_ring_consume+0x430/0x430 [ 65.597000][ T1556] ? _parse_integer+0x2e/0x40 [ 65.597018][ T1556] ? kstrtoull+0x13b/0x1e0 [ 65.597036][ T1556] ? __kasan_check_write+0x18/0x20 [ 65.597056][ T1556] ? ref_tracker_alloc+0x32b/0x5b0 [ 65.597079][ T1556] ? __cfi_ref_tracker_alloc+0x10/0x10 [ 65.597102][ T1556] ? selinux_file_permission+0x318/0xb60 [ 65.597123][ T1556] ? __kasan_check_write+0x18/0x20 [ 65.597142][ T1556] ? proc_fail_nth_write+0x184/0x220 [ 65.597169][ T1556] tun_chr_write_iter+0x1fa/0x310 [ 65.597196][ T1556] vfs_write+0x75f/0xfd0 [ 65.597209][ T1556] ? __cfi_vfs_write+0x10/0x10 [ 65.597222][ T1556] ksys_write+0x145/0x260 [ 65.597240][ T1556] ? __cfi_ksys_write+0x10/0x10 [ 65.597260][ T1556] ? __kasan_check_read+0x15/0x20 [ 65.597279][ T1556] __x64_sys_write+0x7f/0x90 [ 65.597299][ T1556] x64_sys_call+0x271c/0x2ee0 [ 65.597317][ T1556] do_syscall_64+0x57/0xf0 [ 65.597338][ T1556] ? clear_bhb_loop+0x50/0xa0 [ 65.597361][ T1556] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 65.597376][ T1556] RIP: 0033:0x7f7d8db9e0d9 [ 65.597387][ T1556] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 65.597412][ T1556] RSP: 002b:00007f7d8ea1f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 65.597435][ T1556] RAX: ffffffffffffffda RBX: 00007f7d8de25fa0 RCX: 00007f7d8db9e0d9 [ 65.597450][ T1556] RDX: 000000000000fdef RSI: 0000200000000080 RDI: 0000000000000006 [ 65.597464][ T1556] RBP: 00007f7d8ea1f090 R08: 0000000000000000 R09: 0000000000000000 [ 65.597476][ T1556] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 65.597489][ T1556] R13: 00007f7d8de26038 R14: 00007f7d8de25fa0 R15: 00007ffdae97b068 [ 65.597505][ T1556] [ 65.598128][ T9] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 65.861396][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 65.869494][ T9] usb 2-1: Product: syz [ 65.873692][ T9] usb 2-1: Manufacturer: syz [ 65.878351][ T9] usb 2-1: SerialNumber: syz [ 65.887187][ T1501] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 66.073543][ T1569] netlink: 228 bytes leftover after parsing attributes in process `syz.0.419'. [ 66.197528][ T66] usb 4-1: new high-speed USB device number 31 using dummy_hcd [ 66.295553][ T1501] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 66.358911][ T66] usb 4-1: config 1 interface 0 altsetting 1 has 4 endpoint descriptors, different from the interface descriptor's value: 5 [ 66.378345][ T66] usb 4-1: New USB device found, idVendor=174c, idProduct=56aa, bcdDevice= 1.00 [ 66.380523][ T36] audit: type=1400 audit(1786043785.231:345): avc: denied { write } for pid=1579 comm="syz.0.424" name="snapshot" dev="devtmpfs" ino=21 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 66.397155][ T66] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 66.410514][ T1580] random: crng reseeded on system resumption [ 66.418637][ T66] usb 4-1: Product: syz [ 66.428912][ T66] usb 4-1: Manufacturer: syz [ 66.433541][ T66] usb 4-1: SerialNumber: syz [ 66.439020][ T36] audit: type=1400 audit(1786043785.271:346): avc: denied { open } for pid=1579 comm="syz.0.424" path="/dev/snapshot" dev="devtmpfs" ino=21 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 66.477092][ T1584] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 66.486857][ T1584] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 66.498975][ T1589] process 'syz.0.427' launched './file1' with NULL argv: empty string added [ 66.504707][ T9] cdc_ncm 2-1:1.1: failed GET_NTB_PARAMETERS [ 66.513788][ T36] audit: type=1400 audit(1786043785.361:347): avc: denied { execute_no_trans } for pid=1588 comm="syz.0.427" path="/113/file1" dev="tmpfs" ino=633 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 66.539123][ T9] cdc_ncm 2-1:1.1: bind() failure [ 66.552603][ T9] usb 2-1: USB disconnect, device number 23 [ 66.671455][ T66] scsi host1: uas [ 66.676339][ T570] scsi 1:0:0:0: tag#16 sense submit err -2 uas-tag 1 inflight: s-st a-in a-cmd s-cmd [ 66.685917][ T570] scsi 1:0:0:0: tag#16 CDB: opcode=0x12 12 00 00 00 24 00 [ 66.756730][ T60] scsi 1:0:0:0: tag#16 sense submit err -2 uas-tag 1 inflight: s-st a-in a-cmd s-cmd [ 66.766319][ T60] scsi 1:0:0:0: tag#16 CDB: opcode=0x12 12 00 00 00 24 00 [ 66.826691][ T60] scsi 1:0:0:0: tag#16 sense submit err -2 uas-tag 1 inflight: s-st a-in a-cmd s-cmd [ 66.836285][ T60] scsi 1:0:0:0: tag#16 CDB: opcode=0x12 12 00 00 00 24 00 [ 66.837338][ T1595] netlink: 228 bytes leftover after parsing attributes in process `syz.0.429'. [ 66.872202][ T1597] tipc: Started in network mode [ 66.877241][ T1597] tipc: Node identity 0e9e555ddeb2, cluster identity 4711 [ 66.884450][ T1597] tipc: Enabled bearer , priority 10 [ 66.892092][ T1597] tipc: Resetting bearer [ 66.898050][ T60] scsi 1:0:0:0: tag#16 sense submit err -2 uas-tag 1 inflight: s-st a-in a-cmd s-cmd [ 66.907625][ T60] scsi 1:0:0:0: tag#16 CDB: opcode=0x12 12 00 00 00 24 00 [ 66.917976][ T1597] tipc: Disabling bearer [ 66.959036][ T344] usb 4-1: USB disconnect, device number 31 [ 67.034148][ T1605] FAULT_INJECTION: forcing a failure. [ 67.034148][ T1605] name failslab, interval 1, probability 0, space 0, times 0 [ 67.047198][ T1605] CPU: 1 UID: 0 PID: 1605 Comm: syz.2.432 Not tainted syzkaller #0 67f5df147bfe8fe71cdb2f404f013e40b3f12e05 [ 67.047227][ T1605] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 67.047238][ T1605] Call Trace: [ 67.047244][ T1605] [ 67.047252][ T1605] __dump_stack+0x21/0x30 [ 67.047282][ T1605] dump_stack_lvl+0x140/0x1c0 [ 67.047310][ T1605] ? __cfi_dump_stack_lvl+0x10/0x10 [ 67.047336][ T1605] dump_stack+0x19/0x20 [ 67.047369][ T1605] should_fail_ex+0x3c2/0x510 [ 67.047391][ T1605] should_failslab+0xac/0x100 [ 67.047415][ T1605] kmem_cache_alloc_lru_noprof+0x44/0x410 [ 67.047436][ T1605] ? __d_alloc+0x42/0x8c0 [ 67.047454][ T1605] ? kasan_save_alloc_info+0x3a/0x50 [ 67.047484][ T1605] __d_alloc+0x42/0x8c0 [ 67.047500][ T1605] ? _raw_spin_lock_irqsave+0xc1/0x160 [ 67.047524][ T1605] d_alloc_parallel+0xe4/0x1370 [ 67.047544][ T1605] ? number+0xc9d/0xf00 [ 67.047565][ T1605] ? pointer+0xe10/0xe10 [ 67.047584][ T1605] ? __d_lookup+0x4e8/0x550 [ 67.047603][ T1605] ? __cfi_d_alloc_parallel+0x10/0x10 [ 67.047623][ T1605] ? full_name_hash+0xa1/0xf0 [ 67.047646][ T1605] proc_fill_cache+0x174/0x410 [ 67.047668][ T1605] ? __cfi_proc_map_files_instantiate+0x10/0x10 [ 67.047688][ T1605] ? __cfi_proc_fill_cache+0x10/0x10 [ 67.047710][ T1605] ? __cfi_snprintf+0x10/0x10 [ 67.047732][ T1605] proc_map_files_readdir+0x7ae/0x9d0 [ 67.047752][ T1605] ? __cfi_proc_map_files_readdir+0x10/0x10 [ 67.047772][ T1605] ? rwsem_read_trylock+0x275/0x5a0 [ 67.047801][ T1605] ? __cfi_selinux_file_permission+0x10/0x10 [ 67.047821][ T1605] ? down_read_killable+0x7f/0x100 [ 67.047839][ T1605] ? __cfi_down_read_killable+0x10/0x10 [ 67.047865][ T1605] ? bpf_lsm_file_permission+0xd/0x20 [ 67.047886][ T1605] iterate_dir+0x1fa/0x5c0 [ 67.047905][ T1605] __se_sys_getdents64+0xf6/0x250 [ 67.047923][ T1605] ? fput+0x1a4/0x230 [ 67.047942][ T1605] ? __x64_sys_getdents64+0xa0/0xa0 [ 67.047960][ T1605] ? ksys_write+0x1f3/0x260 [ 67.047975][ T1605] ? __cfi_filldir64+0x10/0x10 [ 67.047994][ T1605] ? __cfi_ksys_write+0x10/0x10 [ 67.048010][ T1605] ? __kasan_check_read+0x15/0x20 [ 67.048025][ T1605] __x64_sys_getdents64+0x7f/0xa0 [ 67.048044][ T1605] x64_sys_call+0x27d0/0x2ee0 [ 67.048058][ T1605] do_syscall_64+0x57/0xf0 [ 67.048075][ T1605] ? clear_bhb_loop+0x50/0xa0 [ 67.048096][ T1605] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 67.048115][ T1605] RIP: 0033:0x7f645f79e0d9 [ 67.048129][ T1605] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 67.048142][ T1605] RSP: 002b:00007f646068f028 EFLAGS: 00000246 ORIG_RAX: 00000000000000d9 [ 67.048160][ T1605] RAX: ffffffffffffffda RBX: 00007f645fa25fa0 RCX: 00007f645f79e0d9 [ 67.048173][ T1605] RDX: 0000000000000fef RSI: 0000200000001fc0 RDI: 0000000000000003 [ 67.048183][ T1605] RBP: 00007f646068f090 R08: 0000000000000000 R09: 0000000000000000 [ 67.048193][ T1605] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 67.048203][ T1605] R13: 00007f645fa26038 R14: 00007f645fa25fa0 R15: 00007ffc425648c8 [ 67.048216][ T1605] [ 67.071477][ T1609] netlink: 36 bytes leftover after parsing attributes in process `syz.2.434'. [ 67.080888][ T36] audit: type=1400 audit(1786043785.931:348): avc: denied { read } for pid=1606 comm="syz.1.433" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 67.132999][ T1617] netlink: 228 bytes leftover after parsing attributes in process `syz.2.437'. [ 67.139502][ T36] audit: type=1400 audit(1786043785.931:349): avc: denied { open } for pid=1606 comm="syz.1.433" path="/85/file0" dev="overlay" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 67.497432][ T36] audit: type=1326 audit(1786043786.351:350): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1627 comm="syz.2.441" exe="/root/ci2-android-6-12-rust/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f645f79e0d9 code=0x0 [ 67.551776][ T36] audit: type=1400 audit(1786043786.401:351): avc: denied { module_load } for pid=1633 comm="syz.3.443" path="/82/bus" dev="tmpfs" ino=468 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=system permissive=1 [ 67.551805][ T1634] Invalid ELF header len 7 [ 67.594755][ T1639] input: syz0 as /devices/virtual/input/input12 [ 67.893229][ T1653] kvm: kvm [1652]: vcpu1, guest rIP: 0x914e Unhandled WRMSR(0x187) = 0xffff000000000000 [ 67.911439][ T1653] kvm: kvm [1652]: vcpu1, guest rIP: 0x9150 Unhandled WRMSR(0x187) = 0xffff000000000000 [ 67.921769][ T1653] kvm: kvm [1652]: vcpu1, guest rIP: 0x914e Unhandled WRMSR(0x186) = 0xffff000000000000 [ 67.932148][ T1653] kvm: kvm [1652]: vcpu1, guest rIP: 0x9150 Unhandled WRMSR(0x186) = 0xffff000000000000 [ 67.945724][ T1653] kvm: kvm [1652]: vcpu1, guest rIP: 0x914e Unhandled WRMSR(0x11e) = 0xffff000000000000 [ 67.955586][ T1653] kvm: kvm [1652]: vcpu1, guest rIP: 0x9150 Unhandled WRMSR(0x11e) = 0xffff000000000000 [ 67.968241][ T1653] kvm: kvm [1652]: vcpu1, guest rIP: 0x914e Unhandled WRMSR(0xc2) = 0xffff000000000000 [ 67.977936][ T1653] kvm: kvm [1652]: vcpu1, guest rIP: 0x9150 Unhandled WRMSR(0xc2) = 0xffff000000000000 [ 67.987689][ T66] usb 4-1: new high-speed USB device number 32 using dummy_hcd [ 67.995933][ T1653] kvm: kvm [1652]: vcpu1, guest rIP: 0x914e Unhandled WRMSR(0xc1) = 0xffff000000000000 [ 68.005642][ T1653] kvm: kvm [1652]: vcpu1, guest rIP: 0x9150 Unhandled WRMSR(0xc1) = 0xffff000000000000 [ 68.087228][ T344] usb 2-1: new high-speed USB device number 24 using dummy_hcd [ 68.136649][ T66] usb 4-1: Using ep0 maxpacket: 32 [ 68.143230][ T66] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 68.160127][ T66] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 68.170027][ T66] usb 4-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 68.179107][ T66] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 68.196143][ T66] usb 4-1: config 0 descriptor?? [ 68.203713][ T66] hub 4-1:0.0: USB hub found [ 68.243508][ T344] usb 2-1: Using ep0 maxpacket: 8 [ 68.270526][ T344] usb 2-1: unable to get BOS descriptor or descriptor too short [ 68.280586][ T344] usb 2-1: unable to read config index 0 descriptor/start: -71 [ 68.288588][ T344] usb 2-1: can't read configurations, error -71 [ 68.404929][ T66] hub 4-1:0.0: config failed, can't read hub descriptor (err -22) [ 68.413142][ T1651] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 68.422079][ T1651] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 68.631948][ T66] hid-generic 0003:046D:C31C.000B: item fetching failed at offset 0/1 [ 68.640348][ T66] hid-generic 0003:046D:C31C.000B: probe with driver hid-generic failed with error -22 [ 68.936739][ T66] usb 4-1: USB disconnect, device number 32 [ 69.106657][ T348] usb 1-1: new high-speed USB device number 30 using dummy_hcd [ 69.257697][ T348] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a7, bcdDevice= 1.00 [ 69.266868][ T348] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 69.326650][ T344] usb 2-1: new high-speed USB device number 25 using dummy_hcd [ 69.348086][ T1748] netlink: 8 bytes leftover after parsing attributes in process `syz.3.464'. [ 69.358175][ T1748] IPv6: Can't replace route, no match found [ 69.476641][ T344] usb 2-1: Using ep0 maxpacket: 8 [ 69.483116][ T344] usb 2-1: too many endpoints for config 0 interface 0 altsetting 254: 48, using maximum allowed: 30 [ 69.483375][ T1742] overlayfs: upper fs does not support file handles, falling back to index=off. [ 69.494109][ T344] usb 2-1: config 0 interface 0 altsetting 254 has 1 endpoint descriptor, different from the interface descriptor's value: 48 [ 69.503311][ T1742] overlayfs: NFS export requires "index=on", falling back to nfs_export=off. [ 69.517439][ T344] usb 2-1: config 0 interface 0 has no altsetting 0 [ 69.531748][ T344] usb 2-1: New USB device found, idVendor=056a, idProduct=0057, bcdDevice= 0.00 [ 69.540914][ T344] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 69.549502][ T348] cdc_acm 1-1:1.0: ttyACM0: USB ACM device [ 69.559550][ T344] usb 2-1: config 0 descriptor?? [ 69.596655][ T66] usb 4-1: new high-speed USB device number 33 using dummy_hcd [ 69.746670][ T66] usb 4-1: Using ep0 maxpacket: 8 [ 69.753099][ T66] usb 4-1: unable to get BOS descriptor or descriptor too short [ 69.761510][ T66] usb 4-1: config 2 has an invalid interface number: 99 but max is 0 [ 69.769686][ T66] usb 4-1: config 2 has no interface number 0 [ 69.775790][ T66] usb 4-1: config 2 interface 99 altsetting 7 has an endpoint descriptor with address 0xFE, changing to 0x8E [ 69.787377][ T66] usb 4-1: config 2 interface 99 altsetting 7 endpoint 0x2 has invalid wMaxPacketSize 0 [ 69.797309][ T66] usb 4-1: config 2 interface 99 has no altsetting 0 [ 69.805431][ T66] usb 4-1: New USB device found, idVendor=0000, idProduct=a300, bcdDevice= a.f3 [ 69.814513][ T66] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 69.822552][ T66] usb 4-1: Product: syz [ 69.826751][ T66] usb 4-1: Manufacturer: syz [ 69.831374][ T66] usb 4-1: SerialNumber: syz [ 69.967836][ T344] wacom 0003:056A:0057.000C: unknown main item tag 0xd [ 69.974820][ T344] wacom 0003:056A:0057.000C: unknown main item tag 0xd [ 69.981745][ T344] wacom 0003:056A:0057.000C: unknown main item tag 0x6 [ 69.988691][ T344] wacom 0003:056A:0057.000C: item fetching failed at offset 23/40 [ 69.996736][ T344] wacom 0003:056A:0057.000C: parse failed [ 70.002542][ T344] wacom 0003:056A:0057.000C: probe with driver wacom failed with error -22 [ 70.038281][ T36] kauditd_printk_skb: 1 callbacks suppressed [ 70.038299][ T36] audit: type=1400 audit(1786043788.891:353): avc: denied { accept } for pid=1747 comm="syz.3.464" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_route_socket permissive=1 [ 70.066420][ T66] usb 4-1: USB disconnect, device number 33 [ 70.173986][ T36] audit: type=1400 audit(1786043789.021:354): avc: denied { listen } for pid=1745 comm="syz.1.463" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 70.194983][ T344] usb 2-1: USB disconnect, device number 25 [ 70.790490][ T1775] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 70.799085][ T1775] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 70.866759][ T893] ------------[ cut here ]------------ [ 70.872285][ T893] WARNING: CPU: 1 PID: 893 at fs/inode.c:340 drop_nlink+0xce/0x110 [ 70.880249][ T893] Modules linked in: [ 70.884170][ T893] CPU: 1 UID: 0 PID: 893 Comm: syz.3.197 Not tainted syzkaller #0 67f5df147bfe8fe71cdb2f404f013e40b3f12e05 [ 70.895582][ T893] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 70.905673][ T893] RIP: 0010:drop_nlink+0xce/0x110 [ 70.910764][ T893] Code: 04 00 00 be 08 00 00 00 e8 5f 13 ee ff f0 48 ff 83 b8 04 00 00 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc e8 d2 4b 95 ff <0f> 0b eb 81 44 89 f1 80 e1 07 80 c1 03 38 c1 0f 8c 59 ff ff ff 4c [ 70.930419][ T893] RSP: 0018:ffffc9000fedf8c8 EFLAGS: 00010293 [ 70.936516][ T893] RAX: ffffffff81f225ee RBX: ffff88811f666958 RCX: ffff88811b91b900 [ 70.944527][ T893] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 70.952533][ T893] RBP: ffffc9000fedf8f0 R08: 0000000000000003 R09: 0000000000000004 [ 70.960545][ T893] R10: dffffc0000000000 R11: fffff52001fdbf08 R12: dffffc0000000000 [ 70.968565][ T893] R13: 1ffff11023eccd34 R14: ffff88811f6669a0 R15: 0000000000000000 [ 70.976548][ T893] FS: 0000000000000000(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 70.985521][ T893] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 70.992146][ T893] CR2: 000055557f5889d8 CR3: 0000000131814000 CR4: 00000000003526b0 [ 71.000159][ T893] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 71.008172][ T893] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600 [ 71.016158][ T893] Call Trace: [ 71.019475][ T893] [ 71.022435][ T893] shmem_rmdir+0x5f/0x90 [ 71.026783][ T893] vfs_rmdir+0x3de/0x560 [ 71.031076][ T893] incfs_kill_sb+0x102/0x220 [ 71.035693][ T893] deactivate_locked_super+0xd5/0x270 [ 71.036668][ T66] usb 2-1: new high-speed USB device number 26 using dummy_hcd [ 71.041119][ T893] deactivate_super+0xb8/0xe0 [ 71.053361][ T893] cleanup_mnt+0x438/0x4d0 [ 71.057824][ T893] __cleanup_mnt+0x1d/0x40 [ 71.062272][ T893] task_work_run+0x1e8/0x260 [ 71.066911][ T893] ? __cfi_task_work_run+0x10/0x10 [ 71.072053][ T893] ? free_nsproxy+0x223/0x290 [ 71.076769][ T893] do_exit+0xa46/0x2850 [ 71.080989][ T893] ? __cfi_do_exit+0x10/0x10 [ 71.085616][ T893] ? __kasan_check_write+0x18/0x20 [ 71.090773][ T893] ? _raw_spin_lock_irq+0x93/0x120 [ 71.095918][ T893] ? __kasan_check_read+0x15/0x20 [ 71.100983][ T893] do_group_exit+0x21f/0x2f0 [ 71.105614][ T893] ? cgroup_leave_frozen+0x16a/0x2a0 [ 71.110940][ T893] get_signal+0x134c/0x1490 [ 71.115472][ T893] arch_do_signal_or_restart+0xbc/0x700 [ 71.121058][ T893] ? common_nsleep+0x93/0xb0 [ 71.125679][ T893] ? __cfi_arch_do_signal_or_restart+0x10/0x10 [ 71.131877][ T893] ? __se_sys_clock_nanosleep+0x321/0x3b0 [ 71.137647][ T893] ? __kasan_check_read+0x15/0x20 [ 71.142693][ T893] ? fpregs_assert_state_consistent+0xb6/0xe0 [ 71.148822][ T893] syscall_exit_to_user_mode+0x57/0xb0 [ 71.154305][ T893] do_syscall_64+0x63/0xf0 [ 71.158770][ T893] ? clear_bhb_loop+0x50/0xa0 [ 71.163483][ T893] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 71.169439][ T893] RIP: 00fb:0x5 [ 71.172927][ T893] Code: Unable to access opcode bytes at 0xffffffffffffffdb. [ 71.180330][ T893] RSP: 002b:0000000000000000 EFLAGS: 00000202 ORIG_RAX: 00000000ffffffff [ 71.188821][ T893] RAX: 00000000000000a0 RBX: 0000000000010001 RCX: 0000000000000000 [ 71.196844][ T893] RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000004 [ 71.204839][ T893] RBP: 0000000040000002 R08: cf9d780a350b4549 R09: c7e58b697db8ef3d [ 71.209256][ T66] usb 2-1: New USB device found, idVendor=1430, idProduct=474b, bcdDevice= 0.40 [ 71.212865][ T893] R10: d68d02d45a22dc24 R11: 19b4d49ef33da9ed R12: 39cb75b6fa6cb3d1 [ 71.222191][ T66] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 71.229895][ T893] R13: a8d7b5dbf29d588f R14: 9b8908dcbb4f02b4 R15: 107b9d1451766018 [ 71.229920][ T893] [ 71.238190][ T66] usb 2-1: Product: syz [ 71.245918][ T893] ---[ end trace 0000000000000000 ]--- [ 71.256844][ T893] ================================================================== [ 71.258785][ T66] usb 2-1: Manufacturer: 멥쵍ⵝ⩨ஊ縋㎛辏愛㐜뺙譐̍ᦄ襵㞺凾蛙쐢뷹큩⌹荃ፎᆲ싂뗲깈퓲㲕虙鵅쥲巓軗셙搆빩暮︦㙅缛祘䒷湖픶ඒ㠬췡襰澍⍨Ӫт诬ۮ棗☧嫝维⅀∠᜔᳑놗렙ﳦ㣜䟱ǵ䐖䊒뒺ﾵ즥띍큊ಕቋ亘㎷읕Ꞇ㔥Іㅾ萋 [ 71.266650][ T893] BUG: KASAN: null-ptr-deref in ihold+0x24/0x70 [ 71.266682][ T893] Write of size 4 at addr 0000000000000168 by task syz.3.197/893 [ 71.296005][ T66] usb 2-1: SerialNumber: syz [ 71.301982][ T893] [ 71.301998][ T893] CPU: 1 UID: 0 PID: 893 Comm: syz.3.197 Tainted: G W syzkaller #0 67f5df147bfe8fe71cdb2f404f013e40b3f12e05 [ 71.302034][ T893] Tainted: [W]=WARN [ 71.302043][ T893] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 71.302054][ T893] Call Trace: [ 71.302062][ T893] [ 71.302070][ T893] __dump_stack+0x21/0x30 [ 71.302100][ T893] dump_stack_lvl+0x140/0x1c0 [ 71.302123][ T893] ? __cfi_dump_stack_lvl+0x10/0x10 [ 71.302148][ T893] print_report+0x3d/0x70 [ 71.302172][ T893] kasan_report+0x162/0x1a0 [ 71.302194][ T893] ? ihold+0x24/0x70 [ 71.302215][ T893] ? ihold+0x24/0x70 [ 71.302235][ T893] kasan_check_range+0x25a/0x2b0 [ 71.302265][ T893] __kasan_check_write+0x18/0x20 [ 71.302283][ T893] ihold+0x24/0x70 [ 71.302302][ T893] vfs_rmdir+0x25c/0x560 [ 71.302326][ T893] incfs_kill_sb+0x102/0x220 [ 71.302345][ T893] deactivate_locked_super+0xd5/0x270 [ 71.302369][ T893] deactivate_super+0xb8/0xe0 [ 71.302392][ T893] cleanup_mnt+0x438/0x4d0 [ 71.302413][ T893] __cleanup_mnt+0x1d/0x40 [ 71.302433][ T893] task_work_run+0x1e8/0x260 [ 71.302455][ T893] ? __cfi_task_work_run+0x10/0x10 [ 71.302477][ T893] ? free_nsproxy+0x223/0x290 [ 71.302502][ T893] do_exit+0xa46/0x2850 [ 71.302525][ T893] ? __cfi_do_exit+0x10/0x10 [ 71.302547][ T893] ? __kasan_check_write+0x18/0x20 [ 71.302565][ T893] ? _raw_spin_lock_irq+0x93/0x120 [ 71.302586][ T893] ? __kasan_check_read+0x15/0x20 [ 71.302604][ T893] do_group_exit+0x21f/0x2f0 [ 71.302627][ T893] ? cgroup_leave_frozen+0x16a/0x2a0 [ 71.302651][ T893] get_signal+0x134c/0x1490 [ 71.302676][ T893] arch_do_signal_or_restart+0xbc/0x700 [ 71.302693][ T893] ? common_nsleep+0x93/0xb0 [ 71.302714][ T893] ? __cfi_arch_do_signal_or_restart+0x10/0x10 [ 71.302731][ T893] ? __se_sys_clock_nanosleep+0x321/0x3b0 [ 71.302753][ T893] ? __kasan_check_read+0x15/0x20 [ 71.302770][ T893] ? fpregs_assert_state_consistent+0xb6/0xe0 [ 71.302792][ T893] syscall_exit_to_user_mode+0x57/0xb0 [ 71.302817][ T893] do_syscall_64+0x63/0xf0 [ 71.302837][ T893] ? clear_bhb_loop+0x50/0xa0 [ 71.302860][ T893] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 71.302882][ T893] RIP: 00fb:0x5 [ 71.302896][ T893] Code: Unable to access opcode bytes at 0xffffffffffffffdb. [ 71.302907][ T893] RSP: 002b:0000000000000000 EFLAGS: 00000202 ORIG_RAX: 00000000ffffffff [ 71.302927][ T893] RAX: 00000000000000a0 RBX: 0000000000010001 RCX: 0000000000000000 [ 71.302940][ T893] RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000004 [ 71.302951][ T893] RBP: 0000000040000002 R08: cf9d780a350b4549 R09: c7e58b697db8ef3d [ 71.302965][ T893] R10: d68d02d45a22dc24 R11: 19b4d49ef33da9ed R12: 39cb75b6fa6cb3d1 [ 71.302979][ T893] R13: a8d7b5dbf29d588f R14: 9b8908dcbb4f02b4 R15: 107b9d1451766018 [ 71.302995][ T893] [ 71.303002][ T893] ================================================================== [ 71.598209][ T893] Disabling lock debugging due to kernel taint [ 71.606638][ T893] BUG: kernel NULL pointer dereference, address: 0000000000000168 [ 71.614476][ T893] #PF: supervisor write access in kernel mode [ 71.620548][ T893] #PF: error_code(0x0002) - not-present page [ 71.626536][ T893] PGD 0 P4D 0 [ 71.629919][ T893] Oops: Oops: 0002 [#1] PREEMPT SMP KASAN PTI [ 71.635994][ T893] CPU: 0 UID: 0 PID: 893 Comm: syz.3.197 Tainted: G B W syzkaller #0 67f5df147bfe8fe71cdb2f404f013e40b3f12e05 [ 71.648848][ T893] Tainted: [B]=BAD_PAGE, [W]=WARN [ 71.653873][ T893] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 71.663932][ T893] RIP: 0010:ihold+0x2a/0x70 [ 71.668445][ T893] Code: f3 0f 1e fa 55 48 89 e5 41 56 53 48 89 fb e8 bd 42 95 ff 48 8d bb 68 01 00 00 be 04 00 00 00 e8 1c 0a ee ff 41 be 01 00 00 00 44 0f c1 b3 68 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 cd [ 71.688058][ T893] RSP: 0018:ffffc9000fedf908 EFLAGS: 00010246 [ 71.694137][ T893] RAX: ffff88811b91b900 RBX: 0000000000000000 RCX: ffff88811b91b900 [ 71.702115][ T893] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 71.710080][ T893] RBP: ffffc9000fedf918 R08: ffffffff88bb6947 R09: 1ffffffff1176d28 [ 71.718047][ T893] R10: dffffc0000000000 R11: fffffbfff1176d29 R12: 0000000000000000 [ 71.726011][ T893] R13: 0000000000000000 R14: 0000000000000001 R15: dffffc0000000000 [ 71.733989][ T893] FS: 0000000000000000(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 71.742928][ T893] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 71.749505][ T893] CR2: 0000000000000168 CR3: 000000010db82000 CR4: 00000000003526b0 [ 71.757478][ T893] Call Trace: [ 71.760752][ T893] [ 71.763681][ T893] vfs_rmdir+0x25c/0x560 [ 71.767943][ T893] incfs_kill_sb+0x102/0x220 [ 71.772550][ T893] deactivate_locked_super+0xd5/0x270 [ 71.777927][ T893] deactivate_super+0xb8/0xe0 [ 71.782618][ T893] cleanup_mnt+0x438/0x4d0 [ 71.787047][ T893] __cleanup_mnt+0x1d/0x40 [ 71.791479][ T893] task_work_run+0x1e8/0x260 [ 71.796088][ T893] ? __cfi_task_work_run+0x10/0x10 [ 71.801199][ T893] ? free_nsproxy+0x223/0x290 [ 71.805912][ T893] do_exit+0xa46/0x2850 [ 71.810086][ T893] ? __cfi_do_exit+0x10/0x10 [ 71.814670][ T893] ? __kasan_check_write+0x18/0x20 [ 71.819785][ T893] ? _raw_spin_lock_irq+0x93/0x120 [ 71.824894][ T893] ? __kasan_check_read+0x15/0x20 [ 71.829927][ T893] do_group_exit+0x21f/0x2f0 [ 71.834526][ T893] ? cgroup_leave_frozen+0x16a/0x2a0 [ 71.839808][ T893] get_signal+0x134c/0x1490 [ 71.844314][ T893] arch_do_signal_or_restart+0xbc/0x700 [ 71.849871][ T893] ? common_nsleep+0x93/0xb0 [ 71.854474][ T893] ? __cfi_arch_do_signal_or_restart+0x10/0x10 [ 71.860621][ T893] ? __se_sys_clock_nanosleep+0x321/0x3b0 [ 71.866357][ T893] ? __kasan_check_read+0x15/0x20 [ 71.871393][ T893] ? fpregs_assert_state_consistent+0xb6/0xe0 [ 71.877486][ T893] syscall_exit_to_user_mode+0x57/0xb0 [ 71.882969][ T893] do_syscall_64+0x63/0xf0 [ 71.887398][ T893] ? clear_bhb_loop+0x50/0xa0 [ 71.892080][ T893] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 71.897991][ T893] RIP: 00fb:0x5 [ 71.901463][ T893] Code: Unable to access opcode bytes at 0xffffffffffffffdb. [ 71.908825][ T893] RSP: 002b:0000000000000000 EFLAGS: 00000202 ORIG_RAX: 00000000ffffffff [ 71.917273][ T893] RAX: 00000000000000a0 RBX: 0000000000010001 RCX: 0000000000000000 [ 71.925252][ T893] RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000004 [ 71.933233][ T893] RBP: 0000000040000002 R08: cf9d780a350b4549 R09: c7e58b697db8ef3d [ 71.941207][ T893] R10: d68d02d45a22dc24 R11: 19b4d49ef33da9ed R12: 39cb75b6fa6cb3d1 [ 71.949180][ T893] R13: a8d7b5dbf29d588f R14: 9b8908dcbb4f02b4 R15: 107b9d1451766018 [ 71.957166][ T893] [ 71.960193][ T893] Modules linked in: [ 71.964097][ T893] CR2: 0000000000000168 [ 71.968271][ T893] ---[ end trace 0000000000000000 ]--- [ 71.973730][ T893] RIP: 0010:ihold+0x2a/0x70 [ 71.978249][ T893] Code: f3 0f 1e fa 55 48 89 e5 41 56 53 48 89 fb e8 bd 42 95 ff 48 8d bb 68 01 00 00 be 04 00 00 00 e8 1c 0a ee ff 41 be 01 00 00 00 44 0f c1 b3 68 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 cd [ 71.997869][ T893] RSP: 0018:ffffc9000fedf908 EFLAGS: 00010246 [ 72.003938][ T893] RAX: ffff88811b91b900 RBX: 0000000000000000 RCX: ffff88811b91b900 [ 72.011899][ T893] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 72.019878][ T893] RBP: ffffc9000fedf918 R08: ffffffff88bb6947 R09: 1ffffffff1176d28 [ 72.027850][ T893] R10: dffffc0000000000 R11: fffffbfff1176d29 R12: 0000000000000000 [ 72.035828][ T893] R13: 0000000000000000 R14: 0000000000000001 R15: dffffc0000000000 [ 72.043807][ T893] FS: 0000000000000000(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 72.052727][ T893] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 72.059318][ T893] CR2: 0000000000000168 CR3: 000000010db82000 CR4: 00000000003526b0 [ 72.067313][ T893] Kernel panic - not syncing: Fatal exception [ 72.073621][ T893] Kernel Offset: disabled [ 72.077938][ T893] Rebooting in 86400 seconds..