last executing test programs: 2.050428954s ago: executing program 1 (id=47): openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0x0) futex(&(0x7f000000cffc), 0x9, 0x0, 0x0, 0x0, 0xfffffffe) futex(&(0x7f000000cffc)=0x2, 0x5, 0x40000000, 0x0, &(0x7f0000000200)=0x20000, 0x3000000) 1.969886136s ago: executing program 1 (id=49): sendmsg$802154_dgram(0xffffffffffffffff, &(0x7f000000b8c0)={&(0x7f0000000040)={0x24, @short={0x2, 0x0, 0xaaa0}}, 0x14, &(0x7f0000000080)={0x0}}, 0x0) close(0xffffffffffffffff) openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x20000) r0 = epoll_create1(0x80000) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, 0xffffffffffffffff, &(0x7f0000000500)={0xe000200c}) r1 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0x32, &(0x7f0000000000)=0x32a7, 0x27) fsopen(0x0, 0x0) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x3) r2 = timerfd_create(0x0, 0x0) r3 = timerfd_create(0x0, 0x0) ppoll(&(0x7f0000000700)=[{r2, 0x3041}], 0x1, 0x0, 0x0, 0x0) timerfd_settime(r3, 0x3, &(0x7f0000000380)={{0x0, 0x989680}}, 0x0) socket$can_raw(0x1d, 0x3, 0x1) timerfd_settime(r2, 0x3, &(0x7f0000000440)={{0x0, 0x3938700}}, 0x0) clock_adjtime(0x0, &(0x7f0000000000)={0x3ff, 0xf6d, 0x0, 0xd, 0x7fffffff, 0x0, 0x5, 0x200000000000000, 0x0, 0x6, 0x0, 0x0, 0x9, 0x3, 0x0, 0xfffffffffffffff9, 0x0, 0x0, 0x1000, 0x2000000000008, 0x9, 0x3, 0x8000000000005a, 0x3}) openat(0xffffffffffffff9c, &(0x7f0000000080)='./file4\x00', 0xe040, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f0000006200)={0x2020}, 0x2020) 1.871467152s ago: executing program 1 (id=51): r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) recvmmsg(r0, &(0x7f0000007f80)=[{{0x0, 0x0, 0x0}, 0xa}], 0x1, 0x2140, 0x0) 1.868245594s ago: executing program 1 (id=53): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x1100, 0x2}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@weak_binder={0x77622a85, 0x100a, 0x8000000000}, @flat=@weak_binder={0x77622a85, 0x1100, 0x3}}, &(0x7f0000000200)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x10000000000) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f0000000580)="b3185d7bb56f70f003360fa8bf71ac3086aedebf6fff904f92849a7a07395ee7f0e4cb1d78001c08a0ab73ffcf5ad07693727980eea946e6cba1723e81bfa5c3688803c8a124dcb27df7938e7ddfdd52"}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000004a40)={0x44, 0x0, &(0x7f00000049c0)=[@transaction={0x40406300, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0xa4, 0x0, &(0x7f0000000600)="878b7cdfd4455cf49da7ba6f280ae012ce80389a2aefe4fd04084554d7015aba5330d1b817d6c08af29938b8a9bc2b83462ddadaad3a3a5c0181a0203e49b12c99ac8757fc317fe672938a06f89c133d615cf8c6e94b3ac320fa50046f5c18ac35b49243870e4e6b90c76177feda5469369b2b5a4739cc0b68c1772f1c9b9320d88426bc8f139429054c85b62f2a1dfc705453bea4cabf1f5eee5a0d301fb7c62e36dba0"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 1.791450037s ago: executing program 1 (id=55): socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) sendmsg$MPTCP_PM_CMD_GET_LIMITS(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0xffffffffffffffb4, 0x0, 0x1, 0x0, 0x0, 0x41}, 0x809d) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x40040, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000300)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="000002f0d31209000000bc2e79e995"], 0x0) write$binfmt_script(r2, &(0x7f0000000100), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) preadv(r2, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x3e, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000499000/0x18000)=nil, &(0x7f0000000040)=[@text16={0x10, &(0x7f0000000180)="66b9800000c00f326635000800000f300f0f1c9a65660ff3b20618baa000ec672e660f38803d004000000f285473f61366b9800000c00f320f300f20e06635800000000f22e02b6aa6c8", 0x4a}], 0x1, 0x0, 0x0, 0xfe12) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000240)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x0, 0x0, &(0x7f0000000000)='GPL\x00', 0x2a7, 0x0, 0x0, 0x41100, 0x24, '\x00', 0x0, 0x0, r2}, 0x94) ioctl$KVM_RUN(r3, 0xae80, 0x0) 1.560590428s ago: executing program 2 (id=60): unshare(0x42000000) 1.504073262s ago: executing program 3 (id=63): syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224"], 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x9) r0 = socket$inet(0x2, 0x80003, 0x84) getsockopt$inet_mreq(r0, 0x0, 0x50, 0x0, &(0x7f0000000000)) 1.498923163s ago: executing program 2 (id=64): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x1100, 0x2}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@weak_binder={0x77622a85, 0x100a, 0x8000000000}, @flat=@weak_binder={0x77622a85, 0x1100, 0x3}}, &(0x7f0000000200)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x10000000000) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f0000000580)="b3185d7bb56f70f003360fa8bf71ac3086aedebf6fff904f92849a7a07395ee7f0e4cb1d78001c08a0ab73ffcf5ad07693727980eea946e6cba1723e81bfa5c3688803c8a124dcb27df7938e7ddfdd52"}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000004a40)={0x44, 0x0, &(0x7f00000049c0)=[@transaction={0x40406300, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0xa4, 0x0, &(0x7f0000000600)="878b7cdfd4455cf49da7ba6f280ae012ce80389a2aefe4fd04084554d7015aba5330d1b817d6c08af29938b8a9bc2b83462ddadaad3a3a5c0181a0203e49b12c99ac8757fc317fe672938a06f89c133d615cf8c6e94b3ac320fa50046f5c18ac35b49243870e4e6b90c76177feda5469369b2b5a4739cc0b68c1772f1c9b9320d88426bc8f139429054c85b62f2a1dfc705453bea4cabf1f5eee5a0d301fb7c62e36dba0"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000500), 0x0, 0x0, 0x0}) 1.410176158s ago: executing program 2 (id=65): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1/idVendor\x00', 0x1, 0x0) write(r0, &(0x7f0000000140)='0x1d6b\n', 0x7) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/idProduct\x00', 0x1, 0x0) write(r1, 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/bcdUSB\x00', 0x1, 0x0) write(r2, 0x0, 0x0) write(r0, &(0x7f0000000b40)="a75f3e8763810fb65db27b093ce625d61034fd6f81992cbace7584a0463a17a53bd51219be4c462a52591512f0901461910a999bff9cac267b67b04c786921a9b7730ccc20ca181bdcfd994246f794823814ba667bdd9f2fd0f25ee266", 0x5d) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff) r3 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x1, 0x0) write(r3, &(0x7f0000000380)='0123456789\n', 0xb) write(0xffffffffffffffff, &(0x7f0000000400)='syzkaller\n', 0xa) r4 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/strings/0x409/product\x00', 0x1, 0x0) write(r4, &(0x7f0000000480)='HID Gadge', 0x9) mkdirat(0xffffffffffffff9c, &(0x7f00000004c0)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000640)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff) r5 = openat(0xffffffffffffff9c, &(0x7f0000000680)='./config/usb_gadget/g1/functions/hid.usb0/no_out_endpoint\x00', 0x1, 0x0) write(r5, &(0x7f00000006c0)='1', 0x1) write(0xffffffffffffffff, &(0x7f00000007c0)='1\n', 0x2) openat(0xffffffffffffff9c, &(0x7f0000000880)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x1, 0x0) symlinkat(&(0x7f0000000900)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000980)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00') r6 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r6, &(0x7f0000000a40)='dummy_udc.0\n', 0xc) 1.360402439s ago: executing program 2 (id=66): r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000030c0), 0x2, 0x0) read$alg(r0, 0x0, 0x0) 1.359489698s ago: executing program 2 (id=67): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0a000000050000000200000007"], 0x48) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x0, 0x10, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000b98cad95850000000100000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000000000000850000008600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x10, &(0x7f0000000180)=ANY=[], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) setsockopt$sock_attach_bpf(r2, 0x1, 0x32, &(0x7f00000000c0)=r4, 0x4) sendmsg$unix(r3, &(0x7f00000006c0)={0x0, 0x0, 0x0}, 0x0) 1.291217802s ago: executing program 2 (id=68): r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0) write$UHID_CREATE2(r0, &(0x7f0000001000)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x1d, 0x5, 0x57e, 0x306, 0x3, 0xfffffffc, "05010905a10105091901290a150025017501950a8102950175068103c0"}}, 0x135) write$UHID_INPUT2(r0, &(0x7f0000000080)=ANY=[@ANYBLOB='\f\x00\x00\x00g\x00!'], 0xc) 800.422539ms ago: executing program 1 (id=69): add_key(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, 0x0) syz_usb_connect(0x3, 0x8c6, &(0x7f0000000280)=ANY=[@ANYBLOB="1201500236e47e2082055c2955d4010203010902b408048006a00309047f0e04ff2dde700a24010100000000000824050503fee1daf7b02e54d8bba0d3ceb6485e3c5e2398668bd11f3e8f1f9273699345b77488086870a61c23d57cd53534847f6d3e895ec17b18d806"], &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x4, &(0x7f0000000200)=@lang_id={0x4, 0x3, 0x2001}}]}) bind$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) 540.554358ms ago: executing program 0 (id=72): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/test\x00', 0x777) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x2, 0x0) write(r0, &(0x7f0000000380)='100000', 0x6) r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.cpu/test/memory.oom_control\x00', 0x2, 0x0) write(r1, &(0x7f0000000200)='1', 0x1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) write(r2, &(0x7f0000000280)='0', 0x1) r3 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r3, 0xaf01, 0x0) ioctl$VHOST_SET_VRING_ADDR(r3, 0x4028af11, &(0x7f0000000300)={0x1, 0x0, 0x0, &(0x7f0000001600)=""/78, 0x0}) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f0000001680)) r4 = eventfd2(0x80, 0x800) ioctl$VHOST_SET_VRING_ERR(r3, 0x4008af22, &(0x7f00000001c0)={0x0, r4}) ioctl$VHOST_SET_VRING_ADDR(r3, 0x4028af11, &(0x7f0000000240)={0x0, 0x0, 0x0, &(0x7f0000001d00)=""/176, 0x0, 0xffff1000}) ioctl$VHOST_VSOCK_SET_GUEST_CID(r3, 0x4008af60, &(0x7f0000000140)={@my=0x1}) socket$vsock_stream(0x28, 0x1, 0x0) ioctl$VHOST_SET_VRING_ADDR(r3, 0x4028af11, 0x0) capset(0x0, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) read$FUSE(r0, &(0x7f0000000680)={0x2020}, 0x2020) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) socket$netlink(0x10, 0x3, 0x14) unshare(0x42000000) 430.528583ms ago: executing program 0 (id=73): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x1100, 0x2}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@weak_binder={0x77622a85, 0x100a, 0x8000000000}, @flat=@weak_binder={0x77622a85, 0x1100, 0x3}}, &(0x7f0000000200)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x10000000000) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f0000000580)="b3185d7bb56f70f003360fa8bf71ac3086aedebf6fff904f92849a7a07395ee7f0e4cb1d78001c08a0ab73ffcf5ad07693727980eea946e6cba1723e81bfa5c3688803c8a124dcb27df7938e7ddfdd52"}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000004a40)={0x44, 0x0, &(0x7f00000049c0)=[@transaction={0x40406300, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0xa4, 0x0, &(0x7f0000000600)="878b7cdfd4455cf49da7ba6f280ae012ce80389a2aefe4fd04084554d7015aba5330d1b817d6c08af29938b8a9bc2b83462ddadaad3a3a5c0181a0203e49b12c99ac8757fc317fe672938a06f89c133d615cf8c6e94b3ac320fa50046f5c18ac35b49243870e4e6b90c76177feda5469369b2b5a4739cc0b68c1772f1c9b9320d88426bc8f139429054c85b62f2a1dfc705453bea4cabf1f5eee5a0d301fb7c62e36dba0"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000500), 0x0, 0x0, 0x0}) 430.29758ms ago: executing program 0 (id=74): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1/idVendor\x00', 0x1, 0x0) write(r0, &(0x7f0000000140)='0x1d6b\n', 0x7) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/idProduct\x00', 0x1, 0x0) write(r1, 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/bcdUSB\x00', 0x1, 0x0) write(r2, 0x0, 0x0) write(r0, &(0x7f0000000b40)="a75f3e8763810fb65db27b093ce625d61034fd6f81992cbace7584a0463a17a53bd51219be4c462a52591512f0901461910a999bff9cac267b67b04c786921a9b7730ccc20ca181bdcfd994246f794823814ba667bdd9f2fd0f25ee266", 0x5d) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff) r3 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x1, 0x0) write(r3, &(0x7f0000000380)='0123456789\n', 0xb) write(0xffffffffffffffff, &(0x7f0000000400)='syzkaller\n', 0xa) r4 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/strings/0x409/product\x00', 0x1, 0x0) write(r4, &(0x7f0000000480)='HID Gadge', 0x9) mkdirat(0xffffffffffffff9c, &(0x7f00000004c0)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000640)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff) r5 = openat(0xffffffffffffff9c, &(0x7f0000000680)='./config/usb_gadget/g1/functions/hid.usb0/no_out_endpoint\x00', 0x1, 0x0) write(r5, &(0x7f00000006c0)='1', 0x1) write(0xffffffffffffffff, &(0x7f00000007c0)='1\n', 0x2) openat(0xffffffffffffff9c, &(0x7f0000000880)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x1, 0x0) symlinkat(&(0x7f0000000900)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000980)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00') r6 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r6, &(0x7f0000000a40)='dummy_udc.0\n', 0xc) 348.889618ms ago: executing program 0 (id=75): bpf$MAP_CREATE(0x600000000000000, &(0x7f0000000100)=ANY=[@ANYBLOB="0f000000040000000400000002000200000000003f1ff8f3693dff9b7c"], 0x48) 348.800173ms ago: executing program 0 (id=76): socket$nl_route(0x10, 0x3, 0x0) syz_emit_ethernet(0x56, 0x0, 0x0) syz_io_uring_complete(0x0, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_ADD_COUNTERS(r0, 0x0, 0x41, &(0x7f0000000c80)=ANY=[@ANYBLOB], 0x58) munmap(&(0x7f0000470000/0x400000)=nil, 0xe06500) shmat(0x0, &(0x7f0000d62000/0x4000)=nil, 0xa000) 348.698985ms ago: executing program 3 (id=77): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1/idVendor\x00', 0x1, 0x0) write(r0, &(0x7f0000000140)='0x1d6b\n', 0x7) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/idProduct\x00', 0x1, 0x0) write(r1, 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/bcdUSB\x00', 0x1, 0x0) write(r2, 0x0, 0x0) write(r0, &(0x7f0000000b40)="a75f3e8763810fb65db27b093ce625d61034fd6f81992cbace7584a0463a17a53bd51219be4c462a52591512f0901461910a999bff9cac267b67b04c786921a9b7730ccc20ca181bdcfd994246f794823814ba667bdd9f2fd0f25ee266", 0x5d) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff) r3 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x1, 0x0) write(r3, &(0x7f0000000380)='0123456789\n', 0xb) write(0xffffffffffffffff, &(0x7f0000000400)='syzkaller', 0x9) r4 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/strings/0x409/product\x00', 0x1, 0x0) write(r4, &(0x7f0000000480)='HID Gadget\n', 0xb) mkdirat(0xffffffffffffff9c, &(0x7f00000004c0)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000640)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff) r5 = openat(0xffffffffffffff9c, &(0x7f0000000680)='./config/usb_gadget/g1/functions/hid.usb0/no_out_endpoint\x00', 0x1, 0x0) write(r5, &(0x7f00000006c0)='1', 0x1) write(0xffffffffffffffff, &(0x7f00000007c0)='1\n', 0x2) write(0xffffffffffffffff, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000880)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x1, 0x0) symlinkat(&(0x7f0000000900)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000980)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00') r6 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r6, &(0x7f0000000a40)='dummy_udc.0\n', 0xc) 291.709152ms ago: executing program 3 (id=78): r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000e40), 0x40001, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x9) ioctl$PTP_SYS_OFFSET(r0, 0x43403d05, &(0x7f0000000640)={0x7}) 291.370331ms ago: executing program 0 (id=79): timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r1 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) write$uinput_user_dev(r1, &(0x7f0000000a00)={'syz1\x00', {0x9, 0x7, 0x3, 0x5}, 0x3f, [0x9, 0x7, 0x18, 0x2, 0x2, 0x400, 0x80400000, 0x0, 0x8, 0x0, 0x6, 0x2, 0xfffffffb, 0x39, 0x747d5e13, 0x802, 0xfffffb9a, 0x0, 0x0, 0xfffffffb, 0x2004, 0x3, 0x0, 0xf250, 0x83, 0x4800, 0x300000, 0x7, 0xe, 0x4623f, 0xfffffffe, 0x10001, 0x801ff, 0x8003, 0x0, 0x3, 0x1d, 0x3, 0xba55, 0x8da8, 0x4, 0x80200, 0x2, 0x4, 0xe, 0x4, 0x2, 0x6f, 0x8, 0x9, 0x1, 0x7c23, 0x6, 0x6, 0xc, 0xfffbffff, 0x4, 0x6, 0x1000, 0x5, 0x3d, 0x8, 0xa, 0x5], [0x1, 0x1e, 0x3, 0x8000, 0xfffffffd, 0x3, 0x5bf, 0x25, 0x7, 0xfffffffc, 0x3, 0x7fff, 0x72c, 0x1c32, 0x3, 0x6, 0x10000, 0x400, 0x0, 0x3, 0x1, 0xd, 0x5, 0x0, 0x981, 0x4, 0x0, 0x3ff, 0x0, 0x0, 0x0, 0x1000001, 0x10, 0x10, 0xfffffffd, 0x1, 0x1, 0xffffffff, 0x6, 0x3ff, 0x800, 0x7, 0x3, 0x96, 0xfffffff9, 0x2, 0x0, 0x2, 0x411, 0xc, 0x3, 0x379, 0x9, 0xe, 0x5, 0x7, 0x6, 0x2, 0x1, 0x80001, 0x8, 0x7, 0x200, 0x3], [0x401, 0x4d, 0xffff, 0xcd3, 0x7, 0x1f, 0x404, 0x4, 0x4008, 0xc, 0x7, 0x9, 0xe8b, 0x5, 0x80000001, 0x8, 0x3f92, 0x1000, 0x0, 0x10, 0x1, 0xfffffff9, 0x0, 0x1000, 0x80040101, 0x5, 0xffff, 0x5, 0x200003, 0x2, 0x5, 0x80, 0x9, 0x8001, 0x10000, 0x0, 0x7, 0x400004, 0x3, 0x6d7e, 0x3, 0x8, 0x3, 0xbf23, 0x6, 0x9, 0x956, 0x0, 0x3ff, 0xe, 0x6, 0x100fffd, 0x2005, 0x400, 0x4, 0xea, 0x9, 0x20000005, 0x3, 0xd9, 0x0, 0x7d, 0x5d7, 0xb], [0x108e, 0xffff, 0x7, 0x3, 0x88, 0x2, 0x1, 0x4, 0x4c, 0x2, 0x764, 0xb, 0x402, 0x1, 0x9, 0x4001000, 0x10007f, 0x5, 0x3fa6, 0x4, 0x0, 0x5, 0x6, 0x4, 0xe47, 0x4, 0x3, 0x4, 0x2, 0x2851, 0x3b, 0x20000001, 0x8000, 0x5, 0x1, 0x65f413f9, 0x4, 0x20006, 0x1, 0x86, 0x44, 0x409, 0x3, 0x4, 0x4, 0x57, 0x1e, 0xffffffff, 0x7fff, 0x80000000, 0xfffffff5, 0x401, 0x3, 0x200, 0x7, 0x6a6, 0xfffffffd, 0xa, 0xe, 0x2, 0xf, 0xf, 0x1, 0x7fffffff]}, 0x45c) ioctl$XFS_IOC_PATH_TO_HANDLE(r1, 0xc0385869, &(0x7f0000000440)={r1, &(0x7f0000000000)='syz1\x00', 0x228c80, &(0x7f0000000380)={@align=0xe7, {0x3, 0xffff, 0x3, 0x4}}, 0x680, &(0x7f00000003c0)={@_ha_fsid}, &(0x7f0000000400)=0x3}) getsockname$packet(r2, &(0x7f0000000480)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f00000004c0)=0x14) ioctl$UI_DEV_CREATE(r1, 0x5501) readv(r1, &(0x7f0000001240)=[{&(0x7f00000012c0)=""/41, 0x29}], 0x1) r3 = socket(0x400000000010, 0x3, 0x0) getsockopt$inet6_IPV6_FLOWLABEL_MGR(r3, 0x29, 0x20, &(0x7f0000000300)={@remote, 0x4, 0x1, 0x1, 0x4, 0x3ff, 0xfffb}, &(0x7f0000000340)=0x20) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'veth0\x00', 0x0}) r6 = socket(0xa, 0x3, 0x87) sendmsg(r6, &(0x7f0000000700)={&(0x7f0000000080)=@l2tp6={0xa, 0x0, 0x9, @dev={0xfe, 0x80, '\x00', 0x43}, 0x7, 0x4}, 0x80, &(0x7f0000000680)=[{0x0}, {&(0x7f0000000180)="72a103265e55", 0x6}], 0x2}, 0x0) r7 = syz_genetlink_get_family_id$fou(&(0x7f0000000180), r3) sendmsg$FOU_CMD_ADD(r6, &(0x7f00000002c0)={&(0x7f00000000c0), 0xc, &(0x7f0000000280)={&(0x7f00000001c0)={0x24, r7, 0x4, 0x70bd28, 0x25dfdbff, {}, [@FOU_ATTR_IFINDEX={0x8, 0xb, r5}, @FOU_ATTR_PORT={0x6, 0x1, 0x4e20}]}, 0x24}, 0x1, 0x0, 0x0, 0x1}, 0x44010) sendmsg$nl_route_sched(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)=@delchain={0x24, 0x65, 0x1, 0x70bd26, 0x25dfdbfc, {0x0, 0x0, 0x0, r5, {0xfff2, 0x7}, {0x0, 0x1}, {0xffec, 0xa}}}, 0x24}, 0x1, 0x0, 0x0, 0x8d0}, 0x8000000) 291.20672ms ago: executing program 3 (id=80): bpf$TOKEN_CREATE(0x24, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) fcntl$lock(0xffffffffffffffff, 0x22, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r2, 0x29, 0x2e, &(0x7f0000000200)={0x5, {{0xa, 0x4e20, 0x0, @mcast1={0xff, 0x7}, 0x9}}, {{0xa, 0x3, 0x0, @loopback}}}, 0x108) r3 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r3, 0x29, 0x2a, &(0x7f0000000080)={0x5, {{0xa, 0x0, 0xfffffffe, @mcast1={0xff, 0x7}, 0x10}}, {{0xa, 0x0, 0x0, @remote, 0x7}}}, 0x108) setsockopt$inet6_group_source_req(r3, 0x29, 0x2b, &(0x7f0000000400)={0x0, {{0xa, 0x4e28, 0x20, @mcast1={0xff, 0x7}}}, {{0xa, 0x4000, 0xffffffff, @loopback}}}, 0x108) setsockopt$inet6_group_source_req(r3, 0x29, 0x2b, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}}}, 0x108) close_range(r1, 0xffffffffffffffff, 0x0) r4 = timerfd_create(0x0, 0x0) timerfd_settime(r4, 0x3, &(0x7f0000000440)={{0x0, 0x3938700}}, 0x0) r5 = epoll_create(0x7ffffffd) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r4, 0x0) clock_adjtime(0x0, &(0x7f0000000000)={0x3ff, 0xf6d, 0x0, 0xd, 0x100, 0x0, 0x4, 0x200000000000000, 0x0, 0x100, 0x0, 0x0, 0x9, 0x3, 0x0, 0xfffffffffffffff9, 0x0, 0x0, 0x1000, 0x2000000000008, 0x9, 0x3, 0x8000000000005a, 0x3}) write$selinux_attr(0xffffffffffffffff, &(0x7f0000000100)='system_u:object_r:hugetlbfs_t:s0\x00', 0x1d) 367.409µs ago: executing program 3 (id=81): r0 = socket$packet(0x11, 0x3, 0x300) getsockopt$packet_int(r0, 0x107, 0x12, 0x0, &(0x7f0000001600)) socket$inet6(0xa, 0x2, 0x0) socket$netlink(0x10, 0x3, 0x8000000004) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./proc/net/rpc/auth.unix.gid/channel\x00', 0x2, 0x0) write(r1, &(0x7f0000000500)='4294967295 2000000000 0\n', 0x18) 0s ago: executing program 3 (id=82): r0 = fanotify_init(0x10, 0x8000) syz_emit_ethernet(0x76, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100000008e}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) clock_adjtime(0x0, &(0x7f0000000280)={0x1000000000066fb, 0x800000000004, 0x376, 0x0, 0x0, 0x51, 0x0, 0x4, 0x0, 0x0, 0x0, 0x240b, 0x3f, 0x9, 0x0, 0x7ca53c09, 0xfffffffffffffffd, 0x1fff, 0xfffffffffffffffc, 0x4, 0x10000000000, 0x0, 0x0, 0x100000000003f89, 0x0, 0x8000000000000000}) mmap$IORING_OFF_SQ_RING(0x0, 0xaff9, 0x8, 0x4010, 0xffffffffffffffff, 0x0) clock_adjtime(0x0, &(0x7f00000006c0)={0x7fff, 0x800000000, 0x0, 0x0, 0x0, 0x2c43, 0x0, 0x0, 0x0, 0xa186010000000000, 0x0, 0x2902, 0x20, 0x100000001}) r4 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0) fanotify_mark(r0, 0x7e, 0x800003a, r4, 0x0) r5 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r5, 0x0, 0x40, &(0x7f0000000000)=@nat={'nat\x00', 0x670, 0x5, 0x3d0, 0x0, 0x0, 0xfeffffff, 0x270, 0x1a0, 0x338, 0x338, 0xffffffff, 0x338, 0x338, 0x5, 0x0, {[{{@ip={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 'veth0_to_bond\x00', 'caif0\x00', {}, {}, 0x6}, 0x0, 0xd0, 0xf8, 0x0, {}, [@common=@inet=@tcp={{0x30}}, @common=@inet=@tcp={{0x30}, {[], [], 0x0, 0x0, 0x2, 0x5}}]}, @common=@inet=@TCPMSS={0x28}}, {{@uncond, 0x0, 0x70, 0xa8}, @REDIRECT={0x38, 'REDIRECT\x00', 0x0, {0x1, {0x0, @broadcast, @remote, @icmp_id=0x64, @gre_key=0x8001}}}}, {{@uncond, 0x0, 0x98, 0xd0, 0x0, {}, [@common=@ttl={{0x28}}]}, @NETMAP={0x38, 'NETMAP\x00', 0x0, {0x1, {0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, @icmp_id}}}}, {{@ip={@remote, @broadcast, 0x0, 0x0, 'pimreg\x00', 'wlan0\x00'}, 0x0, 0x90, 0xc8, 0x0, {}, [@common=@socket0={{0x20}}]}, @NETMAP={0x38, 'NETMAP\x00', 0x0, {0x1, {0x0, @private, @rand_addr, @gre_key, @gre_key}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x430) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0xe, 0x3, &(0x7f0000000040)=ANY=[@ANYBLOB], 0x0}, 0x94) fsopen(&(0x7f0000000000)='binder\x00', 0x1) kernel console output (not intermixed with test programs): [ 38.077754][ T43] audit: type=1400 audit(1790226616.040:134): avc: denied { noatsecure } for pid=5709 comm="sshd-session" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 38.079888][ T43] audit: type=1400 audit(1790226616.040:135): avc: denied { write } for pid=5709 comm="sh" path="pipe:[6451]" dev="pipefs" ino=6451 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 38.080132][ T43] audit: type=1400 audit(1790226616.040:136): avc: denied { rlimitinh } for pid=5709 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 38.080551][ T43] audit: type=1400 audit(1790226616.040:137): avc: denied { siginh } for pid=5709 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 Warning: Permanently added '[localhost]:63052' (ED25519) to the list of known hosts. [ 39.808259][ T43] audit: type=1400 audit(1790226617.770:138): avc: denied { name_bind } for pid=5716 comm="sshd-session" src=30000 scontext=system_u:system_r:sshd_t tcontext=system_u:object_r:unreserved_port_t tclass=tcp_socket permissive=1 [ 39.837562][ T43] audit: type=1400 audit(1790226617.790:139): avc: denied { execute } for pid=5717 comm="sh" name="syz-executor" dev="sda1" ino=2020 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:etc_runtime_t tclass=file permissive=1 [ 39.838236][ T43] audit: type=1400 audit(1790226617.800:140): avc: denied { execute_no_trans } for pid=5717 comm="sh" path="/syz-executor" dev="sda1" ino=2020 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:etc_runtime_t tclass=file permissive=1 [ 42.210200][ T43] audit: type=1400 audit(1790226620.170:141): avc: denied { mounton } for pid=5717 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2022 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 42.211864][ T43] audit: type=1400 audit(1790226620.170:142): avc: denied { mount } for pid=5717 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 42.213991][ T5717] cgroup: Unknown subsys name 'net' [ 42.310201][ T5717] cgroup: Unknown subsys name 'cpuset' [ 42.312363][ T5717] cgroup: Unknown subsys name 'rlimit' [ 42.512838][ T5722] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 43.244861][ T5717] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 46.944036][ T43] kauditd_printk_skb: 15 callbacks suppressed [ 46.944050][ T43] audit: type=1400 audit(1790226624.890:158): avc: denied { execmem } for pid=5725 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 47.062395][ T43] audit: type=1400 audit(1790226625.020:159): avc: denied { create } for pid=5728 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 47.062813][ T43] audit: type=1400 audit(1790226625.020:160): avc: denied { read write } for pid=5728 comm="syz-executor" name="vhci" dev="devtmpfs" ino=1290 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 47.063199][ T43] audit: type=1400 audit(1790226625.020:161): avc: denied { open } for pid=5728 comm="syz-executor" path="/dev/vhci" dev="devtmpfs" ino=1290 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 47.076455][ T43] audit: type=1400 audit(1790226625.030:162): avc: denied { ioctl } for pid=5728 comm="syz-executor" path="socket:[6476]" dev="sockfs" ino=6476 ioctlcmd=0x48c9 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 47.086973][ T5730] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 47.089612][ T5735] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 47.090117][ T5735] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 47.090949][ T5735] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 47.091669][ T5735] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 47.091752][ T5735] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 47.092790][ T5735] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 47.093058][ T5735] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 47.094657][ T5730] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 47.097163][ T5735] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 47.103626][ T43] audit: type=1400 audit(1790226625.060:163): avc: denied { read } for pid=5728 comm="syz-executor" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 47.104147][ T43] audit: type=1400 audit(1790226625.060:164): avc: denied { open } for pid=5728 comm="syz-executor" path="net:[4026531833]" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 47.105487][ T43] audit: type=1400 audit(1790226625.060:165): avc: denied { mounton } for pid=5728 comm="syz-executor" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 47.105751][ T5735] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 47.109833][ T5735] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 47.111051][ T5735] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 47.111221][ T5735] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 47.112892][ T5735] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 47.114221][ T43] audit: type=1400 audit(1790226625.070:166): avc: denied { module_request } for pid=5728 comm="syz-executor" kmod="netdev-nr1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 47.114233][ T5735] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 47.114560][ T5737] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 47.115585][ T5737] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 47.115778][ T5737] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 47.116500][ T5737] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 47.144716][ T43] audit: type=1400 audit(1790226625.100:167): avc: denied { sys_module } for pid=5728 comm="syz-executor" capability=16 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 47.708802][ T5728] bridge0: port 1(bridge_slave_0) entered blocking state [ 47.708915][ T5728] bridge0: port 1(bridge_slave_0) entered disabled state [ 47.709013][ T5728] bridge_slave_0: entered allmulticast mode [ 47.711468][ T5728] bridge_slave_0: entered promiscuous mode [ 47.719011][ T5728] bridge0: port 2(bridge_slave_1) entered blocking state [ 47.719089][ T5728] bridge0: port 2(bridge_slave_1) entered disabled state [ 47.719188][ T5728] bridge_slave_1: entered allmulticast mode [ 47.721120][ T5728] bridge_slave_1: entered promiscuous mode [ 47.728800][ T5733] bridge0: port 1(bridge_slave_0) entered blocking state [ 47.728875][ T5733] bridge0: port 1(bridge_slave_0) entered disabled state [ 47.729147][ T5733] bridge_slave_0: entered allmulticast mode [ 47.730480][ T5733] bridge_slave_0: entered promiscuous mode [ 47.776138][ T5733] bridge0: port 2(bridge_slave_1) entered blocking state [ 47.776217][ T5733] bridge0: port 2(bridge_slave_1) entered disabled state [ 47.776273][ T5733] bridge_slave_1: entered allmulticast mode [ 47.777007][ T5733] bridge_slave_1: entered promiscuous mode [ 47.831752][ T5728] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 47.846651][ T5733] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 47.848782][ T5728] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 47.872716][ T5733] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 47.884850][ T5738] bridge0: port 1(bridge_slave_0) entered blocking state [ 47.884897][ T5738] bridge0: port 1(bridge_slave_0) entered disabled state [ 47.884955][ T5738] bridge_slave_0: entered allmulticast mode [ 47.885815][ T5738] bridge_slave_0: entered promiscuous mode [ 47.888130][ T5728] team0: Port device team_slave_0 added [ 47.896136][ T5734] bridge0: port 1(bridge_slave_0) entered blocking state [ 47.896221][ T5734] bridge0: port 1(bridge_slave_0) entered disabled state [ 47.896275][ T5734] bridge_slave_0: entered allmulticast mode [ 47.897005][ T5734] bridge_slave_0: entered promiscuous mode [ 47.899088][ T5734] bridge0: port 2(bridge_slave_1) entered blocking state [ 47.899129][ T5734] bridge0: port 2(bridge_slave_1) entered disabled state [ 47.899298][ T5734] bridge_slave_1: entered allmulticast mode [ 47.900004][ T5734] bridge_slave_1: entered promiscuous mode [ 47.900646][ T5738] bridge0: port 2(bridge_slave_1) entered blocking state [ 47.900686][ T5738] bridge0: port 2(bridge_slave_1) entered disabled state [ 47.900766][ T5738] bridge_slave_1: entered allmulticast mode [ 47.901489][ T5738] bridge_slave_1: entered promiscuous mode [ 47.903138][ T5728] team0: Port device team_slave_1 added [ 47.925121][ T5733] team0: Port device team_slave_0 added [ 47.950018][ T5733] team0: Port device team_slave_1 added [ 47.959365][ T5728] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 47.959381][ T5728] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 47.959402][ T5728] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 47.961361][ T5734] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 47.963820][ T5738] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 47.965822][ T5738] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 47.977483][ T5734] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 47.978125][ T5728] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 47.978138][ T5728] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 47.978159][ T5728] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 48.006965][ T5733] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 48.006975][ T5733] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 48.006987][ T5733] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 48.008625][ T5733] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 48.008637][ T5733] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 48.008655][ T5733] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 48.034489][ T5734] team0: Port device team_slave_0 added [ 48.048758][ T5728] hsr_slave_0: entered promiscuous mode [ 48.049317][ T5728] hsr_slave_1: entered promiscuous mode [ 48.051598][ T5738] team0: Port device team_slave_0 added [ 48.053508][ T5734] team0: Port device team_slave_1 added [ 48.054857][ T5738] team0: Port device team_slave_1 added [ 48.127609][ T5738] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 48.127622][ T5738] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 48.127634][ T5738] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 48.135979][ T5734] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 48.135993][ T5734] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 48.136009][ T5734] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 48.145686][ T5733] hsr_slave_0: entered promiscuous mode [ 48.146505][ T5733] hsr_slave_1: entered promiscuous mode [ 48.147044][ T5733] debugfs: 'hsr0' already exists in 'hsr' [ 48.147118][ T5733] Cannot create hsr debugfs directory [ 48.147935][ T5738] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 48.147944][ T5738] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 48.147957][ T5738] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 48.152553][ T5734] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 48.152563][ T5734] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 48.152575][ T5734] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 48.226019][ T5738] hsr_slave_0: entered promiscuous mode [ 48.226452][ T5738] hsr_slave_1: entered promiscuous mode [ 48.226745][ T5738] debugfs: 'hsr0' already exists in 'hsr' [ 48.226756][ T5738] Cannot create hsr debugfs directory [ 48.259314][ T5734] hsr_slave_0: entered promiscuous mode [ 48.260499][ T5734] hsr_slave_1: entered promiscuous mode [ 48.261052][ T5734] debugfs: 'hsr0' already exists in 'hsr' [ 48.261065][ T5734] Cannot create hsr debugfs directory [ 48.470316][ T5728] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 48.476277][ T5728] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 48.476719][ T5728] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 48.481347][ T5728] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 48.494713][ T5728] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 48.498133][ T5728] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 48.498719][ T5728] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 48.502999][ T5728] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 48.573705][ T5733] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 48.576864][ T5733] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 48.579460][ T5733] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 48.584774][ T5733] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 48.585503][ T5733] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 48.587708][ T5733] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 48.588686][ T5733] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 48.592360][ T5733] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 48.656458][ T5738] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 48.659478][ T5738] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 48.659930][ T5738] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 48.663575][ T5738] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 48.664328][ T5738] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 48.668463][ T5738] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 48.675058][ T5738] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 48.676706][ T5738] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 48.716002][ T5728] 8021q: adding VLAN 0 to HW filter on device bond0 [ 48.749232][ T5734] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 48.751478][ T5734] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 48.762069][ T5734] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 48.765317][ T5734] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 48.766811][ T5728] 8021q: adding VLAN 0 to HW filter on device team0 [ 48.768003][ T5734] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 48.772594][ T5734] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 48.773564][ T5734] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 48.777122][ T5734] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 48.800674][ T1167] bridge0: port 1(bridge_slave_0) entered blocking state [ 48.800742][ T1167] bridge0: port 1(bridge_slave_0) entered forwarding state [ 48.814068][ T1167] bridge0: port 2(bridge_slave_1) entered blocking state [ 48.814214][ T1167] bridge0: port 2(bridge_slave_1) entered forwarding state [ 48.822419][ T5733] 8021q: adding VLAN 0 to HW filter on device bond0 [ 48.855032][ T5733] 8021q: adding VLAN 0 to HW filter on device team0 [ 48.868310][ T1167] bridge0: port 1(bridge_slave_0) entered blocking state [ 48.868360][ T1167] bridge0: port 1(bridge_slave_0) entered forwarding state [ 48.879033][ T1167] bridge0: port 2(bridge_slave_1) entered blocking state [ 48.879096][ T1167] bridge0: port 2(bridge_slave_1) entered forwarding state [ 48.892000][ T5738] 8021q: adding VLAN 0 to HW filter on device bond0 [ 48.912563][ T5738] 8021q: adding VLAN 0 to HW filter on device team0 [ 48.925102][ T1167] bridge0: port 1(bridge_slave_0) entered blocking state [ 48.925146][ T1167] bridge0: port 1(bridge_slave_0) entered forwarding state [ 48.943203][ T1167] bridge0: port 2(bridge_slave_1) entered blocking state [ 48.943251][ T1167] bridge0: port 2(bridge_slave_1) entered forwarding state [ 48.970014][ T5734] 8021q: adding VLAN 0 to HW filter on device bond0 [ 48.984729][ T5738] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 48.995177][ T5734] 8021q: adding VLAN 0 to HW filter on device team0 [ 49.003022][ T226] bridge0: port 1(bridge_slave_0) entered blocking state [ 49.003072][ T226] bridge0: port 1(bridge_slave_0) entered forwarding state [ 49.012226][ T226] bridge0: port 2(bridge_slave_1) entered blocking state [ 49.012271][ T226] bridge0: port 2(bridge_slave_1) entered forwarding state [ 49.135840][ T5728] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 49.149458][ T5737] Bluetooth: hci3: command tx timeout [ 49.149870][ T5737] Bluetooth: hci1: command tx timeout [ 49.150004][ T5735] Bluetooth: hci2: command tx timeout [ 49.160036][ T5735] Bluetooth: hci0: command tx timeout [ 49.171913][ T5728] veth0_vlan: entered promiscuous mode [ 49.176497][ T5733] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 49.178614][ T5728] veth1_vlan: entered promiscuous mode [ 49.212269][ T5728] veth0_macvtap: entered promiscuous mode [ 49.215729][ T5728] veth1_macvtap: entered promiscuous mode [ 49.218669][ T5733] veth0_vlan: entered promiscuous mode [ 49.230604][ T5738] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 49.232029][ T5733] veth1_vlan: entered promiscuous mode [ 49.236408][ T5728] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 49.239375][ T5728] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 49.286308][ T5733] veth0_macvtap: entered promiscuous mode [ 49.290277][ T5733] veth1_macvtap: entered promiscuous mode [ 49.295238][ T5734] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 49.324278][ T5738] veth0_vlan: entered promiscuous mode [ 49.330666][ T5733] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 49.339629][ T5733] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 49.340513][ T226] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 49.340524][ T226] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 49.347595][ T5826] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.354886][ T5738] veth1_vlan: entered promiscuous mode [ 49.396045][ T226] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 49.396058][ T226] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 49.396608][ T5734] veth0_vlan: entered promiscuous mode [ 49.398603][ T5804] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.398638][ T5804] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.398656][ T5804] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.398674][ T5804] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.399115][ T226] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 49.399126][ T226] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 49.407742][ T5826] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.407791][ T5826] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.407819][ T5826] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.426192][ T5734] veth1_vlan: entered promiscuous mode [ 49.429348][ T1167] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 49.429364][ T1167] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 49.441399][ T5738] veth0_macvtap: entered promiscuous mode [ 49.446281][ T5728] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 49.448124][ T5738] veth1_macvtap: entered promiscuous mode [ 49.460866][ T5734] veth0_macvtap: entered promiscuous mode [ 49.464052][ T5738] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 49.466716][ T5734] veth1_macvtap: entered promiscuous mode [ 49.470215][ T5738] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 49.488375][ T5734] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 49.493887][ T5734] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 49.569546][ T37] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 49.569563][ T37] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 49.593959][ T37] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 49.593973][ T37] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 49.602630][ T37] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 49.602642][ T37] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 49.622316][ T37] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 49.622331][ T37] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 49.632229][ T5777] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.632371][ T5777] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.632542][ T5777] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.632664][ T5777] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.632763][ T5777] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.632862][ T5777] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.633013][ T5777] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.633421][ T5777] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.770672][ T5890] oom_control is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 49.795122][ T5890] kobject_uevent: unable to create netlink socket! [ 49.807436][ T5825] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 49.977470][ T5825] usb 6-1: Using ep0 maxpacket: 16 [ 49.984491][ T5735] Bluetooth: hci0: adv larger than maximum supported [ 49.984512][ T5735] Bluetooth: hci0: Malformed LE Event: 0x0d [ 49.985779][ T5825] usb 6-1: unable to get BOS descriptor or descriptor too short [ 49.985804][ T5825] usb 6-1: New USB device found, idVendor=103d, idProduct=0100, bcdDevice=6e.00 [ 49.985821][ T5825] usb 6-1: too many configurations: 216, using maximum allowed: 8 [ 49.987122][ T5825] usb 6-1: unable to read config index 0 descriptor/start: -71 [ 49.987142][ T5825] usb 6-1: can't read configurations, error -71 [ 50.487542][ T5833] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 50.638636][ T5833] usb 7-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 50.639754][ T5833] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 50.640679][ T5833] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 50.640697][ T5833] usb 7-1: SerialNumber: syz [ 50.652953][ T5833] cdc_ether 7-1:1.0: GUID doesn't match [ 50.851531][ T3272] usb 7-1: USB disconnect, device number 2 [ 51.127383][ T10] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 51.237662][ T5089] Bluetooth: hci2: command tx timeout [ 51.237684][ T5089] Bluetooth: hci1: command tx timeout [ 51.237696][ T5089] Bluetooth: hci3: command tx timeout [ 51.238277][ T5735] Bluetooth: hci0: command tx timeout [ 51.253469][ T5930] UDC core: g1: couldn't find an available UDC or it's busy [ 51.277316][ T10] usb 5-1: Using ep0 maxpacket: 32 [ 51.279154][ T10] usb 5-1: unable to get BOS descriptor or descriptor too short [ 51.279188][ T10] usb 5-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 51.280116][ T10] usb 5-1: config 14 has an invalid interface number: 57 but max is 1 [ 51.280154][ T10] usb 5-1: config 14 has an invalid interface number: 228 but max is 1 [ 51.280171][ T10] usb 5-1: config 14 has no interface number 0 [ 51.280183][ T10] usb 5-1: config 14 has no interface number 1 [ 51.280226][ T10] usb 5-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 51.280242][ T10] usb 5-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 51.280261][ T10] usb 5-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 51.280280][ T10] usb 5-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 51.280299][ T10] usb 5-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 51.280318][ T10] usb 5-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 51.280338][ T10] usb 5-1: config 14 interface 57 has no altsetting 0 [ 51.280350][ T10] usb 5-1: config 14 interface 228 has no altsetting 0 [ 51.281968][ T10] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 51.281980][ T10] usb 5-1: Product: syz [ 51.281987][ T10] usb 5-1: Manufacturer: syz [ 51.281994][ T10] usb 5-1: SerialNumber: syz [ 51.523729][ T5942] kvm_intel: kvm [5941]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x1d9) = 0x41 [ 51.648267][ T3272] usb 7-1: new high-speed USB device number 3 using dummy_hcd [ 51.740544][ T10] legousbtower 5-1:14.57: interrupt endpoints not found [ 51.810160][ T3272] usb 7-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 51.811173][ T3272] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 51.811191][ T3272] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 51.813505][ T3272] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 51.813526][ T3272] usb 7-1: SerialNumber: syz [ 51.859176][ T5955] bond_slave_0: entered promiscuous mode [ 51.859191][ T5955] bond_slave_0: entered allmulticast mode [ 51.892576][ T5957] UDC core: g1: couldn't find an available UDC or it's busy [ 52.031305][ T3272] usb 7-1: 0:2 : does not exist [ 52.063818][ T3272] usb 7-1: USB disconnect, device number 3 [ 52.068159][ T43] kauditd_printk_skb: 124 callbacks suppressed [ 52.068175][ T43] audit: type=1401 audit(1790226898.019:292): op=security_bounded_transition seresult=denied oldcontext=root:sysadm_r:sysadm_t newcontext=system_u:object_r:hugetlbfs_t [ 52.094210][ T5966] capability: warning: `syz.1.36' uses deprecated v2 capabilities in a way that may be insecure [ 52.095646][ T43] audit: type=1400 audit(1790226898.049:293): avc: denied { map_create } for pid=5965 comm="syz.1.36" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 52.095984][ T43] audit: type=1400 audit(1790226898.049:294): avc: denied { map_read map_write } for pid=5965 comm="syz.1.36" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 52.136746][ T5744] udevd[5744]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb7/7-1/7-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 52.145120][ T10] legousbtower 5-1:14.228: get version request failed: -121 [ 52.145194][ T10] legousbtower 5-1:14.228: probe with driver legousbtower failed with error -121 [ 52.328559][ T43] audit: type=1400 audit(1790226904.285:295): avc: denied { bind } for pid=5979 comm="syz.1.42" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 52.361647][ T5982] UDC core: g1: couldn't find an available UDC or it's busy [ 52.423432][ T43] audit: type=1401 audit(1790226904.375:296): op=security_bounded_transition seresult=denied oldcontext=root:sysadm_r:sysadm_t newcontext=system_u:object_r:hugetlbfs_t [ 52.453940][ T43] audit: type=1400 audit(1790226904.405:297): avc: denied { mount } for pid=5987 comm="syz.1.46" name="/" dev="sysfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 52.457542][ T5988] udc dummy_udc.0: unsupported command 'n' [ 52.472267][ T43] audit: type=1400 audit(1790226904.425:298): avc: denied { unmount } for pid=5728 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 52.578502][ T43] audit: type=1400 audit(1790226904.535:299): avc: denied { connect } for pid=5993 comm="syz.2.48" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 52.678168][ T43] audit: type=1400 audit(1790226910.636:300): avc: denied { read } for pid=6000 comm="syz.1.51" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 52.758146][ T6008] UDC core: g1: couldn't find an available UDC or it's busy [ 52.800946][ T6012] UDC core: g1: couldn't find an available UDC or it's busy [ 53.145609][ T6034] UDC core: g1: couldn't find an available UDC or it's busy [ 53.190878][ T43] audit: type=1400 audit(1790226917.148:301): avc: denied { read write } for pid=6036 comm="syz.2.66" name="uinput" dev="devtmpfs" ino=942 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 53.263962][ T5833] wiimote 0005:057E:0306.0002: hidraw1: BLUETOOTH HID v0.03 Gamepad [syz0] on syz0 [ 53.264451][ T5833] wiimote 0005:057E:0306.0002: New device registered [ 53.266775][ T6040] wiimote 0005:057E:0306.0002: Device removed [ 53.297482][ T6042] fido_id[6042]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 53.307872][ T1689] usb 8-1: new high-speed USB device number 2 using dummy_hcd [ 53.307876][ T5735] Bluetooth: hci3: command tx timeout [ 53.307902][ T5735] Bluetooth: hci0: command tx timeout [ 53.307915][ T5735] Bluetooth: hci1: command tx timeout [ 53.307928][ T5735] Bluetooth: hci2: command tx timeout [ 53.459757][ T1689] usb 8-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 53.461219][ T1689] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 53.461238][ T1689] usb 8-1: config 0 has no interfaces? [ 53.461261][ T1689] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 53.464274][ T1689] usb 8-1: config 0 descriptor?? [ 53.670245][ T3272] usb 8-1: USB disconnect, device number 2 [ 53.901598][ T3272] usb 5-1: USB disconnect, device number 2 [ 53.987329][ T69] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 54.157385][ T69] usb 6-1: Using ep0 maxpacket: 32 [ 54.165480][ T69] usb 6-1: unable to get BOS descriptor or descriptor too short [ 54.165505][ T69] usb 6-1: New USB device found, idVendor=0582, idProduct=295c, bcdDevice=d4.55 [ 54.166304][ T69] usb 6-1: config 128 has an invalid interface number: 127 but max is 3 [ 54.166316][ T69] usb 6-1: config 128 has an invalid descriptor of length 0, skipping remainder of the config [ 54.166325][ T69] usb 6-1: config 128 has 1 interface, different from the descriptor's value: 4 [ 54.166334][ T69] usb 6-1: config 128 has no interface number 0 [ 54.166352][ T69] usb 6-1: config 128 interface 127 altsetting 14 endpoint 0x5 has an invalid bInterval 218, changing to 11 [ 54.166364][ T69] usb 6-1: config 128 interface 127 altsetting 14 endpoint 0x5 has invalid maxpacket 57854, setting to 1024 [ 54.166377][ T69] usb 6-1: config 128 interface 127 altsetting 14 has 1 endpoint descriptor, different from the interface descriptor's value: 4 [ 54.166390][ T69] usb 6-1: config 128 interface 127 has no altsetting 0 [ 54.167979][ T69] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 54.167991][ T69] usb 6-1: Product: syz [ 54.167998][ T69] usb 6-1: Manufacturer: syz [ 54.168005][ T69] usb 6-1: SerialNumber: syz [ 54.278690][ T5833] wiimote 0005:057E:0306.0002: detected device: Nintendo Wii Remote (Gen 1) [ 54.303310][ T6067] input: syz1 as /devices/virtual/input/input6 [ 54.318300][ T5833] input: Nintendo Wii Remote Accelerometer as /devices/virtual/misc/uhid/0005:057E:0306.0002/input/input7 [ 54.323344][ T5833] input: Nintendo Wii Remote IR as /devices/virtual/misc/uhid/0005:057E:0306.0002/input/input8 [ 54.337966][ T5833] input: Nintendo Wii Remote as /devices/virtual/misc/uhid/0005:057E:0306.0002/input/input5 [ 54.412266][ T69] usb 6-1: USB disconnect, device number 4 [ 54.417418][ T5729] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 54.425132][ T5742] udevd[5742]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb6/6-1/6-1:128.127/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 54.567633][ T5729] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0000, bcdDevice= 7.03 [ 54.569667][ T5729] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 54.570742][ T5729] usb 5-1: Dual-Role OTG device on HNP port [ 54.570976][ T5729] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 54.570987][ T5729] usb 5-1: Product: HID Gadget [ 54.570994][ T5729] usb 5-1: SerialNumber: 0123456789 [ 54.573237][ C1] ------------[ cut here ]------------ [ 54.573245][ C1] usb_ep_enable: ep129 (ep1in-bulk) has maxpacket 0 [ 54.573254][ C1] WARNING: drivers/usb/gadget/udc/core.c:124 at usb_ep_enable+0x3e6/0x490, CPU#1: swapper/1/0 [ 54.597451][ C1] Modules linked in: [ 54.598822][ C1] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted syzkaller #0 PREEMPT(full) [ 54.602004][ C1] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 54.606150][ C1] RIP: 0010:usb_ep_enable+0x3f8/0x490 [ 54.608370][ C1] Code: 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 93 00 00 00 48 8d 3d 2a 07 74 09 48 8b 4b 08 40 0f b6 d5 4d 89 e0 48 c7 c6 c0 12 da 8c <67> 48 0f b9 3a bd ea ff ff ff e9 8e fd ff ff 49 c7 c4 60 05 da 8c [ 54.616070][ C1] RSP: 0018:ffffc900006b0a00 EFLAGS: 00010046 [ 54.618296][ C1] RAX: dffffc0000000000 RBX: ffff88802bb140e0 RCX: ffffffff8cda4960 [ 54.620866][ C1] RDX: 0000000000000081 RSI: ffffffff8cda12c0 RDI: ffffffff9152a610 [ 54.623420][ C1] RBP: 0000000000000081 R08: ffffffff8cda05a0 R09: 0000000000000000 [ 54.626205][ C1] R10: 0000000000000000 R11: 0000000000000001 R12: ffffffff8cda05a0 [ 54.628708][ C1] R13: 0000000000000000 R14: ffff88802bb140e0 R15: ffff88805a2d0998 [ 54.631181][ C1] FS: 0000000000000000(0000) GS:ffff8880d5c53000(0000) knlGS:0000000000000000 [ 54.634486][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 54.637246][ C1] CR2: 00007f61c4027dac CR3: 000000005a2c5000 CR4: 0000000000352ef0 [ 54.640529][ C1] Call Trace: [ 54.641935][ C1] [ 54.643131][ C1] hidg_set_alt+0x190/0xa10 [ 54.645001][ C1] ? do_raw_spin_unlock+0x145/0x1e0 [ 54.647144][ C1] ? rcu_is_watching+0x13/0xc0 [ 54.649117][ C1] composite_setup+0x2ccf/0x9290 [ 54.651198][ C1] ? __lock_acquire+0x5c0/0x1f40 [ 54.653282][ C1] ? __pfx_composite_setup+0x10/0x10 [ 54.655212][ C1] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 54.657111][ C1] ? do_raw_spin_lock+0x128/0x260 [ 54.658722][ C1] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 54.660501][ C1] ? configfs_composite_setup+0xfb/0x130 [ 54.662296][ C1] configfs_composite_setup+0xfb/0x130 [ 54.664269][ C1] dummy_timer+0x2039/0x3700 [ 54.666165][ C1] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 54.668042][ C1] ? debug_object_deactivate+0x2e4/0x3b0 [ 54.669881][ C1] ? __pfx_dummy_timer+0x10/0x10 [ 54.671477][ C1] ? rcu_is_watching+0x13/0xc0 [ 54.673113][ C1] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 54.675092][ C1] ? __pfx_dummy_timer+0x10/0x10 [ 54.677034][ C1] __hrtimer_run_queues+0x462/0x9c0 [ 54.679290][ C1] hrtimer_run_softirq+0x1ca/0x360 [ 54.681754][ C1] handle_softirqs+0x1e6/0x9d0 [ 54.683620][ C1] ? __pfx_handle_softirqs+0x10/0x10 [ 54.685776][ C1] ? _raw_spin_unlock+0x28/0x50 [ 54.687530][ C1] ? __hrtimer_rearm_deferred+0x9b/0x7b0 [ 54.689971][ C1] __irq_exit_rcu+0x16a/0x210 [ 54.692005][ C1] irq_exit_rcu+0x9/0x30 [ 54.693853][ C1] sysvec_apic_timer_interrupt+0xa3/0xc0 [ 54.696140][ C1] [ 54.697187][ C1] [ 54.698159][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 54.700422][ C1] RIP: 0010:pv_native_safe_halt+0xf/0x20 [ 54.702830][ C1] Code: 27 94 02 e9 43 50 03 00 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa eb 07 0f 00 2d 03 28 1a 00 fb f4 cc cc cc cc 66 2e 0f 1f 84 00 00 00 00 00 66 90 90 90 90 90 90 [ 54.710516][ C1] RSP: 0018:ffffc90000187e00 EFLAGS: 00000206 [ 54.712901][ C1] RAX: 0000000000058895 RBX: ffff88801f69cb00 RCX: ffffffff8bd191c5 [ 54.715763][ C1] RDX: 0000000000000001 RSI: ffffffff8e38d191 RDI: ffffffff8c623580 [ 54.718464][ C1] RBP: ffffed1003ed3960 R08: 0000000000000001 R09: ffffed100d4a67bd [ 54.721432][ C1] R10: ffff88806a533deb R11: 0000000000000001 R12: 0000000000000000 [ 54.723883][ C1] R13: 0000000000000000 R14: 1ffff92000030fc4 R15: dffffc0000000000 [ 54.727011][ C1] ? ct_kernel_exit+0x125/0x180 [ 54.729063][ C1] default_idle+0x9/0x10 [ 54.730808][ C1] default_idle_call+0x6c/0xb0 [ 54.732689][ C1] do_idle+0x3ae/0x5b0 [ 54.734213][ C1] ? __pfx_do_idle+0x10/0x10 [ 54.736168][ C1] ? rcu_is_watching+0x13/0xc0 [ 54.738152][ C1] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 54.740515][ C1] ? lockdep_hardirqs_on+0x7d/0x110 [ 54.742533][ C1] cpu_startup_entry+0x4f/0x60 [ 54.744572][ C1] start_secondary+0x21d/0x2d0 [ 54.746481][ C1] ? __pfx_start_secondary+0x10/0x10 [ 54.748187][ C1] common_startup_64+0x13e/0x158 [ 54.750031][ C1] [ 54.751124][ C1] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 54.754052][ C1] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted syzkaller #0 PREEMPT(full) [ 54.757736][ C1] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 54.761338][ C1] Call Trace: [ 54.762432][ C1] [ 54.763384][ C1] dump_stack_lvl+0x100/0x190 [ 54.765345][ C1] vpanic+0x553/0x970 [ 54.767016][ C1] ? __pfx_vpanic+0x10/0x10 [ 54.768945][ C1] panic+0xd1/0xe0 [ 54.770543][ C1] ? __pfx_panic+0x10/0x10 [ 54.772442][ C1] check_panic_on_warn.cold+0x19/0x34 [ 54.774573][ C1] ? usb_ep_enable+0x3e6/0x490 [ 54.776588][ C1] __warn.cold+0x191/0x318 [ 54.778451][ C1] __report_bug+0x30f/0x440 [ 54.780381][ C1] ? usb_ep_enable+0x3e6/0x490 [ 54.782429][ C1] ? __pfx___report_bug+0x10/0x10 [ 54.784516][ C1] ? try_to_wake_up+0x158/0x1c90 [ 54.786576][ C1] report_bug_entry+0xe2/0x290 [ 54.788600][ C1] ? usb_ep_enable+0x3f8/0x490 [ 54.790568][ C1] handle_bug+0x1cd/0x2a0 [ 54.792415][ C1] exc_invalid_op+0x17/0x50 [ 54.794191][ C1] asm_exc_invalid_op+0x1a/0x20 [ 54.796252][ C1] RIP: 0010:usb_ep_enable+0x3f8/0x490 [ 54.798461][ C1] Code: 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 93 00 00 00 48 8d 3d 2a 07 74 09 48 8b 4b 08 40 0f b6 d5 4d 89 e0 48 c7 c6 c0 12 da 8c <67> 48 0f b9 3a bd ea ff ff ff e9 8e fd ff ff 49 c7 c4 60 05 da 8c [ 54.806131][ C1] RSP: 0018:ffffc900006b0a00 EFLAGS: 00010046 [ 54.808589][ C1] RAX: dffffc0000000000 RBX: ffff88802bb140e0 RCX: ffffffff8cda4960 [ 54.811712][ C1] RDX: 0000000000000081 RSI: ffffffff8cda12c0 RDI: ffffffff9152a610 [ 54.814804][ C1] RBP: 0000000000000081 R08: ffffffff8cda05a0 R09: 0000000000000000 [ 54.818093][ C1] R10: 0000000000000000 R11: 0000000000000001 R12: ffffffff8cda05a0 [ 54.821244][ C1] R13: 0000000000000000 R14: ffff88802bb140e0 R15: ffff88805a2d0998 [ 54.824480][ C1] hidg_set_alt+0x190/0xa10 [ 54.826323][ C1] ? do_raw_spin_unlock+0x145/0x1e0 [ 54.828447][ C1] ? rcu_is_watching+0x13/0xc0 [ 54.830372][ C1] composite_setup+0x2ccf/0x9290 [ 54.832399][ C1] ? __lock_acquire+0x5c0/0x1f40 [ 54.834436][ C1] ? __pfx_composite_setup+0x10/0x10 [ 54.836606][ C1] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 54.838803][ C1] ? do_raw_spin_lock+0x128/0x260 [ 54.840817][ C1] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 54.842924][ C1] ? configfs_composite_setup+0xfb/0x130 [ 54.845068][ C1] configfs_composite_setup+0xfb/0x130 [ 54.847186][ C1] dummy_timer+0x2039/0x3700 [ 54.849099][ C1] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 54.851439][ C1] ? debug_object_deactivate+0x2e4/0x3b0 [ 54.853705][ C1] ? __pfx_dummy_timer+0x10/0x10 [ 54.855672][ C1] ? rcu_is_watching+0x13/0xc0 [ 54.857645][ C1] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 54.859962][ C1] ? __pfx_dummy_timer+0x10/0x10 [ 54.862067][ C1] __hrtimer_run_queues+0x462/0x9c0 [ 54.864160][ C1] hrtimer_run_softirq+0x1ca/0x360 [ 54.866234][ C1] handle_softirqs+0x1e6/0x9d0 [ 54.868229][ C1] ? __pfx_handle_softirqs+0x10/0x10 [ 54.870340][ C1] ? _raw_spin_unlock+0x28/0x50 [ 54.872287][ C1] ? __hrtimer_rearm_deferred+0x9b/0x7b0 [ 54.874617][ C1] __irq_exit_rcu+0x16a/0x210 [ 54.876464][ C1] irq_exit_rcu+0x9/0x30 [ 54.878154][ C1] sysvec_apic_timer_interrupt+0xa3/0xc0 [ 54.880380][ C1] [ 54.881617][ C1] [ 54.882869][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 54.885256][ C1] RIP: 0010:pv_native_safe_halt+0xf/0x20 [ 54.887565][ C1] Code: 27 94 02 e9 43 50 03 00 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa eb 07 0f 00 2d 03 28 1a 00 fb f4 cc cc cc cc 66 2e 0f 1f 84 00 00 00 00 00 66 90 90 90 90 90 90 [ 54.895044][ C1] RSP: 0018:ffffc90000187e00 EFLAGS: 00000206 [ 54.897426][ C1] RAX: 0000000000058895 RBX: ffff88801f69cb00 RCX: ffffffff8bd191c5 [ 54.900542][ C1] RDX: 0000000000000001 RSI: ffffffff8e38d191 RDI: ffffffff8c623580 [ 54.903658][ C1] RBP: ffffed1003ed3960 R08: 0000000000000001 R09: ffffed100d4a67bd [ 54.906801][ C1] R10: ffff88806a533deb R11: 0000000000000001 R12: 0000000000000000 [ 54.909959][ C1] R13: 0000000000000000 R14: 1ffff92000030fc4 R15: dffffc0000000000 [ 54.913118][ C1] ? ct_kernel_exit+0x125/0x180 [ 54.915142][ C1] default_idle+0x9/0x10 [ 54.916868][ C1] default_idle_call+0x6c/0xb0 [ 54.918922][ C1] do_idle+0x3ae/0x5b0 [ 54.920640][ C1] ? __pfx_do_idle+0x10/0x10 [ 54.922584][ C1] ? rcu_is_watching+0x13/0xc0 [ 54.924699][ C1] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 54.927062][ C1] ? lockdep_hardirqs_on+0x7d/0x110 [ 54.929165][ C1] cpu_startup_entry+0x4f/0x60 [ 54.931155][ C1] start_secondary+0x21d/0x2d0 [ 54.933171][ C1] ? __pfx_start_secondary+0x10/0x10 [ 54.935382][ C1] common_startup_64+0x13e/0x158 [ 54.937458][ C1] [ 54.939391][ C1] Kernel Offset: disabled [ 54.941071][ C1] Rebooting in 86400 seconds..