last executing test programs: 1m57.869105089s ago: executing program 2 (id=2359): r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="6000000010001fff000000000000000000060000", @ANYRES32=0x0, @ANYBLOB="81efffff00000000380012800b000100727370616e00002800028008001400ff03000008001400020000000400121059000200000800000800010000", @ANYRES32=0x0, @ANYBLOB="08001f0008000000"], 0x60}, 0x1, 0x0, 0x0, 0x1}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f00000000c0)={'ip6tnl0\x00', &(0x7f0000000000)={'syztnl1\x00', 0x0, 0x4, 0x0, 0x0, 0x0, 0x1, @private1, @loopback={0xff00000000000000}, 0x8, 0x0, 0x0, 0x1}}) r2 = socket(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000500)='./proc\x00', &(0x7f0000000600)='proc\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./proc/sys/net/ipv6/conf/syz_tun/addr_gen_mode\x00', 0x1, 0x0) write(r3, &(0x7f0000000900)='1', 0x1) r4 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r1, &(0x7f0000000080)={0x70000008}) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x1, 0x0, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x6, 0x3, &(0x7f0000000480)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f00000004c0)={'veth1_virt_wifi\x00', 0x0}) r8 = bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000540)={r6, r7, 0x25, 0x4, @void}, 0x10) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000000680)={r8, r6, 0x4, r6}, 0x10) r9 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x2e981, 0x0) r10 = ioctl$KVM_CREATE_VM(r9, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r10, 0xae60) r11 = ioctl$KVM_CREATE_VCPU(r10, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r10, r11, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000440)=[@text64={0x40, 0x0}], 0x1, 0x21, 0x0, 0x0) ioctl$KVM_SET_VAPIC_ADDR(r11, 0x4008ae93, &(0x7f0000000040)=0x1000) ioctl$KVM_SET_MSRS(r11, 0x4008ae89, &(0x7f00000002c0)={0x1, 0x0, [{0x40000073, 0x0, 0x81}]}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'bridge0\x00'}) r12 = socket(0x23, 0x2, 0x0) setsockopt(r12, 0x107, 0x1, &(0x7f00000001c0)="110000000200060000071a80010061cc", 0x10) setsockopt(r12, 0x107, 0x2, &(0x7f00000001c0)="110000000200010001001a00002b4000", 0x10) socket$pppl2tp(0x18, 0x1, 0x1) 1m57.51042088s ago: executing program 2 (id=2360): fanotify_init(0x0, 0x1) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000240)={0x73622a85, 0x0, 0x8000000000002}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x800, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000280)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x10000000000) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0xb}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f00000005c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000680)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x1058, 0x0, 0x0, 0x0, 0x0, 0x90, 0x18, &(0x7f0000000300)={@ptr={0x70742a85, 0xfffffffe, 0x0, 0x0, 0x0, 0x21}, @ptr={0x70742a85, 0x1, 0x0, 0x0, 0x0, 0x2e}, @ptr={0x70742a85, 0x1, 0x0, 0x0, 0x1, 0xca}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}, 0x400}], 0x0, 0x0, 0x0}) 1m57.415980214s ago: executing program 2 (id=2362): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=@newlink={0x3c, 0x10, 0xffffffffffffffff, 0x70bd25, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, 0x50a32, 0x823}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bridge={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BR_PRIORITY={0x6, 0x6, 0x37ea}]}}}]}, 0x3c}, 0x1, 0x12, 0x0, 0x20004000}, 0x40000) 1m57.404219789s ago: executing program 2 (id=2363): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r0, 0x29, 0x3, &(0x7f0000000000)=0x1, 0x4) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() r2 = syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) ioctl$FE_SET_FRONTEND(r2, 0x40246f4c, &(0x7f0000000080)={0x30a32c0, 0x1, @qpsk={0x2, 0x11}}) mq_open(&(0x7f0000000080)='eth0\x00#\x13\xaeu\xe0\xfbu0*\xf3\x11i\xdd\xd9\xc6\x87\xde\xbf_\xa0\xf6\xdfk\xbf.\"\xa6\xc0#p\xcd\x1c/\xa6\xf2\xbcyL\x85a\xb5\xbb~+>\xbc\x93\xf8\xab\x9a3\x85l\x1d\x15\x11\x1a{@!2\xb6!\xae\xf79k\x90\x88\v8I$\xfdQ\x1d\x90=r\xd8\xc0\xd8\t/\x8dv\xb8\x93\xc3C\xae\x9dc\xd1T\xdd\x14\xd3\xe1\xbe_$A=z\xee\xbd/X\xbemOX)s\x94\xde\xbe_\v\x01\xbe\xeb\xbb\x91\x11z\xc2|d\x1b\x04\xd2\xf9yx\xb2\x1b\bLTrw\x88\x9e0\t\xc6\xe2\x9c\xed\\\xd8[\xc8\x04 \xf3\xac]V\x1d:\xfc\xc3\x9e\x02\ax\xef\xfe\x1c.TT\xcf\xbf\xf5\x80a%\xdcQ\xb3CuT\xcc7\x8avs\xb2\a\xfe\xb3j*\xad\x18I\xcc\xe9\xaa{]\xef\xb7\xf2\xee*\xf95\bJt\xd0s\xc4\xaa\xc8\x13~\xb2\xf20\xbdf\xdb\xaeG\xe3\xfb\xef\x94\xef:Q\x1b\xe3\xa3\xa4}\xef`e\xcdL\xab\xdb\r\xf2y\x9fg1\xf4\t\x18i/!\x13\xf1,\x8cu\xaa\xbf~)\x94\x1b2\x93\x86\xe7\x9a\xf2j\xa8\x96\xa6\xa2\xfcN\x81\xafTh\xb3\x1bo:\xe8\vq7S\xe4H\xf3L\xa0\x9c\x97B\x12\x10\x9d\xaa\x7fq\x06\xb9(\xf6\x1c\x83\xb1J\xec\x926\xb5a0\xa0B\xae|', 0x42, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000640)={0xffffffffffffffff, 0x2f00020b, 0x0, 0x0, &(0x7f0000000200), 0x0, 0x7515, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{}, &(0x7f0000000080), &(0x7f00000001c0)}, 0x20) sched_setscheduler(r1, 0x1, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) pipe2(0x0, 0x0) write$binfmt_aout(0xffffffffffffffff, 0x0, 0x20) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001880), r5) sendmsg$ETHTOOL_MSG_TSINFO_GET(r5, &(0x7f00000020c0)={0x0, 0x0, &(0x7f0000002080)={&(0x7f0000001ec0)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="010027bd7000ffdbdf252e000000180001801400020064756d6d7930"], 0x2c}, 0x1, 0x0, 0x0, 0x8000}, 0x4) socket$inet_tcp(0x2, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000280)={0xa, 0x4e22, 0x9, @loopback, 0x6}, 0x1c) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000040)=0x42, 0x4) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x16, 0x16, &(0x7f0000000300)=ANY=[@ANYRES64=r4], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x8, &(0x7f0000000040), 0x8, 0x10, &(0x7f00000002c0), 0x10, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x80}, 0x94) connect$inet6(r0, &(0x7f0000000140)={0xa, 0x4e22, 0x23, @loopback, 0x23}, 0x1c) 1m56.460201031s ago: executing program 2 (id=2368): r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2) landlock_create_ruleset(0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1000002, 0x11012, r0, 0x0) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000600)={{{@in6=@mcast2, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in=@broadcast}}, &(0x7f00000003c0)=0xe8) setxattr$system_posix_acl(0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="02000000010000000000000002000400", @ANYRES32=0x0, @ANYBLOB="02000500fa6c42bf047924895da9671e6079f43639c223fd3c092dc3951d0000069b45a731af1b48e3ec83b4b5e0589a1c1d303b3cff528eca9e437540e1b1148fe40d78a88f58a9e005566eacfc3b2344724cde7cda5b6bffda1955f0930776c6cdce989d6590e9bfbad016344a386fc0497bc82294c9dab893512ead51f28bae607a81fd8c35f0735a6da5258131f20dde3ffd0d3d402f409d201c2b61d4c261b86717ca95566ac2bbe5b24c42572678be5da54ed578c07ed82f222774cd50", @ANYRES32=0x0, @ANYBLOB="02000000", @ANYRES32=0x0, @ANYBLOB="02000000", @ANYRES32=0x0, @ANYBLOB="02000100", @ANYRES32=r1, @ANYBLOB="040000000000000010000000000000002000000000000000"], 0x4c, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r2 = socket$inet(0xa, 0x801, 0x84) connect$inet(r2, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r2, 0xaeea) r3 = accept4(r2, 0x0, 0x0, 0x0) sendto$inet(r3, &(0x7f00000002c0)="cc", 0x43, 0x4c050, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f00000001c0)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000140)='./file1\x00') mkdir(&(0x7f00000020c0)='./file0\x00', 0x0) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) r5 = open(&(0x7f00000002c0)='.\x00', 0x101800, 0x1d2) r6 = syz_genetlink_get_family_id$smc(&(0x7f0000000280), r3) sendmsg$SMC_PNETID_FLUSH(r3, &(0x7f0000000440)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000380)={&(0x7f0000000300)={0x1c, r6, 0x8, 0x70bd28, 0x25dfdbfb, {}, [@SMC_PNETID_IBPORT={0x5, 0x4, 0x2}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000000) ioctl$AUTOFS_IOC_PROTOSUBVER(r5, 0x40049366, 0x0) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r3, 0x84, 0x7b, &(0x7f00000004c0)={0x0, 0x1}, 0x8) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000480)=@ipv6_newroute={0x24, 0x19, 0x1, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa}, [@RTA_PREF={0x5, 0x14, 0x80}]}, 0x24}}, 0x0) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r3, 0x84, 0x7c, &(0x7f0000000100)={0x0, 0x1, 0x4}, &(0x7f0000000240)=0x8) sendto$phonet(r3, &(0x7f0000000000), 0x0, 0x4000, &(0x7f0000000040)={0x23, 0x1, 0x29, 0x7b}, 0x10) 1m54.382826918s ago: executing program 2 (id=2373): socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_open_procfs(0x0, &(0x7f0000019240)='net/dev_mcast\x00') prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x66962000) get_mempolicy(0x0, 0x0, 0x0, &(0x7f0000001000/0x4000)=nil, 0x3) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) write$cgroup_type(r2, &(0x7f00000000c0), 0x9) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000480)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x2000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x6, &(0x7f0000000700)=ANY=[@ANYRESOCT=r1, @ANYRES32=r2, @ANYBLOB="0000000000000000180007000000000000000000040000009f7c27bf9933d311ed98f285580eafb92d0f076c4ff389868dbea20675f295d189b41d0461b743e4f10a6394cf9d31c79dd07de9a1b4860338ad48cfeab14a09a5efee06cba2dcde4613859632a5dd2c411604267678e10582eb0d4f39a5436ca136"], &(0x7f0000000000)='GPL\x00'}, 0x94) ioctl$SIOCSIFHWADDR(r0, 0x8b06, &(0x7f0000000080)={'wlan1\x00', @dev={'\xaa\xaa\xaa\xaa\xaa', 0x3c}}) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) sendmsg$IPSET_CMD_DEL(r1, &(0x7f0000000400)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x12000240}, 0xc, &(0x7f00000003c0)={&(0x7f00000005c0)=ANY=[@ANYBLOB="540000000a060104008000000000000005000003090002030000003000000000100007800c00148008000140ac1e1df56d125b6c834ff90e7108000124580880100007800900130073797a320000000010000780be6167f6e0d85863d37776c8087cd529921edae5fcc34a532f6551c974287c5577a585dc6bf1c007b53d613622c54617cca6ee2549376d2be09b8c305a3d7dc48e68c01dc0c14f1517d689f7f6c0c53473d4eb0ac62f5cf99e97cf510962c48ac1a50c7f9afaf4b32a855d7d2182be1c6f51ad97255aceb8def61bd87fb26772d960e0f57dc6dc4917627a923af94debedaca7f516126196be0b5f49a738d753e3fdfed19fb46f5f5abe9049c5"], 0x54}, 0x1, 0x0, 0x0, 0x4000}, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$unix(0x1, 0x3, 0x0) syz_usb_connect$midi(0x0, 0x32, &(0x7f00000015c0)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x40, 0xe41, 0x414a, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x20, 0x1, 0x1, 0x5, 0x0, 0xd, "", {{{0x9, 0x4, 0x0, 0x0, 0x1, 0x1, 0x3, 0x0, 0x8, [], [{{0x9, 0x5, 0x1, 0x3, 0x0, 0x8, 0x0, 0x0, {0x5, 0x25, 0x1, 0x1, "85"}}}]}}}}}]}}, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller1\x00', 0x0}) ioctl$sock_inet_SIOCSIFFLAGS(r8, 0x8914, &(0x7f0000000200)={'syzkaller1\x00', 0x1}) sendmsg$nl_route_sched(r7, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newqdisc={0x30, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r9, {}, {0xfff1, 0x9}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001300)=@newtfilter={0x74, 0x2c, 0x601, 0x70bd29, 0x0, {0x0, 0x0, 0x0, r9, {}, {0xfff1, 0xffff}, {0x300}}, [@filter_kind_options=@f_flower={{0xb}, {0x44, 0x2, [@TCA_FLOWER_KEY_CT_STATE={0x6, 0x5b, 0xc249}, @TCA_FLOWER_KEY_CT_STATE_MASK={0x6, 0x5c, 0x8}, @TCA_FLOWER_INDEV={0x14, 0x2, 'macvlan0\x00'}, @TCA_FLOWER_KEY_IPV6_DST={0x14, 0x10, @loopback}, @TCA_FLOWER_KEY_PORT_SRC_MIN={0x6, 0x57, 0x4e24}]}}]}, 0x74}}, 0x0) write$tun(r6, &(0x7f0000000240)=ANY=[@ANYBLOB="080008000003060004"], 0x92) socket$packet(0x11, 0x3, 0x300) getsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x38, 0x0, &(0x7f0000001000)) 1m38.81635095s ago: executing program 32 (id=2373): socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_open_procfs(0x0, &(0x7f0000019240)='net/dev_mcast\x00') prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x66962000) get_mempolicy(0x0, 0x0, 0x0, &(0x7f0000001000/0x4000)=nil, 0x3) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) write$cgroup_type(r2, &(0x7f00000000c0), 0x9) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000480)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x2000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x6, &(0x7f0000000700)=ANY=[@ANYRESOCT=r1, @ANYRES32=r2, @ANYBLOB="0000000000000000180007000000000000000000040000009f7c27bf9933d311ed98f285580eafb92d0f076c4ff389868dbea20675f295d189b41d0461b743e4f10a6394cf9d31c79dd07de9a1b4860338ad48cfeab14a09a5efee06cba2dcde4613859632a5dd2c411604267678e10582eb0d4f39a5436ca136"], &(0x7f0000000000)='GPL\x00'}, 0x94) ioctl$SIOCSIFHWADDR(r0, 0x8b06, &(0x7f0000000080)={'wlan1\x00', @dev={'\xaa\xaa\xaa\xaa\xaa', 0x3c}}) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) sendmsg$IPSET_CMD_DEL(r1, &(0x7f0000000400)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x12000240}, 0xc, &(0x7f00000003c0)={&(0x7f00000005c0)=ANY=[@ANYBLOB="540000000a060104008000000000000005000003090002030000003000000000100007800c00148008000140ac1e1df56d125b6c834ff90e7108000124580880100007800900130073797a320000000010000780be6167f6e0d85863d37776c8087cd529921edae5fcc34a532f6551c974287c5577a585dc6bf1c007b53d613622c54617cca6ee2549376d2be09b8c305a3d7dc48e68c01dc0c14f1517d689f7f6c0c53473d4eb0ac62f5cf99e97cf510962c48ac1a50c7f9afaf4b32a855d7d2182be1c6f51ad97255aceb8def61bd87fb26772d960e0f57dc6dc4917627a923af94debedaca7f516126196be0b5f49a738d753e3fdfed19fb46f5f5abe9049c5"], 0x54}, 0x1, 0x0, 0x0, 0x4000}, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$unix(0x1, 0x3, 0x0) syz_usb_connect$midi(0x0, 0x32, &(0x7f00000015c0)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x40, 0xe41, 0x414a, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x20, 0x1, 0x1, 0x5, 0x0, 0xd, "", {{{0x9, 0x4, 0x0, 0x0, 0x1, 0x1, 0x3, 0x0, 0x8, [], [{{0x9, 0x5, 0x1, 0x3, 0x0, 0x8, 0x0, 0x0, {0x5, 0x25, 0x1, 0x1, "85"}}}]}}}}}]}}, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller1\x00', 0x0}) ioctl$sock_inet_SIOCSIFFLAGS(r8, 0x8914, &(0x7f0000000200)={'syzkaller1\x00', 0x1}) sendmsg$nl_route_sched(r7, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newqdisc={0x30, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r9, {}, {0xfff1, 0x9}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001300)=@newtfilter={0x74, 0x2c, 0x601, 0x70bd29, 0x0, {0x0, 0x0, 0x0, r9, {}, {0xfff1, 0xffff}, {0x300}}, [@filter_kind_options=@f_flower={{0xb}, {0x44, 0x2, [@TCA_FLOWER_KEY_CT_STATE={0x6, 0x5b, 0xc249}, @TCA_FLOWER_KEY_CT_STATE_MASK={0x6, 0x5c, 0x8}, @TCA_FLOWER_INDEV={0x14, 0x2, 'macvlan0\x00'}, @TCA_FLOWER_KEY_IPV6_DST={0x14, 0x10, @loopback}, @TCA_FLOWER_KEY_PORT_SRC_MIN={0x6, 0x57, 0x4e24}]}}]}, 0x74}}, 0x0) write$tun(r6, &(0x7f0000000240)=ANY=[@ANYBLOB="080008000003060004"], 0x92) socket$packet(0x11, 0x3, 0x300) getsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x38, 0x0, &(0x7f0000001000)) 2.665638547s ago: executing program 1 (id=2871): r0 = bpf$MAP_CREATE(0x100000000000000, &(0x7f0000000440)=@base={0x14, 0x4, 0x8, 0x6, 0x0, 0x1}, 0x48) r1 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000000180)=0x80000001, 0x4) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000a40)={r0, &(0x7f0000000080), &(0x7f0000001500)=@udp6=r1, 0x1}, 0x20) 2.608196465s ago: executing program 0 (id=2873): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r3 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000780)={0x6, 0x4, &(0x7f0000000580)=ANY=[@ANYBLOB="18020000000000020000000000000000850000001700000095"], &(0x7f00000005c0)='GPL\x00'}, 0x94) r4 = socket(0x10, 0x803, 0x8) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000005c0)=ANY=[@ANYBLOB="0600000004000000080000000100000080000000", @ANYRES32=0x1, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000004"], 0x50) sendmsg$IPVS_CMD_SET_INFO(r4, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x2d}, 0x1, 0x0, 0x0, 0x8801}, 0x8000) r5 = socket$netlink(0x10, 0x3, 0x0) getsockname$packet(r4, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r6, @ANYBLOB="00001000252155b21c0012000c000100626f6e64"], 0x3c}}, 0x40000) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000001c0)={r3, r6, 0x25, 0x0, @val=@netkit={@void, @value=r3}}, 0x1c) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3c0000001000030400"/20, @ANYRES32=r2, @ANYBLOB="46ff0f00000000001c00128009000100626f6e64000000000c000280050001"], 0x3c}, 0x1, 0x0, 0x0, 0x690}, 0x20048040) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x200000000000000) 2.557075216s ago: executing program 1 (id=2875): mkdir(&(0x7f00000002c0)='./file0\x00', 0x1e) mount$9p_virtio(&(0x7f0000000000), &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0), 0x0, &(0x7f0000000c00)=ANY=[]) chdir(&(0x7f0000000080)='./file0\x00') openat(0xffffffffffffff9c, 0x0, 0x20842, 0x0) r0 = open$dir(&(0x7f0000000140)='./file0\x00', 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) ftruncate(r1, 0x2000009) sendfile(r0, r1, 0x0, 0x20000000000006) 2.447831027s ago: executing program 0 (id=2877): set_mempolicy(0x4005, &(0x7f0000000040)=0x1001, 0x4) openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x1000000) 2.443047406s ago: executing program 0 (id=2878): r0 = syz_open_dev$tty1(0xc, 0x4, 0x2) ioctl$KDFONTOP_GET(r0, 0x4b72, &(0x7f0000000940)={0x1, 0x0, 0xe, 0x12, 0x1ca, &(0x7f0000000540)}) 2.38291978s ago: executing program 0 (id=2880): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$vmci(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r1, 0x7a7, &(0x7f0000000040)=0x80000) r2 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r2, 0x7a7, &(0x7f0000000080)=0xb0000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r2, 0x7a0, &(0x7f000000c180)={@my=0x0}) ioctl$IOCTL_VMCI_INIT_CONTEXT(r1, 0x7a0, &(0x7f0000000280)={@local, 0x1}) close_range(r0, 0xffffffffffffffff, 0x0) 2.335882721s ago: executing program 1 (id=2881): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_LIST(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)={0x38, 0x7, 0x6, 0x5, 0x0, 0x0, {0x7, 0x0, 0x8}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_FLAGS={0x8, 0x6, 0x1, 0x0, 0xec62}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x38}, 0x1, 0x0, 0x0, 0x40000}, 0x0) 2.313186748s ago: executing program 1 (id=2883): openat$pidfd(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/pid\x00') syz_open_procfs(0xffffffffffffffff, &(0x7f0000000200)='mounts\x00') r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), r0) sendmsg$ETHTOOL_MSG_COALESCE_SET(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010000000000000000001400000008000a00fc00000018000180140002006e657464657673696d300000000000000800050000fcffff08001400fc000000080011000700000008000e00800000000800", @ANYRES64=r0], 0x5c}, 0x1, 0x0, 0x0, 0x800}, 0x0) 2.299902512s ago: executing program 0 (id=2884): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000010c0)=@newtclass={0x24, 0x28, 0x100, 0x70bd2d, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0xfff2, 0xa}, {0xe, 0xfff5}, {0x5, 0xfff2}}}, 0x24}}, 0x10) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=@bridge_newneigh={0x34, 0x1c, 0x401, 0x70bd29, 0x25dfdbff, {0x7, 0x0, 0x0, r2, 0x40, 0x4c, 0x6}, [@NDA_LLADDR={0xa, 0x2, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xc}}, @NDA_FDB_EXT_ATTRS={0xc, 0xe, 0x0, 0x1, [@NFEA_ACTIVITY_NOTIFY={0x5, 0x1, 0x3}]}]}, 0x34}, 0x1, 0x0, 0x0, 0x44801}, 0x840) sendmmsg(r0, &(0x7f00000002c0), 0x40000000000009f, 0x0) 2.226132504s ago: executing program 1 (id=2885): r0 = bpf$MAP_CREATE(0x100000000000000, &(0x7f0000000440)=@base={0x14, 0x4, 0x8, 0x6, 0x0, 0x1}, 0x48) r1 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000000180)=0x80000001, 0x4) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000a40)={r0, &(0x7f0000000080), &(0x7f0000001500)=@udp6=r1, 0x1}, 0x20) 2.22507662s ago: executing program 4 (id=2886): r0 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r0, 0x29, 0x2a, &(0x7f0000000080)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}}}, 0x108) setsockopt$inet6_group_source_req(r0, 0x29, 0x2b, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}}}, 0x108) socket(0x80000000000000a, 0xa, 0x20) r1 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r1, 0x29, 0x2a, &(0x7f0000000080)={0x24, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @remote}}}, 0x108) setsockopt$inet6_group_source_req(r1, 0x29, 0x2e, &(0x7f0000000200)={0x0, {{0xa, 0x1, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x4e23, 0x0, @private2={0xfc, 0x2, '\x00', 0x1}}}}, 0x108) 2.146503734s ago: executing program 5 (id=2887): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000a40)={0x0, 0x0, &(0x7f0000000a00)={&(0x7f0000000a80)=@deltfilter={0x58, 0x2d, 0x200, 0x70bd2d, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0xffff, 0xf}, {0x6, 0xb}, {0x2, 0xfff1}}, [@filter_kind_options=@f_matchall={{0xd}, {0x24, 0x2, [@TCA_MATCHALL_ACT={0x4}, @TCA_MATCHALL_CLASSID={0x8, 0x1, {0xfff2, 0xb}}, @TCA_MATCHALL_CLASSID={0x8, 0x1, {0xfff2}}, @TCA_MATCHALL_FLAGS={0x8, 0x3, 0x2}, @TCA_MATCHALL_ACT={0x4}]}}]}, 0x58}, 0x1, 0x0, 0x0, 0x8480}, 0x24000000) r0 = syz_open_dev$evdev(&(0x7f0000000280), 0x2, 0x822f01) write$char_usb(r0, &(0x7f0000000040)="e2", 0x12d8) ppoll(&(0x7f0000000000)=[{r0, 0x8080}], 0x1, &(0x7f0000000080), 0x0, 0x0) 2.145921798s ago: executing program 1 (id=2888): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r3 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000780)={0x6, 0x4, &(0x7f0000000580)=ANY=[@ANYBLOB="18020000000000020000000000000000850000001700000095"], &(0x7f00000005c0)='GPL\x00'}, 0x94) r4 = socket(0x10, 0x803, 0x8) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000005c0)=ANY=[@ANYBLOB="0600000004000000080000000100000080000000", @ANYRES32=0x1, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000004"], 0x50) sendmsg$IPVS_CMD_SET_INFO(r4, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x2d}, 0x1, 0x0, 0x0, 0x8801}, 0x8000) r5 = socket$netlink(0x10, 0x3, 0x0) getsockname$packet(r4, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r6, @ANYBLOB="00001000252155b21c0012000c000100626f6e64"], 0x3c}}, 0x40000) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000001c0)={r3, r6, 0x25, 0x0, @val=@netkit={@void, @value=r3}}, 0x1c) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3c0000001000030400"/20, @ANYRES32=r2, @ANYBLOB="46ff0f00000000001c00128009000100626f6e64000000000c000280050001"], 0x3c}, 0x1, 0x0, 0x0, 0x690}, 0x20048040) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x200000000000000) 2.012070643s ago: executing program 0 (id=2889): openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x40, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r0, &(0x7f00000021c0)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r0, &(0x7f0000000040)={0x50, 0x0, r1, {0x7, 0x1f, 0x0, 0x490420, 0x2}}, 0x50) syz_fuse_handle_req(r0, &(0x7f000000e3c0)="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d838aae8c05dd22d0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea210560000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001354c4b600", 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={0x20}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x20c01, 0x0) fallocate(r2, 0x0, 0x460e, 0x3) 2.011897269s ago: executing program 5 (id=2890): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0xa8442, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000440)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfb, {0x0, 0x0, 0x0, r2, {0x0, 0x7ffe}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{0x20000002, 0x8, 0xfffffffb, 0x2, 0x2}, 0x5, 0x1, 0x80000000, 0x2, 0x8, 0x17, 0x2, 0x1, 0x0, 0xe, {0x0, 0x7fff, 0x225, 0x3, 0x9, 0x4}}}}]}, 0x78}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000900)=@newtfilter={0x38, 0x2c, 0xd27, 0x170bd2b, 0x2, {0x0, 0x0, 0x0, r2, {0x0, 0xffff}, {}, {0x8, 0xffe0}}, [@filter_kind_options=@f_u32={{0x8}, {0xc, 0x2, [@TCA_U32_DIVISOR={0x8, 0x4, 0x4}]}}]}, 0x38}, 0x1, 0x0, 0x0, 0x884}, 0x40) 1.974415684s ago: executing program 4 (id=2891): creat(&(0x7f00000002c0)='./file0\x00', 0x1) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x2000010, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r0, &(0x7f0000009200)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r0, &(0x7f0000000040)={0x50, 0x0, r1, {0x7, 0x1f, 0x9, 0x9104, 0x40, 0x0, 0x6, 0x3fffff, 0x0, 0x0, 0x40}}, 0x50) syz_fuse_handle_req(r0, &(0x7f00000021c0)="d56cea33946c0eae3241d3604bfce89adddb2eb96960338db7572fa254eb7c69dc0cb526989630e26224c258c8d70ccacc5564d67723f4756c0399174c5460c4995942d24092c36dc820e97344798b5bb45423f853bf50e374323abacf0388cd091016b7a3d7843f4d3ae1658bd34d967e3323a64908442788dbc99c1f4248da53fb5be2c8001236b994ca594e3b3c588beaf3cb1c32c072d768b9e665e7d87044fdfc1fd6452593e6793963153f3850bf85042a5c139799ba8f6cb8d877fc436c4f1601270d6e29d60a4c80d6315e46f4219494ce897127d0b76f5d681e90f4e9282468ef7993cd92076aed266c1db8b81b93adc4969c9b89b32b8768c9f39f2d148e933dbb651746a9364f49986ef73b4c29f647b82b83216bb8179fe5346fdacdc5fda4bd48875cd2f1cf57a0c9a91e059446bac310a6d68948675c35a8e442168fd84d78d9800e5b05bdbce3a6eac65bee7279a3628f2a08931d3d52ce490652c20f8ae529eaf24bf421dad976c68b234ee6f6210c9f9aac3a55c6939d6aa3805b95619546264ff3ff82d0dc690e8ead61b6ed528c3c117cd771a3b7feb214ce8d720640d97f14b399b7f46dc4aad83117e8e642ccb117d13f345536fc3801c124cfaf8aa7aafff6c8df3fdd4469c077eccbd8ddacad80d9113dfde26ae67b226185743b2d53667fb3016fe114f87484ab614ddf0887c4b2c85351ab21a0ece6c066a154b38b4d7c1792d2db2cc5f8ceb42078187949d354b7a08d1529f3d10814757179c860db031dad4a3dc13ca01d1013238ed5f7a9674fcc77f0d34e2118fb851c970d86ecf9de1cfdb8d3ab197480e263c3207c3d7ebe17f9547c7c56b08e83de875294d0fd68df1926ecac24350b2c70bd73e14122ed480c564353d34049e67c26036fc35d04022cd35d6ac00756d3b8550bb22ae80a4bd630a00268d07fa249b0bf545dfbf01bea2f12b30738c6e13156244eb24e6d69ba7c3acdbbefe8bbc06b821aebf836ca07a3cc7b6b24686ed8f3b23085c893e72188b797651c5ab5cceb1465414a325f793a3af6d06eed7eb734ad05bc1f6619e8485259f570a482a67273ee01fe15dd938afce026f1111c7a38ed6d1aba34f009ce1e99140fd0db2de74150541fd48dd2ec5b1d15669de2ffe3a198184b6186ccda31aa64c585ff8cb65b67fe1455753895a88b6ab4c6bf1bb8329739178147e6f15801bfa707bd9ec9da662573ce07af684bb7c880a7d63b0a0a7300881408c44e95c679ea32b0eab845d0b333f245e8d6006258678704aa8cccdaf80cc46138d5b7a0804fdfa34c91d61a0d2fa6c62e7d1a675e5743f845ab40ea5df0182d6eb9781905c94751c75a411699a76f48433142c5f109d5dfddcc0b1dc6254efd5ea50d6ffbc7b9ca031e1a0123844b63c48b964645c6d24707582825e219bcd61677ed4fc45ee1f4be91b4c1b856d65a86acf22b8b0d588bc473248ac040326b1490c2fea24bc0c0a721e2ed63e39973cd4d38df1001dba9b9d995c229655dd26f3cd3d64077ec111e2c370717cb4cd068e0d3a52f1027d3df953e1f1ac768a7215a3695722b1b6714ce43801451a9532212b651d073c780d61712aebadd145c1cd95c1dc0dcf51850046ae5771e365f45858a36e48afe563ec0afee3803ff6a35bc25217b53eda39bb813b8d3d728c21a0b80d014003143666c0d1398cc46a01aaaf97117edda217f984010e7c5cf32535a669d4f11f6b70e3a3b823987ef7c9f878415063bf05205e13bcf7acb287bd0bb0fce77529a711f0ed145ea2ecf2194658dff17c5681cf8c7ad8521d235a705292af4878b3f124be2df661026c091d6c07aae1a74c919f7478d1083f70b3a0fe00c2e220ab998b4595268b6f7cabbfc85e59dfb6ab7a794cd3fd70d5cc4d70ca933a4452df5a345cb31f3267de53519ba39c915d492cd4652843f1d30a5fb311e3b5d868347969f013c5e3b4841b22240abcb61a14ff567186766ce8f6ae64877f672835dbff4fcf19c8230d8a402397630effb698a8b0c9a28ae028d7938ffde488fd64113085bce504cd0551e0eb3730c3f781cbecf0c41d2338766d3f6096661c1f1bec3162b8a0c4099fccd9480e821df8782c2e070530befb62bccd8539fe9dc7d8d3f9bded1bb34db3f2d6050885c8f1d57f5e603f629de7491f5fd9fafcceb565abeaec838b10a763a00a4607d4330bdcedc066d8cf9790d806e03c219866bb8f053a6e602645436d1f469df1d5008f5dcd4bdb7ce5b76ec015a8f4693cb2a63ceb2be00bcf221f0ca32db4efaf8f7022622b335fa8dea4afdd86be10be6c4d66e5f57416add4480509cb98cf31cdda84644eeb782eea041d4bc0e005a20bccc3c4a08cefcdb91cc2c61d9231c4e36e96f6edd2133f9b34e7da90ce20d1c60ff223c6a204bb942766a359b923573bbbaf2a827d79e4f649e79a840216ac4ddb3409c94e71ff08d109bc3f0cf6583219de7d7131a956f835ecf5c131a0b1e056a86d800a0204243f3b695029578c064306a31db53f28a8f0c0302486cd05970904e9b5c53100ac1aabb3110a89820e4d8307c3d46084999d0456c53fec61a9242b486eb41a90f3300fdfd0d8a472e8da7a842588721d1df1f5e4cc425efebc75a904ef4cc881346a4bc23eef4d492e3efccebab86ae4213f42671370579ee7f8341396e9515619e100a8fae2c5cba0139a088579ece7a603c8b8bab9998223fe862dff8480aeaa5970c90b894e5f71c2784e4dfd50ed3e9ed91036e8356c09464de13b4a95227203133b2c2c71cd6323492f083bda58ad7721b6666b9cd93f93f0288482813fd8aade02cca81cd35257e023504ac4f86be1c7a810b67c6d7077f5cdbd305b618a05c03d196894bfb1a6ff511e59ac8ce45d16cee95e1de0797a543728caaa43e5ae42a12b6bb7910d18d4e1ea89d264491287eb23a76095a12a39c46a7c85349e2969edaed3c1fa6a2150494f63f4c98c65fcdd650ac7424ac1ae64421294356ac1e4dbf9d4c817f081f4f7751ebf56788d799bac29dc0bfe83ead7ab3e338b8b84df4cad2b549aaac4e6048a6fa8f8f6f1f7e0e51c8b3c872f18c466e590222b03230f46bc8e9a0171bbd2096c7a480d6a6f29bd74b60105bebda42e59cc830c4b31f6c52687b4ec2ba869149ae363d711d099f94ceade1ada193e931ed9aea0a280ed5f25ad5ab3b4083f140ca17b43e5f6aef2c24a28a0262c80a040187e052ea7d54a528b6fcc176ed3afc07fe6a661d050fb4a3a6abfa3dac5f3230540b45af060781cb5499c2894d6a4a2bf908ddd48d6b34207f56c31229e206c88db3552ceb6e82a0fa2bf7f97baf603d37d6a8b1f2b1f5f95b251129ed05351681908b7cf5cf6cc86dd854174cc19713b4d262b021952b6da5f20f57bbacca62f5b7124409aa625bbea59819baebc1bc2dd188feba48c998d0dbed60d44b8a4f0ac28f6c1c8c9998f7406f1a34e4ce902be2420f7ff51a5ab3b1faa86ab2ec1edbea2493cae090abde43ff27d685c993dedb24eb255772cc56fbd104f4f5275f10d54d7cacb8cbf188ae1a4d29ea880068fb2696b3ba6e8a7c15939e1f7c394ab4bd4c4bef2383121cbeb18646a8e013d570cee3eeecd7fbe84a619f8aa2e34f2e1e9b99d0c7d7d179d9df8d2e2f1cd7ba2c7e60166dc14e5e4ed9c41195935e2884b5bd0057ed0155a5d4c6482e8f554e4cd0d0aef7d6487801ab54d54eb41755d833ab83883b40f47595063ad2a0fee5c661f86b8ab04ad0047d988ad86b3c520eb78dc3d750a57e777f5d766349f1a687e090f744206cb5d048346061b414060f6826d8a884e93f73f1f1f4cb8bd6e8d1215d436d390dbda35b555f550e11e6d8008fce1c429bd9bbd04a1fbb9de28663c1be4d8d7e506bc681ada28a69014b972919b5f70cbb770349324c9af0b7ee7ff4cc8bfe807fb9faa0a69498448b22192d578a1e82582b943051beb543ddca8b643ee6c76ee32278aa8bc92b44a8439a24ed5040545349ab05e831d4511a8da03ca539659585b2267a73775f1cb7c2c5548d3508c896f99a8e5cb55160ab1267e320ac2d7c8f8b57079dd14d301636a1374e24541f8d453978998ed256b381bcf638bb372ce1ebefb341656c02f4092a7667ffec5505e4938dcb03d404654430e244f9f7f7d0fb4189a93f7c2bd7a4fcb3ccff79e41a98adcac3e4c19eebebaec15bd8cea1df0e509cdef62ae10c66734d162caf35a6e511baa717f769c2e449892224fa8ae78de9138cf6ea1d939998a8cb68b0e83cf604e03b99634796d3d495e4617f8fdd9764631e7ed6eafa797deb1159259777bf2915d48b63286f6d6528ad4ca5783609263d9a03aad41ec8ef1e2e1e77734d27229f801192be238468854945c20dab4e1baff9dd593361efda1de95e04561d33cd73a45dff5f85b2e85b0747a49345ac8d38add8ef9c14685eb3d3432f3f994e3ddd4e45b16005870485253afc4f08d8a6d8023b722284d11d56c6ff9209a5bacb7ce1708244bd21878b8cd5c13ab453bd589f6196322de9faede39ce6f94c75d008d2d7ced27a2375cc62c3d5c15c1c4301a01299d8f4c41e5a44e4130e9555a356d6b19728c7d3c86cb9a1ddf906ab63a9447f8233bcd09bd74cf9749f085f0c4689ef40dbc41a7a299f0f891d9d0d3e39409d4d774da53bfb6e8ce668ce50885558e909add2cb9bda2f7e9232541b1a7f742a99740f486ef4f7c98e4052f2da705c56a18d5a8289ae6cbb9dc7de13a8cf420b7a930abaae813b40517d84ae984dfc94cd1021e0e4a7a9e7de841018d474083ca28a829ee03fe625cafcbedadcdef6621ccd679fcd9c9a9ab2136211f8c9a679895aa39facf2d6668e5098b3dd8e0ad78d8caf250dc38f2c9518bccb353ef3418d3906827514c1959d58344ee11a0ef1c1424495cc1a9910187685a47d6dd91f07e5081c5ac3f1b6e363069694dd9072684c5ab0ba56157c10f5fa8409e5bc43b38b31f24a306ca5f7e3de9a392eac1984e877ecb3dfd044f1449b4ae9b586051b1780c0ce462919f4a4b54ad8011d013c3962fc6697d33c2dc6771fec664c82cb16144619b207deb4391866d6c1976b945c5959d19018f15376ce3b05666747743527f22b54171da4dabee2f4e469a5521067de4f92e2bad02e15e812b6cbd27ec88a9eccf600ce7f5643392da9ff6b6412f8e7c68d8c8b9e0006e41777e2a1363a9556befbbb110dff3a84b179da3838acde0b25f53798733a9fb463d76b630aef7c8a43f6219482b34b893fd99cf3a013ecefde7c5c6528e304c1868ff3fd8dd5aba348a05dc950b1c4c281cbb28b800d6d0da180fdee06ec3bad6f97180295ed1d77078156a885b5b0c501ea563e8871adb97dd6052de0ab369bf2d98f434bb2d172d9967bb73d3eba6b52bb8d55d8963bf58d310afedb51c0f94c7814b6da30fd8056ab7be74ac31b1b75c217e3ab93eadcb2d253e5d8bbe47c0f1a411a9e502cf4301d898d905cd5db828e56a722394fa11cca64a03a42e7fc1b3481b71ca0b6a3d9bd1fc8229f7f9d3e6aa0d48051942579fb759201d4715db9a2d399e0745a66dbbd571accf1f2e15573ce832e91bd1f042ab758d9ec13e354f38454cc42668c8d60358916f7e937015f6c38732bcf6131ecde001892cb20fe47153e7e23b1cd2fc4a22662e7bde09f7df10fcbf475783fe23a0fdcb2c3bd8b28453ce523ac19ff77e68c3e9fa0193b796ea68f44132b3a96adebc04181e503f52be4778ef422ce3e6ca38514fa18b500ca518590479e8c73a7942dc2e237d82cda953ae1b296b97ee8ed62e2e755d6ddea7c0334e1b8d76c278bdc454724003106cb6fdc85340d1e784ac8b6551eaabc33c502163ce0d401627bd22ba6be90089372bfa3f91ee745e45844ef8dc0fe3936bef07f9c1d3aadfa4c8e99be6b038bed6beb9597add881da2acc1a3a471f500d68f639cd2bf6f4afab919a2cf747bcbb42b95684e8741b485c3297cf07c7bd98d6653421b61f701a06b82be0fbeecd32eb00feca9c5732bb5e565bccf8c9feb27a50760a785bbb50402768cbd458811e284a604b3374faf3480e1736743665617de9c32fd10e37105ac6dd5303f1a6dc78950bce56215c2a2f9e0ccbc0bf9fe8ccf7647ed29e2aa4948689d681a7a9fe582631338f3eea3df846f28564038ab75aa2a8ee5416b66ceeda9d8f56ecefe07f6a21ace83a2e15ad408d0a480f56708e3d1c96020b124c58f6ff5247f73aff7f77d389167650b8a0b98c97f87a1e5d6c08fa99874ff144bfa905e9da3812f010eeee00f3c9b594450faab5342e1b6e98fed5714a802b67b3e5b1964a62606aacb8222efd4980823f076675ae859e64de7b08f7a0b3d8bc829e1a93eb3b4975b4761cd7fa743e393da537c91f658ea2b23c94244498cdc4bc32c8b9859b9d9792eeabdce635b2d61c311949204826054dba0880505e2b53cc3521fa8b68bbba2ec05050bd3244c02752af1555625ddf50a3656c0043005c43c26a2dc907d5dd67efa831ad974151067b436a75fe99b8c94c9ca9737279fa1aaa09b0108c48c79c7e4ec1eeccfd43aa8e7ab6cacf5a956fc47d4ce77fe719d6eec1730d3e3b3be71d313f644177b6d16df0180848c28b850fbf71168a1ee4e5639bc46f2555b3984dbb91520538dfa6a1905abfb7238ff344d0a7d760f040718a57cfb56634e7de7584097f69f87630693bcf410796266cc3f50302feacfb556bad2506b7191023817527dfe5973101712bda922472076633133a11a76e8bc7d763a2cdaa53fa8d47d442fcc572f791d66d10d8d6a9058ecbbcd6d3dbe45d67b75e1091dd0368bea33ef0f56ba68885630429c24800922062e1066f2d4c4b795332ab03239548df4e6e01c432fe5eb29e8e63f6c7ba4f2edefa208c69e781786e4717c2f71dc2032a98cf1e6d66c10831e17ee776edc6b060ae20d025dc570a88e17da771acd32b7b93d46e43a917b8e2ba8232ad2707324b9b04dd8ee50c3c5a4372c0b1461ab2b7424faf00c7162bd8e8ffc7fadcb055403b0fa7087226ba4330e746af97a3f915f0b9e105759e81fe94a0df0cd6c324fb0b871491b5516c2fbc82c77b07159e3f4c0b7952b74cb4e203a69f241485191e1afc76d12a56db065b0513a41582f655340603c73cb39b728c97d1e919ecf963b91ec2282d25dc426db873394055beb0f9ba20545e2465ce2d0d962f42e1e4c79bdea4cd2829269ff7ef650bbeb5083d39dc7aad668af0b01c521192c548857473b29991f7bb917b5814fe945f4c3ed9bbe0563f4004b391b76860e9fd6b7c0baae82e4ac033f62a2c6ce6a2311b8700b06b5215e604a9b99d37e00450fc7790e893176e9fecda220f838a078a8ef7da7d499b1fe0eb8780c4b9705a6a10674e61b5c228fae1c13488f98c10c1792fa40229dba44b1cb534f9fab6a14407687761d738c91f4b8d4371a1de1a47bde0563a6fc88c4886be5d48c4cb89078c255eb1639598379daf50a672cbf4d8add2d4af6c02aeb1d0f86b611abd363409c7c7fc0b66f307ad3df24241fe06d0f7617d6c3987bb9e5d8f1712aebf095fad19b3b4fcb9cc4fb39012f333c4b040666259ee7bc43cff299a527a8914d71324e91c774b84e9392e615453e9fc648c539059b66f780c888892fe8b30eba799ed18fab08ebc3b9da8bc12a249456351bc0ebafc9f54d5d24697fb53eeb5e734527d690620989f605f57dc65a15a754d304be592acc616cd528b6986064b4457b96cf1fb0ab383a0585acf9887b18e1d6d3aff1e7f2328ea0313a2b36f6f79d671d9ddc4d34fb8fb55a596b2a16c63757083fb4bd01be2e1d82e47c5a44e052279097c5a18feae9884e102cf087611a3b94467ad61635dae6275974f6e6ca7a42ded0ee4577574d56b142853a8c955d92d1eb780de11dc9289acd193214ed4c9f5f26d0481cb3c0c0b8d4c9ad929c61ffeed66bf2e4f7018049593b99358d93559847d55654cee93da30f6578d2e295909791d227a12c09cd4a0edec25d3155086b64a787997a53265cbffb7fe6a2bfd589e12b4d0e21a600276e920397888443584aa99a06d7cfef8e68eeab8fa739c3d8fb74581ceff295110742e763320bed3a4be982b3ebed15ecde37e849aaa91959327d25149f38854ea1137f870aff99979e5e74cc9e45be12e3f0f9912a0955e718a4917e835bca50f43ce92a6bc60ed006b8f623fbacebbfb3dcb4fabd9941a5487c6f637de9a2005a6bc4062e1210a08a51d6f8a5e3f6f97fe90dc7e2e21d4d2f038c0fbc1918aa00e230a4a0e5c41a4808fb9a731271fcc1e73713c9592aa4b2ddccd0d13c3cb68d51166623153445c9ec955c6870dc8543c0684883186082e34ea5714febf8b46921015c3623220d17529896e1a6edac6e32fea2ba30db203238300353602c17dddad7608cad8170b520f6d9d32cdf0156a1de4e9b9eea78f73255ddc6da6994a6018ff900d9886590602ca6a072d8aa5645e2adac0744e2d5b2e1038c746635d5814692c3498aa9043b68f8ce79c44678c5a7d5bc26c085475853b229b2af3dc822ec58047f313c778aae2b64995148174e42908f3ecacd3921855790c0c5a25814416930293010b4f917979d837f4ef9d2d6dce804f5c0926244097746252124a6e0055559ffab197c38778f717362152af8f6dbf7ee03df050ab9b8909556691c2c2775f0f9c26a545db7ba698a4ce37de877705ea97ac0a002db274ea8360a4aa732c2d5e7417138c60cbea69d3b4993ada6a9d8f51d851543a6500a31bac5a057dbef498001f08a44e3c4141900e18b6d73c28c8c67dca805edeb5376384cefe75be1f127225e4d9724b7047d68fa2ed4629e91711a37c80158a07dbce78918931402b472a98a5d5c6b66a2d116314577e94298c37bc441499a9ecea132d87c5d305a0f8f0b3ed16f3b820941082c73b28391d8482ca0cfa78e1e09aa588b0eb1849c6c7916a6bbe56134a6bd93ea306dec125982628dea1db6d022d210627959e1dc819c841f173ed25f356909222e481a1ebb31185fbaeacbd359d2779efe4554ccdac7f4bcc528f656a45049331e16e9c0c796423ec9c7cba15c69d4a8a7741699910f33cc9798a8bf1e48182f08029a14d0131654fd388225d7509e1d7a484e9c7df34d1680bfc6b8d1f6f3920cc4113509fe42dfbd6b261000da9651f7e18088f6c2564472046e5eb7e8c9f8b5286a7452741a7103ced710bfb8e699fb8b1a85c0ae887cc06ef2ff9e2a2b1a77bb4d44ddd4a4e1ba60afcb92baaef108b60486d409889cbb2b1cc77ddff7e4b6caf8cf3488764d84bf3605eb9df709ac6cb36d1a3de89cdd6657f0e6b4009e6dac5d9be14f4ed997cf61e5aaec932520c321359cf286adf6e2dc3094794ae61a4f16089d06e3dc62c958950e73213c1e865c894fe7b8a30de65f5534a1e9c5d19ed49397980126322cb9c72c46a86d7487571300d85b3b5661555f20ab63a78f846c1b8f51a19610a11ffee44f7ccf0f1d67f4148b2c828d74c7f3993965c9067114467a71d242113a68574e28601fce343a023ecc68a72d75259f9a5dce144a7f61ef327192f6474d2bbd06fde3049fe7fb306ba3f54337008d7dbdeaf28a37a224e38ade23adb076cefd3148efcb62539a96d4dfc53f369e34c3d493ac3a5e8c8881133be630a2a906703da62ce7cc02ace9f666d6c3d4b9763a83548825ee1efb54ee3475b09e2616c5bdde3d193181bf020e8ac9ac25f32604b6c11de8ad1a15b9f908c6d7e79181aad1d741b7434aa92597a835c53b9e4b61d6069fa4ee921824d17c98784a8c04590f8d2cf877662b410cae4ebd1ba3616074c020d8cb6099a095735635490d318821310ddd016150edb80370b8d4e2f05557fd619b17192c13353cdae76d495821c610c8641e5b3dff1e7f2ea77b17810ca7975b8e36b7f501a8710b326ef92672096ef66598510902fe663e2a9ef00c3a052f1cfb1739fccb4371f8f28bb92654de5bf87cc2863e92e6d7e4b45d773f90f434eafc8f8398a48527af829a6cae359e7af5941bef158f53798058351107ce58f79ed21036770f6e10e7da92bbca25f369ee83a0f894bbf366a1361f8125b4ffd8e8b4d47ec68cd6b37c840cc5beb8cf65b2269ea1a0e9c371a571f30458ff8ad9bbf8723c19ddae1de5ca7461a436ffcd103c01a20f3252ba0965ee928cfb0d002b9aa4d4f20c805b77e67c8d991c4d07e5419bec9626a32c115d28253dd5f16c17182c1779edf49bdfe3823d87fec88929801163a27bfaeddfd8cdccae8cc3bfd6a9f2e2fec5971fa560c434debd434ff4d0058dcb05d9f3ac5193c458472d6d1685f9f46c8864900c5edbaeeee08971ee1c087f2e11467ff4766743bccf9e3414feedd6dcb904b92a05eec5de8db95444b920c995c770edcedcf7bffc48836c8f30037dde47f0e66fd79550de0ebc3c0c3eba0b66e2a353542eeb20397800e5f41635c5ec2f9a271461bcee8e570ddf945b186f15ab5cabe2a3123189935c6b9010b31732c425a9b2582b097486a5a7b1880b2f16104484e1ca83fa9c278b87e30e4b0cf6ed66c87a979c05683ac94a295d1c53e6f0975a079dd9a2825fdd6ae0926ba1a69f3f69f408eea9d00fbd43235a52c53d11963a611b81dd9f5e05582e1822398873e883662a64c225be19e0b85e102e23fb73d5dcb11435a5437d7418b0409f2e60793038f55ed54c79882b3a17e74ae2148bd558d131dbf446edeb0d05353492534e216761cfcf6582d066a8235a2bd5eb383350a52d7fc2761514e27b6125cb3e387c103dd62e31f5b789c217811c80ccbe3f10fec7a19ad32dc9271368b6d6ba549c45dfd8018507c40962b6ac6468c3078edb71d8ec7f728be8cc23dea1139ac30c2e8d0fc077280e420fbbffc896863db5f1e76922d7dd8e4479c1be822e74212c6f74765e108f916a1b83f6efc8ea54080e9a28b1ba5813a1fefddbe2d0cda413ee1463985b51b59f818f440c9b6a10e4ebf71d37995ae9694ba5867ca2eb2f7bf4e58d26149f2b25943fba216beb3de1f954bcf1bd32ce358b5d23023ab456ebbc493ead41e25b62b5b4ace6c5c18c9a8d512a9cbb4dd59f33663f6138d6b06bc8eb1ec9caccc0077b2e68e7a09d412dfa352e7e5c3942b710ab1648e16d0adda424d9fc2d15c619f4e8093c2b9521e4cdb3f22e655f52ce0fcc1bfd94e56cba8decadb68214451be53f9286c82d2a4912bd2394d1133be908409d791d6d8c2194ca37a76a38d6d0a1fced6478848891d9264cfc08fa849d720339ce00977cad8d9738372184098a7333dd1564d1d7754b4aa4afd6217585804159d31f53017869cb78b718c837b7fd176ce19e3d6996b6f055ed3ba7cd55b0349676c0c113c33d070081ce4ef29af156c4ac8ce760013688d0295d90271e23ef3ca10ec2b3b889855a153c867ce79297a10a02d21e5e8995fbc10d2f4d4bf521565376053b80937bfafaac688108f9962b7c72cf0111874ac8ae27d024ee2f9d57f15b9910a7486ef7542c6629fb0520c93a445542d", 0x2000, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000580)={0x20}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./file0\x00', 0x26d01, 0x0) write$FUSE_NOTIFY_STORE(r2, &(0x7f0000000000)=ANY=[], 0x2d) dup3(r2, r0, 0x80000) 1.804192218s ago: executing program 5 (id=2893): r0 = socket$l2tp6(0xa, 0x2, 0x73) bind$l2tp6(r0, &(0x7f0000000000)={0xa, 0x0, 0x1, @empty, 0x0, 0x3}, 0x20) connect$l2tp6(r0, &(0x7f0000000f40)={0xa, 0x0, 0x0, @empty}, 0x20) getsockname$packet(r0, &(0x7f0000000140), &(0x7f00000001c0)=0x14) 1.748957329s ago: executing program 5 (id=2895): r0 = getpid() r1 = syz_pidfd_open(r0, 0x0) fsopen(&(0x7f0000000140)='sysfs\x00', 0x0) setns(r1, 0x24020000) r2 = syz_clone(0xb21e0000, 0x0, 0x0, 0x0, 0x0, 0x0) r3 = syz_pidfd_open(r2, 0x0) setns(r3, 0x24020000) mount(0x0, &(0x7f0000000140)='.\x00', &(0x7f00000000c0)='sysfs\x00', 0x989, 0x0) 1.627972779s ago: executing program 4 (id=2896): r0 = socket$inet6(0xa, 0x3, 0x8000000003c) connect$inet6(r0, &(0x7f0000000180)={0xa, 0x0, 0xc, @remote, 0x9}, 0x1c) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001680)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x40001}, 0x4040850) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a48000000030a0fdb00000000000000000a0000050900030073797a30000000000900010073797a310000000014000480080002403cb140bb0800014000000003080005400000000014000000110001"], 0x70}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000840) sendmsg$NFT_BATCH(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000cc0)={&(0x7f0000000480)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [@NFT_MSG_NEWCHAIN={0x48, 0x3, 0xa, 0x801, 0x0, 0x0, {0xa, 0x0, 0x7}, [@NFTA_CHAIN_COUNTERS={0x1c, 0x8, 0x0, 0x1, [@NFTA_COUNTER_BYTES={0xc, 0x1, 0x1, 0x0, 0x100000001}, @NFTA_COUNTER_PACKETS={0xc, 0x2, 0x1, 0x0, 0x8}]}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0x70}, 0x1, 0x0, 0x0, 0xb0}, 0x20008894) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x33, &(0x7f0000000100)=[{&(0x7f0000000000)=',', 0x584}], 0x1, 0x0, 0x0, 0x2c}, 0x44004) 1.409988081s ago: executing program 5 (id=2899): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000340)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_MESH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000040)={0x30, r1, 0x1, 0x70bd29, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_MESH_CONFIG={0x14, 0x23, 0x0, 0x1, [@NL80211_MESHCONF_HWMP_ROOT_INTERVAL={0x6, 0x18, 0x5}, @NL80211_MESHCONF_HOLDING_TIMEOUT={0x6, 0x3, 0xa6}]}]}, 0x30}, 0x1, 0x0, 0x0, 0x4044815}, 0x20004004) 1.38142954s ago: executing program 4 (id=2900): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r0, 0x0, 0x0) write(r0, &(0x7f00000002c0)='\n', 0x1) 1.239994s ago: executing program 4 (id=2901): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x3) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000080)=[@text64={0x40, &(0x7f00000000c0)="2ef36644f7e62e3e672e450f078f29d095abaa960000b890a4f084ef66bafc0c6d8f297812cf66ba410066ef48b800100000000000000f23d00f21f835100000080f23f866baf80cb88ef01480ef66bafc0c66b80c0066efc7442402d8650000c7442406000000000f011c2466ba4200ec2e64f30f5a8e6c000000", 0x7b}], 0x1, 0x52, 0x0, 0x0) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000240)={[0x3, 0xf0, 0x401, 0x3, 0x4000000000007, 0x4, 0x7, 0x80000001, 0x4, 0x200, 0xff, 0xffff, 0x5, 0x7, 0x8, 0x6], 0x0, 0x2a80}) ioctl$KVM_RUN(r2, 0xae80, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000480)=[@text64={0x40, 0x0}], 0x1, 0x3f, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 1.16505361s ago: executing program 5 (id=2903): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000100)='vhci_hcd.0\x00', 0xa) 876.690065ms ago: executing program 4 (id=2906): ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r0 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000340)={0x0, 0x0, 0x1000, 0x40002, 0x393}, &(0x7f0000000000)=0x0, &(0x7f0000000040)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(0xffffffffffffffff, r1, r2, r3, &(0x7f0000000400)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000000c0)=@any_dev={0x3, 0x603, 0x0, 0x0, 0x1000, 0xb6a4, 0x0, 0x0, 0xa8}}}, &(0x7f0000000180)=0x0) sendto$packet(0xffffffffffffffff, &(0x7f00000000c0)="37031c00", 0x4, 0x4000800, 0x0, 0x47) syz_ublk_setup_queues(r0, r4, &(0x7f0000000200)={0x0, 0x1463, 0x10f00, 0x2, 0xb6}, &(0x7f0000000d40)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4485, 0x10002, 0x401, 0x31c, 0x0, r0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7682, 0x2000, 0x1, 0x2000008, 0x0, r0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x68ea, 0x10, 0x0, 0x90, 0x0, r0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x16e7, 0x20, 0x2, 0x40021a, 0x0, r0}}], 0x4, &(0x7f0000001540)={0x2e, 0x6, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x72ccfb459c83c565, {0x6}, 0x0, 0x0, '\x00', {0x3, 0x48b, 0x0, 0x0}}, 0x0) mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800006, 0x7000001, 0x6e073, 0xffffffffffffffff, 0x0) 641.885518ms ago: executing program 3 (id=2908): syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) socket$nl_netfilter(0x10, 0x3, 0xc) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x19, 0x4, 0x4, 0x2, 0x0, 0x1, 0xfffffffc}, 0x50) r3 = socket$inet_udp(0x2, 0x2, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000280)={r2, &(0x7f00000003c0), &(0x7f0000000080)=@udp=r3, 0x1}, 0x20) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0x14, &(0x7f00000001c0)=ANY=[@ANYBLOB="18000000000100000000000000000000180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000007000000850000000600000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000fcffffff7b8af8ff00000000bca2000000000000a6020000f8ffffffb703000018000000b704000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000002c0)={r4, r6, 0x25, 0x2, @void}, 0x10) syz_emit_ethernet(0x66, &(0x7f0000000880)={@dev={'\xaa\xaa\xaa\xaa\xaa', 0x33}, @broadcast, @void, {@mpls_uc={0x8847, {[], @ipv4=@gre={{0x5, 0x4, 0x1, 0x5, 0x58, 0x65, 0x0, 0x8, 0x2f, 0x0, @loopback, @initdev={0xac, 0x1e, 0x1, 0x0}}, {{0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x880b, 0x0, 0x3}, {0x0, 0x0, 0x0, 0x1}, {0x1, 0x0, 0x1, 0x1}, {0x8, 0x88be, 0x3, {{0x7, 0x1, 0x9, 0x0, 0x1, 0x2, 0x2, 0xb}, 0x1, {0x2}}}, {0x8, 0x22eb, 0x4, {{0x6, 0x2, 0x6, 0x3, 0x1, 0x1, 0x4, 0x2e}, 0x2, {0x5, 0x5, 0x3, 0x7, 0x1, 0x1, 0x2, 0x1, 0x1}}}, {0x8, 0x6558, 0x1}}}}}}}, 0x0) 587.031907ms ago: executing program 3 (id=2909): r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, 0x0) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r0, 0x89f6, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000000)={'syztnl0\x00', 0x0, 0x0, 0x0, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @remote, @broadcast}}}}) 492.030354ms ago: executing program 3 (id=2910): r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000180)={0x2, 0x898, 0xfffffffe, 0xe}, 0x10) write(r0, &(0x7f0000000000)="1c0000001a005f0214f9f4070009010000000000fe03000100000000", 0x1c) 480.425776ms ago: executing program 3 (id=2911): r0 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_ADD_MFC_PROXY(r0, 0x0, 0xd2, &(0x7f0000000000)={@empty, @multicast1, 0x0, "12ceaac82bb7d944e8496fbd6178697e3b10c9b81bede26c85ee73daab4158e8", 0x2, 0x6, 0x4, 0x4}, 0x3c) 346.009918ms ago: executing program 3 (id=2912): r0 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'ipvlan0\x00', 0x0}) r2 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000040)=@newqdisc={0x24, 0x24, 0x4ee4e6a52ff56541, 0x70bd2e, 0xfffbffff, {0x0, 0x0, 0x0, r1, {0xfff1, 0x2}, {0x8, 0xffff}, {0x8, 0xfff3}}}, 0x24}, 0x1, 0x0, 0x0, 0x40001}, 0x4040010) 0s ago: executing program 3 (id=2913): symlink(&(0x7f0000000040)='.\x00', &(0x7f0000000100)='./file0\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdir(&(0x7f00000004c0)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000140)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}]}) rmdir(&(0x7f0000000040)='./file1\x00') chdir(&(0x7f0000000000)='./bus\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mysys\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./mysys\x00', 0x0, 0x0, 0x0) kernel console output (not intermixed with test programs): to open report descriptor at '/sys/devices/platform/dummy_hcd.3/usb4/report_descriptor': No such file or directory [ 692.232590][T14037] xt_hashlimit: size too large, truncated to 1048576 [ 692.275178][ T29] audit: type=1400 audit(1785373679.457:1205): avc: denied { mount } for pid=14036 comm="syz.2.2263" name="/" dev="securityfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=filesystem permissive=1 [ 692.276937][T14038] binder: 14032:14038 ioctl c00c620f 200000000180 returned -22 [ 692.316656][T14039] CIFS: VFS: UNC: missing delimiter between hostname and share name [ 692.380217][T14039] CIFS: VFS: Malformed UNC in devname [ 692.397174][ T46] usb 2-1: new high-speed USB device number 83 using dummy_hcd [ 692.400293][T14039] netlink: 'syz.2.2263': attribute type 1 has an invalid length. [ 692.598017][ T46] usb 2-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 692.608845][ T46] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 692.633672][T14039] netlink: 'syz.2.2263': attribute type 27 has an invalid length. [ 692.819676][ T46] usb 2-1: config 0 descriptor?? [ 692.936881][ T5712] usb 5-1: new high-speed USB device number 86 using dummy_hcd [ 694.816114][T14029] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 694.884369][T14029] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 694.902400][T14039] bond0: (slave bond_slave_1): Releasing backup interface [ 694.918110][T14039] bond_slave_1 (unregistering): left allmulticast mode [ 694.934775][ T46] udl 2-1:0.0: [drm] Unrecognized vendor firmware descriptor [ 694.958723][ T46] [drm:udl_init] *ERROR* Selecting channel failed [ 694.978281][ T5712] usb 5-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 695.013282][ T5712] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 695.039083][ T5712] usb 5-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 695.131923][ T5712] usb 5-1: config 1 has no interface number 1 [ 695.138358][ T5712] usb 5-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 695.164963][ T46] [drm] Initialized udl 0.0.1 for 2-1:0.0 on minor 2 [ 695.171740][ T46] [drm] Initialized udl on minor 2 [ 695.759101][ T5712] usb 5-1: string descriptor 0 read error: -71 [ 695.766174][ T5712] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 695.793435][ T5712] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 695.834385][ T5712] usb 5-1: can't set config #1, error -71 [ 695.904128][ T29] audit: type=1400 audit(1785373683.057:1206): avc: denied { unmount } for pid=5613 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=filesystem permissive=1 [ 696.127777][ T5712] usb 5-1: USB disconnect, device number 86 [ 696.241564][ T46] udl 2-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 696.297317][ T46] udl 2-1:0.0: [drm] Cannot find any crtc or sizes [ 696.395728][ T46] usb 2-1: USB disconnect, device number 83 [ 696.406837][ T1185] udl 2-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffed [ 696.425604][ T1185] udl 2-1:0.0: [drm] Cannot find any crtc or sizes [ 696.620235][ T5712] usb 5-1: new full-speed USB device number 87 using dummy_hcd [ 696.789558][ T5712] usb 5-1: config 0 interface 0 altsetting 88 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 696.825194][ T5712] usb 5-1: config 0 interface 0 has no altsetting 0 [ 696.847641][ T5712] usb 5-1: New USB device found, idVendor=05ac, idProduct=0265, bcdDevice= 0.00 [ 696.872725][ T5712] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 696.917781][ T5712] usb 5-1: config 0 descriptor?? [ 697.230737][T14085] x_tables: duplicate underflow at hook 1 [ 697.535245][T14091] binder: 14086:14091 ioctl c00c620f 200000000180 returned -22 [ 697.987454][ T5712] hid_parser_main: 31 callbacks suppressed [ 697.987474][ T5712] magicmouse 0003:05AC:0265.0020: unknown main item tag 0x0 [ 698.104002][ T5712] magicmouse 0003:05AC:0265.0020: unknown main item tag 0x0 [ 698.139959][ T5712] magicmouse 0003:05AC:0265.0020: unknown main item tag 0x0 [ 698.174484][ T5712] magicmouse 0003:05AC:0265.0020: unknown main item tag 0x0 [ 698.204540][ T5712] magicmouse 0003:05AC:0265.0020: unknown main item tag 0x0 [ 698.227800][ T5712] magicmouse 0003:05AC:0265.0020: unknown main item tag 0x0 [ 698.248121][ T5712] magicmouse 0003:05AC:0265.0020: unknown main item tag 0x0 [ 698.266198][ T5712] magicmouse 0003:05AC:0265.0020: unknown main item tag 0x0 [ 698.317855][ T5712] magicmouse 0003:05AC:0265.0020: unknown main item tag 0x0 [ 698.334769][ T5712] magicmouse 0003:05AC:0265.0020: unknown main item tag 0x0 [ 698.470205][ T5712] magicmouse 0003:05AC:0265.0020: hidraw0: USB HID v0.09 Device [HID 05ac:0265] on usb-dummy_hcd.4-1/input0 [ 698.485549][ T5712] magicmouse 0003:05AC:0265.0020: magicmouse input not registered [ 699.037149][ T5712] magicmouse 0003:05AC:0265.0020: probe with driver magicmouse failed with error -12 [ 699.084749][ T5712] usb 5-1: USB disconnect, device number 87 [ 699.115467][T14108] fido_id[14108]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.4/usb5/5-1/report_descriptor': No such file or directory [ 699.180453][T14111] binder: 14104:14111 ioctl c00c620f 200000000180 returned -22 [ 699.724273][T14123] : renamed from bond_slave_0 (while UP) [ 701.050233][ T29] audit: type=1400 audit(1785373688.237:1207): avc: denied { write } for pid=14103 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 701.346710][ T29] audit: type=1400 audit(1785373688.527:1208): avc: denied { write } for pid=14140 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 701.375764][T14142] netlink: 36 bytes leftover after parsing attributes in process `syz.4.2285'. [ 701.643967][T14149] netlink: 36 bytes leftover after parsing attributes in process `syz.3.2286'. [ 702.501586][T14151] genirq: Flags mismatch irq 4. 00200000 (das16m1) vs. 00200080 (ttyS0) [ 703.560865][T14171] loop6: detected capacity change from 0 to 2640 [ 703.632834][T14171] Buffer I/O error on dev loop6, logical block 0, async page read [ 703.749808][T14171] Buffer I/O error on dev loop6, logical block 0, async page read [ 704.292054][T14171] Buffer I/O error on dev loop6, logical block 0, async page read [ 704.315090][T14171] Buffer I/O error on dev loop6, logical block 0, async page read [ 704.406718][T14171] Buffer I/O error on dev loop6, logical block 0, async page read [ 704.525669][T14171] Buffer I/O error on dev loop6, logical block 0, async page read [ 704.539434][T14171] Buffer I/O error on dev loop6, logical block 0, async page read [ 704.723088][T14171] Buffer I/O error on dev loop6, logical block 0, async page read [ 704.735936][T14171] ldm_validate_partition_table(): Disk read failed. [ 704.834636][T14171] Buffer I/O error on dev loop6, logical block 0, async page read [ 704.901993][T14186] syzkaller0: entered promiscuous mode [ 704.927109][T14186] syzkaller0: entered allmulticast mode [ 705.032008][T14171] Buffer I/O error on dev loop6, logical block 0, async page read [ 705.049368][ T29] audit: type=1400 audit(1785373692.227:1209): avc: denied { write } for pid=14158 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 705.640734][T14171] Dev loop6: unable to read RDB block 0 [ 705.678079][T14171] loop6: unable to read partition table [ 705.697280][T14186] tipc: Enabled bearer , priority 0 [ 705.731206][T14171] loop_reread_partitions: partition scan of loop6 (3Ÿ ¾‚³˜) failed (rc=-5) [ 705.772061][T14185] tipc: Resetting bearer [ 705.830366][T14195] binder: 14193:14195 ioctl c00c620f 200000000180 returned -22 [ 706.059726][ T29] audit: type=1400 audit(1785373693.247:1210): avc: denied { write } for pid=14197 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 706.259964][T14185] tipc: Disabling bearer [ 706.353143][T14207] binder: 14200:14207 ioctl c00c620f 200000000180 returned -22 [ 707.302728][T14218] genirq: Flags mismatch irq 4. 00200000 (das16m1) vs. 00200080 (ttyS0) [ 707.745962][T14222] netlink: 36 bytes leftover after parsing attributes in process `syz.0.2301'. [ 707.759149][ T46] usb 4-1: new full-speed USB device number 57 using dummy_hcd [ 707.767127][ T5712] usb 2-1: new low-speed USB device number 84 using dummy_hcd [ 707.915048][T14225] comedi comedi1: pcl812: I/O port conflict (0x100,16) [ 708.379280][ T5712] usb 2-1: unable to get BOS descriptor or descriptor too short [ 708.387795][ T46] usb 4-1: unable to get BOS descriptor or descriptor too short [ 708.398707][ T46] usb 4-1: not running at top speed; connect to a high speed hub [ 708.408955][ T5712] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 708.421062][ T5712] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 708.431266][ T46] usb 4-1: config 1 interface 2 altsetting 1 endpoint 0x82 has invalid maxpacket 46588, setting to 1023 [ 708.445643][ T46] usb 4-1: New USB device found, idVendor=2b73, idProduct=0034, bcdDevice= 0.40 [ 708.455698][ T46] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 708.487268][ T5712] usb 2-1: string descriptor 0 read error: -22 [ 708.495033][ T5712] usb 2-1: New USB device found, idVendor=0763, idProduct=2080, bcdDevice= 0.40 [ 708.507310][ T46] usb 4-1: Product: syz [ 708.573138][ T46] usb 4-1: Manufacturer: syz [ 708.587589][ T5712] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 708.599980][ T46] usb 4-1: SerialNumber: syz [ 708.974514][ T46] usb 4-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 709.118500][ T5344] usb 2-1: USB disconnect, device number 84 [ 709.190532][ T46] snd-usb-audio 4-1:1.0: probe with driver snd-usb-audio failed with error -71 [ 709.262733][ T46] usb 4-1: USB disconnect, device number 57 [ 709.644608][T10640] udevd[10640]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card4/controlC4/../uevent} for writing: No such file or directory [ 710.990433][ T29] audit: type=1400 audit(1785373698.177:1211): avc: denied { mount } for pid=14246 comm="syz.1.2310" name="/" dev="autofs" ino=49748 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_t tclass=filesystem permissive=1 [ 711.115652][T14262] netlink: 'syz.0.2314': attribute type 4 has an invalid length. [ 711.151350][T14264] netlink: 36 bytes leftover after parsing attributes in process `syz.3.2315'. [ 711.159767][ T29] audit: type=1400 audit(1785373698.347:1212): avc: denied { unmount } for pid=5608 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_t tclass=filesystem permissive=1 [ 711.850257][T14267] fuse: Unknown parameter '000000000000000000000x0000000000000005' [ 712.148112][T14244] NILFS (nullb0): couldn't find nilfs on the device [ 712.191045][T14267] befs: (nbd4): No write support. Marking filesystem read-only [ 712.304578][T14285] gretap0: entered promiscuous mode [ 712.361784][T14278] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2317'. [ 713.071533][T14302] xt_CONNSECMARK: only valid in 'mangle' or 'security' table, not 'raw' [ 713.460646][T14305] binder: 14297:14305 ioctl c00c620f 200000000180 returned -22 [ 713.696328][T14050] usb 5-1: new high-speed USB device number 88 using dummy_hcd [ 713.832443][T14311] netlink: 'syz.0.2326': attribute type 1 has an invalid length. [ 713.876740][T14050] usb 5-1: too many configurations: 97, using maximum allowed: 8 [ 714.175347][T14050] usb 5-1: unable to read config index 0 descriptor/start: -61 [ 714.198683][T14050] usb 5-1: can't read configurations, error -61 [ 714.303838][T14311] 8021q: adding VLAN 0 to HW filter on device bond4 [ 714.327017][ T29] audit: type=1400 audit(1785373701.517:1213): avc: denied { append } for pid=14317 comm="syz.2.2327" name="ptp0" dev="devtmpfs" ino=1266 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 714.420499][T14050] usb 5-1: new high-speed USB device number 89 using dummy_hcd [ 714.434095][T14320] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2328'. [ 714.576977][T14050] usb 5-1: too many configurations: 97, using maximum allowed: 8 [ 714.591021][T14050] usb 5-1: unable to read config index 0 descriptor/start: -61 [ 714.599451][T14050] usb 5-1: can't read configurations, error -61 [ 714.606092][T14050] usb usb5-port1: attempt power cycle [ 714.730323][T14330] netlink: 36 bytes leftover after parsing attributes in process `syz.2.2332'. [ 715.466364][T14050] usb 5-1: new high-speed USB device number 90 using dummy_hcd [ 715.501342][T14336] hsr0 speed is unknown, defaulting to 1000 [ 715.521573][T14050] usb 5-1: too many configurations: 97, using maximum allowed: 8 [ 715.523299][T14335] hsr0 speed is unknown, defaulting to 1000 [ 715.537172][T14050] usb 5-1: unable to read config index 0 descriptor/start: -61 [ 715.551277][T14050] usb 5-1: can't read configurations, error -61 [ 715.565889][T14336] hsr0 speed is unknown, defaulting to 1000 [ 715.594011][T14335] hsr0 speed is unknown, defaulting to 1000 [ 716.087990][T14351] netlink: 48 bytes leftover after parsing attributes in process `syz.2.2335'. [ 717.674820][T14364] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2336'. [ 717.999487][T14379] netlink: 240 bytes leftover after parsing attributes in process `syz.2.2341'. [ 718.167200][T14385] netlink: 36 bytes leftover after parsing attributes in process `syz.0.2345'. [ 718.997492][ T29] audit: type=1400 audit(1785373706.177:1214): avc: denied { checkpoint_restore } for pid=14390 comm="syz.3.2346" capability=40 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 719.250630][T14391] bridge0: port 3(batadv1) entered disabled state [ 719.257360][T14391] bridge0: port 2(bridge_slave_1) entered disabled state [ 719.264654][T14391] bridge0: port 1(bridge_slave_0) entered disabled state [ 720.886061][T14413] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 721.066423][T14416] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 721.392904][T14422] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2356'. [ 721.403050][T14422] netlink: 'syz.1.2356': attribute type 30 has an invalid length. [ 721.408306][T14391] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 721.576491][ T5810] usb 5-1: new low-speed USB device number 92 using dummy_hcd [ 721.728147][ T5810] usb 5-1: unable to get BOS descriptor or descriptor too short [ 721.737113][ T5810] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 721.748392][ T5810] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 721.761559][ T5810] usb 5-1: string descriptor 0 read error: -22 [ 721.768085][ T5810] usb 5-1: New USB device found, idVendor=0763, idProduct=2080, bcdDevice= 0.40 [ 721.777672][ T5810] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 721.878077][T12888] usb 2-1: new high-speed USB device number 85 using dummy_hcd [ 721.913845][T14430] overlayfs: failed lookup in lower (newroot/473, name='file0', err=-40): overlapping layers [ 722.001075][T14393] workqueue: Failed to create a rescuer kthread for wq "wg-crypt-wireguard%d": -EINTR [ 722.034180][T14435] xt_hashlimit: size too large, truncated to 1048576 [ 722.035675][T14422] vxlan4: entered promiscuous mode [ 722.057927][T14422] vxlan4: entered allmulticast mode [ 722.098527][T14424] veth0: entered promiscuous mode [ 722.112542][T12888] usb 2-1: config 0 has an invalid interface number: 69 but max is 0 [ 722.121096][ T76] netdevsim netdevsim2 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 722.136087][T12888] usb 2-1: config 0 has no interface number 0 [ 722.145728][ T76] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 722.155296][T14438] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2359'. [ 722.164717][T12888] usb 2-1: config 0 interface 69 altsetting 0 bulk endpoint 0x8 has invalid maxpacket 1023 [ 722.174827][ T76] netdevsim netdevsim2 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 722.183953][T12888] usb 2-1: config 0 interface 69 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 722.198914][ T76] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 722.220384][ T76] netdevsim netdevsim2 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 722.236682][T12888] usb 2-1: New USB device found, idVendor=0c4b, idProduct=0100, bcdDevice=d7.ca [ 722.256336][ T76] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 722.265266][T12888] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 722.268376][ T1185] usb 5-1: USB disconnect, device number 92 [ 722.275007][T12888] usb 2-1: Product: syz [ 722.285207][ T76] netdevsim netdevsim2 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 722.296173][T12888] usb 2-1: Manufacturer: syz [ 722.318037][ T76] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 722.327538][T12888] usb 2-1: SerialNumber: syz [ 722.335185][T12888] usb 2-1: config 0 descriptor?? [ 722.346965][T14427] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 722.356997][T12888] cyberjack 2-1:0.69: Reiner SCT Cyberjack USB card reader converter detected [ 722.378259][T12888] cyberjack ttyUSB0: usb_submit_urb(read int) failed [ 722.401319][T12888] usb 2-1: Reiner SCT Cyberjack USB card reader converter now attached to ttyUSB0 [ 722.548571][T14451] i2c i2c-0: Frontend requested software zigzag, but didn't set the frequency step size [ 722.631336][ T1185] usb 2-1: USB disconnect, device number 85 [ 722.637490][T14421] veth0: left promiscuous mode [ 722.701173][ T1185] cyberjack ttyUSB0: Reiner SCT Cyberjack USB card reader converter now disconnected from ttyUSB0 [ 722.720426][ T1185] cyberjack 2-1:0.69: device disconnected [ 723.540984][ T29] audit: type=1400 audit(1785373710.737:1215): avc: denied { map } for pid=14470 comm="syz.2.2368" path="/dev/bus/usb/006/001" dev="devtmpfs" ino=737 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 723.631673][ T29] audit: type=1400 audit(1785373710.817:1216): avc: denied { ioctl } for pid=14460 comm="syz.4.2367" path="socket:[51103]" dev="sockfs" ino=51103 ioctlcmd=0x587f scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 725.279021][T14482] input: syz1 as /devices/virtual/input/input80 [ 725.287445][ T29] audit: type=1400 audit(1785373712.467:1217): avc: denied { write } for pid=14470 comm="syz.2.2368" lport=33321 faddr=::ffff:172.20.255.187 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=sctp_socket permissive=1 [ 725.316011][ T29] audit: type=1400 audit(1785373712.497:1218): avc: denied { mounton } for pid=14470 comm="syz.2.2368" path="/507/file1/file0" dev="autofs" ino=51466 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_t tclass=dir permissive=1 [ 725.357054][ T29] audit: type=1400 audit(1785373712.547:1219): avc: denied { setopt } for pid=14470 comm="syz.2.2368" lport=33321 faddr=::ffff:172.20.255.187 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=sctp_socket permissive=1 [ 725.381947][ T29] audit: type=1400 audit(1785373712.547:1220): avc: denied { getopt } for pid=14470 comm="syz.2.2368" lport=33321 faddr=::ffff:172.20.255.187 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=sctp_socket permissive=1 [ 725.576538][ T1185] usb 4-1: new full-speed USB device number 58 using dummy_hcd [ 725.758492][ T1185] usb 4-1: config 0 interface 0 altsetting 88 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 725.771514][ T1185] usb 4-1: config 0 interface 0 has no altsetting 0 [ 725.781602][ T1185] usb 4-1: New USB device found, idVendor=05ac, idProduct=0265, bcdDevice= 0.00 [ 725.790779][ T1185] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 725.832750][ T1185] usb 4-1: config 0 descriptor?? [ 726.500101][ T1185] hid_parser_main: 31 callbacks suppressed [ 726.500123][ T1185] magicmouse 0003:05AC:0265.0021: unknown main item tag 0x0 [ 726.529451][ T1185] magicmouse 0003:05AC:0265.0021: unknown main item tag 0x0 [ 726.548531][ T1185] magicmouse 0003:05AC:0265.0021: unknown main item tag 0x0 [ 726.566159][ T1185] magicmouse 0003:05AC:0265.0021: unknown main item tag 0x0 [ 726.577829][ T1185] magicmouse 0003:05AC:0265.0021: unknown main item tag 0x0 [ 726.594212][ T1185] magicmouse 0003:05AC:0265.0021: unknown main item tag 0x0 [ 726.602729][ T1185] magicmouse 0003:05AC:0265.0021: unknown main item tag 0x0 [ 726.610684][ T1185] magicmouse 0003:05AC:0265.0021: unknown main item tag 0x0 [ 726.622336][ T1185] magicmouse 0003:05AC:0265.0021: unknown main item tag 0x0 [ 726.630043][ T1185] magicmouse 0003:05AC:0265.0021: unknown main item tag 0x0 [ 726.655217][ T1185] magicmouse 0003:05AC:0265.0021: hidraw0: USB HID v0.09 Device [HID 05ac:0265] on usb-dummy_hcd.3-1/input0 [ 726.666896][ T1185] magicmouse 0003:05AC:0265.0021: magicmouse input not registered [ 726.677203][ T1185] magicmouse 0003:05AC:0265.0021: probe with driver magicmouse failed with error -12 [ 727.214063][T14507] binder: 14505:14507 ioctl c00c620f 200000000180 returned -22 [ 727.316338][ T1185] usb 2-1: new full-speed USB device number 86 using dummy_hcd [ 727.359155][ T804] usb 4-1: USB disconnect, device number 58 [ 727.468115][ T1185] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 727.479179][ T1185] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 727.489616][ T1185] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 727.503125][ T1185] usb 2-1: New USB device found, idVendor=0457, idProduct=07da, bcdDevice= 0.00 [ 727.513018][ T1185] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 727.533294][ T1185] usb 2-1: config 0 descriptor?? [ 727.970023][T14512] hsr0 speed is unknown, defaulting to 1000 [ 727.977220][T14512] hsr0 speed is unknown, defaulting to 1000 [ 728.078305][ T1185] hid-multitouch 0003:0457:07DA.0022: ignoring exceeding usage max [ 728.104016][ T1185] hid-multitouch 0003:0457:07DA.0022: hidraw0: USB HID v0.00 Device [HID 0457:07da] on usb-dummy_hcd.1-1/input0 [ 728.338566][T14504] hsr0 speed is unknown, defaulting to 1000 [ 728.345267][T14504] hsr0 speed is unknown, defaulting to 1000 [ 728.366309][ T804] usb 4-1: new low-speed USB device number 59 using dummy_hcd [ 728.518402][ T804] usb 4-1: unable to get BOS descriptor or descriptor too short [ 728.527388][ T804] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 728.537821][ T804] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 728.549062][ T804] usb 4-1: string descriptor 0 read error: -22 [ 728.555327][ T804] usb 4-1: New USB device found, idVendor=0763, idProduct=2080, bcdDevice= 0.40 [ 728.564845][ T804] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 728.719404][T14521] Bluetooth: MGMT ver 1.23 [ 728.967698][T12888] usb 5-1: new full-speed USB device number 93 using dummy_hcd [ 728.980488][ T804] usb 2-1: USB disconnect, device number 86 [ 728.993936][ T1185] usb 4-1: USB disconnect, device number 59 [ 729.173054][T12888] usb 5-1: unable to get BOS descriptor or descriptor too short [ 729.184449][T12888] usb 5-1: not running at top speed; connect to a high speed hub [ 729.194023][T12888] usb 5-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 120, changing to 4 [ 729.221224][T12888] usb 5-1: New USB device found, idVendor=0b05, idProduct=1743, bcdDevice= 0.40 [ 729.230489][T12888] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 729.238791][T12888] usb 5-1: Product: syz [ 729.242946][T12888] usb 5-1: Manufacturer: syz [ 729.250271][T12888] usb 5-1: SerialNumber: syz [ 729.372287][T14532] netdevsim netdevsim0 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 729.383584][T14532] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 729.445374][T14532] netdevsim netdevsim0 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 729.455238][T14532] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 729.471765][T12888] usb 5-1: 1:1 : unknown format tag 0x5 is detected. processed as MPEG. [ 729.481373][T12888] usb 5-1: found format II with max.bitrate = 512, frame size=4095 [ 729.491090][T12888] usb 5-1: 1:1 : unknown format tag 0x5 is detected. processed as MPEG. [ 729.499605][ T804] usb 2-1: new high-speed USB device number 87 using dummy_hcd [ 729.508574][T12888] usb 5-1: found format II with max.bitrate = 512, frame size=4095 [ 729.519190][T12888] usb 5-1: 2:1: invalid format type 0x1002 is detected, processed as PCM [ 729.528289][T14532] netdevsim netdevsim0 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 729.549927][T14532] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 729.580981][T12888] usb 5-1: USB disconnect, device number 93 [ 729.666517][ T804] usb 2-1: Using ep0 maxpacket: 16 [ 729.694153][ T804] usb 2-1: New USB device found, idVendor=05d1, idProduct=2001, bcdDevice=10.00 [ 729.716547][ T804] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 729.738654][T10633] udevd[10633]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 729.748162][ T804] usb 2-1: Product: syz [ 729.760208][ T804] usb 2-1: Manufacturer: syz [ 729.772256][ T804] usb 2-1: SerialNumber: syz [ 729.775049][T14537] fuse: fd is not a fuse device [ 729.795128][ T804] usb 2-1: config 0 descriptor?? [ 729.808416][ T804] ftdi_sio 2-1:0.0: FTDI USB Serial Device converter detected [ 729.827093][ T804] usb 2-1: Detected FT-X [ 730.017389][T14530] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 730.028894][T14530] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 730.041823][ T804] ftdi_sio ttyUSB0: Unable to read latency timer: -32 [ 730.055387][T14532] netdevsim netdevsim0 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 730.074126][T14532] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 730.232212][T10428] netdevsim netdevsim0 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 730.240655][T10428] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 730.275773][ T1096] netdevsim netdevsim0 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 730.297077][ T1096] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 730.320856][ T1096] netdevsim netdevsim0 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 730.329736][ T1096] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 730.343798][ T1096] netdevsim netdevsim0 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 730.352273][ T1096] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 730.395313][T14543] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(3) [ 730.401859][T14543] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 730.412284][ T46] usb 5-1: new full-speed USB device number 94 using dummy_hcd [ 730.413222][T14543] vhci_hcd vhci_hcd.0: Device attached [ 730.489800][ T804] usb 2-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 730.666393][T12888] usb 39-1: new high-speed USB device number 2 using vhci_hcd [ 730.717698][ T5344] usb 2-1: USB disconnect, device number 87 [ 730.751691][ T5344] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 730.764293][ T5344] ftdi_sio 2-1:0.0: device disconnected [ 730.808200][ T46] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 730.819742][ T46] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 730.829612][ T46] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 730.842659][ T46] usb 5-1: New USB device found, idVendor=0457, idProduct=07da, bcdDevice= 0.00 [ 730.851828][ T46] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 730.861364][ T46] usb 5-1: config 0 descriptor?? [ 730.928288][ T804] usb 4-1: new low-speed USB device number 60 using dummy_hcd [ 731.424679][ T46] hid-multitouch 0003:0457:07DA.0023: ignoring exceeding usage max [ 731.447843][ T804] usb 4-1: config index 0 descriptor too short (expected 561, got 49) [ 731.456628][ T804] usb 4-1: config 0 has an invalid interface number: 0 but max is -1 [ 731.464764][ T804] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 731.465240][ T46] hid-multitouch 0003:0457:07DA.0023: hidraw0: USB HID v0.00 Device [HID 0457:07da] on usb-dummy_hcd.4-1/input0 [ 731.475362][ T804] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 0 [ 731.475409][ T804] usb 4-1: New USB device found, idVendor=0421, idProduct=0335, bcdDevice=5f.0e [ 731.475431][ T804] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 731.482137][ T804] usb 4-1: config 0 descriptor?? [ 731.554974][T14539] hsr0 speed is unknown, defaulting to 1000 [ 731.559486][ T804] rndis_host 4-1:0.0: rndis: master #0/ffff888027652000 slave #1/0000000000000000 [ 731.562899][T14539] hsr0 speed is unknown, defaulting to 1000 [ 731.776369][ T5344] usb 2-1: new high-speed USB device number 88 using dummy_hcd [ 731.927547][ T5344] usb 2-1: Using ep0 maxpacket: 16 [ 731.950307][ T5344] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 731.976688][ T5344] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 732.012336][ T5344] usb 2-1: New USB device found, idVendor=0e20, idProduct=0101, bcdDevice=7a.5a [ 732.028671][ T5344] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 732.053733][ T5344] usb 2-1: Product: syz [ 732.065918][ T5344] usb 2-1: Manufacturer: syz [ 732.089835][ T5344] usb 2-1: SerialNumber: syz [ 732.126616][T14561] JFS: discard option not supported on device [ 732.144986][T14561] Mount JFS Failure: -5 [ 732.149441][T14561] jfs_mount failed w/return code = -5 [ 732.178250][ T5344] usb 2-1: config 0 descriptor?? [ 732.250929][ T5717] usb 5-1: USB disconnect, device number 94 [ 732.252696][ T5344] pegasus_notetaker 2-1:0.0: probe with driver pegasus_notetaker failed with error -22 [ 732.445329][ T5344] usb 2-1: USB disconnect, device number 88 [ 733.640007][T14050] usb 4-1: USB disconnect, device number 60 [ 733.858766][T14544] vhci_hcd: connection reset by peer [ 733.864497][T13160] vhci_hcd vhci_hcd.3: stop threads [ 733.870652][T13160] vhci_hcd vhci_hcd.3: release socket [ 733.876429][T13160] vhci_hcd vhci_hcd.3: disconnect device [ 735.016372][ T5344] usb 5-1: new high-speed USB device number 95 using dummy_hcd [ 735.137855][ T804] usb 4-1: new high-speed USB device number 61 using dummy_hcd [ 735.176728][ T5344] usb 5-1: Using ep0 maxpacket: 32 [ 735.189430][T14587] trusted_key: encrypted_key: insufficient parameters specified [ 735.206921][ T5344] usb 5-1: unable to get BOS descriptor or descriptor too short [ 735.215507][ T5344] usb 5-1: unable to read config index 0 descriptor/start: -71 [ 735.223826][ T5344] usb 5-1: can't read configurations, error -71 [ 735.316319][ T804] usb 4-1: Using ep0 maxpacket: 32 [ 735.323182][ T804] usb 4-1: config 4 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 735.334116][ T804] usb 4-1: config 4 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 735.345388][ T804] usb 4-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 735.354527][ T804] usb 4-1: New USB device strings: Mfr=255, Product=255, SerialNumber=0 [ 735.362908][ T804] usb 4-1: Product: syz [ 735.367214][ T804] usb 4-1: Manufacturer: syz [ 735.375760][ T804] hub 4-1:4.0: USB hub found [ 735.386382][T14050] usb 2-1: new high-speed USB device number 89 using dummy_hcd [ 735.536297][T14050] usb 2-1: Using ep0 maxpacket: 8 [ 735.542561][T14050] usb 2-1: config 150 has an invalid interface number: 204 but max is 2 [ 735.551255][T14050] usb 2-1: config 150 has an invalid descriptor of length 0, skipping remainder of the config [ 735.563032][T14050] usb 2-1: config 150 has 1 interface, different from the descriptor's value: 3 [ 735.572220][T14050] usb 2-1: config 150 has no interface number 0 [ 735.577191][ T804] hub 4-1:4.0: 2 ports detected [ 735.579040][T14050] usb 2-1: config 150 interface 204 has no altsetting 0 [ 735.597578][T14050] usb 2-1: New USB device found, idVendor=04e2, idProduct=1424, bcdDevice=c3.eb [ 735.607099][T14050] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 735.615128][T14050] usb 2-1: Product: syz [ 735.619536][T14050] usb 2-1: Manufacturer: syz [ 735.624157][T14050] usb 2-1: SerialNumber: syz [ 735.655170][T14595] kvm: MWAIT instruction emulated as NOP! [ 735.808551][T12888] vhci_hcd vhci_hcd.3: vhci_device speed not set [ 735.849987][T14591] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2403'. [ 735.859732][T14591] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=1011 sclass=netlink_route_socket pid=14591 comm=syz.1.2403 [ 736.252800][ T804] usb 4-1: USB disconnect, device number 61 [ 736.407111][ T5344] usb 5-1: new full-speed USB device number 96 using dummy_hcd [ 736.438405][T14050] usb 2-1: USB disconnect, device number 89 [ 736.708883][ T5344] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 736.738946][ T5344] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 736.759461][ T5344] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 736.772463][ T5344] usb 5-1: New USB device found, idVendor=0457, idProduct=07da, bcdDevice= 0.00 [ 736.782549][ T5344] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 736.817328][ T5344] usb 5-1: config 0 descriptor?? [ 737.923682][ T5344] hid_parser_main: 59 callbacks suppressed [ 737.923702][ T5344] hid-multitouch 0003:0457:07DA.0024: unknown main item tag 0x0 [ 737.950599][T14601] hsr0 speed is unknown, defaulting to 1000 [ 737.956600][ T5344] hid-multitouch 0003:0457:07DA.0024: ignoring exceeding usage max [ 737.965813][ T5344] hid-multitouch 0003:0457:07DA.0024: unknown main item tag 0x0 [ 737.989853][ T5344] hid-multitouch 0003:0457:07DA.0024: unknown main item tag 0x0 [ 738.013941][ T5344] hid-multitouch 0003:0457:07DA.0024: unknown main item tag 0x0 [ 738.024087][T14601] hsr0 speed is unknown, defaulting to 1000 [ 738.057973][ T5344] hid-multitouch 0003:0457:07DA.0024: unknown main item tag 0x0 [ 738.071345][T14627] input: syz0 as /devices/virtual/input/input83 [ 738.200539][ T5344] hid-multitouch 0003:0457:07DA.0024: unknown main item tag 0x0 [ 738.446191][ T5344] hid-multitouch 0003:0457:07DA.0024: unknown main item tag 0x0 [ 738.454087][ T5344] hid-multitouch 0003:0457:07DA.0024: unknown main item tag 0x0 [ 738.461992][ T5344] hid-multitouch 0003:0457:07DA.0024: unknown main item tag 0x0 [ 738.473831][ T5344] hid-multitouch 0003:0457:07DA.0024: unknown main item tag 0x0 [ 738.514608][ T5344] hid-multitouch 0003:0457:07DA.0024: hidraw0: USB HID v0.00 Device [HID 0457:07da] on usb-dummy_hcd.4-1/input0 [ 739.082459][T14648] syzkaller0: entered promiscuous mode [ 739.096778][T14648] syzkaller0: entered allmulticast mode [ 739.280248][ T804] usb 5-1: USB disconnect, device number 96 [ 740.456320][ T804] usb 2-1: new high-speed USB device number 90 using dummy_hcd [ 741.081152][ T804] usb 2-1: Using ep0 maxpacket: 8 [ 741.111435][ T804] usb 2-1: config 2 has an invalid interface number: 118 but max is 0 [ 741.139675][ T804] usb 2-1: config 2 has no interface number 0 [ 741.160081][ T804] usb 2-1: config 2 interface 118 has no altsetting 0 [ 741.199581][ T804] usb 2-1: New USB device found, idVendor=04dd, idProduct=8005, bcdDevice=d9.fa [ 741.229385][ T804] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 741.307512][ T804] usb 2-1: Product: syz [ 741.326114][T14683] binder: 14680:14683 ioctl c00c620f 200000000180 returned -22 [ 741.339705][ T804] usb 2-1: Manufacturer: syz [ 741.351382][ T804] usb 2-1: SerialNumber: syz [ 741.721377][ T804] usb 2-1: unsupported MDLM descriptors [ 741.834528][ T804] usb 2-1: USB disconnect, device number 90 [ 741.870703][T14694] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2428'. [ 741.992981][ T49] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 742.010418][ T49] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 742.023164][ T49] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 742.037003][ T49] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 742.051899][ T49] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 742.070615][ T29] audit: type=1400 audit(1785373729.257:1221): avc: denied { mounton } for pid=14692 comm="syz-executor" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 742.325832][ T5613] bond0: (slave syz_tun): Releasing backup interface [ 742.361656][ T5613] syz_tun (unregistering): left allmulticast mode [ 742.529345][T14705] binder: 14703:14705 ioctl c00c620f 200000000180 returned -22 [ 743.670114][T14726] netlink: 76 bytes leftover after parsing attributes in process `syz.4.2434'. [ 744.137154][ T49] Bluetooth: hci5: command tx timeout [ 744.318051][T14730] netlink: 240 bytes leftover after parsing attributes in process `syz.0.2436'. [ 744.493880][T14711] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 744.896438][ T5717] usb 5-1: new low-speed USB device number 97 using dummy_hcd [ 745.005062][T14711] bond0: left allmulticast mode [ 745.016592][T14711] : left allmulticast mode [ 745.021683][T14711] bond_slave_1: left allmulticast mode [ 745.027257][T14711] bond0: left promiscuous mode [ 745.032202][T14711] : left promiscuous mode [ 745.038005][T14711] bond_slave_1: left promiscuous mode [ 745.057986][ T5717] usb 5-1: unable to get BOS descriptor or descriptor too short [ 745.073781][ T5717] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 745.087949][ T5717] usb 5-1: config 1 interface 0 altsetting 7 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 745.101974][ T5717] usb 5-1: config 1 interface 0 has no altsetting 0 [ 745.134829][ T5717] usb 5-1: string descriptor 0 read error: -22 [ 745.150273][ T5717] usb 5-1: New USB device found, idVendor=04b8, idProduct=0202, bcdDevice= 0.40 [ 745.171739][ T5717] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 745.226382][T13162] netdevsim netdevsim3 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 745.257180][T13162] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 745.274123][T13162] netdevsim netdevsim3 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 745.291139][T13162] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 745.338891][T14746] tipc: Cannot configure node identity twice [ 745.347238][T13162] netdevsim netdevsim3 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 745.368781][T13162] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 745.387910][T13162] netdevsim netdevsim3 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 745.430398][T13162] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 745.688675][T14692] hsr0 speed is unknown, defaulting to 1000 [ 745.963293][T14692] hsr0 speed is unknown, defaulting to 1000 [ 746.217293][ T49] Bluetooth: hci5: command tx timeout [ 746.960645][T13160] batadv1: left allmulticast mode [ 746.973617][T14772] netlink: 64 bytes leftover after parsing attributes in process `syz.0.2444'. [ 747.036285][T14776] netlink: 'syz.1.2443': attribute type 10 has an invalid length. [ 747.090888][T14777] netlink: 'syz.1.2443': attribute type 10 has an invalid length. [ 747.099041][T14777] netlink: 40 bytes leftover after parsing attributes in process `syz.1.2443'. [ 747.235636][ T1313] ieee802154 phy1 wpan1: encryption failed: -22 [ 747.339753][T13160] batadv1: left promiscuous mode [ 747.349978][T13160] bridge0: port 3(batadv1) entered disabled state [ 747.418370][T13160] bridge_slave_1: left allmulticast mode [ 747.430925][T14050] usb 5-1: USB disconnect, device number 97 [ 747.460431][T13160] bridge_slave_1: left promiscuous mode [ 747.652700][T13160] bridge0: port 2(bridge_slave_1) entered disabled state [ 747.682459][ T29] audit: type=1400 audit(1785373734.857:1222): avc: denied { write } for pid=14763 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 747.740673][T13160] bridge_slave_0: left allmulticast mode [ 747.752445][T13160] bridge_slave_0: left promiscuous mode [ 747.758699][T13160] bridge0: port 1(bridge_slave_0) entered disabled state [ 747.896474][T14796] netlink: 240 bytes leftover after parsing attributes in process `syz.3.2446'. [ 748.077179][ T29] audit: type=1400 audit(1785373735.267:1223): avc: denied { write } for pid=14798 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 748.308104][ T49] Bluetooth: hci5: command tx timeout [ 748.434993][T13160] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 748.444187][T13160] bond_slave_0: left allmulticast mode [ 748.451281][T13160] bond0 (unregistering): Released all slaves [ 748.460925][T13160] bond1 (unregistering): Released all slaves [ 748.489992][T13160] bond2 (unregistering): Released all slaves [ 748.501514][T13160] bond3 (unregistering): Released all slaves [ 748.518065][T14776] 8021q: adding VLAN 0 to HW filter on device team0 [ 748.526308][T14776] team0: entered allmulticast mode [ 748.531618][T14776] team_slave_0: entered allmulticast mode [ 748.537505][T14776] team_slave_1: entered allmulticast mode [ 748.544193][T14776] bond0: (slave team0): Enslaving as an active interface with an up link [ 748.556761][T14776] team_slave_0: entered promiscuous mode [ 748.562900][T14776] team_slave_1: entered promiscuous mode [ 748.571985][T14777] team0: entered promiscuous mode [ 748.600154][T14777] bond0: (slave team0): Releasing backup interface [ 748.619449][T14777] bridge0: port 3(team0) entered blocking state [ 748.626720][T14777] bridge0: port 3(team0) entered disabled state [ 748.642754][T13160] tipc: Left network mode [ 748.755884][ T5273] 8021q: adding VLAN 0 to HW filter on device eth1 [ 750.392630][ T49] Bluetooth: hci5: command tx timeout [ 750.940519][T14857] binder: 14850:14857 ioctl c00c620f 200000000180 returned -22 [ 751.435910][ T29] audit: type=1400 audit(1785373738.627:1224): avc: denied { write } for pid=14821 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 751.539505][ T804] usb 5-1: new full-speed USB device number 98 using dummy_hcd [ 751.573609][ T29] audit: type=1400 audit(1785373738.757:1225): avc: denied { write } for pid=14872 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 751.656835][T14692] bridge0: port 1(bridge_slave_0) entered blocking state [ 751.665712][T14692] bridge0: port 1(bridge_slave_0) entered disabled state [ 751.673213][T14692] bridge_slave_0: entered allmulticast mode [ 751.680900][T14692] bridge_slave_0: entered promiscuous mode [ 751.689105][T14692] bridge0: port 2(bridge_slave_1) entered blocking state [ 751.696770][T14692] bridge0: port 2(bridge_slave_1) entered disabled state [ 751.705850][T14692] bridge_slave_1: entered allmulticast mode [ 751.713455][T14692] bridge_slave_1: entered promiscuous mode [ 751.740687][ T804] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 751.746991][ T5273] 8021q: adding VLAN 0 to HW filter on device eth2 [ 751.786672][ T804] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 751.796304][ T5717] usb 2-1: new low-speed USB device number 91 using dummy_hcd [ 751.820967][ T804] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 751.866168][ T804] usb 5-1: New USB device found, idVendor=0457, idProduct=07da, bcdDevice= 0.00 [ 751.881354][T14692] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 751.890644][ T804] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 751.925033][ T804] usb 5-1: config 0 descriptor?? [ 751.958908][T14692] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 751.978394][ T5717] usb 2-1: unable to get BOS descriptor or descriptor too short [ 751.996993][ T5717] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 752.029269][ T5717] usb 2-1: config 1 interface 0 altsetting 7 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 752.166024][ T5717] usb 2-1: config 1 interface 0 has no altsetting 0 [ 752.612417][ T5717] usb 2-1: string descriptor 0 read error: -22 [ 752.623978][ T5717] usb 2-1: New USB device found, idVendor=04b8, idProduct=0202, bcdDevice= 0.40 [ 752.662179][ T5717] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 752.672662][T14692] team0: Port device team_slave_0 added [ 752.681992][T14692] team0: Port device team_slave_1 added [ 752.758585][T13160] hsr_slave_0: left promiscuous mode [ 752.812588][T13160] hsr_slave_1: left promiscuous mode [ 752.827064][T13160] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 752.859351][ T804] hid_parser_main: 4 callbacks suppressed [ 752.859373][ T804] hid-multitouch 0003:0457:07DA.0025: unknown main item tag 0x0 [ 752.920709][ T804] hid-multitouch 0003:0457:07DA.0025: ignoring exceeding usage max [ 752.941319][ T804] hid-multitouch 0003:0457:07DA.0025: unknown main item tag 0x0 [ 752.971145][ T804] hid-multitouch 0003:0457:07DA.0025: unknown main item tag 0x0 [ 752.988344][ T804] hid-multitouch 0003:0457:07DA.0025: unknown main item tag 0x0 [ 753.111763][T14905] binder: 14903:14905 ioctl c00c620f 200000000180 returned -22 [ 753.270647][ T804] hid-multitouch 0003:0457:07DA.0025: unknown main item tag 0x0 [ 753.281712][ T804] hid-multitouch 0003:0457:07DA.0025: unknown main item tag 0x0 [ 753.289498][ T29] audit: type=1400 audit(1785373740.467:1226): avc: denied { write } for pid=14892 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 753.314353][ T804] hid-multitouch 0003:0457:07DA.0025: unknown main item tag 0x0 [ 753.328397][ T804] hid-multitouch 0003:0457:07DA.0025: unknown main item tag 0x0 [ 753.356323][ T804] hid-multitouch 0003:0457:07DA.0025: unknown main item tag 0x0 [ 753.374579][ T804] hid-multitouch 0003:0457:07DA.0025: unknown main item tag 0x0 [ 753.444586][ T804] hid-multitouch 0003:0457:07DA.0025: hidraw0: USB HID v0.00 Device [HID 0457:07da] on usb-dummy_hcd.4-1/input0 [ 753.469889][ T29] audit: type=1400 audit(1785373740.657:1227): avc: denied { write } for pid=14910 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 754.282858][T13160] team0 (unregistering): Port device team_slave_1 removed [ 754.296111][T13160] team0 (unregistering): Port device team_slave_0 removed [ 754.398674][T14692] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 754.405784][T14692] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 754.439033][T14692] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 754.521839][ T5273] 8021q: adding VLAN 0 to HW filter on device eth3 [ 754.569114][ T5717] usb 2-1: USB disconnect, device number 91 [ 754.569651][T14692] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 754.749712][T14692] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 754.777579][T14692] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 754.788855][T14906] hsr0 speed is unknown, defaulting to 1000 [ 755.344081][T14929] xt_CONNSECMARK: only valid in 'mangle' or 'security' table, not 'raw' [ 755.544797][T14906] hsr0 speed is unknown, defaulting to 1000 [ 755.799301][ T804] usb 4-1: new high-speed USB device number 62 using dummy_hcd [ 755.841876][T14692] hsr_slave_0: entered promiscuous mode [ 755.899146][T14692] hsr_slave_1: entered promiscuous mode [ 755.987257][ T804] usb 4-1: too many configurations: 97, using maximum allowed: 8 [ 756.138491][ T804] usb 4-1: unable to read config index 0 descriptor/start: -61 [ 756.146116][ T804] usb 4-1: can't read configurations, error -61 [ 756.316307][ T804] usb 4-1: new high-speed USB device number 63 using dummy_hcd [ 756.492614][ T29] audit: type=1400 audit(1785373743.667:1228): avc: denied { write } for pid=14935 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 756.532128][ T804] usb 4-1: too many configurations: 97, using maximum allowed: 8 [ 756.554017][ T804] usb 4-1: unable to read config index 0 descriptor/start: -61 [ 756.567162][ T804] usb 4-1: can't read configurations, error -61 [ 756.585236][ T804] usb usb4-port1: attempt power cycle [ 756.694268][T13160] IPVS: stop unused estimator thread 0... [ 756.743116][ T29] audit: type=1400 audit(1785373743.927:1229): avc: denied { write } for pid=14956 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 756.893118][T11479] usb 5-1: USB disconnect, device number 98 [ 756.897875][ T5273] 8021q: adding VLAN 0 to HW filter on device eth4 [ 756.957204][ T804] usb 4-1: new high-speed USB device number 64 using dummy_hcd [ 756.979124][ T804] usb 4-1: too many configurations: 97, using maximum allowed: 8 [ 756.980573][ T804] usb 4-1: unable to read config index 0 descriptor/start: -61 [ 756.980607][ T804] usb 4-1: can't read configurations, error -61 [ 757.189015][ T804] usb 4-1: new high-speed USB device number 65 using dummy_hcd [ 757.223608][ T804] usb 4-1: too many configurations: 97, using maximum allowed: 8 [ 757.234866][ T804] usb 4-1: unable to read config index 0 descriptor/start: -61 [ 757.234902][ T804] usb 4-1: can't read configurations, error -61 [ 757.337323][ T804] usb usb4-port1: unable to enumerate USB device [ 757.446632][T14975] binder: 14967:14975 ioctl c00c620f 200000000180 returned -22 [ 757.515032][T14692] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 757.564813][T14692] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 757.568698][T14692] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 757.609408][T14692] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 757.613256][T14692] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 757.645985][T14692] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 757.655747][T14692] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 757.719806][T14692] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 759.073865][T14974] fuse: Bad value for 'fd' [ 759.173914][T14692] 8021q: adding VLAN 0 to HW filter on device bond0 [ 759.207854][T14692] 8021q: adding VLAN 0 to HW filter on device team0 [ 759.219246][ T8704] bridge0: port 1(bridge_slave_0) entered blocking state [ 759.221235][ T8704] bridge0: port 1(bridge_slave_0) entered forwarding state [ 759.225927][ T8704] bridge0: port 2(bridge_slave_1) entered blocking state [ 759.226013][ T8704] bridge0: port 2(bridge_slave_1) entered forwarding state [ 759.651245][ T5712] usb 5-1: new full-speed USB device number 99 using dummy_hcd [ 759.884208][ T5712] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 759.911400][ T5712] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 759.921928][ T5712] usb 5-1: New USB device found, idVendor=045e, idProduct=02f9, bcdDevice= 0.11 [ 759.936733][ T5712] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 759.963588][ T5712] usb 5-1: config 0 descriptor?? [ 760.644898][T12888] usb 5-1: USB disconnect, device number 99 [ 760.667266][ T49] block nbd0: Receive control failed (result -32) [ 760.668582][ T5615] block nbd0: Receive control failed (result -32) [ 760.694948][T14692] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 761.011181][T15027] fuse: fd is not a fuse device [ 761.467791][T14692] veth0_vlan: entered promiscuous mode [ 761.482715][T14692] veth1_vlan: entered promiscuous mode [ 761.523854][T14692] veth0_macvtap: entered promiscuous mode [ 761.538082][T14692] veth1_macvtap: entered promiscuous mode [ 761.559091][T14692] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 761.573880][T14692] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 761.602693][ T8718] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 761.639990][ T8718] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 761.659677][ T8718] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 761.692920][ T8718] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 761.760184][T15035] netlink: 56 bytes leftover after parsing attributes in process `syz.0.2480'. [ 762.249819][T10435] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 762.261621][ T8704] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 762.272400][T10435] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 762.279856][ T8704] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 763.288055][ T29] audit: type=1400 audit(1785373750.477:1230): avc: denied { mounton } for pid=14692 comm="syz-executor" path="/root/syzkaller.mVLoI9/syz-tmp" dev="sda1" ino=2048 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 763.475200][ T29] audit: type=1400 audit(1785373750.627:1231): avc: denied { mounton } for pid=14692 comm="syz-executor" path="/root/syzkaller.mVLoI9/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 763.511486][ T29] audit: type=1400 audit(1785373750.627:1232): avc: denied { mounton } for pid=14692 comm="syz-executor" path="/root/syzkaller.mVLoI9/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=53786 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1 [ 763.539709][ T29] audit: type=1400 audit(1785373750.677:1233): avc: denied { mounton } for pid=14692 comm="syz-executor" path="/dev/gadgetfs" dev="devtmpfs" ino=2784 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=dir permissive=1 [ 763.565087][ T29] audit: type=1400 audit(1785373750.677:1234): avc: denied { mount } for pid=14692 comm="syz-executor" name="/" dev="gadgetfs" ino=7639 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=filesystem permissive=1 [ 763.657608][ T29] audit: type=1400 audit(1785373750.677:1235): avc: denied { mounton } for pid=14692 comm="syz-executor" path="/sys/fs/fuse/connections" dev="fusectl" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=dir permissive=1 [ 763.738912][T15052] team0: Device wg0 is of different type [ 763.816951][T15052] A link change request failed with some changes committed already. Interface wg0 may have been left with an inconsistent configuration, please check. [ 763.872822][T15057] netlink: 'syz.4.2486': attribute type 1 has an invalid length. [ 764.506420][ T5712] usb 4-1: new full-speed USB device number 66 using dummy_hcd [ 764.834713][ T5712] usb 4-1: config 0 interface 0 altsetting 88 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 764.848274][ T5712] usb 4-1: config 0 interface 0 has no altsetting 0 [ 764.856494][ T5712] usb 4-1: New USB device found, idVendor=05ac, idProduct=0265, bcdDevice= 0.00 [ 764.867497][ T5712] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 764.871882][T15057] 8021q: adding VLAN 0 to HW filter on device bond5 [ 764.891254][ T5712] usb 4-1: config 0 descriptor?? [ 765.019829][T15073] syzkaller0: entered promiscuous mode [ 765.026777][T15073] syzkaller0: entered allmulticast mode [ 765.206452][ T804] usb 2-1: new low-speed USB device number 92 using dummy_hcd [ 765.429109][ T804] usb 2-1: unable to get BOS descriptor or descriptor too short [ 765.507676][ T804] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 765.674409][ T804] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 765.987835][ T804] usb 2-1: string descriptor 0 read error: -22 [ 766.071174][ T804] usb 2-1: New USB device found, idVendor=0763, idProduct=2080, bcdDevice= 0.40 [ 766.123607][ T804] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 767.171807][ T804] usb 2-1: USB disconnect, device number 92 [ 768.303371][ T5712] usbhid 4-1:0.0: can't add hid device: -71 [ 768.524455][ T5712] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 768.641843][ T5712] usb 4-1: USB disconnect, device number 66 [ 768.652713][T15099] fuse: Bad value for 'fd' [ 770.076924][ T1185] usb 6-1: new full-speed USB device number 2 using dummy_hcd [ 770.089156][T15103] binder: 15102:15103 ioctl c00c620f 200000000180 returned -22 [ 770.278250][ T1185] usb 6-1: config 0 interface 0 altsetting 88 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 770.319085][ T1185] usb 6-1: config 0 interface 0 has no altsetting 0 [ 770.341592][ T1185] usb 6-1: New USB device found, idVendor=05ac, idProduct=0265, bcdDevice= 0.00 [ 770.375200][ T1185] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 770.406792][ T1185] usb 6-1: config 0 descriptor?? [ 771.137317][T15139] netlink: 240 bytes leftover after parsing attributes in process `syz.0.2505'. [ 771.253690][ T29] audit: type=1400 audit(1785373758.437:1236): avc: denied { write } for pid=15112 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 772.048046][ T29] audit: type=1400 audit(1785373759.237:1237): avc: denied { write } for pid=15154 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 773.354442][ T1185] usbhid 6-1:0.0: can't add hid device: -71 [ 773.365818][ T1185] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 773.381049][ T1185] usb 6-1: USB disconnect, device number 2 [ 775.450393][ T29] audit: type=1400 audit(1785373762.637:1238): avc: denied { write } for pid=15164 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 776.221854][ T29] audit: type=1400 audit(1785373763.407:1239): avc: denied { write } for pid=15206 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 776.306582][ T1185] usb 2-1: new low-speed USB device number 93 using dummy_hcd [ 776.589805][ T1185] usb 2-1: Invalid ep0 maxpacket: 32 [ 776.771492][ T1185] usb 2-1: new low-speed USB device number 94 using dummy_hcd [ 777.030047][ T804] usb 5-1: new high-speed USB device number 100 using dummy_hcd [ 777.218935][ T1185] usb 2-1: Invalid ep0 maxpacket: 32 [ 777.224602][ T1185] usb usb2-port1: attempt power cycle [ 777.770052][ T5615] Bluetooth: hci4: unexpected subevent 0x06 length: 18 > 10 [ 777.784114][ T804] usb 5-1: device descriptor read/64, error -71 [ 777.937600][T11479] hid_parser_main: 4 callbacks suppressed [ 777.937619][T11479] hid-generic 0000:0000:0000.0026: unknown main item tag 0x0 [ 777.960377][T11479] hid-generic 0000:0000:0000.0026: unknown main item tag 0x0 [ 777.972828][ T29] audit: type=1400 audit(1785373765.147:1240): avc: denied { write } for pid=15215 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 777.998685][T11479] hid-generic 0000:0000:0000.0026: unknown main item tag 0x0 [ 778.006153][T11479] hid-generic 0000:0000:0000.0026: unknown main item tag 0x0 [ 778.014212][T11479] hid-generic 0000:0000:0000.0026: unknown main item tag 0x0 [ 778.059566][T11479] hid-generic 0000:0000:0000.0026: unknown main item tag 0x0 [ 778.077100][T11479] hid-generic 0000:0000:0000.0026: unknown main item tag 0x0 [ 778.092406][T11479] hid-generic 0000:0000:0000.0026: unknown main item tag 0x0 [ 778.118953][T11479] hid-generic 0000:0000:0000.0026: unknown main item tag 0x0 [ 778.151030][T11479] hid-generic 0000:0000:0000.0026: unknown main item tag 0x0 [ 778.173982][ T29] audit: type=1400 audit(1785373765.367:1241): avc: denied { write } for pid=15241 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 778.196329][ T1185] usb 2-1: new low-speed USB device number 95 using dummy_hcd [ 778.206637][ T804] usb 5-1: new high-speed USB device number 101 using dummy_hcd [ 778.221993][T11479] hid-generic 0000:0000:0000.0026: hidraw0: HID v0.03 Device [syz1] on syz1 [ 778.237465][ T1185] usb 2-1: Invalid ep0 maxpacket: 32 [ 778.310939][T15245] fido_id[15245]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 778.377484][ T804] usb 5-1: device descriptor read/64, error -71 [ 778.458573][ T1185] usb 2-1: new low-speed USB device number 96 using dummy_hcd [ 778.500722][ T1185] usb 2-1: Invalid ep0 maxpacket: 32 [ 778.523986][ T1185] usb usb2-port1: unable to enumerate USB device [ 778.863211][ T804] usb usb5-port1: attempt power cycle [ 779.299637][ T804] usb 5-1: new high-speed USB device number 102 using dummy_hcd [ 779.418730][T11479] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 779.816741][ T5615] Bluetooth: hci4: command 0x0406 tx timeout [ 779.954766][ T804] usb 5-1: device descriptor read/8, error -71 [ 780.014894][ T29] audit: type=1400 audit(1785373767.197:1242): avc: denied { write } for pid=15252 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 780.041949][T11479] usb 6-1: Using ep0 maxpacket: 32 [ 780.074426][T11479] usb 6-1: New USB device found, idVendor=06b9, idProduct=4061, bcdDevice=89.53 [ 780.090846][T11479] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 780.107929][T11479] usb 6-1: Product: syz [ 780.117297][T11479] usb 6-1: Manufacturer: syz [ 780.132920][T11479] usb 6-1: SerialNumber: syz [ 780.177317][ T29] audit: type=1400 audit(1785373767.367:1243): avc: denied { write } for pid=15285 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 780.366787][T11479] speedtch 6-1:5.0: speedtch_bind: wrong device class 71 [ 780.857972][T11479] speedtch 6-1:5.0: usbatm_usb_probe: bind failed: -19! [ 780.867651][T11479] usb 6-1: USB disconnect, device number 3 [ 781.372678][T15309] netlink: 36 bytes leftover after parsing attributes in process `syz.3.2539'. [ 782.586349][ T804] usb 6-1: new full-speed USB device number 4 using dummy_hcd [ 782.902602][ T804] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 782.917076][ T804] usb 6-1: New USB device found, idVendor=0b48, idProduct=3007, bcdDevice=4f.64 [ 782.929106][ T804] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 782.938016][ T804] usb 6-1: Product: syz [ 782.976646][ T804] usb 6-1: Manufacturer: syz [ 782.984900][ T804] usb 6-1: SerialNumber: syz [ 783.005261][ T804] usb 6-1: config 0 descriptor?? [ 783.032137][ T804] dvb-usb: found a 'Technotrend TT Connect S2-3600' in warm state. [ 783.047233][ T804] pctv452e: pctv452e_power_ctrl: 1 [ 783.047233][ T804] [ 783.056410][ T804] usb 6-1: selecting invalid altsetting 3 [ 783.065816][ T804] pctv452e: pctv452e_power_ctrl: Warning set interface returned: -22 [ 783.065816][ T804] [ 783.084146][ T804] dvb-usb: bulk message failed: -22 (5/0) [ 783.197709][ T804] dvb-usb: This USB2.0 device cannot be run on a USB1.1 port. (it lacks a hardware PID filter) [ 783.221300][ T804] dvb-usb: Technotrend TT Connect S2-3600 error while loading driver (-19) [ 783.749834][ T804] usb 6-1: USB disconnect, device number 4 [ 784.311156][T15339] loop6: detected capacity change from 0 to 2640 [ 784.319875][T15339] buffer_io_error: 11 callbacks suppressed [ 784.319886][T15339] Buffer I/O error on dev loop6, logical block 0, async page read [ 784.333908][T15339] Buffer I/O error on dev loop6, logical block 0, async page read [ 784.354660][T15339] Buffer I/O error on dev loop6, logical block 0, async page read [ 784.366369][T15339] Buffer I/O error on dev loop6, logical block 0, async page read [ 784.396094][T15339] Buffer I/O error on dev loop6, logical block 0, async page read [ 784.416355][T15339] Buffer I/O error on dev loop6, logical block 0, async page read [ 784.436295][T15339] Buffer I/O error on dev loop6, logical block 0, async page read [ 784.444175][T15339] Buffer I/O error on dev loop6, logical block 0, async page read [ 784.466319][T15339] ldm_validate_partition_table(): Disk read failed. [ 784.473770][T15339] Buffer I/O error on dev loop6, logical block 0, async page read [ 784.482080][T15339] Buffer I/O error on dev loop6, logical block 0, async page read [ 784.490313][T15339] Dev loop6: unable to read RDB block 0 [ 784.501652][T15339] loop6: unable to read partition table [ 784.510087][T15339] loop_reread_partitions: partition scan of loop6 (3Ÿ ¾‚³˜) failed (rc=-5) [ 785.004211][T15358] bond1: option mode: unable to set because the bond device has slaves [ 785.092246][T15358] macvlan4: entered allmulticast mode [ 785.106745][T15358] bond0: entered allmulticast mode [ 785.126017][T15358] : entered allmulticast mode [ 785.144067][T15358] bond_slave_1: entered allmulticast mode [ 785.176176][T15358] 8021q: adding VLAN 0 to HW filter on device macvlan4 [ 785.206654][T15358] bond1: (slave macvlan4): Enslaving as an active interface with an up link [ 785.298833][ T804] usb 5-1: new low-speed USB device number 104 using dummy_hcd [ 785.308196][T12888] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 785.358248][T15366] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 785.388978][T15368] FAULT_INJECTION: forcing a failure. [ 785.388978][T15368] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 785.411626][T15368] CPU: 1 UID: 0 PID: 15368 Comm: syz.3.2559 Tainted: G L syzkaller #0 PREEMPT(full) [ 785.411656][T15368] Tainted: [L]=SOFTLOCKUP [ 785.411662][T15368] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 785.411671][T15368] Call Trace: [ 785.411677][T15368] [ 785.411684][T15368] dump_stack_lvl+0x100/0x190 [ 785.411711][T15368] should_fail_ex.cold+0x5/0xa [ 785.411733][T15368] _copy_from_user+0x2e/0xd0 [ 785.411758][T15368] copy_msghdr_from_user+0x9f/0x4c0 [ 785.411799][T15368] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 785.411835][T15368] ___sys_sendmsg+0x106/0x1e0 [ 785.411862][T15368] ? __pfx____sys_sendmsg+0x10/0x10 [ 785.411885][T15368] ? __lock_acquire+0x49f/0x1a40 [ 785.411905][T15368] ? get_pid_task+0x106/0x250 [ 785.411955][T15368] __sys_sendmsg+0x160/0x210 [ 785.411976][T15368] ? __pfx___sys_sendmsg+0x10/0x10 [ 785.412008][T15368] do_syscall_64+0x115/0x870 [ 785.412028][T15368] ? clear_bhb_loop+0x40/0x90 [ 785.412049][T15368] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 785.412065][T15368] RIP: 0033:0x7f3ca359de99 [ 785.412080][T15368] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 785.412094][T15368] RSP: 002b:00007f3ca4515028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 785.412110][T15368] RAX: ffffffffffffffda RBX: 00007f3ca3825fa0 RCX: 00007f3ca359de99 [ 785.412120][T15368] RDX: 0000000020000000 RSI: 0000200000000580 RDI: 0000000000000006 [ 785.412130][T15368] RBP: 00007f3ca4515090 R08: 0000000000000000 R09: 0000000000000000 [ 785.412140][T15368] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 785.412150][T15368] R13: 00007f3ca3826038 R14: 00007f3ca3825fa0 R15: 00007ffd66a7a0f8 [ 785.412174][T15368] [ 785.526692][T12888] usb 6-1: Using ep0 maxpacket: 32 [ 785.609507][T12888] usb 6-1: config index 0 descriptor too short (expected 29220, got 36) [ 785.618208][T12888] usb 6-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 785.627865][T12888] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 785.637186][T12888] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 785.647041][T12888] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 785.660382][T12888] usb 6-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 785.673770][ T804] usb 5-1: unable to get BOS descriptor or descriptor too short [ 785.683488][T12888] usb 6-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 785.693181][ T804] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 785.707468][ T804] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 785.730553][T12888] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 785.749315][ T804] usb 5-1: string descriptor 0 read error: -22 [ 785.755714][ T804] usb 5-1: New USB device found, idVendor=0763, idProduct=2080, bcdDevice= 0.40 [ 785.781581][T12888] usb 6-1: config 0 descriptor?? [ 785.802169][ T804] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 785.883968][T15375] netlink: 36 bytes leftover after parsing attributes in process `syz.3.2561'. [ 786.255559][T12888] usblp 6-1:0.0: usblp0: USB Bidirectional printer dev 5 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 786.315106][T12888] usb 6-1: USB disconnect, device number 5 [ 786.414182][T12888] usblp0: removed [ 786.433099][ T804] usb 5-1: USB disconnect, device number 104 [ 786.756528][T12888] usb 6-1: new high-speed USB device number 6 using dummy_hcd [ 786.869727][T15389] netlink: 'syz.4.2567': attribute type 1 has an invalid length. [ 786.887232][T15389] 8021q: adding VLAN 0 to HW filter on device bond6 [ 786.937698][T12888] usb 6-1: Using ep0 maxpacket: 32 [ 786.947065][T12888] usb 6-1: config index 0 descriptor too short (expected 29220, got 36) [ 786.958448][T12888] usb 6-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 786.967594][T12888] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 786.981180][T15393] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2568'. [ 786.991178][T12888] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 787.014219][T12888] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 787.029612][T12888] usb 6-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 787.153149][T12888] usb 6-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 787.195634][T12888] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 787.312910][ T1185] usb 4-1: new high-speed USB device number 67 using dummy_hcd [ 787.495965][T12888] usb 6-1: config 0 descriptor?? [ 787.806522][T12888] usblp 6-1:0.0: usblp0: USB Bidirectional printer dev 6 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 787.936322][ T1185] usb 4-1: Using ep0 maxpacket: 8 [ 787.943251][T15398] xt_hashlimit: size too large, truncated to 1048576 [ 787.947454][ T1185] usb 4-1: config 0 has an invalid interface number: 55 but max is 0 [ 787.976292][ T1185] usb 4-1: config 0 has no interface number 0 [ 787.992578][ T1185] usb 4-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 788.013719][ T1185] usb 4-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 788.027806][ T1185] usb 4-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 788.039113][ T1185] usb 4-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 788.076293][ T1185] usb 4-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 788.095656][ T1185] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 788.117940][ T1185] usb 4-1: config 0 descriptor?? [ 788.135983][ T5615] Bluetooth: hci5: unexpected cc 0x1407 length: 11 > 9 [ 788.150998][ T1185] ldusb 4-1:0.55: LD USB Device #1 now attached to major 180 minor 1 [ 788.453984][ T29] audit: type=1400 audit(1785373775.607:1244): avc: denied { read write } for pid=15361 comm="syz.5.2556" name="lp0" dev="devtmpfs" ino=4265 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:printer_device_t tclass=chr_file permissive=1 [ 788.587876][ T1185] usb 4-1: USB disconnect, device number 67 [ 788.599358][T12888] usb 6-1: USB disconnect, device number 6 [ 788.607672][T12888] usblp0: removed [ 788.625719][ T29] audit: type=1400 audit(1785373775.607:1245): avc: denied { open } for pid=15361 comm="syz.5.2556" path="/dev/usb/lp0" dev="devtmpfs" ino=4265 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:printer_device_t tclass=chr_file permissive=1 [ 788.651206][ T1185] ldusb 4-1:0.55: LD USB Device #1 now disconnected [ 788.966413][ T804] usb 2-1: new high-speed USB device number 97 using dummy_hcd [ 789.141231][ T804] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 789.241520][ T804] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 64, changing to 10 [ 789.275351][ T804] usb 2-1: New USB device found, idVendor=0525, idProduct=81a1, bcdDevice= 0.40 [ 789.290755][ T804] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 789.311834][ T804] usb 2-1: Product: syz [ 789.316101][ T804] usb 2-1: Manufacturer: syz [ 789.321826][ T804] usb 2-1: SerialNumber: syz [ 789.334476][ T804] usb 2-1: selecting invalid altsetting 1 [ 789.538951][T15408] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 789.571243][T15408] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 790.069806][T15426] gretap0: entered promiscuous mode [ 790.762217][ T804] cdc_ncm 2-1:1.0: failed GET_NTB_PARAMETERS [ 790.783525][ T29] audit: type=1400 audit(1785373777.517:1246): avc: denied { listen } for pid=15425 comm="syz.5.2578" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 790.907137][T15408] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 790.917354][ T804] cdc_ncm 2-1:1.0: bind() failure [ 790.964772][T15438] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 791.053964][T15408] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 791.086913][T15438] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 791.172766][ T804] usb 2-1: USB disconnect, device number 97 [ 791.208103][T15419] fuse: fd is not a fuse device [ 791.303717][T15448] xt_hashlimit: size too large, truncated to 1048576 [ 791.878830][ T804] usb 4-1: new high-speed USB device number 68 using dummy_hcd [ 792.677815][ T804] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 792.688247][ T804] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x85 has an invalid bInterval 0, changing to 7 [ 792.699897][ T804] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 792.713287][ T804] usb 4-1: New USB device found, idVendor=2040, idProduct=1605, bcdDevice= a.94 [ 792.729236][ T804] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 792.750519][ T804] usb 4-1: config 0 descriptor?? [ 793.033186][T15457] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 793.049425][T15457] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 793.070510][ T804] usb 4-1: USB disconnect, device number 68 [ 793.997413][ T29] audit: type=1400 audit(1785373781.187:1247): avc: denied { name_bind } for pid=15477 comm="syz.5.2591" src=20004 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=rawip_socket permissive=1 [ 794.783668][T12888] usb 5-1: new low-speed USB device number 105 using dummy_hcd [ 794.794467][T15491] binder: 15489:15491 ioctl c00c620f 200000000180 returned -22 [ 795.019807][T15494] xt_hashlimit: size too large, truncated to 1048576 [ 795.154887][T12888] usb 5-1: unable to get BOS descriptor or descriptor too short [ 795.164108][T12888] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 795.187229][T12888] usb 5-1: config 1 interface 0 altsetting 7 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 795.221297][T12888] usb 5-1: config 1 interface 0 has no altsetting 0 [ 795.234086][T12888] usb 5-1: string descriptor 0 read error: -22 [ 795.240762][T12888] usb 5-1: New USB device found, idVendor=04b8, idProduct=0202, bcdDevice= 0.40 [ 795.287599][T12888] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 796.556626][ T5717] usb 4-1: new low-speed USB device number 69 using dummy_hcd [ 797.134755][ T5717] usb 4-1: unable to get BOS descriptor or descriptor too short [ 797.148173][ T5717] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 797.158421][ T5717] usb 4-1: config 1 interface 0 altsetting 7 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 797.172426][ T5717] usb 4-1: config 1 interface 0 has no altsetting 0 [ 797.181619][ T5717] usb 4-1: string descriptor 0 read error: -22 [ 797.187877][ T5717] usb 4-1: New USB device found, idVendor=04b8, idProduct=0202, bcdDevice= 0.40 [ 797.197050][ T1185] usb 6-1: new full-speed USB device number 7 using dummy_hcd [ 797.204543][ T5717] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 797.324367][ T804] usb 5-1: USB disconnect, device number 105 [ 797.358224][ T1185] usb 6-1: config 251 has an invalid interface number: 202 but max is 0 [ 797.367665][ T1185] usb 6-1: config 251 has no interface number 0 [ 797.375117][ T1185] usb 6-1: config 251 interface 202 altsetting 1 has an invalid descriptor for endpoint zero, skipping [ 797.388061][ T1185] usb 6-1: config 251 interface 202 altsetting 1 endpoint 0x6 has invalid maxpacket 1024, setting to 64 [ 797.402246][ T1185] usb 6-1: config 251 interface 202 altsetting 1 has an endpoint descriptor with address 0xC1, changing to 0x81 [ 797.414602][ T1185] usb 6-1: config 251 interface 202 altsetting 1 has a duplicate endpoint with address 0x81, skipping [ 797.483186][ T1185] usb 6-1: config 251 interface 202 altsetting 1 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 797.516420][ T1185] usb 6-1: config 251 interface 202 has no altsetting 0 [ 797.527405][ T1185] usb 6-1: New USB device found, idVendor=0572, idProduct=cb00, bcdDevice=bb.c9 [ 797.536794][ T1185] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 797.545079][ T1185] usb 6-1: Product: syz [ 797.549462][ T1185] usb 6-1: Manufacturer: syz [ 797.554774][ T1185] usb 6-1: SerialNumber: syz [ 798.213718][ T1185] cxacru 6-1:251.202: usbatm_usb_probe: bind failed: -19! [ 798.245609][ T1185] usb 6-1: USB disconnect, device number 7 [ 798.561130][ T29] audit: type=1400 audit(1785373785.747:1248): avc: denied { write } for pid=15539 comm="syz.1.2607" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 798.619181][ T29] audit: type=1400 audit(1785373785.787:1249): avc: denied { ioctl } for pid=15539 comm="syz.1.2607" path="socket:[56090]" dev="sockfs" ino=56090 ioctlcmd=0x89e0 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 798.668023][T15542] xt_hashlimit: size too large, truncated to 1048576 [ 799.320887][T15550] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2611'. [ 799.413652][ T1185] usb 4-1: USB disconnect, device number 69 [ 799.474059][T15555] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2613'. [ 800.640729][T15573] FAULT_INJECTION: forcing a failure. [ 800.640729][T15573] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 800.660355][T15573] CPU: 0 UID: 0 PID: 15573 Comm: syz.0.2618 Tainted: G L syzkaller #0 PREEMPT(full) [ 800.660375][T15573] Tainted: [L]=SOFTLOCKUP [ 800.660379][T15573] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 800.660386][T15573] Call Trace: [ 800.660390][T15573] [ 800.660395][T15573] dump_stack_lvl+0x100/0x190 [ 800.660413][T15573] should_fail_ex.cold+0x5/0xa [ 800.660429][T15573] _copy_from_user+0x2e/0xd0 [ 800.660450][T15573] __sys_bpf+0x2f5/0x4e80 [ 800.660467][T15573] ? __pfx___sys_bpf+0x10/0x10 [ 800.660478][T15573] ? find_held_lock+0x2b/0x80 [ 800.660495][T15573] ? get_pid_task+0xfc/0x250 [ 800.660513][T15573] ? get_pid_task+0xfc/0x250 [ 800.660536][T15573] ? find_held_lock+0x2b/0x80 [ 800.660556][T15573] ? rcu_read_lock_any_held+0x6a/0xa0 [ 800.660568][T15573] ? find_held_lock+0x2b/0x80 [ 800.660585][T15573] ? ksys_write+0x190/0x250 [ 800.660603][T15573] ? ksys_write+0x190/0x250 [ 800.660630][T15573] ? fput+0x79/0x100 [ 800.660646][T15573] ? __x64_sys_bpf+0xce/0x140 [ 800.660657][T15573] __x64_sys_bpf+0xce/0x140 [ 800.660669][T15573] ? do_syscall_64+0x90/0x870 [ 800.660683][T15573] do_syscall_64+0x115/0x870 [ 800.660696][T15573] ? clear_bhb_loop+0x40/0x90 [ 800.660710][T15573] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 800.660724][T15573] RIP: 0033:0x7f5cc5b9de99 [ 800.660734][T15573] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 800.660745][T15573] RSP: 002b:00007f5cc69ca028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 800.660757][T15573] RAX: ffffffffffffffda RBX: 00007f5cc5e25fa0 RCX: 00007f5cc5b9de99 [ 800.660764][T15573] RDX: 0000000000000028 RSI: 0000200000000140 RDI: 0000000000000012 [ 800.660771][T15573] RBP: 00007f5cc69ca090 R08: 0000000000000000 R09: 0000000000000000 [ 800.660778][T15573] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 800.660784][T15573] R13: 00007f5cc5e26038 R14: 00007f5cc5e25fa0 R15: 00007ffe84861e68 [ 800.660799][T15573] [ 800.998158][T15576] netlink: 76 bytes leftover after parsing attributes in process `syz.0.2621'. [ 801.070332][T15579] xt_hashlimit: size too large, truncated to 1048576 [ 801.876487][ T5615] Bluetooth: hci0: unexpected subevent 0x06 length: 18 > 10 [ 801.925648][ T5712] hid_parser_main: 84 callbacks suppressed [ 801.925667][ T5712] hid-generic 0000:0000:0000.0027: unknown main item tag 0x0 [ 801.943032][ T5712] hid-generic 0000:0000:0000.0027: unknown main item tag 0x0 [ 801.951146][ T5712] hid-generic 0000:0000:0000.0027: unknown main item tag 0x0 [ 801.959147][ T5712] hid-generic 0000:0000:0000.0027: unknown main item tag 0x0 [ 801.972619][ T5712] hid-generic 0000:0000:0000.0027: unknown main item tag 0x0 [ 801.994144][ T5712] hid-generic 0000:0000:0000.0027: unknown main item tag 0x0 [ 802.015275][ T5712] hid-generic 0000:0000:0000.0027: unknown main item tag 0x0 [ 802.025290][T15600] siw: device registration error -23 [ 802.037181][ T29] audit: type=1400 audit(1785374045.230:1250): avc: denied { write } for pid=15594 comm="syz.4.2627" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 802.079348][ T5712] hid-generic 0000:0000:0000.0027: unknown main item tag 0x0 [ 802.101458][ T5712] hid-generic 0000:0000:0000.0027: unknown main item tag 0x0 [ 802.133689][ T5712] hid-generic 0000:0000:0000.0027: unknown main item tag 0x0 [ 802.134727][T13163] Bluetooth: (null): Invalid header checksum [ 802.185392][ T5712] hid-generic 0000:0000:0000.0027: hidraw0: HID v0.03 Device [syz1] on syz1 [ 802.201510][T15599] xt_CT: You must specify a L4 protocol and not use inversions on it [ 802.201766][ T29] audit: type=1400 audit(1785374045.390:1251): avc: denied { ioctl } for pid=15594 comm="syz.4.2627" path="socket:[57021]" dev="sockfs" ino=57021 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 802.234917][T13163] Bluetooth: (null): Too short H5 packet [ 802.326579][T13163] Bluetooth: (null): Invalid header checksum [ 802.348937][ T8718] Bluetooth: (null): Invalid header checksum [ 802.429532][T15601] fido_id[15601]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 802.449578][ T76] Bluetooth: (null): Invalid header checksum [ 802.537445][T15607] binder: 15602:15607 ioctl c00c620f 200000000180 returned -22 [ 802.846584][T15614] netlink: 36 bytes leftover after parsing attributes in process `syz.4.2632'. [ 802.944876][ T5712] usb 6-1: new low-speed USB device number 8 using dummy_hcd [ 803.320598][ T5712] usb 6-1: unable to get BOS descriptor or descriptor too short [ 803.346592][ T5712] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 803.388782][ T5712] usb 6-1: config 1 interface 0 altsetting 7 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 803.435350][ T5712] usb 6-1: config 1 interface 0 has no altsetting 0 [ 803.452409][ T5712] usb 6-1: string descriptor 0 read error: -22 [ 803.459899][ T5712] usb 6-1: New USB device found, idVendor=04b8, idProduct=0202, bcdDevice= 0.40 [ 803.474985][ T5712] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 803.795698][T15627] xt_hashlimit: size too large, truncated to 1048576 [ 803.857344][ T5712] usb 4-1: new low-speed USB device number 70 using dummy_hcd [ 803.896922][ T5615] Bluetooth: hci0: command 0x0406 tx timeout [ 804.019484][ T5712] usb 4-1: unable to get BOS descriptor or descriptor too short [ 804.035621][ T5712] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 804.057317][ T5712] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 804.081082][ T5712] usb 4-1: string descriptor 0 read error: -22 [ 804.088610][ T5712] usb 4-1: New USB device found, idVendor=0763, idProduct=2080, bcdDevice= 0.40 [ 804.109444][ T5712] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 805.256083][T12888] usb 4-1: USB disconnect, device number 70 [ 805.447217][T15650] syzkaller1: tun_chr_ioctl cmd 1074025675 [ 805.453269][T15650] syzkaller1: persist disabled [ 805.934813][ T804] usb 6-1: USB disconnect, device number 8 [ 806.333139][T15668] syzkaller0: entered promiscuous mode [ 806.376264][T15668] syzkaller0: entered allmulticast mode [ 806.438141][T15663] syz.1.2645 (15663): /proc/15663/oom_adj is deprecated, please use /proc/15663/oom_score_adj instead. [ 806.457256][T15668] tipc: Enabled bearer , priority 0 [ 806.480745][T15665] tipc: Resetting bearer [ 806.524058][T15665] tipc: Disabling bearer [ 807.246959][ T1185] usb 5-1: new high-speed USB device number 106 using dummy_hcd [ 807.476598][ T1185] usb 5-1: Using ep0 maxpacket: 8 [ 807.846690][ T1185] usb 5-1: config 65 has an invalid interface number: 60 but max is 1 [ 807.860314][ T1185] usb 5-1: config 65 has an invalid interface number: 248 but max is 1 [ 807.869429][ T1185] usb 5-1: config 65 has no interface number 0 [ 807.876075][ T1185] usb 5-1: config 65 has no interface number 1 [ 807.882735][ T1185] usb 5-1: config 65 interface 60 altsetting 3 endpoint 0x6 has invalid maxpacket 1024, setting to 64 [ 807.894115][ T1185] usb 5-1: config 65 interface 248 altsetting 64 has a duplicate endpoint with address 0x6, skipping [ 807.989721][ T1185] usb 5-1: config 65 interface 248 altsetting 64 endpoint 0x1 has invalid maxpacket 1024, setting to 64 [ 808.001341][ T1185] usb 5-1: config 65 interface 248 altsetting 64 endpoint 0xF has invalid maxpacket 1024, setting to 64 [ 808.012659][ T1185] usb 5-1: config 65 interface 248 altsetting 64 has an invalid descriptor for endpoint zero, skipping [ 808.023871][ T1185] usb 5-1: config 65 interface 248 altsetting 64 has a duplicate endpoint with address 0x8, skipping [ 808.035358][ T1185] usb 5-1: config 65 interface 248 altsetting 64 has an endpoint descriptor with address 0x65, changing to 0x5 [ 808.047702][ T1185] usb 5-1: config 65 interface 248 altsetting 64 endpoint 0x5 has invalid maxpacket 55258, setting to 64 [ 808.059028][ T1185] usb 5-1: config 65 interface 248 altsetting 64 endpoint 0xA has an invalid bInterval 129, changing to 7 [ 808.070570][ T1185] usb 5-1: config 65 interface 248 altsetting 64 has a duplicate endpoint with address 0xF, skipping [ 808.081499][ T1185] usb 5-1: config 65 interface 248 altsetting 64 has an invalid descriptor for endpoint zero, skipping [ 808.092646][ T1185] usb 5-1: config 65 interface 248 altsetting 64 bulk endpoint 0x9 has invalid maxpacket 32 [ 808.103478][ T1185] usb 5-1: config 65 interface 248 altsetting 64 has a duplicate endpoint with address 0x6, skipping [ 808.565734][ T1185] usb 5-1: config 65 interface 248 altsetting 64 has a duplicate endpoint with address 0xA, skipping [ 808.605032][ T1185] usb 5-1: config 65 interface 248 altsetting 64 has 13 endpoint descriptors, different from the interface descriptor's value: 12 [ 808.629198][ T1313] ieee802154 phy1 wpan1: encryption failed: -22 [ 808.648682][T15700] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2657'. [ 808.657711][ T1185] usb 5-1: config 65 interface 60 has no altsetting 0 [ 808.667389][ T1185] usb 5-1: config 65 interface 248 has no altsetting 0 [ 808.680388][T15700] netlink: 12 bytes leftover after parsing attributes in process `syz.5.2657'. [ 808.701118][ T1185] usb 5-1: New USB device found, idVendor=0499, idProduct=7010, bcdDevice=48.d3 [ 808.715454][ T1185] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 808.795456][ T1185] usb 5-1: Product: syz [ 808.803361][ T1185] usb 5-1: Manufacturer: а [ 808.808344][ T1185] usb 5-1: SerialNumber: syz [ 808.997418][T15710] bond1: option mode: unable to set because the bond device has slaves [ 809.029547][ T1185] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 809.050855][ T1185] snd-usb-audio 5-1:65.60: probe with driver snd-usb-audio failed with error -2 [ 809.063581][T15712] FAULT_INJECTION: forcing a failure. [ 809.063581][T15712] name failslab, interval 1, probability 0, space 0, times 0 [ 809.081885][T15712] CPU: 0 UID: 0 PID: 15712 Comm: syz.5.2662 Tainted: G L syzkaller #0 PREEMPT(full) [ 809.081915][T15712] Tainted: [L]=SOFTLOCKUP [ 809.081921][T15712] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 809.081931][T15712] Call Trace: [ 809.081937][T15712] [ 809.081944][T15712] dump_stack_lvl+0x100/0x190 [ 809.081976][T15712] should_fail_ex.cold+0x5/0xa [ 809.081999][T15712] should_failslab+0xc2/0x120 [ 809.082023][T15712] kmem_cache_alloc_node_noprof+0x94/0x6b0 [ 809.082045][T15712] ? __alloc_skb+0x5b7/0x710 [ 809.082066][T15712] ? __alloc_skb+0x140/0x710 [ 809.082089][T15712] __alloc_skb+0x140/0x710 [ 809.082106][T15712] ? __alloc_skb+0x5b7/0x710 [ 809.082124][T15712] ? __pfx___alloc_skb+0x10/0x10 [ 809.082151][T15712] netlink_alloc_large_skb+0x69/0x150 [ 809.082172][T15712] netlink_sendmsg+0x680/0xda0 [ 809.082192][T15712] ? __pfx_netlink_sendmsg+0x10/0x10 [ 809.082212][T15712] ? selinux_socket_sendmsg+0x198/0x2f0 [ 809.082242][T15712] ____sys_sendmsg+0xa4d/0xbe0 [ 809.082267][T15712] ? __pfx_netlink_sendmsg+0x10/0x10 [ 809.082286][T15712] ? __pfx_____sys_sendmsg+0x10/0x10 [ 809.082320][T15712] ___sys_sendmsg+0x190/0x1e0 [ 809.082348][T15712] ? __pfx____sys_sendmsg+0x10/0x10 [ 809.082373][T15712] ? __lock_acquire+0x49f/0x1a40 [ 809.082395][T15712] ? get_pid_task+0x106/0x250 [ 809.082448][T15712] __sys_sendmsg+0x160/0x210 [ 809.082473][T15712] ? __pfx___sys_sendmsg+0x10/0x10 [ 809.082507][T15712] do_syscall_64+0x115/0x870 [ 809.082528][T15712] ? clear_bhb_loop+0x40/0x90 [ 809.082550][T15712] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 809.082568][T15712] RIP: 0033:0x7febf999de99 [ 809.082583][T15712] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 809.082600][T15712] RSP: 002b:00007febfa7ef028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 809.082617][T15712] RAX: ffffffffffffffda RBX: 00007febf9c25fa0 RCX: 00007febf999de99 [ 809.082629][T15712] RDX: 0000000020000000 RSI: 0000200000000580 RDI: 0000000000000006 [ 809.082639][T15712] RBP: 00007febfa7ef090 R08: 0000000000000000 R09: 0000000000000000 [ 809.082649][T15712] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 809.082660][T15712] R13: 00007febf9c26038 R14: 00007febf9c25fa0 R15: 00007ffc90525308 [ 809.082684][T15712] [ 809.085126][T15710] macvlan5: entered promiscuous mode [ 809.338997][ T1185] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 809.375600][T15710] bond0: entered promiscuous mode [ 809.390685][ T1185] usb 5-1: USB disconnect, device number 106 [ 809.396296][T15710] : entered promiscuous mode [ 809.403159][T15710] bond_slave_1: entered promiscuous mode [ 809.462280][T15710] macvlan5: entered allmulticast mode [ 809.484370][T15710] 8021q: adding VLAN 0 to HW filter on device macvlan5 [ 809.527388][T10640] udevd[10640]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:65.248/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 809.527484][T15710] bond0: left promiscuous mode [ 809.600294][T15710] : left promiscuous mode [ 809.616121][T15710] bond_slave_1: left promiscuous mode [ 809.667713][T15716] ip6erspan0: entered allmulticast mode [ 810.408288][ T29] audit: type=1400 audit(1785374053.590:1252): avc: denied { write } for pid=15724 comm="syz.5.2667" name="functions" dev="configfs" ino=21525 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 810.454640][ T29] audit: type=1400 audit(1785374053.590:1253): avc: denied { create } for pid=15724 comm="syz.5.2667" name="uac1.usb0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:configfs_t tclass=dir permissive=1 [ 811.000195][T15739] netlink: 'syz.5.2671': attribute type 1 has an invalid length. [ 811.079810][T15745] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 811.087550][T15743] binder: BINDER_SET_CONTEXT_MGR already set [ 811.155780][T15746] binder: 15742:15746 ioctl c018620c 200000000240 returned -1 [ 811.208297][T15743] binder: 15742:15743 ioctl 4018620d 200000000100 returned -16 [ 811.265848][T15743] binder: BINDER_SET_CONTEXT_MGR already set [ 811.281631][T15745] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 811.345004][T15743] binder: 15742:15743 ioctl 4018620d 200000000100 returned -16 [ 811.355980][T15743] binder: BINDER_SET_CONTEXT_MGR already set [ 811.362761][T15743] binder: 15742:15743 ioctl 4018620d 200000000100 returned -16 [ 811.375853][T15743] binder: BINDER_SET_CONTEXT_MGR already set [ 811.386255][T15743] binder: 15742:15743 ioctl 4018620d 200000000100 returned -16 [ 811.399006][T15743] binder: BINDER_SET_CONTEXT_MGR already set [ 811.408413][T15743] binder: 15742:15743 ioctl 4018620d 200000000100 returned -16 [ 811.431036][T15743] binder: BINDER_SET_CONTEXT_MGR already set [ 811.453248][T15739] 8021q: adding VLAN 0 to HW filter on device bond1 [ 811.501939][T15743] binder: 15742:15743 ioctl 4018620d 200000000100 returned -16 [ 811.548907][T15743] binder: BINDER_SET_CONTEXT_MGR already set [ 811.589227][T15743] binder: 15742:15743 ioctl 4018620d 200000000100 returned -16 [ 811.629002][T15743] binder: BINDER_SET_CONTEXT_MGR already set [ 811.653816][T15743] binder: 15742:15743 ioctl 4018620d 200000000100 returned -16 [ 811.676328][T15743] binder: BINDER_SET_CONTEXT_MGR already set [ 811.683893][T15743] binder: 15742:15743 ioctl 4018620d 200000000100 returned -16 [ 811.706331][T15743] binder: BINDER_SET_CONTEXT_MGR already set [ 811.723100][T15743] binder: 15742:15743 ioctl 4018620d 200000000100 returned -16 [ 811.737045][T15743] binder: BINDER_SET_CONTEXT_MGR already set [ 811.746344][T15743] binder: 15742:15743 ioctl 4018620d 200000000100 returned -16 [ 811.761642][T15743] binder: BINDER_SET_CONTEXT_MGR already set [ 811.776342][T15743] binder: 15742:15743 ioctl 4018620d 200000000100 returned -16 [ 811.792839][T15743] binder: BINDER_SET_CONTEXT_MGR already set [ 811.806288][T15743] binder: 15742:15743 ioctl 4018620d 200000000100 returned -16 [ 811.816362][T12888] usb 6-1: new high-speed USB device number 9 using dummy_hcd [ 811.824008][T15743] binder: BINDER_SET_CONTEXT_MGR already set [ 811.839234][T15743] binder: 15742:15743 ioctl 4018620d 200000000100 returned -16 [ 811.852385][ T29] audit: type=1400 audit(1785374055.040:1254): avc: denied { getopt } for pid=15757 comm="syz.3.2678" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 811.874191][T15743] binder: BINDER_SET_CONTEXT_MGR already set [ 811.885404][T15743] binder: 15742:15743 ioctl 4018620d 200000000100 returned -16 [ 811.945270][T15759] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2678'. [ 812.050353][T12888] usb 6-1: Using ep0 maxpacket: 8 [ 812.115774][T12888] usb 6-1: config 0 has an invalid interface number: 55 but max is 0 [ 812.207816][T12888] usb 6-1: config 0 has no interface number 0 [ 812.277811][T12888] usb 6-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 812.322173][T12888] usb 6-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 812.341191][T15764] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2679'. [ 812.350396][T12888] usb 6-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 812.380373][T12888] usb 6-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 812.426607][T12888] usb 6-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 812.446383][T12888] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 813.175991][T12888] usb 6-1: config 0 descriptor?? [ 813.437532][T12888] ldusb 6-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 813.449581][T15778] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 813.494133][T15778] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 813.560074][T15750] FAULT_INJECTION: forcing a failure. [ 813.560074][T15750] name failslab, interval 1, probability 0, space 0, times 0 [ 813.611284][T15750] CPU: 0 UID: 0 PID: 15750 Comm: syz.5.2675 Tainted: G L syzkaller #0 PREEMPT(full) [ 813.611312][T15750] Tainted: [L]=SOFTLOCKUP [ 813.611318][T15750] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 813.611328][T15750] Call Trace: [ 813.611333][T15750] [ 813.611340][T15750] dump_stack_lvl+0x100/0x190 [ 813.611366][T15750] should_fail_ex.cold+0x5/0xa [ 813.611393][T15750] should_failslab+0xc2/0x120 [ 813.611418][T15750] __kmalloc_cache_noprof+0x91/0x6c0 [ 813.611464][T15750] ? check_prev_add+0x354/0xe60 [ 813.611487][T15750] ? dummy_urb_enqueue+0xa3/0x880 [ 813.611520][T15750] dummy_urb_enqueue+0xa3/0x880 [ 813.611546][T15750] ? usb_hcd_map_urb_for_dma+0x28a/0x1190 [ 813.611578][T15750] usb_hcd_submit_urb+0x268/0x2150 [ 813.611606][T15750] ? find_held_lock+0x2b/0x80 [ 813.611634][T15750] usb_submit_urb+0x827/0x19b0 [ 813.611658][T15750] ld_usb_write+0x723/0xbf0 [ 813.611686][T15750] ? __pfx_ld_usb_write+0x10/0x10 [ 813.611714][T15750] ? avc_policy_seqno+0x9/0x20 [ 813.611733][T15750] ? selinux_file_permission+0x8f/0x6d0 [ 813.611762][T15750] ? bpf_lsm_file_permission+0x9/0x10 [ 813.611787][T15750] ? security_file_permission+0x76/0x210 [ 813.611805][T15750] ? rw_verify_area+0xce/0x6d0 [ 813.611831][T15750] vfs_write+0x2aa/0x1050 [ 813.611857][T15750] ? __pfx_ld_usb_write+0x10/0x10 [ 813.611882][T15750] ? __pfx_vfs_write+0x10/0x10 [ 813.611905][T15750] ? find_held_lock+0x2b/0x80 [ 813.611928][T15750] ? __fget_files+0x215/0x3d0 [ 813.611944][T15750] ? __fget_files+0x215/0x3d0 [ 813.611965][T15750] ? __fget_files+0x21f/0x3d0 [ 813.611990][T15750] ksys_write+0x1f8/0x250 [ 813.612015][T15750] ? __pfx_ksys_write+0x10/0x10 [ 813.612048][T15750] do_syscall_64+0x115/0x870 [ 813.612066][T15750] ? clear_bhb_loop+0x40/0x90 [ 813.612087][T15750] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 813.612106][T15750] RIP: 0033:0x7febf999de99 [ 813.612120][T15750] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 813.612136][T15750] RSP: 002b:00007febfa7ef028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 813.612152][T15750] RAX: ffffffffffffffda RBX: 00007febf9c25fa0 RCX: 00007febf999de99 [ 813.612163][T15750] RDX: 0000000000000001 RSI: 0000200000000080 RDI: 0000000000000004 [ 813.612173][T15750] RBP: 00007febfa7ef090 R08: 0000000000000000 R09: 0000000000000000 [ 813.612184][T15750] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 813.612193][T15750] R13: 00007febf9c26038 R14: 00007febf9c25fa0 R15: 00007ffc90525308 [ 813.612216][T15750] [ 813.612736][T15750] ldusb 6-1:0.55: Couldn't submit interrupt_out_urb -12 [ 813.680321][ T1185] usb 4-1: new full-speed USB device number 71 using dummy_hcd [ 813.819817][T15793] netlink: 240 bytes leftover after parsing attributes in process `syz.1.2685'. [ 813.902978][ T804] usb 6-1: USB disconnect, device number 9 [ 813.948950][ T804] ldusb 6-1:0.55: LD USB Device #0 now disconnected [ 814.187826][ T29] audit: type=1400 audit(1785374057.380:1255): avc: denied { getopt } for pid=15802 comm="syz.4.2690" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 815.736333][ T804] usb 2-1: new low-speed USB device number 98 using dummy_hcd [ 816.188124][ T5810] usb 6-1: new full-speed USB device number 10 using dummy_hcd [ 816.342306][ T804] usb 2-1: Invalid ep0 maxpacket: 32 [ 816.772401][T15828] syzkaller0: entered promiscuous mode [ 816.780013][T15828] syzkaller0: entered allmulticast mode [ 816.837491][ T804] usb 2-1: new low-speed USB device number 99 using dummy_hcd [ 816.950306][ T5810] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 816.967841][ T5810] usb 6-1: New USB device found, idVendor=0b48, idProduct=3007, bcdDevice=4f.64 [ 816.980691][ T5810] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 816.989687][ T5810] usb 6-1: Product: syz [ 816.993878][ T5810] usb 6-1: Manufacturer: syz [ 816.998667][ T5810] usb 6-1: SerialNumber: syz [ 817.006100][ T5810] usb 6-1: config 0 descriptor?? [ 817.014611][ T5810] dvb-usb: found a 'Technotrend TT Connect S2-3600' in warm state. [ 817.023537][ T5810] pctv452e: pctv452e_power_ctrl: 1 [ 817.023537][ T5810] [ 817.031004][ T5810] usb 6-1: selecting invalid altsetting 3 [ 817.041301][T15828] tipc: Enabled bearer , priority 0 [ 817.048402][ T5810] pctv452e: pctv452e_power_ctrl: Warning set interface returned: -22 [ 817.048402][ T5810] [ 817.059972][ T5810] dvb-usb: bulk message failed: -22 (5/0) [ 817.066783][T15827] tipc: Resetting bearer [ 817.093258][ T5810] dvb-usb: This USB2.0 device cannot be run on a USB1.1 port. (it lacks a hardware PID filter) [ 817.104244][T15827] tipc: Disabling bearer [ 817.119499][ T5810] dvb-usb: Technotrend TT Connect S2-3600 error while loading driver (-19) [ 817.128551][ T804] usb 2-1: Invalid ep0 maxpacket: 32 [ 817.136342][ T804] usb usb2-port1: attempt power cycle [ 817.234464][ T5810] usb 6-1: USB disconnect, device number 10 [ 817.248927][ T5717] libceph: connect (2)0.0.0.0:6789 error -22 [ 817.257454][ T5717] libceph: ceph_tcp_connect failed: -22 [ 817.259841][T15843] netlink: 240 bytes leftover after parsing attributes in process `syz.4.2699'. [ 817.263039][ T5717] libceph: mon0 (2)0.0.0.0:6789 connect error [ 817.496597][ T804] usb 2-1: new low-speed USB device number 100 using dummy_hcd [ 817.526773][ T804] usb 2-1: Invalid ep0 maxpacket: 32 [ 817.544281][ T5717] libceph: connect (2)0.0.0.0:6789 error -22 [ 817.554272][ T5717] libceph: ceph_tcp_connect failed: -22 [ 817.565927][ T5717] libceph: mon0 (2)0.0.0.0:6789 connect error [ 817.666508][ T804] usb 2-1: new low-speed USB device number 101 using dummy_hcd [ 817.696974][ T804] usb 2-1: Invalid ep0 maxpacket: 32 [ 817.703565][ T804] usb usb2-port1: unable to enumerate USB device [ 817.807452][ T1185] usb 4-1: new high-speed USB device number 72 using dummy_hcd [ 817.966427][ T1185] usb 4-1: Using ep0 maxpacket: 8 [ 817.975119][ T1185] usb 4-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 817.985370][ T1185] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 818.127972][ T5717] libceph: connect (2)0.0.0.0:6789 error -22 [ 818.137644][ T1185] pvrusb2: Hardware description: Terratec Grabster AV400 [ 818.155449][ T5717] libceph: ceph_tcp_connect failed: -22 [ 818.161160][ T1185] pvrusb2: ********** [ 818.165896][ T1185] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 818.176091][ T5717] libceph: mon0 (2)0.0.0.0:6789 connect error [ 818.182636][ T1185] pvrusb2: Important functionality might not be entirely working. [ 818.190539][ T1185] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 818.202018][ T1185] pvrusb2: ********** [ 818.296733][T15841] ceph: No mds server is up or the cluster is laggy [ 818.375440][ T2364] pvrusb2: Invalid write control endpoint [ 818.432836][ T2364] pvrusb2: Invalid write control endpoint [ 818.440874][ T2364] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 818.455001][ T2364] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 818.463231][ T2364] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 818.474207][ T2364] pvrusb2: Device being rendered inoperable [ 818.480304][ T2364] cx25840 2-0044: Unable to detect h/w, assuming cx23887 [ 818.491370][ T2364] cx25840 2-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_b) [ 818.496303][ T804] usb 5-1: new high-speed USB device number 107 using dummy_hcd [ 818.514514][ T2364] pvrusb2: Attached sub-driver cx25840 [ 818.525807][ T2364] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 818.546638][ T2364] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 818.666407][ T804] usb 5-1: Using ep0 maxpacket: 8 [ 818.675532][ T804] usb 5-1: config 65 has an invalid interface number: 60 but max is 1 [ 818.699377][ T804] usb 5-1: config 65 has an invalid interface number: 248 but max is 1 [ 818.723377][ T5810] usb 4-1: USB disconnect, device number 72 [ 818.740589][ T804] usb 5-1: config 65 has no interface number 0 [ 819.248224][ T804] usb 5-1: config 65 has no interface number 1 [ 819.264882][ T804] usb 5-1: config 65 interface 60 altsetting 3 endpoint 0x6 has invalid maxpacket 1024, setting to 64 [ 819.295091][ T804] usb 5-1: config 65 interface 248 altsetting 64 has a duplicate endpoint with address 0x6, skipping [ 819.337058][ T804] usb 5-1: config 65 interface 248 altsetting 64 endpoint 0x1 has invalid maxpacket 1024, setting to 64 [ 819.359652][ T804] usb 5-1: config 65 interface 248 altsetting 64 endpoint 0xF has invalid maxpacket 1024, setting to 64 [ 819.378737][ T804] usb 5-1: config 65 interface 248 altsetting 64 has an invalid descriptor for endpoint zero, skipping [ 819.390642][ T804] usb 5-1: config 65 interface 248 altsetting 64 has a duplicate endpoint with address 0x8, skipping [ 819.487529][ T804] usb 5-1: config 65 interface 248 altsetting 64 has an endpoint descriptor with address 0x65, changing to 0x5 [ 819.501935][ T804] usb 5-1: config 65 interface 248 altsetting 64 endpoint 0x5 has invalid maxpacket 55258, setting to 64 [ 819.517480][ T804] usb 5-1: config 65 interface 248 altsetting 64 endpoint 0xA has an invalid bInterval 129, changing to 7 [ 819.529400][ T804] usb 5-1: config 65 interface 248 altsetting 64 has a duplicate endpoint with address 0xF, skipping [ 819.540330][ T804] usb 5-1: config 65 interface 248 altsetting 64 has an invalid descriptor for endpoint zero, skipping [ 819.553017][ T804] usb 5-1: config 65 interface 248 altsetting 64 bulk endpoint 0x9 has invalid maxpacket 32 [ 819.569864][ T804] usb 5-1: config 65 interface 248 altsetting 64 has a duplicate endpoint with address 0x6, skipping [ 819.604683][ T804] usb 5-1: config 65 interface 248 altsetting 64 has a duplicate endpoint with address 0xA, skipping [ 819.637722][ T804] usb 5-1: config 65 interface 248 altsetting 64 has 13 endpoint descriptors, different from the interface descriptor's value: 12 [ 819.668917][ T804] usb 5-1: config 65 interface 60 has no altsetting 0 [ 819.690510][ T804] usb 5-1: config 65 interface 248 has no altsetting 0 [ 819.766291][ T804] usb 5-1: New USB device found, idVendor=0499, idProduct=7010, bcdDevice=48.d3 [ 819.806674][ T5810] usb 4-1: new high-speed USB device number 73 using dummy_hcd [ 819.827750][ T804] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 819.863165][ T804] usb 5-1: Product: syz [ 819.879304][ T804] usb 5-1: Manufacturer: а [ 819.895571][ T804] usb 5-1: SerialNumber: syz [ 820.006354][ T5810] usb 4-1: Using ep0 maxpacket: 32 [ 820.042047][ T5810] usb 4-1: config 155 has an invalid descriptor of length 0, skipping remainder of the config [ 820.091870][ T5810] usb 4-1: config 155 interface 0 altsetting 0 has an endpoint descriptor with address 0xE2, changing to 0x82 [ 820.145731][ T5810] usb 4-1: config 155 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 820.231207][ T5810] usb 4-1: config 155 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 11 [ 820.344474][ T5810] usb 4-1: New USB device found, idVendor=15c2, idProduct=ffdc, bcdDevice=bd.30 [ 820.401824][ T804] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 820.422885][ T5810] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 820.473293][ T5810] usb 4-1: Product: syz [ 820.481388][ T804] snd-usb-audio 5-1:65.60: probe with driver snd-usb-audio failed with error -2 [ 820.498350][ T5810] usb 4-1: Manufacturer: syz [ 820.522439][ T5810] usb 4-1: SerialNumber: syz [ 820.611968][ T804] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 820.673378][ C0] imon 4-1:155.0: imon usb_rx_callback_intf0: status(-71) [ 820.827361][ T5810] input: iMON Panel, Knob and Mouse(15c2:ffdc) as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:155.0/input/input95 [ 820.907614][ T804] usb 5-1: USB disconnect, device number 107 [ 821.498082][ T5810] imon 4-1:155.0: Unknown 0xffdc device, defaulting to VFD and iMON IR [ 821.514415][T10610] udevd[10610]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:65.248/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 821.534735][ T5810] (id 0x00) [ 821.548404][T15891] syzkaller0: entered promiscuous mode [ 821.580860][T15891] syzkaller0: entered allmulticast mode [ 821.657495][ T5810] rc_core: IR keymap rc-imon-pad not found [ 821.678156][ T5810] Registered IR keymap rc-empty [ 821.692678][ T5810] imon 4-1:155.0: Looks like you're trying to use an IR protocol this device does not support [ 821.719965][ T5810] imon 4-1:155.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 821.785875][ T5810] rc rc0: iMON Remote (15c2:ffdc) as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:155.0/rc/rc0 [ 821.866473][ T5810] input: iMON Remote (15c2:ffdc) as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:155.0/rc/rc0/input96 [ 822.298265][ T5810] imon 4-1:155.0: iMON device (15c2:ffdc, intf0) on usb<4:73> initialized [ 824.067155][T12888] usb 6-1: new high-speed USB device number 11 using dummy_hcd [ 824.274914][T12888] usb 6-1: New USB device found, idVendor=0bda, idProduct=8150, bcdDevice= 0.00 [ 824.291985][T12888] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 824.319299][T12888] usb 6-1: Product: syz [ 824.326504][T12888] usb 6-1: Manufacturer: syz [ 824.347704][T12888] usb 6-1: SerialNumber: syz [ 825.519199][T12888] rtl8150 6-1:1.0: couldn't reset the device [ 825.535236][T12888] rtl8150 6-1:1.0: probe with driver rtl8150 failed with error -5 [ 826.740878][ T5810] usb 4-1: USB disconnect, device number 73 [ 826.783979][T14050] usb 6-1: USB disconnect, device number 11 [ 827.477938][T15942] xt_hashlimit: size too large, truncated to 1048576 [ 828.012732][T15957] kvm: user requested TSC rate below hardware speed [ 828.039626][ T29] audit: type=1400 audit(1785374071.230:1256): avc: denied { setopt } for pid=15956 comm="syz.0.2726" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 828.549852][T14050] usb 6-1: new full-speed USB device number 12 using dummy_hcd [ 828.707765][T14050] usb 6-1: config 251 has an invalid interface number: 202 but max is 0 [ 828.721663][T14050] usb 6-1: config 251 has no interface number 0 [ 828.773978][T14050] usb 6-1: config 251 interface 202 altsetting 1 has an invalid descriptor for endpoint zero, skipping [ 828.785767][T14050] usb 6-1: config 251 interface 202 altsetting 1 endpoint 0x6 has invalid maxpacket 1024, setting to 64 [ 828.799872][T14050] usb 6-1: config 251 interface 202 altsetting 1 has an endpoint descriptor with address 0xC1, changing to 0x81 [ 828.814365][T14050] usb 6-1: config 251 interface 202 altsetting 1 endpoint 0x81 has an invalid bInterval 0, changing to 4 [ 828.829537][T14050] usb 6-1: config 251 interface 202 altsetting 1 endpoint 0x81 has invalid wMaxPacketSize 0 [ 828.846327][T14050] usb 6-1: config 251 interface 202 altsetting 1 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 828.868814][T14050] usb 6-1: config 251 interface 202 has no altsetting 0 [ 828.901299][T14050] usb 6-1: New USB device found, idVendor=0572, idProduct=cb00, bcdDevice=bb.c9 [ 828.928886][T14050] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 828.941247][T14050] usb 6-1: Product: syz [ 828.945456][T14050] usb 6-1: Manufacturer: syz [ 828.950907][T14050] usb 6-1: SerialNumber: syz [ 829.196449][T14050] cxacru 6-1:251.202: cxacru_bind: interface has incorrect endpoints [ 829.220999][T14050] cxacru 6-1:251.202: usbatm_usb_probe: bind failed: -19! [ 829.260101][T15986] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2737'. [ 829.269624][T14050] usb 6-1: USB disconnect, device number 12 [ 829.375056][T15991] netlink: 48 bytes leftover after parsing attributes in process `syz.4.2738'. [ 829.386733][T15986] 8021q: adding VLAN 0 to HW filter on device bond5 [ 829.419803][T15990] macvlan3: entered promiscuous mode [ 829.438673][T15990] macvlan3: entered allmulticast mode [ 829.460069][T15990] bond5: entered promiscuous mode [ 829.492198][T15990] 8021q: adding VLAN 0 to HW filter on device macvlan3 [ 829.519299][T15990] bond5: left promiscuous mode [ 831.155831][T16062] netlink: 'syz.3.2766': attribute type 1 has an invalid length. [ 831.190815][T16062] 8021q: adding VLAN 0 to HW filter on device bond5 [ 831.218713][T16062] bond5 (unregistering): Released all slaves [ 831.388529][ T29] audit: type=1400 audit(1785374074.580:1257): avc: denied { write } for pid=16073 comm="syz.5.2771" name="random" dev="devtmpfs" ino=8 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:random_device_t tclass=chr_file permissive=1 [ 831.466099][T16076] xt_hashlimit: max too large, truncated to 1048576 [ 831.609455][ T29] audit: type=1400 audit(1785374074.800:1258): avc: denied { write } for pid=16082 comm="syz.3.2774" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_iscsi_socket permissive=1 [ 831.610099][T16083] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2774'. [ 831.801296][T16083] bond5: entered promiscuous mode [ 831.824220][T16083] bond5: entered allmulticast mode [ 831.955062][T16093] 0: reclassify loop, rule prio 0, protocol 03 [ 832.242799][T16100] ip6gre1: entered promiscuous mode [ 832.249194][T16100] ip6gre1: entered allmulticast mode [ 832.868923][ T29] audit: type=1400 audit(1785374076.050:1259): avc: denied { relabelfrom } for pid=16112 comm="syz.5.2782" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tun_socket permissive=1 [ 832.927748][ T29] audit: type=1400 audit(1785374076.060:1260): avc: denied { relabelto } for pid=16112 comm="syz.5.2782" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tun_socket permissive=1 [ 833.382752][T16135] netlink: 'syz.4.2792': attribute type 1 has an invalid length. [ 833.449830][T16135] 8021q: adding VLAN 0 to HW filter on device bond7 [ 833.509841][T16139] bond7: (slave veth0_to_bond): making interface the new active one [ 833.543148][T16139] bond7: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 833.571250][T16144] bond7: entered promiscuous mode [ 833.587324][T16144] veth0_to_bond: entered promiscuous mode [ 833.608024][T16144] bond7: entered allmulticast mode [ 833.629282][T16144] veth0_to_bond: entered allmulticast mode [ 833.675926][T16150] fuse: Bad value for 'fd' [ 833.718914][T16135] macvlan4: entered promiscuous mode [ 833.724481][T16135] macvlan4: entered allmulticast mode [ 833.732163][T16135] 8021q: adding VLAN 0 to HW filter on device macvlan4 [ 833.750663][T16135] bond7: (slave macvlan4): the slave hw address is in use by the bond; giving it the hw address of veth0_to_bond [ 834.023716][T16158] x_tables: duplicate underflow at hook 1 [ 834.150316][T16158] sock: sock_set_timeout: `syz.3.2799' (pid 16158) tries to set negative timeout [ 834.668898][ T29] audit: type=1400 audit(1785374077.850:1261): avc: denied { unmount } for pid=5610 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:devpts_t tclass=filesystem permissive=1 [ 834.989494][T16193] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2815'. [ 835.084121][T16203] sctp: [Deprecated]: syz.0.2818 (pid 16203) Use of int in max_burst socket option. [ 835.084121][T16203] Use struct sctp_assoc_value instead [ 835.258680][T16207] hsr0 speed is unknown, defaulting to 1000 [ 835.271356][T16207] hsr0 speed is unknown, defaulting to 1000 [ 835.949921][ T29] audit: type=1400 audit(1785374079.140:1262): avc: denied { search } for pid=16253 comm="syz.0.2838" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 836.007863][ T29] audit: type=1400 audit(1785374079.140:1263): avc: denied { search } for pid=16253 comm="syz.0.2838" name="events" dev="tracefs" ino=1073 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 836.069692][T16259] 8021q: adding VLAN 0 to HW filter on device bond1 [ 836.070089][ T29] audit: type=1400 audit(1785374079.140:1264): avc: denied { search } for pid=16253 comm="syz.0.2838" name="kvm" dev="tracefs" ino=59673 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 836.092008][T16259] 8021q: adding VLAN 0 to HW filter on device bond3 [ 836.131770][T16259] 8021q: adding VLAN 0 to HW filter on device bond7 [ 836.133641][ T29] audit: type=1400 audit(1785374079.140:1265): avc: denied { search } for pid=16253 comm="syz.0.2838" name="kvm_entry" dev="tracefs" ino=59675 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 836.155051][T10434] bond1: (slave macvlan3): link status definitely up, 10000 Mbps full duplex [ 836.171138][ T29] audit: type=1400 audit(1785374079.140:1266): avc: denied { read write } for pid=16253 comm="syz.0.2838" name="enable" dev="tracefs" ino=19680823 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=file permissive=1 [ 836.195383][ T29] audit: type=1400 audit(1785374079.140:1267): avc: denied { open } for pid=16253 comm="syz.0.2838" path="/538/trace/events/kvm/kvm_entry/enable" dev="tracefs" ino=19680823 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=file permissive=1 [ 836.236872][T10434] bond1: (slave macvlan3): making interface the new active one [ 836.253710][T10434] bond1: (slave macvlan3): dev_set_mac_address on slave failed! ALB mode requires that the base driver support setting the hw address also when the network device's interface is open [ 836.302833][T10434] bond1: active interface up! [ 836.365747][T16264] hsr0 speed is unknown, defaulting to 1000 [ 836.375831][T16264] hsr0 speed is unknown, defaulting to 1000 [ 836.532564][T16282] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2849'. [ 836.623416][T16282] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 836.647897][T16282] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 837.362870][T16339] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2873'. [ 837.406624][T16339] bond6: entered promiscuous mode [ 837.416009][T16339] bond6: entered allmulticast mode [ 837.435441][T16344] 9pnet_virtio: no channels available for device syz [ 837.841389][ T29] audit: type=1400 audit(1785374081.030:1268): avc: denied { append } for pid=16373 comm="syz.5.2887" name="event2" dev="devtmpfs" ino=923 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 837.892791][T16377] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2888'. [ 837.986118][T16377] bond5: entered promiscuous mode [ 837.996015][T16377] bond5: entered allmulticast mode [ 838.209375][ T49] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 838.225217][ T49] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 838.235223][ T49] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 838.251860][ T49] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 838.262071][ T49] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 838.443730][T16397] VFS: Mount too revealing [ 838.794906][T16422] fuse: fd is not a fuse device [ 838.895942][T16388] hsr0 speed is unknown, defaulting to 1000 [ 838.905027][T16388] hsr0 speed is unknown, defaulting to 1000 [ 838.917094][T16426] vhci_hcd vhci_hcd.0: remove, state 4 [ 838.934729][T16428] overlayfs: failed to clone upperpath [ 838.955072][T16426] usb usb34: USB disconnect, device number 1 [ 838.964201][T16428] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 838.983360][T16428] overlayfs: missing 'lowerdir' [ 839.833674][T10434] vhci_hcd vhci_hcd.0: stop threads [ 839.844570][T16426] vhci_hcd vhci_hcd.0: USB bus 34 deregistered [ 839.850909][T10434] vhci_hcd vhci_hcd.0: release socket [ 839.868985][T10434] vhci_hcd vhci_hcd.0: disconnect device [ 839.879435][T16388] bridge0: port 1(bridge_slave_0) entered blocking state [ 839.889569][T16388] bridge0: port 1(bridge_slave_0) entered disabled state [ 839.899419][T16388] bridge_slave_0: entered allmulticast mode [ 839.906951][T16388] bridge_slave_0: entered promiscuous mode [ 839.912807][T10434] vhci_hcd vhci_hcd.0: stop threads [ 839.914753][T16388] bridge0: port 2(bridge_slave_1) entered blocking state [ 839.925196][T16388] bridge0: port 2(bridge_slave_1) entered disabled state [ 839.937509][T16388] bridge_slave_1: entered allmulticast mode [ 839.944554][T10434] vhci_hcd vhci_hcd.0: release socket [ 839.944808][T16388] bridge_slave_1: entered promiscuous mode [ 839.979092][T16388] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 839.983513][T10434] vhci_hcd vhci_hcd.0: disconnect device [ 839.990925][T16388] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 840.011184][T16455] overlayfs: failed to clone upperpath [ 840.026635][T16388] team0: Port device team_slave_0 added [ 840.037411][T10434] vhci_hcd vhci_hcd.0: stop threads [ 840.050977][T16388] team0: Port device team_slave_1 added [ 840.056285][T10434] vhci_hcd vhci_hcd.0: release socket [ 840.073369][T10434] vhci_hcd vhci_hcd.0: disconnect device [ 840.091857][T10434] vhci_hcd vhci_hcd.0: stop threads [ 840.093018][T16388] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 840.114493][T16388] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 840.114574][T10434] vhci_hcd vhci_hcd.0: release socket [ 840.114595][T10434] vhci_hcd vhci_hcd.0: disconnect device [ 840.150991][T16388] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 840.159428][T16426] vhci_hcd vhci_hcd.0: remove, state 4 [ 840.187315][T16426] usb usb33: USB disconnect, device number 1 [ 840.216979][T10434] ================================================================== [ 840.225064][T10434] BUG: KASAN: slab-use-after-free in _raw_spin_lock_irqsave+0x3a/0x60 [ 840.233233][T10434] Read of size 1 at addr ffff88801bd38b68 by task kworker/u8:47/10434 [ 840.241379][T10434] [ 840.243709][T10434] CPU: 0 UID: 0 PID: 10434 Comm: kworker/u8:47 Tainted: G L syzkaller #0 PREEMPT(full) [ 840.243737][T10434] Tainted: [L]=SOFTLOCKUP [ 840.243743][T10434] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 840.243755][T10434] Workqueue: usbip_event event_handler [ 840.243777][T10434] Call Trace: [ 840.243784][T10434] [ 840.243791][T10434] dump_stack_lvl+0x100/0x190 [ 840.243814][T10434] print_report+0x13d/0x4b0 [ 840.243840][T10434] ? __virt_addr_valid+0x239/0x430 [ 840.243864][T10434] ? _raw_spin_lock_irqsave+0x3a/0x60 [ 840.243891][T10434] kasan_report+0xdf/0x1c0 [ 840.243915][T10434] ? _raw_spin_lock_irqsave+0x3a/0x60 [ 840.243945][T10434] ? _raw_spin_lock_irqsave+0x3a/0x60 [ 840.243972][T10434] __kasan_check_byte+0x36/0x50 [ 840.243995][T10434] lock_acquire+0x132/0x370 [ 840.244017][T10434] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 840.244035][T10434] ? _raw_spin_lock_irqsave+0x52/0x60 [ 840.244064][T10434] _raw_spin_lock_irqsave+0x3a/0x60 [ 840.244091][T10434] ? event_handler+0x21e/0x570 [ 840.244108][T10434] event_handler+0x21e/0x570 [ 840.244127][T10434] process_one_work+0xa23/0x1940 [ 840.244151][T10434] ? __pfx_process_one_work+0x10/0x10 [ 840.244174][T10434] ? __pfx_event_handler+0x10/0x10 [ 840.244193][T10434] worker_thread+0x5ef/0xe50 [ 840.244217][T10434] ? kthread+0x13a/0x450 [ 840.244234][T10434] ? __pfx_worker_thread+0x10/0x10 [ 840.244252][T10434] kthread+0x370/0x450 [ 840.244269][T10434] ? __pfx_kthread+0x10/0x10 [ 840.244287][T10434] ret_from_fork+0x72b/0xd50 [ 840.244312][T10434] ? __pfx_ret_from_fork+0x10/0x10 [ 840.244336][T10434] ? rcu_is_watching+0x12/0xc0 [ 840.244363][T10434] ? __switch_to+0x800/0x10f0 [ 840.244382][T10434] ? __pfx_kthread+0x10/0x10 [ 840.244406][T10434] ret_from_fork_asm+0x1a/0x30 [ 840.244436][T10434] [ 840.244443][T10434] [ 840.422185][T10434] Allocated by task 1: [ 840.426231][T10434] kasan_save_stack+0x30/0x50 [ 840.430897][T10434] kasan_save_track+0x14/0x30 [ 840.435553][T10434] __kasan_kmalloc+0xaa/0xb0 [ 840.440123][T10434] __kmalloc_noprof+0x322/0x820 [ 840.444952][T10434] __usb_create_hcd+0x5e/0xac0 [ 840.449697][T10434] vhci_hcd_probe+0x1a5/0x4e0 [ 840.454351][T10434] platform_probe+0x106/0x1d0 [ 840.459008][T10434] really_probe+0x241/0xa60 [ 840.463490][T10434] __driver_probe_device+0x20e/0x450 [ 840.468759][T10434] driver_probe_device+0x4a/0x140 [ 840.473767][T10434] __device_attach_driver+0x1df/0x320 [ 840.479121][T10434] bus_for_each_drv+0x159/0x1e0 [ 840.483952][T10434] __device_attach+0x1e4/0x4d0 [ 840.488697][T10434] device_initial_probe+0xaf/0xd0 [ 840.493702][T10434] bus_probe_device+0x64/0x160 [ 840.498444][T10434] device_add+0x121d/0x1970 [ 840.502943][T10434] platform_device_add+0x35a/0x800 [ 840.508045][T10434] platform_device_register_full+0x5cf/0x830 [ 840.514005][T10434] vhci_hcd_init+0x1a1/0x2f0 [ 840.518573][T10434] do_one_initcall+0x11d/0x700 [ 840.523320][T10434] kernel_init_freeable+0x6ea/0x7b0 [ 840.528500][T10434] kernel_init+0x1f/0x1e0 [ 840.532811][T10434] ret_from_fork+0x72b/0xd50 [ 840.537398][T10434] ret_from_fork_asm+0x1a/0x30 [ 840.542145][T10434] [ 840.544451][T10434] Freed by task 16426: [ 840.548492][T10434] kasan_save_stack+0x30/0x50 [ 840.553147][T10434] kasan_save_track+0x14/0x30 [ 840.557801][T10434] kasan_save_free_info+0x3b/0x70 [ 840.562809][T10434] __kasan_slab_free+0x5f/0x80 [ 840.567554][T10434] kfree+0x22b/0x6c0 [ 840.571432][T10434] usb_put_hcd+0x149/0x1f0 [ 840.575831][T10434] vhci_hcd_remove+0xb5/0x1b0 [ 840.580486][T10434] platform_remove+0x5f/0x80 [ 840.585069][T10434] device_remove+0xcb/0x180 [ 840.589549][T10434] device_release_driver_internal+0x44e/0x620 [ 840.595598][T10434] unbind_store+0xf8/0x110 [ 840.599991][T10434] drv_attr_store+0x74/0xb0 [ 840.604477][T10434] sysfs_kf_write+0xf2/0x150 [ 840.609053][T10434] kernfs_fop_write_iter+0x3e0/0x5f0 [ 840.614336][T10434] vfs_write+0x6ac/0x1050 [ 840.618663][T10434] ksys_write+0x12a/0x250 [ 840.622977][T10434] do_syscall_64+0x115/0x870 [ 840.627564][T10434] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 840.633442][T10434] [ 840.635741][T10434] Last potentially related work creation: [ 840.641428][T10434] kasan_save_stack+0x30/0x50 [ 840.646091][T10434] kasan_record_aux_stack+0xa7/0xc0 [ 840.651273][T10434] insert_work+0x36/0x230 [ 840.655590][T10434] __queue_work+0x9bc/0x12b0 [ 840.660157][T10434] queue_work_on+0x1a9/0x1e0 [ 840.664728][T10434] usb_hcd_giveback_urb+0x330/0x4a0 [ 840.669921][T10434] unlink1+0x418/0x510 [ 840.673972][T10434] usb_hcd_unlink_urb+0x131/0x210 [ 840.678979][T10434] usb_kill_urb+0x121/0x320 [ 840.683467][T10434] hub_quiesce+0x1e9/0x320 [ 840.687863][T10434] hub_suspend+0x4ab/0x9e0 [ 840.692273][T10434] usb_suspend_both+0x288/0x950 [ 840.697131][T10434] usb_runtime_suspend+0x49/0x120 [ 840.702151][T10434] __rpm_callback+0xc8/0x620 [ 840.706733][T10434] rpm_callback+0x16a/0x1b0 [ 840.711224][T10434] rpm_suspend+0x2f4/0x11a0 [ 840.715709][T10434] __pm_runtime_suspend+0xba/0x1a0 [ 840.720805][T10434] usb_new_device.cold+0xd61/0x115c [ 840.725986][T10434] register_root_hub+0x4e6/0x639 [ 840.730918][T10434] usb_add_hcd.cold+0xccd/0x1158 [ 840.735835][T10434] vhci_hcd_probe+0x1c2/0x4e0 [ 840.740492][T10434] platform_probe+0x106/0x1d0 [ 840.745147][T10434] really_probe+0x241/0xa60 [ 840.749633][T10434] __driver_probe_device+0x20e/0x450 [ 840.754900][T10434] driver_probe_device+0x4a/0x140 [ 840.759912][T10434] __device_attach_driver+0x1df/0x320 [ 840.765289][T10434] bus_for_each_drv+0x159/0x1e0 [ 840.770129][T10434] __device_attach+0x1e4/0x4d0 [ 840.774886][T10434] device_initial_probe+0xaf/0xd0 [ 840.779902][T10434] bus_probe_device+0x64/0x160 [ 840.784649][T10434] device_add+0x121d/0x1970 [ 840.789138][T10434] platform_device_add+0x35a/0x800 [ 840.794235][T10434] platform_device_register_full+0x5cf/0x830 [ 840.800214][T10434] vhci_hcd_init+0x1a1/0x2f0 [ 840.804783][T10434] do_one_initcall+0x11d/0x700 [ 840.809533][T10434] kernel_init_freeable+0x6ea/0x7b0 [ 840.814713][T10434] kernel_init+0x1f/0x1e0 [ 840.819037][T10434] ret_from_fork+0x72b/0xd50 [ 840.823631][T10434] ret_from_fork_asm+0x1a/0x30 [ 840.828401][T10434] [ 840.830730][T10434] Second to last potentially related work creation: [ 840.837301][T10434] kasan_save_stack+0x30/0x50 [ 840.841979][T10434] kasan_record_aux_stack+0xa7/0xc0 [ 840.847175][T10434] insert_work+0x36/0x230 [ 840.851488][T10434] __queue_work+0x9bc/0x12b0 [ 840.856057][T10434] queue_work_on+0x1a9/0x1e0 [ 840.860626][T10434] usb_hcd_giveback_urb+0x3b8/0x4a0 [ 840.865818][T10434] usb_hcd_submit_urb+0xab7/0x2150 [ 840.870911][T10434] usb_submit_urb+0x827/0x19b0 [ 840.875652][T10434] usb_start_wait_urb+0x10e/0x580 [ 840.880652][T10434] usb_control_msg+0x328/0x4b0 [ 840.885396][T10434] hub_suspend+0x826/0x9e0 [ 840.889793][T10434] usb_suspend_both+0x288/0x950 [ 840.894626][T10434] usb_runtime_suspend+0x49/0x120 [ 840.899634][T10434] __rpm_callback+0xc8/0x620 [ 840.904208][T10434] rpm_callback+0x16a/0x1b0 [ 840.908690][T10434] rpm_suspend+0x2f4/0x11a0 [ 840.913172][T10434] __pm_runtime_suspend+0xba/0x1a0 [ 840.918264][T10434] usb_new_device.cold+0xd61/0x115c [ 840.923445][T10434] register_root_hub+0x4e6/0x639 [ 840.928363][T10434] usb_add_hcd.cold+0xccd/0x1158 [ 840.933287][T10434] vhci_hcd_probe+0x1c2/0x4e0 [ 840.937943][T10434] platform_probe+0x106/0x1d0 [ 840.942597][T10434] really_probe+0x241/0xa60 [ 840.947079][T10434] __driver_probe_device+0x20e/0x450 [ 840.952354][T10434] driver_probe_device+0x4a/0x140 [ 840.957371][T10434] __device_attach_driver+0x1df/0x320 [ 840.962735][T10434] bus_for_each_drv+0x159/0x1e0 [ 840.967576][T10434] __device_attach+0x1e4/0x4d0 [ 840.972343][T10434] device_initial_probe+0xaf/0xd0 [ 840.977355][T10434] bus_probe_device+0x64/0x160 [ 840.982100][T10434] device_add+0x121d/0x1970 [ 840.986588][T10434] platform_device_add+0x35a/0x800 [ 840.991688][T10434] platform_device_register_full+0x5cf/0x830 [ 840.997647][T10434] vhci_hcd_init+0x1a1/0x2f0 [ 841.002219][T10434] do_one_initcall+0x11d/0x700 [ 841.006971][T10434] kernel_init_freeable+0x6ea/0x7b0 [ 841.012152][T10434] kernel_init+0x1f/0x1e0 [ 841.016466][T10434] ret_from_fork+0x72b/0xd50 [ 841.021041][T10434] ret_from_fork_asm+0x1a/0x30 [ 841.025788][T10434] [ 841.028089][T10434] The buggy address belongs to the object at ffff88801bd38000 [ 841.028089][T10434] which belongs to the cache kmalloc-8k of size 8192 [ 841.042124][T10434] The buggy address is located 2920 bytes inside of [ 841.042124][T10434] freed 8192-byte region [ffff88801bd38000, ffff88801bd3a000) [ 841.056072][T10434] [ 841.058384][T10434] The buggy address belongs to the physical page: [ 841.064769][T10434] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1bd38 [ 841.073502][T10434] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 841.081993][T10434] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 841.089525][T10434] page_type: f5(slab) [ 841.093486][T10434] raw: 00fff00000000040 ffff88813fe28280 dead000000000122 0000000000000000 [ 841.102046][T10434] raw: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000 [ 841.110612][T10434] head: 00fff00000000040 ffff88813fe28280 dead000000000122 0000000000000000 [ 841.119262][T10434] head: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000 [ 841.127909][T10434] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 841.136562][T10434] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 841.145206][T10434] page dumped because: kasan: bad access detected [ 841.151593][T10434] page_owner tracks the page as allocated [ 841.157280][T10434] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 2771676244, free_ts 0 [ 841.176881][T10434] post_alloc_hook+0xfd/0x120 [ 841.181556][T10434] get_page_from_freelist+0xf48/0x3530 [ 841.186992][T10434] __alloc_frozen_pages_noprof+0x299/0x2dc0 [ 841.192866][T10434] new_slab+0xa2/0x640 [ 841.196912][T10434] refill_objects+0xe3/0x410 [ 841.201496][T10434] __pcs_replace_empty_main+0x376/0x680 [ 841.207030][T10434] __kmalloc_noprof+0x66d/0x820 [ 841.211865][T10434] dibs_dev_add+0xa8/0x4d0 [ 841.216266][T10434] dibs_loopback_init+0x1d5/0x2d0 [ 841.221274][T10434] dibs_init+0x2f/0x70 [ 841.225328][T10434] do_one_initcall+0x11d/0x700 [ 841.230076][T10434] kernel_init_freeable+0x6ea/0x7b0 [ 841.235255][T10434] kernel_init+0x1f/0x1e0 [ 841.239567][T10434] ret_from_fork+0x72b/0xd50 [ 841.244155][T10434] ret_from_fork_asm+0x1a/0x30 [ 841.248904][T10434] page_owner free stack trace missing [ 841.254244][T10434] [ 841.256543][T10434] Memory state around the buggy address: [ 841.262148][T10434] ffff88801bd38a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 841.270185][T10434] ffff88801bd38a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 841.278224][T10434] >ffff88801bd38b00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 841.286260][T10434] ^ [ 841.293692][T10434] ffff88801bd38b80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 841.301732][T10434] ffff88801bd38c00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 841.309769][T10434] ================================================================== [ 841.317806][T10434] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 841.324983][T10434] CPU: 0 UID: 0 PID: 10434 Comm: kworker/u8:47 Tainted: G L syzkaller #0 PREEMPT(full) [ 841.336155][T10434] Tainted: [L]=SOFTLOCKUP [ 841.340463][T10434] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 841.350519][T10434] Workqueue: usbip_event event_handler [ 841.355976][T10434] Call Trace: [ 841.359234][T10434] [ 841.362144][T10434] dump_stack_lvl+0x100/0x190 [ 841.366804][T10434] vpanic+0x552/0x970 [ 841.370764][T10434] ? __pfx_vpanic+0x10/0x10 [ 841.375244][T10434] ? __pfx_vprintk_emit+0x10/0x10 [ 841.380257][T10434] ? _raw_spin_lock_irqsave+0x3a/0x60 [ 841.385619][T10434] panic+0xd1/0xe0 [ 841.389321][T10434] ? __pfx_panic+0x10/0x10 [ 841.393719][T10434] ? end_report.part.0+0x23/0x90 [ 841.398642][T10434] ? rcu_is_watching+0x12/0xc0 [ 841.403391][T10434] ? end_report.part.0+0x23/0x90 [ 841.408312][T10434] ? check_panic_on_warn+0x1f/0x90 [ 841.413405][T10434] check_panic_on_warn.cold+0x19/0x34 [ 841.418759][T10434] end_report.part.0+0x3a/0x90 [ 841.423509][T10434] kasan_report.cold+0xe/0x18 [ 841.428175][T10434] ? _raw_spin_lock_irqsave+0x3a/0x60 [ 841.433536][T10434] ? _raw_spin_lock_irqsave+0x3a/0x60 [ 841.438897][T10434] __kasan_check_byte+0x36/0x50 [ 841.443732][T10434] lock_acquire+0x132/0x370 [ 841.448218][T10434] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 841.454003][T10434] ? _raw_spin_lock_irqsave+0x52/0x60 [ 841.459363][T10434] _raw_spin_lock_irqsave+0x3a/0x60 [ 841.464567][T10434] ? event_handler+0x21e/0x570 [ 841.469311][T10434] event_handler+0x21e/0x570 [ 841.473881][T10434] process_one_work+0xa23/0x1940 [ 841.478804][T10434] ? __pfx_process_one_work+0x10/0x10 [ 841.484159][T10434] ? __pfx_event_handler+0x10/0x10 [ 841.489258][T10434] worker_thread+0x5ef/0xe50 [ 841.493852][T10434] ? kthread+0x13a/0x450 [ 841.498084][T10434] ? __pfx_worker_thread+0x10/0x10 [ 841.503204][T10434] kthread+0x370/0x450 [ 841.507262][T10434] ? __pfx_kthread+0x10/0x10 [ 841.511836][T10434] ret_from_fork+0x72b/0xd50 [ 841.516419][T10434] ? __pfx_ret_from_fork+0x10/0x10 [ 841.521525][T10434] ? rcu_is_watching+0x12/0xc0 [ 841.526277][T10434] ? __switch_to+0x800/0x10f0 [ 841.530936][T10434] ? __pfx_kthread+0x10/0x10 [ 841.535506][T10434] ret_from_fork_asm+0x1a/0x30 [ 841.540262][T10434] [ 841.543469][T10434] Kernel Offset: disabled [ 841.547766][T10434] Rebooting in 86400 seconds..