last executing test programs: 3.805250185s ago: executing program 1 (id=390): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) close(0xffffffffffffffff) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x321101, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) socket$inet_icmp(0x2, 0x2, 0x1) socket$packet(0x11, 0x2, 0x300) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$netlink(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000300)={0x20, 0x13, 0x821, 0x0, 0x0, "", [@typed={0x8, 0x0, 0x0, 0x0, @fd=r3}, @typed={0x6, 0x0, 0x0, 0x0, @str='!\xa5'}]}, 0x20}], 0x1}, 0x0) 3.681521307s ago: executing program 1 (id=393): setsockopt$sock_timeval(0xffffffffffffffff, 0x1, 0x43, &(0x7f00000001c0)={0x0, 0xea60}, 0xfffffffffffffcf4) (async, rerun: 32) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000440)=ANY=[@ANYBLOB="7f454c4601098700810000000000010402dd64e81d3e9a5c5546f4f868003e00f9ffffff6b0000000000000040000000000000000601000000000000030023300500380002007800070000000400000009000000010000000000000044020000000000000800860000000000060000000000000000000000e251e574640100000001000000000000000600000000000000090000000000000001000000800c5de507080000000000000600000000000000000000000000000000feff4da3cf01cb0a", @ANYRES8], 0xb0) (async, rerun: 32) lsetxattr$security_capability(&(0x7f0000002580)='./file0\x00', &(0x7f00000025c0), 0x0, 0x0, 0x0) (async) close(0xffffffffffffffff) (async) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000200)={0x0, 0x0, 0xe000, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000100)={'ip6gre0\x00', &(0x7f0000000740)={'ip6_vti0\x00', 0x0, 0x0, 0x0, 0x0, 0x20005c8c, 0x26, @remote, @private0={0xfc, 0x0, '\x00', 0x1}, 0x80, 0x700, 0x0, 0x20000000}}) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000005c0), 0x121000, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) (async) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x2001c0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x2) ioctl$KVM_SET_SIGNAL_MASK(r6, 0x4004ae8b, &(0x7f0000000040)={0x8, "a529984655f7624f"}) r7 = syz_kvm_setup_syzos_vm$x86(r3, &(0x7f0000c00000/0x400000)=nil) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000600)={0xc, 0x0, 0xfec00000, 0x0, &(0x7f0000000000/0x1000)=nil}) (async) r8 = syz_kvm_add_vcpu$x86(r7, &(0x7f0000000640)={0x0, &(0x7f0000000680)=[@code={0xa, 0x18, {"b80000c0fe3acb80"}}], 0xd3}) r9 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x48241, 0x0) ioctl$TUNSETIFF(r9, 0x400454ca, &(0x7f00000002c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) (async) r10 = socket$unix(0x1, 0x3, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r10, 0x8914, &(0x7f00000006c0)={'syzkaller1\x00', 0x1}) (async, rerun: 64) write$tun(r9, &(0x7f0000000700)={@val={0x70}, @void, @eth={@broadcast, @remote, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0xb, 0x28, 0x64, 0x0, 0x9, 0x6, 0x0, @remote, @broadcast}, {{0x4e23, 0x4e21, 0x41424344, 0x41424344, 0x1, 0x0, 0x5, 0x20, 0x0, 0x0, 0x2}}}}}}}, 0x3a) (rerun: 64) ioctl$KVM_RUN(r8, 0xae80, 0x0) r11 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) r12 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r12) ptrace$setregs(0xd, r12, 0x0, &(0x7f0000000340)="18607651149d7b10b4024fbbdc08899b8f589df2dbb5d7a8d1b36cfab675cb3976ee8100e2878c9cfa178cac130eb046eda93df39ed4b41924dc225ad4028dd63defb87d698be5c749450b350a789dcfc6b2d6a696b5026d1e52f19274566d1da0f353dd65e330ebf71c5e823f2753c5fd76724828ef31b353e71805205c3dceb44cc4c7b3664e29fb") (async, rerun: 32) ptrace$getregset(0x4204, r12, 0x200, &(0x7f0000000400)={0x0}) (async, rerun: 32) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r11, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000240)=[@textreal={0x8, &(0x7f0000000300)="660f3a0b0204b8ff0f8ee80f413d650f06f464f031b90048f40f01f3660f3804d3660fc737", 0x25}], 0x1, 0x43, 0x0, 0x0) 3.257406781s ago: executing program 1 (id=394): r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000003c0), 0x0, 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x1) r1 = add_key$keyring(&(0x7f0000000040), &(0x7f0000000080)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffe) getgroups(0x2, &(0x7f00000000c0)=[0xee01, 0xffffffffffffffff]) (async) getgroups(0x2, &(0x7f00000000c0)=[0xee01, 0xffffffffffffffff]) setgroups(0x0, 0x0) socket$inet(0x2, 0x1, 0x0) (async) r3 = socket$inet(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x2e, &(0x7f0000000240), 0x2c) (async) setsockopt$inet_tcp_int(r3, 0x6, 0x2e, &(0x7f0000000240), 0x2c) setsockopt$inet_opts(r3, 0x0, 0x4, &(0x7f0000000480)="8907040400", 0x5) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f00000004c0)='bridge0\x00', 0x10) (async) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f00000004c0)='bridge0\x00', 0x10) connect$inet(r3, &(0x7f0000000500)={0x2, 0x4e2c, @multicast1}, 0x10) (async) connect$inet(r3, &(0x7f0000000500)={0x2, 0x4e2c, @multicast1}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r3, 0x6, 0x13, &(0x7f0000000540), 0x4) keyctl$chown(0x4, r1, 0xee01, r2) openat$random(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) (async) r4 = openat$random(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) fsetxattr$security_selinux(r4, &(0x7f0000000380), &(0x7f0000000400)='system_u:object_r:hald_exec_t:s0\x00', 0x21, 0x2) keyctl$setperm(0x5, r1, 0x30925) r5 = openat$kvm(0x0, &(0x7f0000000100), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = syz_kvm_setup_syzos_vm$x86(r6, &(0x7f0000c00000/0x400000)=nil) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000140)={0x2710, 0x0, 0xf0000000, 0x2000, &(0x7f0000f67000/0x2000)=nil}) (async) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000140)={0x2710, 0x0, 0xf0000000, 0x2000, &(0x7f0000f67000/0x2000)=nil}) gettid() (async) r8 = gettid() timer_create(0x0, &(0x7f0000000280)={0x0, 0x21, 0x800000000004, @tid=r8}, &(0x7f00000005c0)) (async) timer_create(0x0, &(0x7f0000000280)={0x0, 0x21, 0x800000000004, @tid=r8}, &(0x7f00000005c0)=0x0) timer_settime(r9, 0x1, &(0x7f0000000600)={{0x0, 0x989680}, {0x0, 0x3938700}}, 0x0) r10 = syz_create_resource$futex(&(0x7f0000000640)=0x1) r11 = syz_create_resource$futex(&(0x7f0000000680)=0x1) futex(r11, 0xb, 0x1, 0x0, r10, 0x403) futex(r11, 0xc, 0x1, 0x0, r10, 0x1) futex(0x0, 0x80, 0x2, 0x0, r11, 0x2) r12 = syz_kvm_add_vcpu$x86(r7, &(0x7f0000000180)={0x0, &(0x7f00000001c0)=[@enable_nested={0x12c, 0x18}, @nested_create_vm={0x12d, 0x18}, @nested_vmlaunch={0x12f, 0x18}], 0x48}) ioctl$KVM_RUN(r12, 0xae80, 0x0) (async) ioctl$KVM_RUN(r12, 0xae80, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) 3.182317938s ago: executing program 0 (id=395): r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) openat$pfkey(0xffffffffffffff9c, &(0x7f00000003c0), 0x8800, 0x0) close(r0) r1 = accept4$vsock_stream(r0, &(0x7f0000000040)={0x28, 0x0, 0x0, @host}, 0x10, 0x100000) connect$vsock_stream(r1, &(0x7f0000000080)={0x28, 0x0, 0x2710, @hyper}, 0x10) 3.181818098s ago: executing program 0 (id=396): io_setup(0x2, &(0x7f0000000000)=0x0) io_destroy(r0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x8082, 0x0) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r1, 0xc0c89425, &(0x7f00000001c0)={"d0a4994fa524388e9e41cb033186cdbc", 0x0, 0x0, {0x8001, 0x10}, {0x5, 0xff}, 0x1, [0x4, 0x9c2, 0x0, 0xd, 0x2, 0x6, 0xac5, 0x3, 0x80000000, 0x7, 0x80000001, 0x8, 0x0, 0x28, 0x8, 0x9]}) ioctl$BTRFS_IOC_SNAP_DESTROY_V2(r1, 0x5000943f, &(0x7f0000000740)={{r1}, r2, 0x0, @unused=[0x10000, 0x4, 0x2, 0x4], @name="2dcef93472cd2387a02d71cf237b55acf5aa9d0b6d55f136bccc18d29c2a6d2a2c188f4a43399db9639d347129c1cf7ba0b3bb0ed8c083768e60ee6e4a292b9fdb79b5f777d1c90a98fce7454afa28cfcf76c6912d636e016e5b51b8da1316764ca16446135b7c3a1bef83f67027efbc9f93a15a81383e1790a8dee605e62fa8c25dd4a14b6d36eda69968746ebbafaab8103609067c0cdf8cc4e47ec41308678df753fe4008064421f63b524223b8dc7ed909e3877c50f5966dafe7c8da856de0c7bbc142f908f7653c889cf0e81ba00599ed5712689c908004e417acb404617b2377ac7c6d02c0b2408a43900e95bad2e96fb00c70d1f4e8725e3ac3c583817bc6191f603e4b85f521bda1563fd653e59dd097da74f3a862fed5d21b900242f90a170fca9c69775f362a585f34196530834b80a3a307c580f65c48de1fec619c2560079b11acfd85e4609dd23aa610cf0a88d4b84215f0b31d672c0d022db590806ca2f40ea72dcaa553402a3e85cdf4cf29fc586c4af6d099e0be9cfd778205a62d6e64bc30cea55c46918fc53a8bc41496dd2d54f249ce051f1144e2aaba668af43c5800ad862cec56715f54fa3c0ffdfd0288175fdb6237d9222afd8733c6cda061b42c169f9bbba53e860aa6889e669578b9e9943f2ecfc21d4a2933f920faf5bfb5721aa09fbd181e8cc09d7c2a289e19583a721dd316bdb89edfa3c60f60d6a8660b064ef408d0a9d249a7cd4de241734bcebdf9e0d7964faf0d10bee6bf00fbfa08e74144b9452ecbaffa38880485b3385bf42700c0e8e0ba4974fd47d0214263bc6b10ebf0dcf2882a447ad5fd861812ccc97593f6f980ef3424d3dec93efba2dbc9b51d24ed8ba862ae23602e8bdaf7e54463fae278f06b9769b1e584196c36f625ae93050b0a806b781836c0b5062fe733bf2e94cb90bbba641604790c0eaff75f8a45b64b6a0c6cb17a312d1c22a0c7021be27ea5318476cb46de7444105e04527acbe62e494a1aba26c668282199f343a6487aa1aa24b5b368e57208e0e5efd63ad8964331d9f9d4eb0a5604fc3bc152a764833cdc3195272a747d26de225e7f94140f69ffdc57bc229f18445d24b7019dbba4f0998358b7879509a3836d54c5223569738738caae1658d41712649698684629d0f1e2cf10765bffb102213b1ca7688a0379ef500347e7b7802db335b154824a2b9fb80babbf41ef1de6565d51be96519850bfc5870970ae61196f95842cb3f3f6081caaa4a72e783e5677605da399243ad72485fd9a353005bd0f3dbca6a4f04eea2a6dcd153e96c85017dbe5b8a38f319dcb61cb33208d4ec450c4e712a8ade2586c3a2242fb9ecf103047f5ccc135bfcf700943c01607719d7da8fb2214aca4ca46c19dbfccf4d78cdecac1e8038e0c316f5f40787c7c503635d839a440f8a8871384b43b76ff935dfde8487e93bbf59b312bd137287180aef5813ae1cbed3193fd638a82f03f7af9893a569d5861e276a429e155ee2a825d6d0194f3f1f887bdb06cc4ce104e93cc857e3638265e475db27f4c3b9ef919093c9459efbd2543a259921613a8bd5fe639ba84a55d53f3fee960d8f9a1826368b5135631962da1485ed0846ec871aa5b2157d6c8e5f921c2b716e32cacb42b77b16c885d648205f5219982456a5673697a7b4da89680e3d6146fe8a213c4afda1ce15079af9d0f21d2ef34aafd5f88f0a01979053695398aba1b5d83708678c6f675aaefae39252a67d9bb29452f74a793a3578f2820b62536bedad38082fa06741189ef7dce1ec7ecd37645f2888aff2d94627f5b8b62b5f4c5fee56893213324ff042afd38ec7911fd72b0ab6c82dfb347fc05c8f9367baeb78951eb186113eccde19f18fa0b072b5892c7c8f70b674c433c6c8a342a60b78557ce24154bce8ed7259bbc623b78f2daaac0b9c4d83c67bc286dff262420f915b5b52bed1b839e3b58404a4ded7656a0e76e024506d0bd7a368c9b09b4d9120ce6dd42df830ef1babf1df1b5eb0492c88c3e2c5db64db2cd13f0e868fbf44524e169fcea84279e2bcfd0f2c2209be2c02e299130ab05386ea0e7cb48eecee659f8a4585e79f78524452df82c9e55355fc28bfbafddf02753194414e8114ab06573f0594aed83e44f49fb7f760ae19203d4186a48d311e25aca2d7eaf6ce928b70797d3404ddbc315a70b2c3de4cfef1707fa8338a4527b19cbc560bc085d8355bd88b71c090088af6a10b16cc47c3d4b775645c2a53fdeadb5e42d242b7b676cd10e43192d404086e87c6432bc3de46bc0ceceb87248b7d656b956b1fe6ca4c312d2323a73cebda19df45a31ba22838498a6f5a5e6a5bef5d9b1a12cc392a037f6d69884a273d1516e278522c76546d7dbf62bd5ab088d27f3e57b38129d83de032b384667f3e10cbdd1162c0a54875c3789265bd1bde222d12c23e5c00afbbbb9d0acf49960198ea036146c904c9e6bc7c01603b99a4e5ced2a261aee566c188b6f4027268e5cafb17dc719de32e432aadd47cdb367ff31f7e07c624d1f507aa6e7dc1923f0f333d37aca8dd03ed95c6104f75b30eef43d1bdda166c89fea4d9b7880fcfe9ac726097aff86e770363f7e03b82cc39ca3df3e93306892fa3b181ef8d83fc91951689c33b34ceb174eddb2c396ce195bd5a2054308c7e7b103e3512962efeb9648bb0153f2432b106a1674bd3fb5192716baa765ee91ac68d90dd584be56b9d272a094f2abac34efea32febfcda3ecefb70ebef85caf837eea9ea6000c77a43ae0b2c2af48b6b104782e9fbcef1182ceaf0a79bcf83b4c046a3c12637741de6ff93a621b7a115c16aae329bc16b3c556db4f1b3b3fc846a359854809a09911aa550e79dfdf111e801ef957b8ccf674d95c70a099e5c20e2457c69ca6c8cbf55292cf01eaa29dfe30e07fa43717881f5b5e931a9ec2b95cb798d101ba627053b6123a6a140a3fbbfefeadd996275dec26eee16a1e6311d197d6a92fd74da5b0a8eceddabd0a3b4925fe10308841ab51ab741c951be2203614cf56758504e4a9dd717cae3281ed97d7c80addd561064267af14816110fba0af65289f2cda48b5a1d681ca58d2b20deab351641a47649697802784c216d7279b5cbc4142d9fbe42c75a08a232b18ed67eaaa6c74b87ec05c10366c1961472355c88a01d1f662e040704dfed4edb35dd08802e207095de79d64d2eb03483da3fc4ea1b9c240b92696a84a77a15d072e8c7a357c74df4ca29ed248f4f518f2afa25f222490fe33ea56e51a42b6c5f01795808f50c3019a89d77463fb25cf62a7faeb9950502cb1e839eafec92e0b5305fb225f9217bd1c0ba2120064912ef89527178a1c19be4dec49d69f5e31374144b5ca808777a5000cafd9e4cd5620585b9aa0a4f70da2649b44de479660a8b25e0f71315a6ce134d29e1a8c5a4f98498c822464825ed15fa00a8db98e81e7f76cd6eee32b57589ee459801415fbc165ad4902d2493d5a107ee8001c5b380e02ef76780e7fd811f257b9cf7be393ea13c9f04b3cd3ce64a414081811895f5c8c578d6c3c4840870f89f7fa18b3ec659a1b37de5d87a15ec230593df9c497b07c2c8e2f4d6087652da8dea46643d351e086182a213588eb8486825195f73dacc9f628d1fedf13a2800299605fd73bf212f482d193f3c705e00a8211d77f75372c7952de15556603f108c489063909f751f65f806b6933b1cfc660b08bdf44a24d79b4206e42e90f322749ba763944f445659b7b662650429a539f7edbce70f41f883b1944dc0f95c1c0fad7f9e659190569f7e172ebbddc34eae5d885a0648e54478b2ffdfba9bcbe868eebf7d7f192b88f42801ebb78fd0846d1465ad11f370a8aac59335b8ae9abbcf20495373d584516bfcced9483bcbacfc8367dad658082ea92fb291135d5a60bc41c9973995afc3bbcb50b6823883cb16078c471869f7385cf884278ce06f55ab081c2bbdb6fd817884a71903a82495a1e7e2f896eeb3f4871c39795ee06ace097b8beae5884cf1fbfb3d2d0d57682c073e75e34c4ee4fe27d85b49bfc25ec7e6f55fddbc7b3db28c8f397d796202a88b00e00a7971025de7194fcdf497f546e99a8a481f73652efd9d744ff401cf9890d63fc2dff350cdbe62bcb2928ebcb71c8037a019ed29b1a74d56a9409c07efbaaf8a127f1ac1f008c57748aa9d9e8d6fde53d16cf5d247b5f154c16b9f7a8075c2e4a290f32d66e59c30895607909b720b514b1f27793a42a505140fdef85f09b399af6e0f0b75587f0275a75b88e59ea5490cc46ae0c040ef77d88e39576b0987dab1a5a91c7d32a9fe063c1c26d9631748ec032eb4cbd87a1d180d3de84dd5acddcfacade5e4e9097ca49a12cd903299962c27481b53094ad9766f9921ab4f9a8421d0be5db5d8cfcfc1357e50079ba8b9a4b995f0986c0db0c56f9bf5545bb681a948c43e06a5815541f3dc4c9082d1751d3f978973d0992c985cbce06d6bf2e9fe22dc12d7bc1d8b658a1c11f93e96c3a371f112a8eac7a1e932f09f54e839f82f039ca4cedf8892bd098fac94284b032ab1f43a37e80f7c0a73c78a0488789c582b91cd7d99ccd573526ec1ef1c2d3678e1d559872eabfea58d7fbcca935fc8484a61200cfbe6e2d60d6bfaf7fc89420f40fe559ae37fadce537a9a373326ff5f45b9af697340cf22644a21b049b90559cad13200954485a5960c9083fdc8c46adf83c75f816bbfc5c697f9b76e1f00519530ff51d1b7e2c4d055cfca23aa747c743f66c482bbdbfcc3ba09ddfd1921bdc780721981298651f9c949660f27ffc20ea0de4d90e0354da5cef1a06c67e24f603645a69b4c9a58ea2871ee7875ca0c0bf38c00801a128b78b77ae9d8f7ddcf866fde0ed2e94a98ccf2381927a48a0ff266ff4a71361151ab81b8864a4807b49a314f314e19061c2f1c28379518458cabc442215127dd70a2790e639f02c0abcb90c0cb0b0e1cd98521f752b55bf0166c429307f9db6e91243a36d94acb0fd2257412c74a52803362155ba597869bc11a02ee6e505ab8585bf1f80a0596f86c551801655ad8122ab1eedaa7733e5b964cf848279cd5cddbbd26a8029f4f13e39258be1a04967fcf94bee6f37b07ce6e5090a657d0e43d8a10694b5e6f7cb748d7650fb7a3fa845a361b150365d7cad766d3fdb4b37f3fb26e1092ac8d580402e0c37ca6c7ae08327b9e1cc74d3a278efd462b2eb007f1347bb7c8a4881ea1f1542756854b69807224aa62ca746d29be7de425a6cea2aa70071d09d3c1e14933a5f30f5b4831fb70fd90e6043cdbf14078d837e4c2a36af9f86bacbb091a358514253822ba8dc02a3d82e67a667900e387ee787ce89663a6e5972b35f988ff62178eeb8ddf9bb49191c39f2f0342ea036eda32f24fed0f99b31ea983e0aab15dc5544ad67dcc653c1fe5f6707291ef13fe2295ab22305b648983cdf6c4b9a74d7b968f66c39b7b5b4b69f13b6257976e44b255ba00e76c8d2b9fa6d37cbd170f5cb63b89c77ea280f4ba908e756ecbfd0286de8308732cf8a457cb6ecc6b2185b8a8e492f93924c5cefea4807541b2e386b812fe028763deca65458ae65d8bccbfec980ce692dcd19a3b71ec5f0c8b2620caebd9412756543c2e885fd3a62ae14efffda6c044f49439508308fbb1a357e47440904b8d7fa14fef31427c2f2b5186b"}) (async) r3 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x2) (async) ioctl$KVM_CLEAR_DIRTY_LOG(0xffffffffffffffff, 0xc018aec0, &(0x7f0000000040)={0x10200, 0x100, 0x240, &(0x7f0000000340)=[0x1, 0xfffffffffffffffd, 0x3, 0x80, 0xffff, 0x101, 0xfffffffffffffffa, 0x2, 0x8, 0x2, 0xb, 0x700000000000000, 0x6, 0xffff, 0xfffffffffffffffb, 0x7, 0x7fffffff, 0x5, 0x26, 0x2, 0x1, 0x6, 0x8, 0x2, 0x4, 0x20000000009, 0x401, 0x9, 0x3, 0x0, 0x4, 0x5, 0x200000000000005, 0x4002, 0x8, 0x43, 0xfffffffffffffff5, 0x7, 0x7fffffff, 0x7d, 0x0, 0x4, 0x20008, 0x2e2, 0x3, 0x6, 0x8000000000000005, 0x80000000, 0x2000100000000, 0xfffffffff7fffffd, 0x8, 0x1000009, 0x7fff, 0xec, 0x8000000000000000, 0x4, 0x94f, 0x7, 0x7fffffffffffffff, 0xa, 0xfffffffffffffffe, 0xd, 0x11, 0x6, 0x5, 0xa8, 0x1, 0x2000000000000007, 0x7fffffffffffffff, 0x38c, 0x2, 0x7, 0x8, 0x44, 0xffffffffffff8001, 0x6, 0x355, 0xdac, 0xe94, 0x7, 0x4c5d, 0xa7, 0xba00, 0x2, 0x7ff, 0x8, 0x1, 0x7, 0x4, 0xffffffffffffffff, 0xfffff7fffffffffc, 0x80000001, 0x2005, 0x21, 0xfffffffffffffbff, 0xfffffffffffffffd, 0x10000, 0x3, 0x1e4b, 0xbd, 0x79, 0x10, 0xfffe, 0x2, 0x10000000002, 0x3, 0x7, 0xfffffffffffffff9, 0x0, 0x1, 0xa, 0x6518, 0x8, 0x2, 0x100000001, 0x80, 0x3, 0xd, 0x4, 0xb, 0x9, 0x1, 0x10, 0x58, 0x2, 0x1, 0xea7, 0x1]}) ioctl$KVM_SET_CPUID2(r4, 0x4008ae90, &(0x7f00000000c0)={0x29}) 3.124261184s ago: executing program 0 (id=398): r0 = socket$netlink(0x10, 0x3, 0x0) (async, rerun: 64) newfstatat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0}, 0x400) (async, rerun: 64) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x31, 0x0, 0x0) (async) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x10004004, 0x0, 0x0) (async, rerun: 64) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) (async, rerun: 64) r2 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, 0x0) (async, rerun: 64) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, 0x0) (async, rerun: 64) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqn(r3, 0x0, 0x27, &(0x7f0000000ec0)={@multicast2, @loopback}, 0xc) r4 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r4, 0x8914, &(0x7f0000000f00)={'lo\x00'}) (async, rerun: 64) r5 = socket$inet(0x2, 0x2, 0x0) (rerun: 64) setsockopt$inet_mreqn(r5, 0x0, 0x23, &(0x7f0000000f40)={@multicast2, @loopback}, 0x64) (async) setsockopt$inet_msfilter(r5, 0x0, 0x29, &(0x7f0000000f80)=ANY=[@ANYBLOB="e00000027f0000010000000003"], 0x1c) (async) close(r3) r6 = syz_open_procfs$pagemap(0xffffffffffffffff, &(0x7f0000000240)) (async) r7 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) process_vm_writev(r7, &(0x7f00000003c0)=[{&(0x7f0000000400)=""/152, 0x98}], 0x1, &(0x7f00000004c0)=[{&(0x7f0000000500)=""/189, 0xbd}], 0x1, 0x0) pipe2$9p(&(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) (async) r10 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_int(r10, 0x29, 0x8, 0x0, &(0x7f0000000e80)) (async) fstat(r8, &(0x7f0000000e00)={0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$netlink(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000000)={0x38, 0x15, 0x100, 0x70bd26, 0x25dfdbfe, "", [@generic="b6dae648554d858584e375a0ff0ba8742f08094ccff8bdcb933257f16d1da45501ce6f0cbc6a"]}, 0x38}, {&(0x7f0000000140)={0xec, 0x2b, 0x400, 0x70bd2b, 0x25dfdbfe, "", [@typed={0x8, 0xe, 0x0, 0x0, @ipv4=@rand_addr=0x64010100}, @nested={0xd4, 0x13d, 0x0, 0x1, [@typed={0x8, 0x10b, 0x0, 0x0, @uid=r11}, @typed={0x4, 0x154}, @typed={0x8, 0x105, 0x0, 0x0, @uid=r1}, @typed={0xbb, 0x628, 0x0, 0x0, @binary="4ceaefc1915699847c15927a99219cc2103b53b23e982b30e243b4073669aad2712f51e9106a9ef2a496064eabd8818c9719b027da4655a35dbcd177ed8ad194763a45618b89e0858bc9953ea5c66d98b43e70132a83f3d606a02d482ff0a944a7f52565d4645448ffb2ece876abefca303b287725b2aa070acfed5970bea2ecf73031befcf8f9e720665d9dc6cffb93fbbd2be7c304697414fff110341eff2141d7a867665db66e3f3ab040c554503be3a665a012af20"}]}]}, 0xec}, {&(0x7f0000000280)={0x13c, 0x39, 0x8, 0x70bd2a, 0x25dfdbfc, "", [@generic="25f7bde2eaca35af04b29d3cba32d483c55e2f28f04a257bb440f2", @nested={0x18, 0x26, 0x0, 0x1, [@typed={0x8, 0x145, 0x0, 0x0, @str='!@]\x00'}, @nested={0x4, 0x4}, @typed={0x8, 0x1b, 0x0, 0x0, @fd=r6}]}, @nested={0x8, 0xc8, 0x0, 0x1, [@nested={0x4, 0x1e}]}, @generic="6955df2d28556736cf9d6cec04aab66ec1147b4d5ccfb3b5c271aa67086af2828a5dc54c01294e1692907d5f184ceb7b63f5aa3a64c272cd9b0628d42d9d003853e4fb1ab0d64d5bc4a27dc545a9d6dd66aae2016a90cec57944b5fc2820fdb4ebe33a51b5dbb04c", @generic="44ecf33498cf7bb33b98340319a95adfe72fc265e93182bbdbe38daa86f643e09f5c5caded7fe807b5a30c0135b728517153d14e73203179c84a0faf7d1f6a4bdb554a89af1e5f90b72b94c6d9fb55f95b8fe18763f618469397fca3d24fe6365679d7792665e00618be265dfbbad448c5913e57ddb05068ad3169c981686441", @typed={0x8, 0x124, 0x0, 0x0, @fd=r0}]}, 0x13c}, {&(0x7f0000000600)=ANY=[@ANYBLOB="7c000000380000022bbd7000fddbdf253400678008005e00008011000800d100", @ANYRES32=r7, @ANYBLOB="040040800400358008003800", @ANYRES32=r9, @ANYBLOB="08000400080000000800df00ac1414bb0d00580077817c8af745dc3ade0000000c00c000706167656d617000d7f4636722c942b3b12face17ed3e918010900929dbe1c86df000000"], 0x7c}, {&(0x7f0000000680)={0x120, 0x16, 0x20, 0x70bd2a, 0x2, "", [@generic="1bf73a9e44cd6074203a6893999e1db67a4e6f890292ec9260b70941e8fe185e8e2ec13768dfe913a70a8cb94fcc2122a33760451393c5fbda4a911ff2414955e7d004c9d7358ed544a38be2cd1ea75f347224963c56b5cf1bb22fd5df690e605c34e66e0d11647847961a5e3655a0c347", @nested={0xc, 0xe9, 0x0, 0x1, [@nested={0x4, 0xb1}, @nested={0x4, 0x41}]}, @generic="4b527b7a5d75152b971b8f2ad2a9a3e883c7078c49efde807519f49464", @generic="804642a2f215265dd6bc2e4e0e62af9942829af0186aee6de4841a9b114f9b69900bfdc3797eafb2c1969de4b1f10cdf296f13a3c7425195f2880cb34bdfe91e8167a6d7e13206e7ca800075e0c9a86a9b84cd3e4e33c306c2530364201b2d3506fcce7d503af726529ffbdc74f9aa005a0d9a3e7d"]}, 0x120}, {&(0x7f00000007c0)={0x3ac, 0x15, 0x800, 0x70bd28, 0x550, "", [@nested={0x216, 0x12f, 0x0, 0x1, [@typed={0xc, 0xad, 0x0, 0x0, @u64=0x7ff}, @typed={0xe1, 0x158, 0x0, 0x0, @binary="e5e1509b9b15a3b64d4cc69b1fa1a77654d042e3e79df6309505528e89776aafdbb46076381a379bcd28aae505b7b085f3a1936e3f66ab3dd945fefe21b28d775c859e46b97765351ad9d2659b519e6c988075c2cd9979ebe6ad4d504284d7947f14064789a471f25153361926ed946b0adeb883c0267ea4186bef02018c51abc353fa988e2f73a02a1b58452c87e861a0fef19d1dbd6ce46851c0016ba8cb0ee84cf130cbbe59804e676cdb58838350ff48af80acfc1b76fa3cb8fdd8628c48be779379139da81f49df1d85f35a083e15ea70287b0ee0e152fb272369"}, @generic="af7736347274c3bfd73b11a929093ff5a4272aba5bbe502fc058d12f2b97f4ff08b8c011dc8a18bfc43a7a33ace8719b9f68bd3847eeae91d92fe49d81c1e6ef342530f3dd0199ce29c3184daf5366962e94e0796c0ef2bfe73cba87cb38237672d74dc70771bfb30b10862bd50d76e3d49b5a3aac9fc996a314f81129fa8d91", @generic="a6b9f9a4f6091963d8f5be70f8de96b130218e5e2f4519c10ae0bd855815f9d55216c0a795c2aba475d572cbdf43886cafe9ba1eb0bc07cafd68a7e2a0e3b3431b43a096a0cf641a420e91823d0a9ab92b3d0468037d2bf4ed135bfd0b29fe5cafdd0c972069efe442b5b8d21a5bbc65329ba856926964dd798aa6bbc1515a82f6aa61537008ed119a3b2db9bbcfe23b3df7", @nested={0x4, 0x4b}, @typed={0x8, 0x126, 0x0, 0x0, @pid=r7}, @nested={0x4, 0x2f}]}, @generic="480c1ee2c6540a1a8682dff77cad7cfe9307805ecce724115eefa432754f5a12cbb9a483079a728958dc1e2425a91e90cd1a452b156311b65e117fea3f1088f86565b544bb6e66f93c71787ac7c23bbf4c3380818313b3a91ee631f8cd4dfe49384434fcca47fe8151f4977ca4122c5bbfa6b675391cd15a111299baeea2cac28c834b0ea63695e81da56e7d2d2f01f0eee6e2543bafc12297c9c7ae0bac7d903a822a6bbf5ff7f21480cc507d00c748fc9921f5418f0608b36ba88b2f065cb7009bbff04c3e19889859df0fc7665efc2255dcb1b82082881ee9868e3cbb8c5f3253816375b946f8d6576942fb954c49", @typed={0x8, 0x107, 0x0, 0x0, @u32=0x66}, @typed={0x62, 0x9c, 0x0, 0x0, @binary="68dd97186c754e826e41879b36f9162cef2140bd6b429107f6f064060216cfedd00eaa428b1175b3323266886095de360233374f9254c05ec24c8252fd7a3c2387ff378a3e9499e13c2f4ce97196a96da4c4d58d75f698cf326619404c7b"}, @generic="1f80ef84957f21f8", @typed={0xc, 0x162, 0x0, 0x0, @str='pagemap\x00'}, @nested={0x14, 0x106, 0x0, 0x1, [@typed={0x8, 0xd0, 0x0, 0x0, @ipv4=@multicast1}, @typed={0x8, 0x7a, 0x0, 0x0, @fd=r6}]}]}, 0x3ac}, {&(0x7f0000000b80)=ANY=[@ANYBLOB="9c0000002700000428bd7000fcdbdf25edb5e5fc297b0c222a0a07f49cf1b9f6f3c7b104c6288340ba79c0f462b07e755089144404ff56c5f1d8a2e3691ca8e94afb05621b2767ac4c00249e4f49fc66bf7ddf1c560e96692109ca3008217086e9be9cfa436b19355323b599689d5eabd8b71cc8214ce13521faccc8d7e64515473c6a649a041cf2dd14c346cc3a7c4e0b090e5fee6f7c01c7000000"], 0x9c}, {&(0x7f0000000c40)={0x120, 0x11, 0x300, 0x70bd2b, 0x25dfdbfd, "", [@generic="a9aca3878af61ed7fe16e8f18e623c510553f6cba0b1c5885abdd0ed047d93a6f90e7453b385", @nested={0xe7, 0x112, 0x0, 0x1, [@nested={0x4, 0x163}, @generic="20f57d663374216e71e1a71fb4cfef7f1693347fe23d7013e481b1e2b705db4cfeb4cb48bf839d02a197f93a522cfbf5db7f45f5a5b5e948ce8dd78fec3709fb778c1c3ed4477b29c5d050d4c6b9219e7d8b12e9785004b8cec3b397b2a8b8243a0e3a49a4d8057776361e5ed08005ec85e4d2", @generic="46bbe4c9f955f0e082e8ece901d4651fb0f2208a8eddcb6d437f80ddee8b61d73d3710e11e806e25d0a3de557f70876c9ecb9cd59bdb69a45690b4b9f7a3c92e74f3ecc8de9503782961c3209fdbb970584bc720b36cc16f778eb1bb2256babd5da63893f41ef3c1998ce359"]}]}, 0x120}], 0x8, 0x0, 0x0, 0x4000001}, 0x50) 2.797766877s ago: executing program 0 (id=400): mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000440)='./proc\x00', &(0x7f0000000500)='proc\x00', 0x4000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000006c0)='./proc/thread-self/fail-nth\x00', 0x2, 0x2) write(r0, &(0x7f0000000700)='3', 0x4e) r1 = syz_create_resource$futex(&(0x7f0000000000)) r2 = syz_create_resource$futex(&(0x7f0000000040)) futex(r2, 0xc, 0x400000, 0x0, r1, 0xffffffec) 2.797603267s ago: executing program 3 (id=401): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) close(0xffffffffffffffff) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) syz_usb_connect(0x0, 0x5b, &(0x7f00000003c0)=ANY=[@ANYBLOB="1201000202020040dd0405800000010203010902"], 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) socket$inet_icmp(0x2, 0x2, 0x1) socket$packet(0x11, 0x2, 0x300) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$netlink(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000300)={0x20, 0x13, 0x821, 0x0, 0x0, "", [@typed={0x8, 0x0, 0x0, 0x0, @fd=r3}, @typed={0x6, 0x0, 0x0, 0x0, @str='!\xa5'}]}, 0x20}], 0x1}, 0x0) 2.785238888s ago: executing program 0 (id=402): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x0, 0x0, 0x0) mount(0x0, 0x0, 0x0, 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x1, 0x42) memfd_create(0x0, 0x1) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r3 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r3, &(0x7f0000000040)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r4 = socket$netlink(0x10, 0x3, 0x10) r5 = syz_ublk_setup_io_uring(0x21, &(0x7f0000000480)={0x0, 0x0, 0x40, 0x0, 0x4158}, &(0x7f0000000500)=0x0, &(0x7f0000000540)=0x0, &(0x7f0000000580)=0x0) syz_ublk_add_dev(r5, r6, r7, r8, &(0x7f00000005c0)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000640)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, 0x0) r9 = syz_open_procfs(0x0, &(0x7f0000000680)='fdinfo/3\x00') read$FUSE(r9, &(0x7f00000006c0)={0x2020}, 0x2020) r10 = eventfd(0x0) read$eventfd(r10, &(0x7f0000002700), 0x8) writev(r10, &(0x7f0000002740)=[{&(0x7f0000002780)="02965d1f5ec3de3d", 0x8}, {0x0}], 0x2) bind$netlink(r4, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r4, 0x1, 0x8, &(0x7f00000000c0), 0x4) r11 = socket$nl_generic(0x10, 0x3, 0x10) r12 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_DEBUG_SET(r11, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x40, r12, 0x1, 0x0, 0x25dfdbfd, {}, [@ETHTOOL_A_DEBUG_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}, @ETHTOOL_A_DEBUG_MSGMASK={0x20, 0x2, 0x0, 0x1, [@ETHTOOL_A_BITSET_NOMASK={0x4}, @ETHTOOL_A_BITSET_BITS={0x18, 0x3, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8}]}, {0x8, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_VALUE={0x4}]}]}]}]}, 0x40}}, 0x0) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r4, 0x10e, 0x4, &(0x7f00000002c0)=0x1800, 0x4) sendmsg$DEVLINK_CMD_RATE_NEW(r3, &(0x7f0000000300)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000380)={&(0x7f00000003c0)={0x14, 0x0, 0x300, 0x70bd2b, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x4008040}, 0x20000040) r13 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCETHTOOL(r13, 0x8946, &(0x7f0000000400)={'syz_tun\x00', &(0x7f0000000440)=@ethtool_link_settings={0x4d, 0x600, 0xf, 0x80, 0x0, 0x0, 0xfc, 0x1, 0x80, 0x4, [0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x4]}}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 2.348036462s ago: executing program 1 (id=403): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r2, 0x10e, 0x4, &(0x7f0000000080)=0x6, 0x4) setsockopt$sock_int(r2, 0x1, 0x8, &(0x7f0000000100), 0x4) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)={0x64, 0x0, 0x1, 0x401, 0x0, 0x1a14, {0x2}, [@CTA_TUPLE_ORIG={0x24, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8, 0x2, @multicast1}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x24, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8}, {0x8, 0x2, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TIMEOUT={0x8, 0x7, 0x1, 0x0, 0x1}]}, 0x64}}, 0x0) sendmsg$IPCTNL_MSG_CT_DELETE(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)=ANY=[@ANYBLOB="14000000020105"], 0x14}, 0x1, 0x0, 0x0, 0x20044804}, 0x40040) sendmsg$IPCTNL_MSG_CT_NEW(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=ANY=[@ANYBLOB="640000000001010400000000141a000002000000240001801400018008000100e000000108000200e00000010c00028005000100000000002400028014000180080001000000000008000200ac1e00010c0002800500010000000000080007"], 0x64}}, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r5, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000480)=ANY=[@ANYBLOB="4c000000000101040d0000000000000002000000240002801400018008000100e000000108000200e00000010c000280050001"], 0x4c}, 0x1, 0x0, 0x0, 0x811}, 0x0) sendmsg$nl_generic(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)={0x38, 0x4a, 0x1, 0x0, 0x0, {0xa, 0x0, 0x6e80}, [@typed={0x8, 0x0, 0x0, 0x0, @u32}, @nested={0x14, 0x1, 0x0, 0x1, [@nested={0x10, 0x1e, 0x0, 0x1, [@nested={0x9, 0x3d, 0x0, 0x1, [@generic="f1df62fd16"]}]}]}, @typed={0x8, 0x140, 0x0, 0x0, @ipv4=@rand_addr=0x64010102}]}, 0x38}}, 0x0) mount$overlay(0x0, &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500), 0x2002018, &(0x7f0000000540)={[{@uuid_null}], [{@subj_user={'subj_user', 0x3d, ']{%(-'}}, {@obj_user={'obj_user', 0x3d, '-+{$]'}}, {@appraise}, {@measure}, {@appraise}, {@smackfstransmute}]}) 2.262564591s ago: executing program 1 (id=404): add_key(&(0x7f0000000180)='asymmetric\x00', 0x0, &(0x7f0000000380)="308201d43082017ba00302010202142eea648d7f17e62e9e5869c887c68e1bd0f86fde300a06082a8648ce3d040302303a3138303606035504030c2f436572746966696361746520766572696669636174696f6e2045434453412073656c662d74657374696e67206b65793020170d3234303431333232313632365a180f32313234303332303232313632365a303a3138303606035504030c2f43657274696669636174652076657269666963617428a2e0861e1ae90d412073656c662d6e657374696e67206b65793059301306072a8648ce3d02011e082a8648ce3d0301070342000407e56b51affc19412c88926b775771039ee2fe6e6a714ec7299f90e177189fc2e70a82d08ae181a9717c5a73fb25b95b1e248c739ff838f848b4ad1619c022c6a35d305b301d0603551d0e141604142900bcea1deb7bc8479a84a23d758efdfdd2b2d3301f0603551d3e0418301680142900bcea1deb7bc8479a84a23d758efdfdd2b2d3300c0603551d130101ff04023000300b0603551d0f040403020780300a06082a8648ce3d040302034700304402201ad7ac07c89738f489437ec7666ea5007c121db409760c996b8c265de9705cb4022073b7c77a5adb670a964219cf4f674f356aee2925f24fc810149d79691c7ad75d", 0x1d8, 0xfffffffffffffffd) (async, rerun: 32) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (rerun: 32) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0xffff, 0x3}, 0x6) (async) write(r0, &(0x7f0000000100)="4a00ffff11003ee0b4fdddd685986a49e00588f1ba6f01", 0x17) (async, rerun: 32) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x8) (rerun: 32) r2 = dup2(r1, r0) bind$packet(r2, &(0x7f0000000140)={0x1f, 0x16, 0x0, 0x1, 0x10, 0x6, @broadcast}, 0x14) (async, rerun: 32) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) (rerun: 32) sendmsg$nl_xfrm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="480100001000010000000000fddadf257f0000010000000000000600000000000000000000000000000000000000000040000000000300030000000000000200", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="ac1414aa0000000000000000000000000000000033000000ff020000000000000000000000000001000000000000000000000000000000000000000000000000010400000000000000000000000000000000000000000000040000000000000080ffffffffffffff0000000000000000000000000000000000000000000000000000000000000000000010000000000000000000feffffff000000000a00010000000000000000000800230001000000480001"], 0x148}}, 0x4000040) (async, rerun: 32) r4 = syz_pidfd_open(0x0, 0x0) (rerun: 32) r5 = pidfd_getfd(r4, r3, 0x0) unlinkat(r5, &(0x7f0000000000)='./file0\x00', 0x200) 2.118809786s ago: executing program 1 (id=405): r0 = openat$binderfs_log(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder_logs/transactions_hashed\x00', 0x0, 0x0) ioctl$TIOCSSOFTCAR(r0, 0x541a, &(0x7f0000000040)=0x10001) r1 = epoll_create1(0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000780)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f00000007c0), 0x400000000000247, 0x0) close(r2) capset(&(0x7f0000000080)={0x20071026}, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r4, 0x6, 0x2a, &(0x7f0000000100)=0x77, 0x4) r5 = socket$unix(0x1, 0x1, 0x0) r6 = syz_ublk_setup_io_uring(0x155a, &(0x7f0000000140)={0x0, 0xa355, 0x10000, 0x2, 0x15a}, &(0x7f00000001c0)=0x0, &(0x7f0000000200)=0x0, &(0x7f0000000240)=0x0) r10 = memfd_create(0x0, 0x0) ioctl$XFS_IOC_START_COMMIT(r10, 0x81007702, 0x0) syz_ublk_add_dev(r6, r7, r8, r9, &(0x7f0000000280)={0x2e, 0x34, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000300)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x5}}}, &(0x7f0000000340)=0x0) r13 = socket$inet6_tcp(0xa, 0x1, 0x0) r14 = dup(r13) syz_ublk_setup_queues(r14, r12, &(0x7f0000000380)={0x0, 0x8000001, 0x1f00, 0x1, 0x252, 0x0, r6}, &(0x7f0000000400)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7fffde, 0x200, 0x2, 0x15e, 0x0, r14}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe914, 0x200, 0x10000004, 0x142, 0x0, r14}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf90f, 0x2000, 0x3, 0x0, 0x0, r6}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x8256, 0x2, 0x3, 0x1e9}}], 0x1, &(0x7f0000000680)={0x2e, 0x0, 0x0, r14, 0xc0107520, 0x0, 0x0, 0x700, 0x0, {}, 0x1f, r11, '\x00', {0xfff9, 0x8004, 0x0, 0x0}}, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r14, 0x40345410, &(0x7f0000000700)={{0x1, 0x3, 0xfffffffc, 0x2, 0x13fffffc}}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r5, &(0x7f0000000740)={0xa002803f}) syz_usb_connect(0x0, 0x97, &(0x7f00000000c0)=ANY=[@ANYRES8=r0], 0x0) 1.865179151s ago: executing program 0 (id=406): r0 = syz_usb_connect$hid(0x2, 0x6c, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040b827ed0100000000000109022400010000000009040000010300000009210000200122050009058103"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) (async) mount_setattr(0xffffffffffffffff, 0x0, 0x8900, &(0x7f0000000140)={0x0, 0x1, 0x340000}, 0x20) (async) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="002205"], 0x0}, 0x0) r1 = socket$nl_audit(0x10, 0x3, 0x9) syz_usb_ep_write(r0, 0x8, 0xc4, &(0x7f0000000280)="47d217f296bdb897b0c2d81674d55d92a502243537fac81f5e5123d879de467a4d66bead12f87d46bb0f343b46cc550d49174cb7c351b0d894deacd1ca7635d6ac2f3b4c7d1463c2c8952db7d29e776204d448bfbc51c2200a000eba0452ec83965bce5b9bf4bad6910be0ba65db63faa3c059ac0e045b7358ede01f938da8c06e04345b71461e2f114c979d8828117f3efac9a94ff30ffe41f714399cf5b344a380ca1260fa3a6e4fd1b529bde8d0ed230282eb785bba19d7b2907b708f41935079acd2") (async) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f0000000180)={'team_slave_0\x00', &(0x7f00000001c0)=@ethtool_sset_info={0x2b, 0x0, 0x101}}) (async) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000240)={0x24, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000000540)={0x2c, 0x0, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="20c538180100000000cbffb916fe71d00b005799e4f87ae26a9dc891cd4081bf6210276498fb61368564b62d9a458d8ea6f23e2799ebb17061ea0aa7c76272811f81d791b482f6f9cb546c3b72c6dc481b7e2afaeaed9791b3787b9cd24ac5b7d21c801ae4b30651ce980600000000000000"], 0x0}) (async) syz_open_dev$hiddev(&(0x7f0000000100), 0x3ff, 0x212801) 1.746263084s ago: executing program 2 (id=407): r0 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) mknodat$loop(r0, &(0x7f00000000c0)='./file0/file0\x00', 0x2000, 0x1) (async) mount$9p_unix(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='./file0\x00', 0x0, 0x12d7498, 0x0) (async) write$khugepaged_scan(r0, &(0x7f0000000080), 0x8) unshare(0x22020400) (async) umount2(&(0x7f0000000180)='./file0\x00', 0xb) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) 1.744358644s ago: executing program 2 (id=408): syz_usb_connect$uac2(0x0, 0x80, &(0x7f0000000100)=ANY=[@ANYBLOB="1201100300000040532b310040000102030109026e0003010d0067080b0002010020ff09040000000101200009240100800c0e000005240b04000904010000010220000904010101010220000905010920000308fb082501010305f9ff09040200000102200009040001"], &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0}) r0 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$BTRFS_IOC_START_SYNC(r0, 0x80089418, &(0x7f0000000000)) 1.374252411s ago: executing program 3 (id=409): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0xa) ioctl$TCFLSH(r0, 0x800455cc, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) 1.361703793s ago: executing program 3 (id=410): setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x1, &(0x7f0000000080)=@ccm_128={{0x7}, "6b4cc0f85f0461bc", "b1ba9dcd8ad74c10a011ec7fb1cd56c3", "66cadd98", "812bf68c4bd88067"}, 0x28) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x2501, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000140)={[0x60000000004, 0x7, 0x1, 0x41, 0xc3d, 0x0, 0x2004cb, 0xffffffffffffffff, 0xa1d, 0x7, 0x5, 0x79, 0x3, 0x2], 0x3332d000, 0x202}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_SET_SREGS(r2, 0x4138ae84, &(0x7f0000000200)={{0x4000, 0xe000, 0x0, 0x77, 0x0, 0x3, 0xcb, 0x2, 0x0, 0x6, 0x6}, {0x2, 0xffffffff, 0x3, 0xeb, 0x2, 0x0, 0x3, 0xff, 0x7, 0x0, 0x3}, {0x30000, 0x1000, 0x0, 0x0, 0x7, 0xc4, 0x5, 0x1, 0x45, 0x3, 0x4, 0xfc}, {0x1, 0x0, 0x1b, 0x4, 0x81, 0x0, 0x9, 0x3, 0x3, 0x0, 0x9}, {0x0, 0xffff1000, 0x3, 0x4, 0x0, 0x4, 0x0, 0x6, 0x2, 0x34, 0x4}, {0xffff1000, 0x1, 0x0, 0x78, 0xa, 0xfc, 0x2, 0x1c, 0xa3, 0xff, 0x5, 0x4}, {0xeeee8000, 0xdddd1000, 0xa, 0x4, 0xab, 0x0, 0x7, 0x20, 0x0, 0x0, 0x0, 0x10}, {0x0, 0x6000, 0xa, 0x2, 0xa4, 0x7, 0x8, 0x40, 0x26, 0x0, 0x0, 0xfe}, {0x80a0000, 0x3}, {0x3000, 0xfffd}, 0xddf8ffdb, 0x0, 0x100000, 0x120, 0xe, 0x1000, 0xa000, [0x80000001, 0x0, 0xffbfffffffffffff, 0xfffffffffffffffe]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 1.250088464s ago: executing program 3 (id=411): r0 = add_key$keyring(&(0x7f0000001c80), &(0x7f0000001cc0)={'syz', 0x1}, 0x0, 0x0, 0xffffffffffffffff) add_key$fscrypt_v1(&(0x7f0000001d00), &(0x7f0000001d40)={'fscrypt:', @desc4}, &(0x7f0000001d80)={0x0, "00379bce195566778899aabbccddfcff00112233445566778899aabbccddeeff000011688e0346d524b29db701e5ddeeff8000", 0x40}, 0x48, r0) r1 = add_key$fscrypt_v1(&(0x7f0000001e00), &(0x7f0000001e40)={'fscrypt:', @auto=[0x39, 0x30, 0x30, 0x30, 0x30, 0x30, 0x37, 0x30, 0x64, 0x30, 0x30, 0x6c, 0x30, 0x64, 0x30, 0x32]}, &(0x7f0000001e80)={0x0, "00112233445566778899aabbccddeeff00112233305566778899aabbccddeeff001122334455667733445566778899aabbccddeeff00", 0x42}, 0x48, r0) add_key$fscrypt_v1(&(0x7f0000001f00), &(0x7f0000001f40)={'fscrypt:', @auto=[0x63, 0x39, 0x64, 0x65, 0x64, 0xe, 0x36, 0x38, 0x36, 0x62, 0x37, 0x31, 0x33, 0x34, 0x62, 0x34]}, &(0x7f0000001f80)={0x0, "83be91e3956f7eeab185c5532a737cbf86a019abc3c6c5b882e77c6b66c6d809ae8c0052697af3e28ee0d067c73f9e8f2c1af82447d244584968c7ffb982e9b4", 0x1e}, 0x48, r0) add_key$fscrypt_v1(&(0x7f0000002000), &(0x7f0000002040)={'fscrypt:', @auto=[0x61, 0x30, 0x38, 0x30, 0x30, 0x30, 0x30, 0x30, 0x62, 0x30, 0x30, 0x39, 0x38, 0x30, 0x30, 0x33]}, &(0x7f0000002080)={0x0, "01000004000000008899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r0) add_key$fscrypt_v1(&(0x7f0000002100), &(0x7f0000002140)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x34]}, &(0x7f0000002180)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r0) add_key$fscrypt_v1(&(0x7f0000002200), &(0x7f0000002240)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x6d, 0x30, 0x30, 0x30, 0x32, 0x30, 0x30, 0x61, 0x30, 0x35]}, &(0x7f0000002280)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabb0600000000000000445566778899aabbccddeeff", 0x36}, 0x48, r0) add_key$fscrypt_v1(&(0x7f0000002300), &(0x7f0000002340)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x64, 0x30, 0x30, 0x30, 0x30, 0x30, 0x36]}, &(0x7f0000002380)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r0) add_key$fscrypt_v1(&(0x7f0000002400), &(0x7f0000002440)={'fscrypt:', @desc3}, &(0x7f0000002480)={0x0, "fe1b5c4bf346207d87478c27b86bb51289055bc124bb60432572800f18aa4fd90aabed9d0fe61c88c11301a15ee3f0f5cdf737eba09fed73da1807ecb5b00d17", 0x24}, 0x48, r0) add_key$fscrypt_v1(&(0x7f0000002500), &(0x7f0000002540)={'fscrypt:', @auto=[0x30, 0x30, 0x64, 0x30, 0x30, 0x37, 0x30, 0x38, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x0, 0x38]}, &(0x7f0000002580)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aa91ccddeeff", 0x40}, 0x48, r0) add_key$fscrypt_v1(&(0x7f0000002600), &(0x7f0000002640)={'fscrypt:', @desc1}, &(0x7f0000002680)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x27}, 0x48, r0) add_key$fscrypt_v1(&(0x7f0000002700), &(0x7f0000002740)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x62, 0x30, 0x30, 0x30, 0x37, 0x30, 0x30, 0x30, 0x30, 0x32, 0x64, 0x30, 0x61]}, &(0x7f0000002780)={0x0, "00112233445566778999aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r0) add_key$keyring(&(0x7f0000002800), &(0x7f0000002840)={'syz', 0x0}, 0x0, 0x0, r0) add_key$fscrypt_v1(&(0x7f0000002880), &(0x7f00000028c0)={'fscrypt:', @auto=[0x30, 0x30, 0x63, 0x30, 0x30, 0x30, 0x30, 0x33, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x57, 0x62]}, &(0x7f0000002900)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r0) add_key$keyring(&(0x7f0000002980), &(0x7f00000029c0)={'syz', 0x2}, 0x0, 0x0, r0) add_key$fscrypt_v1(&(0x7f0000002a00), &(0x7f0000002a40)={'fscrypt:', @auto=[0x64, 0x65, 0x0, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x38, 0x30, 0x0, 0x30, 0x8, 0x64]}, &(0x7f0000002a80)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r0) add_key$fscrypt_v1(&(0x7f0000002b00), &(0x7f0000002b40)={'fscrypt:', @auto=[0x30, 0x58425c31ab49816a, 0x30, 0x30, 0x30, 0x30, 0x30, 0x65, 0x67, 0x30, 0x39, 0x33, 0x30, 0x30, 0x30, 0x66]}, &(0x7f0000002b80)={0x0, "00112233445566778899aabbccddeeff00112200080000778899aabbccddeeff00aabbccddeeff00112233445566778899aabbccddeeff00", 0x40}, 0x48, r0) add_key$fscrypt_v1(&(0x7f0000002c00), &(0x7f0000002c40)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x31, 0x30]}, &(0x7f0000002c80)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r0) add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000002d40)={'fscrypt:', @auto=[0x66, 0x62, 0x30, 0x37, 0x0, 0x30, 0x31, 0x30, 0x30, 0x30, 0x30, 0x31, 0x30, 0x30, 0x31, 0x31]}, &(0x7f0000002d80)={0x0, "00172233445566778899aabbccddeeff00112233445566778899aabbccddd7ff00112233305566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x13}, 0x48, r1) socket$nl_netfilter(0x10, 0x3, 0xc) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$XFS_IOC_START_COMMIT(r2, 0x80585882, &(0x7f0000000640)={0xffffffffffffffff}) ioctl$PPPIOCSMRU1(r3, 0x40047452, &(0x7f0000000700)=0x4) r4 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0x4008ae89, &(0x7f0000000040)={0x1, 0x0, [{0x4b564d02, 0x0, 0x1009}]}) ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) syz_usb_connect$uac2(0x5, 0x9f, &(0x7f0000000580)=ANY=[@ANYBLOB="12010003000000206307032040000102030109028d00030104007f080b0101010a20020904000000010120000924010500061500b20c24030500040a25007f0080090401000001022000090401010101022000082402010403020610240105050001100000050500004001090501090002"], &(0x7f0000000600)={0x0, 0x0, 0x0, 0x0}) r5 = socket(0x10, 0x803, 0x0) sendto(r5, &(0x7f00000000c0)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r5, &(0x7f0000000100)=[{{0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000380)=""/227, 0xe3}, {&(0x7f0000000480)=""/217, 0xd9}, {&(0x7f00000007c0)=""/4097, 0x1001}, {&(0x7f0000001800)=""/163, 0xa3}, {&(0x7f00000018c0)=""/149, 0x95}, {&(0x7f0000001980)=""/146, 0xfffffffffffffe70}, {&(0x7f0000001a40)=""/118, 0x76}, {&(0x7f0000001ac0)=""/260, 0x104}, {&(0x7f0000001c00)=""/88, 0x58}], 0x9}, 0xe}, {{0x0, 0x0, 0x0}, 0x3}, {{0x0, 0x0, 0x0}, 0x40002}, {{0x0, 0x0, 0x0}, 0xffffffff}, {{0x0, 0x0, 0x0}, 0xffffffde}, {{0x0, 0x0, 0x0}, 0x8}, {{0x0, 0x0, 0x0}, 0xa}], 0x7, 0x40000100, 0x0) 585.224411ms ago: executing program 2 (id=412): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)={0x14, 0x1, 0x2, 0x5, 0x0, 0x0, {0x3, 0x0, 0x1}}, 0x14}, 0x1, 0x0, 0x0, 0x40010}, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2}}, 0x2e) dup3(r0, r1, 0x80000) 571.393852ms ago: executing program 2 (id=413): r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) (async, rerun: 32) r1 = socket$key(0xf, 0x3, 0x2) (async, rerun: 32) r2 = socket$key(0xf, 0x3, 0x2) (async) r3 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000b80)={'vcan0\x00', 0x0}) connect$can_bcm(r3, &(0x7f0000000bc0)={0x1d, r4}, 0x10) (async) sendmsg$can_bcm(r3, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000c40)={&(0x7f0000000c80)=ANY=[@ANYBLOB="0100000000", @ANYRESHEX=r4, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0], 0x48}, 0x1, 0x0, 0x0, 0xc000}, 0x410) r5 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r5) (async) ptrace$setregs(0xd, r5, 0x800, &(0x7f0000000cc0)="18607651149d7b10b4024fbbdc08899b8f589df2dbb5d7a8d1b36cfab675cb3976ee8100e2878c9cfa178cac130eb046eda93df39ed4b41924dc225ad4028dd63defb87d698be5c749450b350a789dcfc6b2d6a696b5026d1e52f19274566d1da0f353dd65e330ebf71c5e823f2753c5fd76724828ef31b353e71805205c3dceb44cc4c7b3664e29fb") ptrace$getregset(0x4205, r5, 0x2, &(0x7f0000000d80)={0x0, 0xfffffffffffffe28}) (async) sendmsg$key(r2, &(0x7f0000000980)={0x3, 0x0, &(0x7f00000009c0)={&(0x7f0000000a00)=ANY=[@ANYBLOB="020100020a0000000000000000000000030006002b20000002004e24ac1414aa0000000000000000030005000000000002000a01000000000000000000000000020013"], 0x50}, 0x1, 0x7}, 0x20000000) (async, rerun: 64) sendmsg$key(r1, &(0x7f0000000a80)={0x0, 0x0, &(0x7f0000000ac0)={&(0x7f0000000b00)=ANY=[@ANYBLOB="0207e80702"], 0x10}}, 0x40044) (async, rerun: 64) r6 = socket$inet6(0xa, 0x3, 0x84) connect$inet6(r6, &(0x7f0000000b40)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0xff}}}, 0x1c) (async) r7 = eventfd(0x10000) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1, 0x7f}) (async, rerun: 64) ioctl$VHOST_SET_LOG_FD(r0, 0x4004af07, &(0x7f0000000240)=r7) (rerun: 64) r8 = syz_open_procfs(0x0, &(0x7f0000000800)='net/mcfilter6\x00') preadv(r8, &(0x7f0000000840)=[{&(0x7f0000000880)=""/128, 0x80}], 0x1, 0x5b, 0x0) (async) ioctl$VHOST_VDPA_GET_DEVICE_ID(r8, 0x8004af70, &(0x7f0000000900)) ioctl$VHOST_SET_VRING_KICK(r0, 0x4008af20, &(0x7f0000000040)={0x1, r7}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000180)={0x0, 0x0, 0x0, &(0x7f00000002c0)=""/43, 0x0}) (async) creat(&(0x7f0000000940)='./file0\x00', 0x103) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, &(0x7f0000000380)=""/220, &(0x7f00000000c0)=""/80, &(0x7f0000000780)=""/82}) (async) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000680)={0x1, 0x0, [{0x0, 0xfffffeac, &(0x7f00000001c0)=""/115}]}) (async, rerun: 64) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000340)=0x1) (rerun: 64) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000300)={0x2, &(0x7f0000000000)=[{0x8, 0x87, 0x7, 0x15e}, {0x82ca, 0x1, 0x6, 0x5}]}) (async, rerun: 64) ioctl$BTRFS_IOC_SCRUB_PROGRESS(0xffffffffffffffff, 0xc400941d, &(0x7f0000000380)={0x0, 0x9c28, 0x7fff}) (rerun: 64) 462.137564ms ago: executing program 2 (id=414): r0 = socket$packet(0x11, 0x3, 0x300) r1 = fsopen(0x0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, 0x0, &(0x7f0000000000)='c:::/\x83\xc1\xcfD\xc4AO\x06)\xb03\xfcI\x95w\x96\x9b\xe9\xa6\x1a\x96\xael\x11\xa6\x06\xe3G\xb1\x1d$\xc2;\x8f\xf3\x13\xebB\x93\x94\x01\x8b\x88\xeb\xa3\x01\rx\x86bK&\x13a~\x04/\x18\x14ZM\xcb\xad\x92>\xe5\x01V\xdc\x05#\x13\xe9F\xa0\x1b\xf8\xe12\xe9\x80\x988\xd8?\x86\xe9i\x7f\xa8\xe0c\x94\xc1\xae\x9c\xba\x1c\xfa\xbc\xa8\xbf\xff\xfe\xfe!\x7f2\xf1\xc7P\x80A\x1c2k\xf6}P\x19\xee:i|0\x1c\x13u\xb0I\xaa\xe3\x14\x9a\x1f\x9f(\xd1$\x06\xa8&\xc1&A0\xa7\xef\x9cL\x8e1K', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000100), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_PAUSE_SET(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r2, @ANYBLOB="0100030010651fbe347b2c2b00000c00018008000100"], 0x20}, 0x1, 0x0, 0x0, 0x1}, 0x0) setsockopt$packet_tx_ring(r0, 0x107, 0x5, &(0x7f00000000c0)=@req3={0x8000, 0x6, 0x8000, 0x6}, 0x1c) mmap(&(0x7f0000000000/0x2000)=nil, 0x30000, 0x2, 0x11, r0, 0x0) madvise(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1) munmap(&(0x7f0000002000/0x4000)=nil, 0x4000) r4 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000240), 0xffffffffffffffff) sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000280)={0x318, r4, 0x200, 0x70bd27, 0x25dfdbff, {}, [@NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0x2}, @NLBL_CIPSOV4_A_TAGLST={0x3c, 0x4, 0x0, 0x1, [{0x5, 0x3, 0x7}, {0x5}, {0x5, 0x3, 0x7}, {0x5, 0x3, 0x7}, {0x5, 0x3, 0x2}, {0x5, 0x3, 0x7}, {0x5, 0x3, 0x2}]}, @NLBL_CIPSOV4_A_MLSCATLST={0x10, 0xc, 0x0, 0x1, [{0xc, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x50ba5e58}]}]}, @NLBL_CIPSOV4_A_MLSLVLLST={0x170, 0x8, 0x0, 0x1, [{0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x96}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xfd}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x471670e2}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xf4}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x2ff055a4}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x6f327e6f}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xb1}]}, {0x34, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x36032325}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xcb}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x52}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xc2}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x69}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0xaa860f5}]}, {0x1c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xd3}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xeb}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x50416f9d}]}, {0x2c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x3c}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x34e61f53}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x13cfc00c}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x4af18f1c}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x2f7cc82d}]}, {0x44, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x5d}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x11}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x5eaca4d9}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x6d86013b}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x72b2e59c}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x397d30a3}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x63611f15}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x1ecc7c0d}]}, {0x24, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x59143100}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x26}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xb}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x78}]}, {0x4c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x6d03f25d}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x4e0b0e09}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xc3}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x12017c13}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x5e866de0}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x76dbe88e}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x88}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xd7}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x92}]}]}, @NLBL_CIPSOV4_A_MLSLVLLST={0x12c, 0x8, 0x0, 0x1, [{0x24, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x1289ffb7}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x229549b4}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x40}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x31}]}, {0x24, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x3011c262}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xdc}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x52beb74a}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6b}]}, {0x4c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x3977d978}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x45e25d93}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xf3}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x523aacb9}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x54}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x4b9a1883}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xe0}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xab}]}, {0x2c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x1d}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x3d3e67dd}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x26647d06}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0xaecb92}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xd4}]}, {0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x9a}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x19e7500a}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x26e99464}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xdd}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x3d}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x289d1a98}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x3fff78c7}]}, {0x2c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x300ae8b7}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa1}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x1c}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7d513be3}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x78}]}]}, @NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0x3}, @NLBL_CIPSOV4_A_TAGLST={0x4}, @NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0x1}]}, 0x318}, 0x1, 0x0, 0x0, 0x80}, 0x10) 460.692584ms ago: executing program 2 (id=415): r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000000), 0x0) ftruncate(0xffffffffffffffff, 0xffff) socket(0x400000000010, 0x3, 0x0) r1 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) openat2$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f00000011c0)='task\x00') fchdir(r2) mount(0x0, &(0x7f0000001200)='.\x00', &(0x7f0000000040)='nfsd\x00', 0x2230898, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x6a855000) r3 = syz_open_procfs(r1, &(0x7f0000001280)='stack\x00') pread64(r3, &(0x7f00000012c0)=""/15, 0xf, 0x4) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r4, &(0x7f0000000080)={0x0, 0x15, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="340000001400010004000000fedbdf250a00000004000000080008800402478014000280bf"], 0x34}, 0x1, 0x0, 0x0, 0x20000804}, 0x4800) write(r4, &(0x7f00000001c0)="d2376d8079579a2c196bfdb7020a88f664816b185921ddb5aa9389ae75cced8cb47d4f40ce2bce152bfc59c7b4a897eef866622a6b3e8e14f0304fc9fe64cea673ac811630509eefef052d809e65f6c16e18f4aaa12114d222a2e5ca273394e8a5ecf7d2310f9fb1d6fd8a3b8e05140823e9d753ae950892b831c7e05fcf03760714b1c41fac645f209772a205db5e7c79f1a7dd65db346cc1a9648da4b25fbc01d3b8d05536a4f21b612dbb3464e10e5fd9d1d0cad2933504be09f8026b07049c75ac222ed1dc6116dcbccb0958b533098e58e74de1f1da0748328402e73571435e7293ecde2b1eff4d6b944b57e9f1b90f18f200820bdb0253609c6e79204137acacae9b014ffea11332b95e17403df39107f7924c74da220e44a1276581edd3104bf00aa4942aa3aab22dee8305fd6c3582086f005066c79c8c35b0be216b298c56fb48f9c6f2ab8bf5a0cb2cbde7af1f45ea0cfa74d651ee70ef8275998b3d29394aa9d5cc6155f514743389a43bfbe52ef6c8a3a40d2eb39a1c70f92ca2cd808d54641a59dad87f752e7cfd9aebe4fdd174e2a3137bb6d3dca537a4ab537f2dfb0940035ac616f67413e001c65de0aad1296d3f6f00aba6e59bf21844edd2158df3286718160ab0b25514c28d0f59893d7a3635cefabb12e8496600066b96146b31438f0c61cfcd737d52752f1c062460233ca94f7915828a9d6da986f40f72a1cbf09a451bf5aa0800a90f72b131918f91cf9e1a6349a063dc611a35c2019367031d424a082c1c769b430456c2a1d809edd77d326722bc4d8c0ecc9ed43eec6b77f574d20f6f9d841b19387ee78f1fab186d601d13e226982201c3c5901f1da0bf42a7278e424fa673f90a6cfe0da942926b878b76f5dfa38a41211659b84b25fd2296b8cf0a877a4ec408e824082faaf892f32e4a0b284873934aa30e97651402c580930281e4537b0a2e66196c74d79d2b55d57d68fbc19c4775ea6c49d87d03380df046fd36e174a0072168d7aa683b8831f9d148d2901125173895240a4d5d269a94ef912eb4ed24c57d805c3ef1d00c78fccd0b335b172fb23130efbff4b65ae19c6bdb433dbf024fb7e6cee1426c9e84d04adafea30b6bb0130f26ddb3be62acff313f056b6d34164d3f515a7bb4e50e1d51515fa0788378759921146bf6cb039c31b58e5198e3f7bd57e456df6bfa004fd562d03af294397ab6943bce471abc5ebe2714dff7394200b9212714330bb6814a9c87f0ced87bf73f0e58994c3700b12e21a80d910d471e828f3a5495fe73fd7f6b96bd2a0de67411b15f2bf3f259e5dad500c813a05131532edd4f20fd3957e4f1f1d3d5f1a4baa443a5be8072f7b62a727d70f526ebb1e55178ce45a7dd1b1ffa9852526eccaaefe864fecd56e20bd251bd010c0ec0021c93f67f30013a164bc26dd3ec92cf19fdad584732d3673e12c47f463c19f51012dbc1e862f5cae14812c0de30d8473d8afb5bd56ad4b79adbfb8c54b7cdf9c06d986458e9f431a6bb43274ed26e3a81e454bc8cbe44f170ec1fc4dcf2edb2957cbe8138a7a01b7cb1b3402cbf426aeccdca8622cf05401b447f6ad0e40107ebab4724cc9ee5351fa75f8bf040116e05024d892b327556bfae66132333d22f3d9917184671ca6968d4eb6f341b5dac1c5d6efab24909d0826c1df0b2d7638cce03315c789853106cc7006e23cad666e15170ce9d91c725c79a339765cde05da2c74d85382a07fd6eac0a1607b1163c456a317776f0dc5fac25a774e6165b56f1b21e935d91c0852c17fa99319557b2ce9a81a7f844b1953c972f16e9de1af8e9857184f57287a8e5a70e851c8db2036159ea58c5216fe610df7ef3347f37faaf143464965d9bcd88e2ad8c9d79ce068ee477e6c27f84882037eaf8147397ebbbde22468d993640bf7c1f7adc0ba51fe3843bb23892883c8757f5f1ff2f0ff950baaf0cf3c053d68bf54223763c9515161189fae32f4ae5665eadcaf824575fae565cc93e114193a7100d068ca6ac47c95ead830e1274669a1d623d0718131b0400b34e65ad4958a5e43d58e24711dd42623e00a39254b2ce93dce0655c0cd71f03798501a848496f642124653d48d79cb120e7d16f2ab82c905417a715f834bed4a5850c7563d9df18bc659ff4fccf67a21249864feaa55f0217c3add1e68905fc77d1c8f67d087a2e8903ecda82d59c2c2b300468693ed357257e7a427963e9b3d2b99d6cfe8b060b77d046a24ce1e997793331ed40a79fd99faf99ac3ad12222daf717c3b99bd4e3a5bde4a743b1e9683669786000755383fc66b6f501b532be4624152e5c69849918d321d8764d834c158477c777edb1868297da44355583af76e2e4d760f0a1aa86fc9c675fd8440213e9878203b280c7d5e9f87a5941c487e0e52aaf2df0184e5d8efc4982ffe9ce87d61d6bee659c254f0d3ce44ffc8989870a9e89c874592e1ecc2176cb11da6d8ca4b877ff08f7d5774458386c8671b4ca66589bd8928c17ff883205c214922dce58ce1546e645fd086e3c0280cad299ff8ae2da60576d60703b8d8437c8da75cb1563901b45a2aec5eed0cc37259ceab2645a0b66d8eadd6d2d30917fbecd1b2a49aa7acbabb0ad7f5ee6a1f83d94072bd7c4f2726dbf9a73d044f05e086ba4c9d33bc859f53203f98f9cff9f2c375bec2bdc0008e61c610918f468f9630f1c170b4584146d49028c4d5259d32561b8b0ace2139500d05f122011a94ac43afa963861696081288ba39b6f34531ab66648a082bec2c22ea041b1f59e993cc6ff391878b3ebb4480d3f5dbd0c43d3b999db7b967041795bdf48c549d1fa650e13836a39e86f2ed307f817f178d579683736cab5f90aa71804dc03eb047f36e41f37d979cd0173b0ef5406a14520c615467b3406186debca8255ebb64de0c22d1199a31d368c2eea4940d5979a5c57cb53fbccbdacd98ba9c4d22b2c19a3d4d7bdd183d485c492683ef4154228c53d9373a036be0e53abc46d121e52e37060e0a751b127af97d170d75d20a22b796305e37692cab9d1d323bc07e5691fd53c59628bf094453fdc3d42e0845b6ecce316e2d5b57844101a78c0d3d3f09e3bbcbddbebe29923bb35da700eabcc4b7b6de614f2adfb1a043464ce498842b2e53c82ecd0c101833316462a06f8a6f753cbfb0d244f46d51d704d60e061363359c71fcf1d52420e5ef300dd7723097f267d1584f567419ad910d95903957f5151197c7c20be4cb8ac8a6eedeed57d444643bdc4056288a6be1ac10d7d5150234509959d1c999ff47d0a11199091cf054a694cb41c372de5abe65d0916624c63ac36c557f8b343bdb4d06121082b63999f1588a124291fad1751aa67c7271a053d586b61cb6f4c04f499a8ccdc4e21d3ad43fae032338b87060531e012eba4daf354d8d1f8d922e6fe7381e9aad7b2a14472260bc7e6fcfa1e29baab6f1015da2d99fe412b802f43f0c0c7f81eb975e9dccfc4e8b2b0d40b917acf4d41529c2a54e612b0e82d76540f36385e5de587e2de1c976f18acc20a694f775043fa60a05a62e812196ad45b436673daad33ba0959bb7fcf7b0066d80e2f5213fd88cd54436078abbc56d1a11b019b7cf472cad26b0780c41da27c0f7bda2aaf9ee47317810d43f7dc7d16735b0627016b3b5e94f7ffa37118b20ae16ed9ea5adfda62ca6b587dcf1e55209c147eed552107da21dd156dfb22adac4e64ccd53d25f330e3cf8334c07a9df72120c840ff6e686d3bcb539ee796d187baf0be1cfdb8929c0196db5493834f6a18b6f14e72b5a9850032bea7d49db685fb71a8375415d6f155761c2ff78f9b6bc18d8668aec1b239db18c00d9e78ea8e82efb42dda17719ce549bd77169ad95f6bdd01512c6ee37d158d5aca8842b2e6472833f23f44c7045d1e387f2360adf201e6a79158d59e692c837145bdc791aee475bc2746ae9ed1f6c516976bb11524210de89f60bfc9d448c129756a59b870d5d57fd0e4043724b00eeef451861e25af25c20531a745dbc6e27d1a6846235233e4a9670762a16fb85b16cec0c45bc069d46fb6617ee95a894780dc72375ff0f9adeed7f0eba0582c3b59918eba6e6658d9d2bac412a23876278c4839230344b53be2d5be51bf8cb24561f1ba8035c605c402d8ac8f8898e66be28f70cbb13515fe13fb64d4010c3237f716a087e1733accd3c9407f7970906bffbd5421af48831237ee30d6dcb777338422d80ec4ef821b9881092938454a29449ea94a266165710ee1631712be7169662bc2626498e5baa91d9d17f66949cf454447095ca7112ba0520168ea7896c681b3703df6d59ea43db446002387aec58aff4a1c8520b59bdd36e1b35bf4282fd3d95e98cf0d800b0dde2dca8c1903cca65d0dfe48288fff9d12492c08e53529cb8f33d21a7e959a5784153a1daac873dbe54ac12a34cf982682b4ea4c3d9deac02c98c808010bfa486acc63b673c433bc1daf30367ee133048258a885bab9836b8425b73976a0bb62e341f9af5383b2e8d2096d8a1735dfaf5db887f152033ee8b1adc6eb4d4994eb691c6caf23ea48a4f3384d3330d706a210ee34af5c3f149fc038f218d0694b53365c98431783cad26bb8aa967ee0413795399cc53adb257ed821f9b43e1757bf80970d9d13f02f113ac979e8600a8df2fe3274084cdf65fe3dd4e3741e3497934f14b3a2c69156d3202b5bcc79c453d218ccb79d09d16c3da09a247bf1fdb6ed09a4c431718283fa5c1c117e1635b4fe4d22f5cfe9383c4cc9bdbaf1490f3691f5e7e7953569a76e8957c480fef452c19d32b30c136fdf0b47975fe64b41b83887417ebe95fec7602a865139ddd78bca2d6f04886681b3280da4ce56e5a4a33935299e834c9d379ed3ca480a6d5b4a236a46e26968ae9981a996652ef3eba49610dba2e17b9a841b5ae90db6e4fa386cdc54bdc5db5f43da33ada7b38c09aac06723916c2684cc5cd9e33b36ce0b4b2111881b25f65de4bb8cecee709c43e21ae424c134aca5bdb5eea3d32eca3c2a522455991ad04ae846b1c1aaec222ddd56337dace499b7df23535f832bf7306c85c425f06a19fa1578ac2eef4a4e945cd4dc4104fce732150ae6eac185e1620c985021b783a2dae9aebdbf80a963d1dfd19c64185f18b97d8093d21a620275b089925ed2602bfbeb5adfc64e991fa33206079e563abbd9f9df55631d809be71eee193a9d73e7c5d2a1bec2555ebae9e569f8f7fc1d8b332810360cecf6e5e441b682623284b97668c6d2a5e5c7a008b2ce39a5638c32db8a7fcb6bc099fd8c11274afb27df7f655ab1b423f20fc2df43a2393f0b308a0f1b618963e42695c00e2c190fa94b26aaef5081901db2d78a6e2e620b376fa8a845b6c5fa7705a57bf23fd36c161338eb8d6f63b58f20785f28936f9104bd0418efdc7ffff5dbc429cfee45672d0823ad579f5c457853954283a3e25c6908ede4cc813156c56e2a90ccf20d78063ed80db1ed2cdf9fff9c38228d2f5ebeca74d2ec237736a7e1b4f1c4dd04116d643f7eb8ba55774738979908ff9d450098f282cf0b853a93c85e72764ad2bf3b5f0b28169a7979df0f7d52d42892de6b0ef56abf2fbdcf416c946ee8328beec6e656c880f2cef1fd36061c75369d6af767ed61e5f11e9625e3bcf2ca5001ecb177fc11e7d1172b510cdbb6c49869c9b9bdde46c68537055dd0e64daa71123dc871b23d37290557bac9ca39fa4455b793f6e85d48c21aca9a8b0e21add8744475a01d422aef4c2b", 0x1000) syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000ffff1a40d8048200b7ce01028297090212000100000000090400100002"], 0x0) prctl$PR_SET_IO_FLUSHER(0x39, 0x1) syz_clone(0x880280, 0x0, 0x0, 0x0, 0x0, 0x0) writev(r0, &(0x7f0000000140)=[{&(0x7f0000000180)="3900000013000318680907070000000f0000ff3f04000000170a001700000000040037000f00030001332564aaee7b1d58b9a64411f6bbf44d", 0x39}], 0x1) 65.184164ms ago: executing program 3 (id=416): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCSIFVLAN_SET_VLAN_INGRESS_PRIORITY_CMD(r0, 0x8983, &(0x7f0000000440)={0x2, 'vlan1\x00', {0x100007f}, 0xfffc}) add_key$fscrypt_provisioning(&(0x7f0000000100), 0x0, 0x0, 0xfffffffffffffe4e, 0x0) memfd_create(0x0, 0x18) r1 = socket(0x2, 0x2, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x80102, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = eventfd2(0xe5c, 0x80000) ioctl$KVM_IRQFD(r3, 0x4020ae76, &(0x7f0000000080)={r4, 0x7, 0x2, r4}) r5 = eventfd2(0xe5c, 0x80000) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_PAUSE_SET(r6, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)=ANY=[@ANYBLOB="14000000", @ANYRES16=0x0, @ANYBLOB="04"], 0x14}, 0x1, 0x0, 0x0, 0x4044020}, 0x4000000) recvmmsg(r6, &(0x7f0000000300)=[{{0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000380)=""/60, 0x3c}, {&(0x7f0000000480)=""/4104, 0x1008}], 0x2}}], 0x1, 0x40030002, 0x0) sendmsg$nl_generic(r6, &(0x7f00000014c0)={0x0, 0x0, &(0x7f0000001500)={&(0x7f0000001540)=ANY=[@ANYBLOB="200000001000010700000000000000000a0000000c0002006e6c3830323131"], 0x20}}, 0x0) ioctl$KVM_IRQFD(r3, 0x4020ae76, &(0x7f00000000c0)={r5, 0x7, 0x2, r4}) r7 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='.\x00', 0x0, 0x121) fcntl$notify(r7, 0x402, 0x2) mknodat$loop(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x1000, 0x0) r8 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x20842, 0x4) write$P9_RWALK(r8, &(0x7f0000000200)={0x9, 0x6f, 0x2}, 0x9) ioctl$BINDER_CTL_ADD(r8, 0xc1086201, &(0x7f0000001580)={'binder1\x00'}) write$P9_RVERSION(r8, 0x0, 0x15) ioctl$sock_SIOCSIFVLAN_DEL_VLAN_CMD(r1, 0x8983, &(0x7f0000000000)={0x1, 'wg2\x00', {}, 0x5832}) 0s ago: executing program 3 (id=417): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) close(0xffffffffffffffff) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) syz_usb_connect(0x0, 0x5b, &(0x7f00000003c0)=ANY=[@ANYBLOB="1201000202020040dd0405800000010203010902"], 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) socket$inet_icmp(0x2, 0x2, 0x1) socket$packet(0x11, 0x2, 0x300) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$netlink(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000300)={0x20, 0x13, 0x821, 0x0, 0x0, "", [@typed={0x8, 0x0, 0x0, 0x0, @fd=r3}, @typed={0x6, 0x0, 0x0, 0x0, @str='!\xa5'}]}, 0x20}], 0x1}, 0x0) 0s ago: executing program 1 (id=419): r0 = openat$dm_control(0xffffffffffffff9c, &(0x7f00000010c0), 0x2, 0x0) ioctl$DM_DEV_CREATE(r0, 0xc138fd03, &(0x7f0000001100)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x88001, 0x0, 0x0, {0x0, {'syz', 0x0, '0\x00'}}}) ioctl$DM_TABLE_LOAD(r0, 0xc138fd09, &(0x7f0000000180)={0x4, 0x0, 0x0, 0x188, 0x138, 0x1, 0x0, 0x0, 0x0, 0x0, @by_dev={r1}, [@snapshot={0x0, 0x1008, 0x0, 0x50, 'snapshot-merge\x00', {@ram_num={'1:', 0x0}, 0x20, @ram={'/dev/ram', 0x0}, 0x20, 'n', 0x20, '64'}}]}) kernel console output (not intermixed with test programs): 71.418635][ T1362] ? __alloc_pages_noprof+0x35a/0x7e0 [ 71.418655][ T1362] ? __cfi___alloc_pages_noprof+0x10/0x10 [ 71.418675][ T1362] __mem_cgroup_charge+0xfc/0x420 [ 71.418695][ T1362] ? folio_add_lru+0x116/0x400 [ 71.418712][ T1362] ? __cfi___mem_cgroup_charge+0x10/0x10 [ 71.418739][ T1362] shmem_alloc_and_add_folio+0x8e4/0x10b0 [ 71.418757][ T1362] ? shmem_replace_folio+0x9b0/0x9b0 [ 71.418773][ T1362] ? shmem_huge_global_enabled+0x2da/0x360 [ 71.418797][ T1362] ? shmem_allowable_huge_orders+0x1f7/0x430 [ 71.418820][ T1362] ? __kasan_check_write+0x18/0x20 [ 71.418838][ T1362] ? _raw_spin_lock+0x92/0x120 [ 71.418854][ T1362] shmem_get_folio_gfp+0x5cd/0x12e0 [ 71.418876][ T1362] ? shmem_get_folio+0xc0/0xc0 [ 71.418894][ T1362] ? follow_page_pte+0x8fb/0xba0 [ 71.418909][ T1362] ? inode_to_bdi+0x6d/0x100 [ 71.418924][ T1362] shmem_write_begin+0xf4/0x260 [ 71.418937][ T1362] generic_perform_write+0x32c/0x970 [ 71.418953][ T1362] ? __cfi_generic_perform_write+0x10/0x10 [ 71.418966][ T1362] ? generic_write_checks_count+0x426/0x540 [ 71.418981][ T1362] ? file_update_time+0xa3/0x210 [ 71.418996][ T1362] shmem_file_write_iter+0x105/0x130 [ 71.419010][ T1362] __kernel_write_iter+0x45f/0x900 [ 71.419028][ T1362] ? __cfi___kernel_write_iter+0x10/0x10 [ 71.419043][ T1362] ? get_dump_page+0x165/0x220 [ 71.419056][ T1362] ? __asan_memset+0x39/0x50 [ 71.419072][ T1362] ? iov_iter_bvec+0xc0/0x180 [ 71.419087][ T1362] dump_user_range+0xb8b/0xe60 [ 71.419106][ T1362] ? __cfi_dump_user_range+0x10/0x10 [ 71.419123][ T1362] ? elf_coredump_extra_notes_write+0x426/0x4b0 [ 71.419143][ T1362] ? __cfi_elf_coredump_extra_notes_write+0x10/0x10 [ 71.419161][ T1362] ? elf_core_dump+0x23cf/0x3840 [ 71.419175][ T1362] elf_core_dump+0x2d61/0x3840 [ 71.419189][ T1362] ? __cfi_elf_core_dump+0x10/0x10 [ 71.419200][ T1362] ? mas_next_slot+0xf01/0xfd0 [ 71.419221][ T1362] ? dump_interrupted+0xf0/0xf0 [ 71.419239][ T1362] ? filp_open+0x199/0x1f0 [ 71.419255][ T1362] ? 0xffffffffff600000 [ 71.419269][ T1362] do_coredump+0x20d5/0x3050 [ 71.419290][ T1362] ? __cfi_do_coredump+0x10/0x10 [ 71.419308][ T1362] ? asm_exc_page_fault+0x2b/0x30 [ 71.419333][ T1362] ? __kasan_slab_free+0x6a/0x80 [ 71.419347][ T1362] ? get_signal+0xa2a/0x1490 [ 71.419368][ T1362] get_signal+0x11bf/0x1490 [ 71.419390][ T1362] arch_do_signal_or_restart+0xbc/0x700 [ 71.419407][ T1362] ? __cfi_arch_do_signal_or_restart+0x10/0x10 [ 71.419432][ T1362] ? __kasan_check_read+0x15/0x20 [ 71.419451][ T1362] irqentry_exit_to_user_mode+0x4d/0xb0 [ 71.419472][ T1362] irqentry_exit+0x16/0x60 [ 71.419492][ T1362] exc_page_fault+0x65/0xc0 [ 71.419510][ T1362] asm_exc_page_fault+0x2b/0x30 [ 71.419527][ T1362] RIP: 0033:0xf61da3 [ 71.419547][ T1362] Code: Unable to access opcode bytes at 0xf61d79. [ 71.419554][ T1362] RSP: 002b:0000200000000068 EFLAGS: 00010217 [ 71.419595][ T1362] RAX: 0000000000000000 RBX: 00007fdfcc226090 RCX: 00007fdfcbf9f559 [ 71.419606][ T1362] RDX: 0000200000000080 RSI: 0000200000000060 RDI: 0000000001000200 [ 71.419617][ T1362] RBP: 00007fdfcc036b20 R08: 0000200000000100 R09: 0000200000000100 [ 71.419628][ T1362] R10: 00002000000000c0 R11: 0000000000000206 R12: 0000000000000000 [ 71.419638][ T1362] R13: 00007fdfcc226128 R14: 00007fdfcc226090 R15: 00007ffe2215cc68 [ 71.419651][ T1362] [ 71.419673][ T1362] memory: usage 307200kB, limit 307200kB, failcnt 30936 [ 71.486142][ T1553] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 71.501309][ T1362] memory+swap: usage 432088kB, limit 9007199254740988kB, failcnt 0 [ 71.516890][ T1553] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 71.518795][ T36] audit: type=1400 audit(1793285144.552:348): avc: denied { map } for pid=1551 comm="syz.0.304" path="/dev/raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 71.528706][ T1555] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 71.533405][ T36] audit: type=1400 audit(1793285144.552:349): avc: denied { execute } for pid=1551 comm="syz.0.304" path="/dev/raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 71.538927][ T1557] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 71.543478][ T1362] kmem: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 71.548207][ T1555] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 71.553183][ T1362] Memory cgroup stats for [ 71.559472][ T1557] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 71.564705][ T1362] /syz1 [ 71.800643][ T31] usb 1-1: new high-speed USB device number 28 using dummy_hcd [ 71.803814][ T1362] : [ 71.960638][ T31] usb 1-1: device descriptor read/64, error -71 [ 71.962712][ T1362] cache 314384384 [ 72.011981][ T1362] rss 77824 [ 72.015160][ T1362] rss_huge 0 [ 72.018370][ T1362] shmem 314384384 [ 72.022131][ T1362] mapped_file 0 [ 72.025590][ T1362] dirty 0 [ 72.028514][ T1362] writeback 0 [ 72.031841][ T1362] workingset_refault_anon 13 [ 72.036533][ T1362] workingset_refault_file 99 [ 72.041251][ T1362] swap 127885312 [ 72.044829][ T1362] swapcached 110592 [ 72.048690][ T1362] pgpgin 201457 [ 72.052215][ T1362] pgpgout 125168 [ 72.056283][ T1362] pgfault 88924 [ 72.059877][ T1362] pgmajfault 14 [ 72.063613][ T1362] inactive_anon 172347392 [ 72.068278][ T1362] active_anon 142225408 [ 72.072724][ T1362] inactive_file 0 [ 72.076467][ T1362] active_file 0 [ 72.080039][ T1362] unevictable 0 [ 72.083888][ T1362] hierarchical_memory_limit 314572800 [ 72.089355][ T1362] hierarchical_memsw_limit 9223372036854771712 [ 72.095742][ T1362] total_cache 314384384 [ 72.099917][ T1362] total_rss 77824 [ 72.103591][ T1362] total_rss_huge 0 [ 72.107372][ T1362] total_shmem 314384384 [ 72.111574][ T1362] total_mapped_file 0 [ 72.115588][ T1362] total_dirty 0 [ 72.119093][ T1362] total_writeback 0 [ 72.122961][ T1362] total_workingset_refault_anon 13 [ 72.128102][ T1362] total_workingset_refault_file 99 [ 72.133275][ T1362] total_swap 127885312 [ 72.137398][ T1362] total_swapcached 110592 [ 72.142057][ T1362] total_pgpgin 201457 [ 72.146350][ T1362] total_pgpgout 125168 [ 72.150504][ T1362] total_pgfault 88924 [ 72.154570][ T1362] total_pgmajfault 14 [ 72.158576][ T1362] total_inactive_anon 172347392 [ 72.165321][ T36] audit: type=1400 audit(1793285145.212:350): avc: denied { bind } for pid=1565 comm="syz.2.306" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 72.184668][ T1362] total_active_anon 142225408 [ 72.189384][ T1362] total_inactive_file 0 [ 72.196704][ T1362] total_active_file 0 [ 72.201022][ T1362] total_unevictable 0 [ 72.205152][ T1362] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz1,mems_allowed=0,oom_memcg=/syz1,task_memcg=/syz1,task=syz.1.263,pid=1338,uid=0 [ 72.220301][ T36] audit: type=1400 audit(1793285145.242:351): avc: denied { cmd } for pid=1568 comm="iou-wrk-1569" path="socket:[22623]" dev="sockfs" ino=22623 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 72.220644][ T31] usb 1-1: device descriptor read/64, error -71 [ 72.243403][ T1362] Memory cgroup out of memory: Killed process 1338 (syz.1.263) total-vm:90424kB, anon-rss:1264kB, file-rss:53248kB, shmem-rss:0kB, UID:0 pgtables:192kB oom_score_adj:1000 [ 72.296058][ T10] usb-storage 4-1:71.173: USB Mass Storage device detected [ 72.394093][ T1576] tipc: Started in network mode [ 72.404740][ T1576] tipc: Node identity ac1414aa, cluster identity 4711 [ 72.419524][ T1576] tipc: Enabling of bearer rejected, failed to enable media [ 72.442327][ T10] usb 4-1: USB disconnect, device number 28 [ 72.514056][ T1364] syz.1.263 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 72.520619][ T31] usb 1-1: new high-speed USB device number 29 using dummy_hcd [ 72.531582][ T1364] CPU: 0 UID: 0 PID: 1364 Comm: syz.1.263 Not tainted syzkaller #0 5cdf496c3980d18a0efbb3b3e73d13bf69df874e [ 72.531611][ T1364] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 72.531621][ T1364] Call Trace: [ 72.531627][ T1364] [ 72.531633][ T1364] __dump_stack+0x21/0x30 [ 72.531664][ T1364] dump_stack_lvl+0x140/0x1c0 [ 72.531688][ T1364] ? __cfi_dump_stack_lvl+0x10/0x10 [ 72.531712][ T1364] ? ___ratelimit+0x41c/0x5c0 [ 72.531742][ T1364] ? __kasan_check_write+0x18/0x20 [ 72.531767][ T1364] dump_stack+0x19/0x20 [ 72.531790][ T1364] dump_header+0xd9/0x460 [ 72.531813][ T1364] oom_kill_process+0x35d/0x640 [ 72.531838][ T1364] ? __pv_queued_spin_lock_slowpath+0x22e/0xe90 [ 72.531862][ T1364] out_of_memory+0x5d1/0xa20 [ 72.531887][ T1364] ? __cfi_out_of_memory+0x10/0x10 [ 72.531911][ T1364] ? mutex_lock_killable+0x97/0x1d0 [ 72.531933][ T1364] ? __cfi_mutex_lock_killable+0x10/0x10 [ 72.531957][ T1364] mem_cgroup_out_of_memory+0x2c5/0x390 [ 72.531982][ T1364] ? css_next_descendant_pre+0x1ec/0x210 [ 72.532008][ T1364] ? __kasan_check_write+0x18/0x20 [ 72.532030][ T1364] ? drain_obj_stock+0xec0/0xec0 [ 72.532054][ T1364] ? memcg1_oom_prepare+0x2c5/0x3a0 [ 72.532078][ T1364] try_charge_memcg+0x925/0xe10 [ 72.532097][ T1364] ? static_key_count+0x45/0x70 [ 72.532116][ T1364] ? lruvec_init+0x241/0x280 [ 72.532139][ T1364] ? __cfi_try_charge_memcg+0x10/0x10 [ 72.532251][ T1364] ? __alloc_pages_noprof+0x35a/0x7e0 [ 72.532283][ T1364] ? __cfi___alloc_pages_noprof+0x10/0x10 [ 72.532302][ T1364] __mem_cgroup_charge+0xfc/0x420 [ 72.532328][ T1364] ? folio_add_lru+0x116/0x400 [ 72.532347][ T1364] ? __cfi___mem_cgroup_charge+0x10/0x10 [ 72.532369][ T1364] shmem_alloc_and_add_folio+0x8e4/0x10b0 [ 72.532386][ T1364] ? shmem_replace_folio+0x9b0/0x9b0 [ 72.532401][ T1364] ? shmem_huge_global_enabled+0x2da/0x360 [ 72.532423][ T1364] ? shmem_allowable_huge_orders+0x1f7/0x430 [ 72.532443][ T1364] ? __kasan_check_write+0x18/0x20 [ 72.532463][ T1364] ? _raw_spin_lock+0x92/0x120 [ 72.532490][ T1364] shmem_get_folio_gfp+0x5cd/0x12e0 [ 72.532513][ T1364] ? shmem_get_folio+0xc0/0xc0 [ 72.532532][ T1364] ? follow_page_pte+0x8fb/0xba0 [ 72.532549][ T1364] ? inode_to_bdi+0x6d/0x100 [ 72.532567][ T1364] shmem_write_begin+0xf4/0x260 [ 72.532580][ T1364] generic_perform_write+0x32c/0x970 [ 72.532598][ T1364] ? __cfi_generic_perform_write+0x10/0x10 [ 72.532613][ T1364] ? generic_write_checks_count+0x426/0x540 [ 72.532632][ T1364] ? file_update_time+0xa3/0x210 [ 72.532650][ T1364] shmem_file_write_iter+0x105/0x130 [ 72.532667][ T1364] __kernel_write_iter+0x45f/0x900 [ 72.532688][ T1364] ? __cfi___kernel_write_iter+0x10/0x10 [ 72.532706][ T1364] ? get_dump_page+0x165/0x220 [ 72.532722][ T1364] ? __asan_memset+0x39/0x50 [ 72.532739][ T1364] ? iov_iter_bvec+0xc0/0x180 [ 72.532758][ T1364] dump_user_range+0xb8b/0xe60 [ 72.532783][ T1364] ? __cfi_dump_user_range+0x10/0x10 [ 72.532804][ T1364] ? elf_coredump_extra_notes_write+0x426/0x4b0 [ 72.532829][ T1364] ? __cfi_elf_coredump_extra_notes_write+0x10/0x10 [ 72.532859][ T1364] ? elf_core_dump+0x23cf/0x3840 [ 72.532876][ T1364] elf_core_dump+0x2d61/0x3840 [ 72.532894][ T1364] ? __cfi_elf_core_dump+0x10/0x10 [ 72.532909][ T1364] ? mas_next_slot+0xf01/0xfd0 [ 72.532934][ T1364] ? dump_interrupted+0xf0/0xf0 [ 72.532953][ T1364] ? filp_open+0x199/0x1f0 [ 72.532970][ T1364] ? 0xffffffffff600000 [ 72.532983][ T1364] do_coredump+0x20d5/0x3050 [ 72.533003][ T1364] ? __cfi_do_coredump+0x10/0x10 [ 72.533022][ T1364] ? asm_exc_page_fault+0x2b/0x30 [ 72.533057][ T1364] ? __kasan_slab_free+0x6a/0x80 [ 72.533072][ T1364] ? get_signal+0xa2a/0x1490 [ 72.533093][ T1364] get_signal+0x11bf/0x1490 [ 72.533115][ T1364] arch_do_signal_or_restart+0xbc/0x700 [ 72.533133][ T1364] ? __cfi_arch_do_signal_or_restart+0x10/0x10 [ 72.533150][ T1364] ? __kasan_check_read+0x15/0x20 [ 72.533197][ T1364] irqentry_exit_to_user_mode+0x4d/0xb0 [ 72.533221][ T1364] irqentry_exit+0x16/0x60 [ 72.533239][ T1364] exc_page_fault+0x65/0xc0 [ 72.533258][ T1364] asm_exc_page_fault+0x2b/0x30 [ 72.533276][ T1364] RIP: 0033:0xf61da3 [ 72.533298][ T1364] Code: Unable to access opcode bytes at 0xf61d79. [ 72.533306][ T1364] RSP: 002b:0000200000000068 EFLAGS: 00010217 [ 72.533323][ T1364] RAX: 0000000000000000 RBX: 00007fdfcc226090 RCX: 00007fdfcbf9f559 [ 72.533335][ T1364] RDX: 0000200000000080 RSI: 0000200000000060 RDI: 0000000001000200 [ 72.533346][ T1364] RBP: 00007fdfcc036b20 R08: 0000200000000100 R09: 0000200000000100 [ 72.533358][ T1364] R10: 00002000000000c0 R11: 0000000000000206 R12: 0000000000000000 [ 72.533368][ T1364] R13: 00007fdfcc226128 R14: 00007fdfcc226090 R15: 00007ffe2215cc68 [ 72.533382][ T1364] [ 72.533390][ T1364] memory: usage 307200kB, limit 307200kB, failcnt 33956 [ 72.670648][ T31] usb 1-1: device descriptor read/64, error -71 [ 72.672387][ T1364] memory+swap: usage 399424kB, limit 9007199254740988kB, failcnt 0 [ 72.920620][ T31] usb 1-1: device descriptor read/64, error -71 [ 72.923481][ T1364] kmem: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 73.021992][ T1364] Memory cgroup stats for /syz1: [ 73.022126][ T1364] cache 314355712 [ 73.030922][ T31] usb usb1-port1: attempt power cycle [ 73.030940][ T1364] rss 102400 [ 73.039576][ T1364] rss_huge 0 [ 73.042931][ T1364] shmem 314355712 [ 73.046585][ T1364] mapped_file 0 [ 73.050112][ T1364] dirty 0 [ 73.053110][ T1364] writeback 0 [ 73.056392][ T1364] workingset_refault_anon 20 [ 73.061061][ T1364] workingset_refault_file 1091 [ 73.065853][ T1364] swap 127856640 [ 73.069399][ T1364] swapcached 135168 [ 73.073222][ T1364] pgpgin 210617 [ 73.076677][ T1364] pgpgout 134328 [ 73.080204][ T1364] pgfault 89238 [ 73.083689][ T1364] pgmajfault 21 [ 73.087157][ T1364] inactive_anon 219058176 [ 73.091550][ T1364] active_anon 95514624 [ 73.095657][ T1364] inactive_file 0 [ 73.099275][ T1364] active_file 0 [ 73.102992][ T1364] unevictable 0 [ 73.106543][ T1364] hierarchical_memory_limit 314572800 [ 73.112225][ T1364] hierarchical_memsw_limit 9223372036854771712 [ 73.118394][ T1364] total_cache 314355712 [ 73.122627][ T1364] total_rss 102400 [ 73.126411][ T1364] total_rss_huge 0 [ 73.130116][ T1364] total_shmem 314355712 [ 73.134329][ T1364] total_mapped_file 0 [ 73.138382][ T1364] total_dirty 0 [ 73.141864][ T1364] total_writeback 0 [ 73.145749][ T1364] total_workingset_refault_anon 20 [ 73.150917][ T10] usb 4-1: new low-speed USB device number 29 using dummy_hcd [ 73.158485][ T1364] total_workingset_refault_file 1091 [ 73.163882][ T1364] total_swap 127856640 [ 73.168206][ T1364] total_swapcached 135168 [ 73.172568][ T1364] total_pgpgin 210617 [ 73.176613][ T1364] total_pgpgout 134328 [ 73.180745][ T1364] total_pgfault 89238 [ 73.184782][ T1364] total_pgmajfault 21 [ 73.188743][ T1364] total_inactive_anon 219058176 [ 73.193908][ T1364] total_active_anon 95514624 [ 73.198544][ T1364] total_inactive_file 0 [ 73.202805][ T1364] total_active_file 0 [ 73.206856][ T1364] total_unevictable 0 [ 73.210849][ T1364] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz1,mems_allowed=0,oom_memcg=/syz1,task_memcg=/syz1,task=syz.1.263,pid=1342,uid=0 [ 73.225620][ T1364] Memory cgroup out of memory: Killed process 1342 (syz.1.263) total-vm:90424kB, anon-rss:1264kB, file-rss:50176kB, shmem-rss:0kB, UID:0 pgtables:184kB oom_score_adj:1000 [ 73.321693][ T10] usb 4-1: config 3 has an invalid interface number: 3 but max is 0 [ 73.329919][ T10] usb 4-1: config 3 has no interface number 0 [ 73.330027][ T1358] syz.1.263 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 73.337701][ T10] usb 4-1: config 3 interface 3 has no altsetting 0 [ 73.359634][ T10] usb 4-1: string descriptor 0 read error: -22 [ 73.366173][ T10] usb 4-1: New USB device found, idVendor=09fb, idProduct=6026, bcdDevice=ae.dc [ 73.375442][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 73.380712][ T31] usb 1-1: new high-speed USB device number 30 using dummy_hcd [ 73.386527][ T10] ftdi_sio 4-1:3.3: FTDI USB Serial Device converter detected [ 73.399677][ T10] ftdi_sio ttyUSB0: unknown device type: 0xaedc [ 73.411866][ T31] usb 1-1: device descriptor read/8, error -71 [ 73.450658][ T1358] CPU: 0 UID: 0 PID: 1358 Comm: syz.1.263 Not tainted syzkaller #0 5cdf496c3980d18a0efbb3b3e73d13bf69df874e [ 73.450699][ T1358] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 73.450712][ T1358] Call Trace: [ 73.450718][ T1358] [ 73.450727][ T1358] __dump_stack+0x21/0x30 [ 73.450769][ T1358] dump_stack_lvl+0x140/0x1c0 [ 73.450793][ T1358] ? __cfi_dump_stack_lvl+0x10/0x10 [ 73.450819][ T1358] ? ___ratelimit+0x41c/0x5c0 [ 73.450848][ T1358] ? __kasan_check_write+0x18/0x20 [ 73.450882][ T1358] dump_stack+0x19/0x20 [ 73.450904][ T1358] dump_header+0xd9/0x460 [ 73.450928][ T1358] oom_kill_process+0x35d/0x640 [ 73.450960][ T1358] out_of_memory+0x5d1/0xa20 [ 73.450983][ T1358] ? __cfi_out_of_memory+0x10/0x10 [ 73.451006][ T1358] ? mutex_lock_killable+0x97/0x1d0 [ 73.451030][ T1358] ? __cfi_mutex_lock_killable+0x10/0x10 [ 73.451053][ T1358] mem_cgroup_out_of_memory+0x2c5/0x390 [ 73.451084][ T1358] ? css_next_descendant_pre+0x1ec/0x210 [ 73.451112][ T1358] ? __kasan_check_write+0x18/0x20 [ 73.451134][ T1358] ? drain_obj_stock+0xec0/0xec0 [ 73.451159][ T1358] ? memcg1_oom_prepare+0x2c5/0x3a0 [ 73.451182][ T1358] try_charge_memcg+0x925/0xe10 [ 73.451207][ T1358] ? static_key_count+0x45/0x70 [ 73.451226][ T1358] ? lruvec_init+0x241/0x280 [ 73.451250][ T1358] ? __cfi_try_charge_memcg+0x10/0x10 [ 73.451271][ T1358] ? __alloc_pages_noprof+0x35a/0x7e0 [ 73.451292][ T1358] ? __cfi___alloc_pages_noprof+0x10/0x10 [ 73.451325][ T1358] __mem_cgroup_charge+0xfc/0x420 [ 73.451346][ T1358] ? folio_add_lru+0x116/0x400 [ 73.451365][ T1358] ? __cfi___mem_cgroup_charge+0x10/0x10 [ 73.451387][ T1358] shmem_alloc_and_add_folio+0x8e4/0x10b0 [ 73.451407][ T1358] ? shmem_replace_folio+0x9b0/0x9b0 [ 73.451425][ T1358] ? shmem_huge_global_enabled+0x2da/0x360 [ 73.451451][ T1358] ? shmem_allowable_huge_orders+0x1f7/0x430 [ 73.451475][ T1358] ? __kasan_check_write+0x18/0x20 [ 73.451497][ T1358] ? _raw_spin_lock+0x92/0x120 [ 73.451516][ T1358] shmem_get_folio_gfp+0x5cd/0x12e0 [ 73.451541][ T1358] ? shmem_get_folio+0xc0/0xc0 [ 73.451564][ T1358] ? __kasan_check_write+0x18/0x20 [ 73.451586][ T1358] ? inode_to_bdi+0x6d/0x100 [ 73.451612][ T1358] shmem_write_begin+0xf4/0x260 [ 73.451630][ T1358] generic_perform_write+0x32c/0x970 [ 73.451650][ T1358] ? inode_update_timestamps+0x4d1/0x6e0 [ 73.451677][ T1358] ? __cfi_generic_perform_write+0x10/0x10 [ 73.451697][ T1358] ? generic_write_checks_count+0x426/0x540 [ 73.451718][ T1358] ? mnt_get_write_access_file+0x1af/0x3b0 [ 73.451739][ T1358] ? mnt_put_write_access_file+0xc2/0x100 [ 73.451760][ T1358] ? file_update_time+0x1de/0x210 [ 73.451781][ T1358] shmem_file_write_iter+0x105/0x130 [ 73.451801][ T1358] __kernel_write_iter+0x45f/0x900 [ 73.451825][ T1358] ? __cfi___kernel_write_iter+0x10/0x10 [ 73.451848][ T1358] ? get_dump_page+0x165/0x220 [ 73.451869][ T1358] ? __asan_memset+0x39/0x50 [ 73.451891][ T1358] ? iov_iter_bvec+0xc0/0x180 [ 73.451914][ T1358] dump_user_range+0xb8b/0xe60 [ 73.451942][ T1358] ? __cfi_dump_user_range+0x10/0x10 [ 73.451966][ T1358] ? elf_coredump_extra_notes_write+0x426/0x4b0 [ 73.451993][ T1358] ? __cfi_elf_coredump_extra_notes_write+0x10/0x10 [ 73.452018][ T1358] ? elf_core_dump+0x23cf/0x3840 [ 73.452038][ T1358] elf_core_dump+0x2d61/0x3840 [ 73.452060][ T1358] ? __cfi_elf_core_dump+0x10/0x10 [ 73.452078][ T1358] ? mas_next_slot+0xf01/0xfd0 [ 73.452108][ T1358] ? dump_interrupted+0xf0/0xf0 [ 73.452130][ T1358] ? filp_open+0x199/0x1f0 [ 73.452150][ T1358] ? 0xffffffffff600000 [ 73.452166][ T1358] do_coredump+0x20d5/0x3050 [ 73.452191][ T1358] ? __cfi_do_coredump+0x10/0x10 [ 73.452213][ T1358] ? asm_exc_page_fault+0x2b/0x30 [ 73.452251][ T1358] ? __kasan_slab_free+0x6a/0x80 [ 73.452269][ T1358] ? get_signal+0xa2a/0x1490 [ 73.452295][ T1358] get_signal+0x11bf/0x1490 [ 73.452326][ T1358] arch_do_signal_or_restart+0xbc/0x700 [ 73.452348][ T1358] ? __cfi_arch_do_signal_or_restart+0x10/0x10 [ 73.452369][ T1358] ? __kasan_check_read+0x15/0x20 [ 73.452391][ T1358] irqentry_exit_to_user_mode+0x4d/0xb0 [ 73.452417][ T1358] irqentry_exit+0x16/0x60 [ 73.452472][ T1358] exc_page_fault+0x65/0xc0 [ 73.452496][ T1358] asm_exc_page_fault+0x2b/0x30 [ 73.452517][ T1358] RIP: 0033:0xf61da3 [ 73.452539][ T1358] Code: Unable to access opcode bytes at 0xf61d79. [ 73.452548][ T1358] RSP: 002b:0000200000000068 EFLAGS: 00010217 [ 73.452568][ T1358] RAX: 0000000000000000 RBX: 00007fdfcc226090 RCX: 00007fdfcbf9f559 [ 73.452582][ T1358] RDX: 0000200000000080 RSI: 0000200000000060 RDI: 0000000001000200 [ 73.452595][ T1358] RBP: 00007fdfcc036b20 R08: 0000200000000100 R09: 0000200000000100 [ 73.452609][ T1358] R10: 00002000000000c0 R11: 0000000000000206 R12: 0000000000000000 [ 73.452621][ T1358] R13: 00007fdfcc226128 R14: 00007fdfcc226090 R15: 00007ffe2215cc68 [ 73.452637][ T1358] [ 73.452713][ T1358] memory: usage 297048kB, limit 307200kB, failcnt 36207 [ 73.551635][ T31] usb 1-1: device descriptor read/8, error -71 [ 73.596686][ T10] usb 4-1: USB disconnect, device number 29 [ 73.826416][ T1358] memory+swap: usage 413504kB, limit 9007199254740988kB, failcnt 0 [ 73.829987][ T10] ftdi_sio 4-1:3.3: device disconnected [ 73.870654][ T31] usb 1-1: new high-speed USB device number 31 using dummy_hcd [ 73.942266][ T1358] kmem: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 74.001728][ T31] usb 1-1: device descriptor read/8, error -71 [ 74.027388][ T1358] Memory cgroup stats for /syz1: [ 74.027527][ T1358] cache 314470400 [ 74.036290][ T1358] rss 102400 [ 74.039577][ T1358] rss_huge 0 [ 74.044246][ T1358] shmem 314470400 [ 74.047895][ T1358] mapped_file 0 [ 74.051977][ T1358] dirty 0 [ 74.054922][ T1358] writeback 0 [ 74.058199][ T1358] workingset_refault_anon 20 [ 74.063041][ T1358] workingset_refault_file 1091 [ 74.067807][ T1358] swap 127975424 [ 74.071503][ T1358] swapcached 20480 [ 74.075294][ T1358] pgpgin 218068 [ 74.078751][ T1358] pgpgout 141779 [ 74.082491][ T1358] pgfault 89692 [ 74.086026][ T1358] pgmajfault 21 [ 74.089506][ T1358] inactive_anon 118157312 [ 74.093879][ T1358] active_anon 196141056 [ 74.098082][ T1358] inactive_file 0 [ 74.101737][ T1358] active_file 0 [ 74.105195][ T1358] unevictable 0 [ 74.108656][ T1358] hierarchical_memory_limit 314572800 [ 74.114065][ T1358] hierarchical_memsw_limit 9223372036854771712 [ 74.120215][ T1358] total_cache 314470400 [ 74.124394][ T1358] total_rss 102400 [ 74.128112][ T1358] total_rss_huge 0 [ 74.131851][ T1358] total_shmem 314470400 [ 74.135997][ T1358] total_mapped_file 0 [ 74.139959][ T1358] total_dirty 0 [ 74.141713][ T31] usb 1-1: device descriptor read/8, error -71 [ 74.143486][ T1358] total_writeback 0 [ 74.153374][ T1358] total_workingset_refault_anon 20 [ 74.158468][ T1358] total_workingset_refault_file 1091 [ 74.163769][ T1358] total_swap 127975424 [ 74.167858][ T1358] total_swapcached 20480 [ 74.172127][ T1358] total_pgpgin 218068 [ 74.176139][ T1358] total_pgpgout 141779 [ 74.180191][ T1358] total_pgfault 89692 [ 74.184208][ T1358] total_pgmajfault 21 [ 74.188183][ T1358] total_inactive_anon 118157312 [ 74.193041][ T1358] total_active_anon 196141056 [ 74.197770][ T1358] total_inactive_file 0 [ 74.201943][ T1358] total_active_file 0 [ 74.205916][ T1358] total_unevictable 0 [ 74.209875][ T1358] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz1,mems_allowed=0,oom_memcg=/syz1,task_memcg=/syz1,task=syz.1.263,pid=1353,uid=0 [ 74.224650][ T1358] Memory cgroup out of memory: Killed process 1353 (syz.1.263) total-vm:90424kB, anon-rss:1392kB, file-rss:53804kB, shmem-rss:0kB, UID:0 pgtables:212kB oom_score_adj:1000 [ 74.260796][ T31] usb usb1-port1: unable to enumerate USB device [ 74.299216][ T36] audit: type=1400 audit(1793285147.342:352): avc: denied { write } for pid=1578 comm="syz.2.309" name="file0" dev="tmpfs" ino=540 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 74.434339][ T1584] SELinux: policydb magic number 0x6c65732f does not match expected magic number 0xf97cff8c [ 74.467059][ T1584] SELinux: failed to load policy [ 74.688859][ T36] audit: type=1400 audit(1793285147.732:353): avc: denied { getopt } for pid=1608 comm="syz.3.312" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 74.735154][ T36] audit: type=1400 audit(1793285147.782:354): avc: denied { mount } for pid=1613 comm="syz.3.313" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 74.799018][ T1371] syz.1.263 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 74.812646][ T1371] CPU: 0 UID: 0 PID: 1371 Comm: syz.1.263 Not tainted syzkaller #0 5cdf496c3980d18a0efbb3b3e73d13bf69df874e [ 74.812676][ T1371] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 74.812688][ T1371] Call Trace: [ 74.812695][ T1371] [ 74.812702][ T1371] __dump_stack+0x21/0x30 [ 74.812735][ T1371] dump_stack_lvl+0x140/0x1c0 [ 74.812760][ T1371] ? __cfi_dump_stack_lvl+0x10/0x10 [ 74.812783][ T1371] ? ___ratelimit+0x41c/0x5c0 [ 74.812805][ T1371] ? __kasan_check_write+0x18/0x20 [ 74.812829][ T1371] dump_stack+0x19/0x20 [ 74.812852][ T1371] dump_header+0xd9/0x460 [ 74.812876][ T1371] oom_kill_process+0x35d/0x640 [ 74.812903][ T1371] out_of_memory+0x5d1/0xa20 [ 74.812927][ T1371] ? __cfi_out_of_memory+0x10/0x10 [ 74.812950][ T1371] ? mutex_lock_killable+0x115/0x1d0 [ 74.812973][ T1371] ? __cfi_mutex_lock_killable+0x10/0x10 [ 74.812995][ T1371] mem_cgroup_out_of_memory+0x2c5/0x390 [ 74.813019][ T1371] ? css_next_descendant_pre+0x1ec/0x210 [ 74.813048][ T1371] ? __kasan_check_write+0x18/0x20 [ 74.813069][ T1371] ? drain_obj_stock+0xec0/0xec0 [ 74.813093][ T1371] ? memcg1_oom_prepare+0x2c5/0x3a0 [ 74.813119][ T1371] try_charge_memcg+0x925/0xe10 [ 74.813138][ T1371] ? static_key_count+0x45/0x70 [ 74.813156][ T1371] ? lruvec_init+0x241/0x280 [ 74.813180][ T1371] ? __cfi_try_charge_memcg+0x10/0x10 [ 74.813201][ T1371] ? __alloc_pages_noprof+0x35a/0x7e0 [ 74.813223][ T1371] ? __cfi___alloc_pages_noprof+0x10/0x10 [ 74.813244][ T1371] __mem_cgroup_charge+0xfc/0x420 [ 74.813265][ T1371] ? __cfi___mem_cgroup_charge+0x10/0x10 [ 74.813287][ T1371] ? __schedule+0x1706/0x23d0 [ 74.813307][ T1371] shmem_alloc_and_add_folio+0x8e4/0x10b0 [ 74.813327][ T1371] ? shmem_replace_folio+0x9b0/0x9b0 [ 74.813345][ T1371] ? shmem_huge_global_enabled+0x2da/0x360 [ 74.813375][ T1371] ? shmem_allowable_huge_orders+0x1f7/0x430 [ 74.813400][ T1371] shmem_get_folio_gfp+0x5cd/0x12e0 [ 74.813425][ T1371] ? shmem_get_folio+0xc0/0xc0 [ 74.813448][ T1371] ? follow_page_pte+0x8fb/0xba0 [ 74.813469][ T1371] ? inode_to_bdi+0x6d/0x100 [ 74.813497][ T1371] shmem_write_begin+0xf4/0x260 [ 74.813515][ T1371] generic_perform_write+0x32c/0x970 [ 74.813537][ T1371] ? __cfi_generic_perform_write+0x10/0x10 [ 74.813556][ T1371] ? generic_write_checks_count+0x426/0x540 [ 74.813579][ T1371] ? file_update_time+0xa3/0x210 [ 74.813600][ T1371] shmem_file_write_iter+0x105/0x130 [ 74.813619][ T1371] __kernel_write_iter+0x45f/0x900 [ 74.813644][ T1371] ? __cfi___kernel_write_iter+0x10/0x10 [ 74.813667][ T1371] ? get_dump_page+0x165/0x220 [ 74.813685][ T1371] ? __asan_memset+0x39/0x50 [ 74.813707][ T1371] ? iov_iter_bvec+0xc0/0x180 [ 74.813729][ T1371] dump_user_range+0xb8b/0xe60 [ 74.813755][ T1371] ? __cfi_dump_user_range+0x10/0x10 [ 74.813779][ T1371] ? elf_coredump_extra_notes_write+0x426/0x4b0 [ 74.813813][ T1371] ? __cfi_elf_coredump_extra_notes_write+0x10/0x10 [ 74.813839][ T1371] ? elf_core_dump+0x23cf/0x3840 [ 74.813859][ T1371] elf_core_dump+0x2d61/0x3840 [ 74.813879][ T1371] ? __cfi_elf_core_dump+0x10/0x10 [ 74.813897][ T1371] ? mas_next_slot+0xf01/0xfd0 [ 74.813925][ T1371] ? dump_interrupted+0xf0/0xf0 [ 74.813947][ T1371] ? filp_open+0x199/0x1f0 [ 74.813966][ T1371] ? 0xffffffffff600000 [ 74.813981][ T1371] do_coredump+0x20d5/0x3050 [ 74.814004][ T1371] ? __cfi_do_coredump+0x10/0x10 [ 74.814026][ T1371] ? asm_exc_page_fault+0x2b/0x30 [ 74.814056][ T1371] ? __kasan_slab_free+0x6a/0x80 [ 74.814075][ T1371] ? get_signal+0xa2a/0x1490 [ 74.814101][ T1371] get_signal+0x11bf/0x1490 [ 74.814127][ T1371] arch_do_signal_or_restart+0xbc/0x700 [ 74.814147][ T1371] ? __cfi_arch_do_signal_or_restart+0x10/0x10 [ 74.814169][ T1371] ? __kasan_check_read+0x15/0x20 [ 74.814190][ T1371] irqentry_exit_to_user_mode+0x4d/0xb0 [ 74.814216][ T1371] irqentry_exit+0x16/0x60 [ 74.814238][ T1371] exc_page_fault+0x65/0xc0 [ 74.814261][ T1371] asm_exc_page_fault+0x2b/0x30 [ 74.814281][ T1371] RIP: 0033:0xf61da3 [ 74.814301][ T1371] Code: Unable to access opcode bytes at 0xf61d79. [ 74.814308][ T1371] RSP: 002b:0000200000000068 EFLAGS: 00010217 [ 74.814325][ T1371] RAX: 0000000000000000 RBX: 00007fdfcc226090 RCX: 00007fdfcbf9f559 [ 74.814337][ T1371] RDX: 0000200000000080 RSI: 0000200000000060 RDI: 0000000001000200 [ 74.814350][ T1371] RBP: 00007fdfcc036b20 R08: 0000200000000100 R09: 0000200000000100 [ 74.814362][ T1371] R10: 00002000000000c0 R11: 0000000000000206 R12: 0000000000000000 [ 74.814373][ T1371] R13: 00007fdfcc226128 R14: 00007fdfcc226090 R15: 00007ffe2215cc68 [ 74.814387][ T1371] [ 74.981772][ T31] usb 1-1: new high-speed USB device number 32 using dummy_hcd [ 75.150642][ T1371] memory: usage 288784kB, limit 307200kB, failcnt 41965 [ 75.338758][ T1371] memory+swap: usage 432176kB, limit 9007199254740988kB, failcnt 0 [ 75.380651][ T31] usb 1-1: Using ep0 maxpacket: 32 [ 75.399536][ T31] usb 1-1: unable to get BOS descriptor or descriptor too short [ 75.407546][ T1371] kmem: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 75.415058][ T31] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 75.428146][ T31] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x8E has an invalid bInterval 0, changing to 7 [ 75.456688][ T31] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 75.465466][ T1371] Memory cgroup stats for /syz1: [ 75.466580][ T1371] cache 314470400 [ 75.475331][ T31] usb 1-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 75.504670][ T31] usb 1-1: New USB device found, idVendor=0e41, idProduct=4244, bcdDevice= 0.40 [ 75.507545][ T36] audit: type=1400 audit(1793285148.552:355): avc: denied { lock } for pid=1631 comm="syz.2.314" path="/dev/kvm" dev="devtmpfs" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 75.514037][ T31] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 75.537778][ T1632] netlink: 4 bytes leftover after parsing attributes in process `syz.2.314'. [ 75.551765][ T1371] rss 102400 [ 75.566995][ T31] usb 1-1: Product: syz [ 75.576995][ T31] usb 1-1: Manufacturer: syz [ 75.587749][ T36] audit: type=1400 audit(1793285148.552:356): avc: denied { bind } for pid=1631 comm="syz.2.314" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 75.590657][ T31] usb 1-1: SerialNumber: syz [ 75.610652][ T36] audit: type=1400 audit(1793285148.552:357): avc: denied { setopt } for pid=1631 comm="syz.2.314" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 75.633384][ T1371] rss_huge 0 [ 75.637710][ T1371] shmem 314458112 [ 75.644934][ T1371] mapped_file 4096 [ 75.648698][ T1371] dirty 0 [ 75.651786][ T1371] writeback 0 [ 75.655186][ T1371] workingset_refault_anon 21 [ 75.659796][ T1371] workingset_refault_file 2165 [ 75.664771][ T1371] swap 127975424 [ 75.673646][ T1371] swapcached 20480 [ 75.677563][ T1371] pgpgin 231907 [ 75.681085][ T1371] pgpgout 155618 [ 75.684739][ T1371] pgfault 90402 [ 75.690119][ T1371] pgmajfault 26 [ 75.693742][ T1371] inactive_anon 221089792 [ 75.699026][ T1371] active_anon 93470720 [ 75.703203][ T1371] inactive_file 8192 [ 75.707184][ T1371] active_file 0 [ 75.714740][ T1371] unevictable 0 [ 75.720625][ T1371] hierarchical_memory_limit 314572800 [ 75.730645][ T1371] hierarchical_memsw_limit 9223372036854771712 [ 75.739869][ T1371] total_cache 314470400 [ 75.744162][ T1371] total_rss 102400 [ 75.748572][ T1371] total_rss_huge 0 [ 75.753908][ T1371] total_shmem 314458112 [ 75.758108][ T1371] total_mapped_file 4096 [ 75.762443][ T1371] total_dirty 0 [ 75.767887][ T1371] total_writeback 0 [ 75.771821][ T1371] total_workingset_refault_anon 21 [ 75.777029][ T1371] total_workingset_refault_file 2165 [ 75.782404][ T1371] total_swap 127975424 [ 75.788020][ T1371] total_swapcached 20480 [ 75.792477][ T1371] total_pgpgin 231907 [ 75.796467][ T1371] total_pgpgout 155618 [ 75.800554][ T1371] total_pgfault 90402 [ 75.804770][ T1371] total_pgmajfault 26 [ 75.808774][ T1371] total_inactive_anon 221089792 [ 75.813898][ T1371] total_active_anon 93470720 [ 75.818516][ T1371] total_inactive_file 8192 [ 75.825813][ T1371] total_active_file 0 [ 75.829837][ T1371] total_unevictable 0 [ 75.840334][ T1371] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz1,mems_allowed=0,oom_memcg=/syz1,task_memcg=/syz1,task=syz.1.263,pid=1347,uid=0 [ 75.846348][ T31] usb 1-1: MIDIStreaming interface descriptor not found [ 75.858153][ T1371] Memory cgroup out of memory: Killed process 1347 (syz.1.263) total-vm:90424kB, anon-rss:1264kB, file-rss:48768kB, shmem-rss:0kB, UID:0 pgtables:180kB oom_score_adj:1000 [ 75.920760][ T31] usb 1-1: USB disconnect, device number 32 [ 76.068587][ T293] syz-executor invoked oom-killer: gfp_mask=0x2100cca(GFP_HIGHUSER_MOVABLE|__GFP_CMA), order=0, oom_score_adj=0 [ 76.190632][ T597] usb 3-1: new high-speed USB device number 20 using dummy_hcd [ 76.240636][ T293] CPU: 1 UID: 0 PID: 293 Comm: syz-executor Not tainted syzkaller #0 5cdf496c3980d18a0efbb3b3e73d13bf69df874e [ 76.240671][ T293] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 76.240682][ T293] Call Trace: [ 76.240688][ T293] [ 76.240697][ T293] __dump_stack+0x21/0x30 [ 76.240727][ T293] dump_stack_lvl+0x140/0x1c0 [ 76.240750][ T293] ? __cfi_dump_stack_lvl+0x10/0x10 [ 76.240774][ T293] ? ___ratelimit+0x41c/0x5c0 [ 76.240795][ T293] ? __kasan_check_write+0x18/0x20 [ 76.240822][ T293] dump_stack+0x19/0x20 [ 76.240844][ T293] dump_header+0xd9/0x460 [ 76.240872][ T293] oom_kill_process+0x35d/0x640 [ 76.240903][ T293] out_of_memory+0x5d1/0xa20 [ 76.240926][ T293] ? __cfi_out_of_memory+0x10/0x10 [ 76.240949][ T293] ? mutex_lock_killable+0x97/0x1d0 [ 76.240971][ T293] ? __cfi_mutex_lock_killable+0x10/0x10 [ 76.240995][ T293] mem_cgroup_out_of_memory+0x2c5/0x390 [ 76.241019][ T293] ? css_next_descendant_pre+0x1ec/0x210 [ 76.241046][ T293] ? __kasan_check_write+0x18/0x20 [ 76.241067][ T293] ? drain_obj_stock+0xec0/0xec0 [ 76.241091][ T293] ? memcg1_oom_prepare+0x2c5/0x3a0 [ 76.241114][ T293] try_charge_memcg+0x925/0xe10 [ 76.241135][ T293] ? __cfi_try_charge_memcg+0x10/0x10 [ 76.241157][ T293] mem_cgroup_swapin_charge_folio+0x1b3/0x3e0 [ 76.241181][ T293] __read_swap_cache_async+0x496/0x860 [ 76.241206][ T293] ? __asan_memcpy+0x5a/0x80 [ 76.241227][ T293] ? __kasan_check_write+0x18/0x20 [ 76.241249][ T293] ? __cfi___read_swap_cache_async+0x10/0x10 [ 76.241274][ T293] ? __asan_memset+0x39/0x50 [ 76.241295][ T293] ? blk_start_plug+0x71/0x1c0 [ 76.241314][ T293] swap_cluster_readahead+0x321/0x570 [ 76.241347][ T293] ? __cfi_swap_cluster_readahead+0x10/0x10 [ 76.241376][ T293] ? is_bpf_text_address+0x17b/0x1a0 [ 76.241399][ T293] swapin_readahead+0x102/0x840 [ 76.241422][ T293] ? __cfi_stack_trace_consume_entry+0x10/0x10 [ 76.241447][ T293] ? __cfi___filemap_get_folio+0x10/0x10 [ 76.241465][ T293] ? __cfi_swapin_readahead+0x10/0x10 [ 76.241489][ T293] ? stack_depot_save_flags+0x38/0x800 [ 76.241510][ T293] ? get_swap_device+0x10f/0x290 [ 76.241526][ T293] do_swap_page+0x4bc/0x4b30 [ 76.241550][ T293] ? security_file_alloc+0x49/0x220 [ 76.241571][ T293] ? init_file+0x9e/0x210 [ 76.241589][ T293] ? alloc_empty_file+0xd9/0x270 [ 76.241607][ T293] ? __sys_socket+0x14c/0x1c0 [ 76.241626][ T293] ? __x64_sys_socket+0x7e/0x90 [ 76.241645][ T293] ? x64_sys_call+0x2608/0x2ee0 [ 76.241662][ T293] ? do_syscall_64+0x57/0xf0 [ 76.241682][ T293] ? __cfi_do_swap_page+0x10/0x10 [ 76.241707][ T293] ? __cfi_default_wake_function+0x10/0x10 [ 76.241731][ T293] ? pte_offset_map_rw_nolock+0x236/0x2c0 [ 76.241754][ T293] handle_mm_fault+0x1238/0x1ba0 [ 76.241774][ T293] ? __cfi_handle_mm_fault+0x10/0x10 [ 76.241790][ T293] ? lock_vma_under_rcu+0x4cf/0x590 [ 76.241809][ T293] ? tcp_v4_init_sock+0x19/0x60 [ 76.241832][ T293] do_user_addr_fault+0x951/0x1230 [ 76.241850][ T293] ? fd_install+0x246/0x400 [ 76.241874][ T293] ? fpregs_assert_state_consistent+0xb6/0xe0 [ 76.241898][ T293] exc_page_fault+0x58/0xc0 [ 76.241921][ T293] asm_exc_page_fault+0x2b/0x30 [ 76.241942][ T293] RIP: 0033:0x7fdfcbe55ada [ 76.241959][ T293] Code: 00 41 56 45 31 f6 41 55 41 54 55 53 48 8d 1d 9d d9 39 00 48 81 ec a8 06 00 00 e8 f1 b2 14 00 89 c5 83 f8 ff 0f 84 e6 01 00 00 <8b> 43 a8 85 c0 75 2f 41 83 c6 01 48 81 c3 80 06 00 00 41 83 fe 03 [ 76.241974][ T293] RSP: 002b:00007ffe2215c8f0 EFLAGS: 00010297 [ 76.241991][ T293] RAX: 0000000000000000 RBX: 00007fdfcc1f4160 RCX: 00007fdfcbfa0dc7 [ 76.242005][ T293] RDX: 0000000000000006 RSI: 0000000000000001 RDI: 0000000000000002 [ 76.242017][ T293] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000 [ 76.242028][ T293] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000041 [ 76.242041][ T293] R13: 0000555585e148e0 R14: 0000000000000002 R15: 00007ffe2215d060 [ 76.242056][ T293] [ 76.350613][ T597] usb 3-1: Using ep0 maxpacket: 16 [ 76.356216][ T293] memory: usage 306004kB, limit 307200kB, failcnt 43405 [ 76.361336][ T597] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 76.363088][ T293] memory+swap: usage 430864kB, limit 9007199254740988kB, failcnt 0 [ 76.367544][ T597] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 96 [ 76.373216][ T293] kmem: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 76.384693][ T597] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 8 [ 76.392786][ T293] Memory cgroup stats for [ 76.400644][ T597] usb 3-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 18 [ 76.409894][ T293] /syz1: [ 76.421477][ T597] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 76.426808][ T293] cache 313630720 [ 76.431505][ T597] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 76.437744][ T293] rss 102400 [ 76.450675][ T597] usb 3-1: SerialNumber: syz [ 76.454216][ T293] rss_huge 0 [ 76.467906][ T1667] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 76.472209][ T293] shmem 313626624 [ 76.480141][ T1667] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 76.500617][ T293] mapped_file 0 [ 76.513425][ T597] hub 3-1:1.0: bad descriptor, ignoring hub [ 76.555052][ T293] dirty 0 [ 76.580716][ T597] hub 3-1:1.0: probe with driver hub failed with error -5 [ 76.703247][ T1691] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=16 sclass=netlink_audit_socket pid=1691 comm=syz.0.316 [ 76.714701][ T1667] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 76.798854][ T36] audit: type=1400 audit(1793285149.762:358): avc: denied { audit_write } for pid=1688 comm="syz.0.316" capability=29 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 76.822838][ T1667] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 76.830517][ T293] writeback 118784 [ 76.837838][ T293] workingset_refault_anon 21 [ 76.842741][ T293] workingset_refault_file 2165 [ 76.847612][ T293] swap 127856640 [ 76.851255][ T293] swapcached 139264 [ 76.851429][ T1693] ./dev/sda1: Can't lookup blockdev [ 76.855073][ T293] pgpgin 235760 [ 76.855084][ T293] pgpgout 159625 [ 76.867358][ T293] pgfault 90600 [ 76.872731][ T293] pgmajfault 26 [ 76.882103][ T293] inactive_anon 89452544 [ 76.886662][ T293] active_anon 222801920 [ 76.893564][ T293] inactive_file 4096 [ 76.897569][ T293] active_file 0 [ 76.901342][ T293] unevictable 0 [ 76.905104][ T293] hierarchical_memory_limit 314572800 [ 76.952671][ T293] hierarchical_memsw_limit 9223372036854771712 [ 76.959606][ T293] total_cache 313630720 [ 76.972141][ T293] total_rss 102400 [ 76.976085][ T293] total_rss_huge 0 [ 76.979993][ T293] total_shmem 313626624 [ 76.991993][ T293] total_mapped_file 0 [ 76.997358][ T293] total_dirty 0 [ 77.001105][ T293] total_writeback 118784 [ 77.005366][ T293] total_workingset_refault_anon 21 [ 77.010494][ T293] total_workingset_refault_file 2165 [ 77.015853][ T293] total_swap 127856640 [ 77.019934][ T293] total_swapcached 139264 [ 77.024647][ T293] total_pgpgin 235760 [ 77.028670][ T293] total_pgpgout 159625 [ 77.034029][ T293] total_pgfault 90600 [ 77.038214][ T293] total_pgmajfault 26 [ 77.042321][ T293] total_inactive_anon 89452544 [ 77.047160][ T293] total_active_anon 222801920 [ 77.051935][ T293] total_inactive_file 4096 [ 77.056381][ T293] total_active_file 0 [ 77.060389][ T293] total_unevictable 0 [ 77.064529][ T293] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz1,mems_allowed=0,oom_memcg=/syz1,task_memcg=/syz1,task=syz.1.263,pid=1344,uid=0 [ 77.079375][ T293] Memory cgroup out of memory: Killed process 1344 (syz.1.263) total-vm:90424kB, anon-rss:1264kB, file-rss:53932kB, shmem-rss:0kB, UID:0 pgtables:212kB oom_score_adj:1000 [ 77.233754][ T1371] syz.1.263 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 77.246060][ T597] cdc_ether 3-1:1.0 usb0: register 'cdc_ether' at usb-dummy_hcd.2-1, CDC Ethernet Device, 42:42:42:42:42:42 [ 77.322203][ T1371] CPU: 0 UID: 0 PID: 1371 Comm: syz.1.263 Not tainted syzkaller #0 5cdf496c3980d18a0efbb3b3e73d13bf69df874e [ 77.322245][ T1371] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 77.322257][ T1371] Call Trace: [ 77.322263][ T1371] [ 77.322271][ T1371] __dump_stack+0x21/0x30 [ 77.322300][ T1371] dump_stack_lvl+0x140/0x1c0 [ 77.322324][ T1371] ? __cfi_dump_stack_lvl+0x10/0x10 [ 77.322347][ T1371] ? ___ratelimit+0x41c/0x5c0 [ 77.322367][ T1371] ? __kasan_check_write+0x18/0x20 [ 77.322390][ T1371] dump_stack+0x19/0x20 [ 77.322412][ T1371] dump_header+0xd9/0x460 [ 77.322434][ T1371] oom_kill_process+0x35d/0x640 [ 77.322459][ T1371] out_of_memory+0x5d1/0xa20 [ 77.322482][ T1371] ? __cfi_out_of_memory+0x10/0x10 [ 77.322504][ T1371] ? mutex_lock_killable+0x97/0x1d0 [ 77.322527][ T1371] ? __cfi_mutex_lock_killable+0x10/0x10 [ 77.322551][ T1371] mem_cgroup_out_of_memory+0x2c5/0x390 [ 77.322576][ T1371] ? css_next_descendant_pre+0x1ec/0x210 [ 77.322601][ T1371] ? __kasan_check_write+0x18/0x20 [ 77.322622][ T1371] ? drain_obj_stock+0xec0/0xec0 [ 77.322646][ T1371] ? memcg1_oom_prepare+0x2c5/0x3a0 [ 77.322670][ T1371] try_charge_memcg+0x925/0xe10 [ 77.322689][ T1371] ? static_key_count+0x45/0x70 [ 77.322708][ T1371] ? lruvec_init+0x241/0x280 [ 77.322731][ T1371] ? __cfi_try_charge_memcg+0x10/0x10 [ 77.322748][ T1371] ? __alloc_pages_noprof+0x35a/0x7e0 [ 77.322767][ T1371] ? __cfi___alloc_pages_noprof+0x10/0x10 [ 77.322784][ T1371] __mem_cgroup_charge+0xfc/0x420 [ 77.322802][ T1371] ? folio_add_lru+0x116/0x400 [ 77.322819][ T1371] ? __cfi___mem_cgroup_charge+0x10/0x10 [ 77.322840][ T1371] shmem_alloc_and_add_folio+0x8e4/0x10b0 [ 77.322858][ T1371] ? shmem_replace_folio+0x9b0/0x9b0 [ 77.322874][ T1371] ? shmem_huge_global_enabled+0x2da/0x360 [ 77.322896][ T1371] ? shmem_allowable_huge_orders+0x1f7/0x430 [ 77.322919][ T1371] ? __kasan_check_write+0x18/0x20 [ 77.322940][ T1371] ? _raw_spin_lock+0x92/0x120 [ 77.322958][ T1371] shmem_get_folio_gfp+0x5cd/0x12e0 [ 77.322982][ T1371] ? shmem_get_folio+0xc0/0xc0 [ 77.323006][ T1371] ? follow_page_pte+0x8fb/0xba0 [ 77.323025][ T1371] ? inode_to_bdi+0x6d/0x100 [ 77.323045][ T1371] shmem_write_begin+0xf4/0x260 [ 77.323062][ T1371] generic_perform_write+0x32c/0x970 [ 77.323083][ T1371] ? __cfi_generic_perform_write+0x10/0x10 [ 77.323102][ T1371] ? generic_write_checks_count+0x426/0x540 [ 77.323123][ T1371] ? file_update_time+0xa3/0x210 [ 77.323145][ T1371] shmem_file_write_iter+0x105/0x130 [ 77.323165][ T1371] __kernel_write_iter+0x45f/0x900 [ 77.323189][ T1371] ? __cfi___kernel_write_iter+0x10/0x10 [ 77.323211][ T1371] ? get_dump_page+0x165/0x220 [ 77.323238][ T1371] ? __asan_memset+0x39/0x50 [ 77.323259][ T1371] ? iov_iter_bvec+0xc0/0x180 [ 77.323286][ T1371] dump_user_range+0xb8b/0xe60 [ 77.323312][ T1371] ? __cfi_dump_user_range+0x10/0x10 [ 77.323336][ T1371] ? elf_coredump_extra_notes_write+0x426/0x4b0 [ 77.323363][ T1371] ? __cfi_elf_coredump_extra_notes_write+0x10/0x10 [ 77.323390][ T1371] ? elf_core_dump+0x23cf/0x3840 [ 77.323408][ T1371] elf_core_dump+0x2d61/0x3840 [ 77.323429][ T1371] ? __cfi_elf_core_dump+0x10/0x10 [ 77.323447][ T1371] ? mas_next_slot+0xf01/0xfd0 [ 77.323475][ T1371] ? dump_interrupted+0xf0/0xf0 [ 77.323497][ T1371] ? filp_open+0x199/0x1f0 [ 77.323516][ T1371] ? 0xffffffffff600000 [ 77.323531][ T1371] do_coredump+0x20d5/0x3050 [ 77.323555][ T1371] ? __cfi_do_coredump+0x10/0x10 [ 77.323577][ T1371] ? asm_exc_page_fault+0x2b/0x30 [ 77.323606][ T1371] ? __kasan_slab_free+0x6a/0x80 [ 77.323622][ T1371] ? get_signal+0xa2a/0x1490 [ 77.323647][ T1371] get_signal+0x11bf/0x1490 [ 77.323673][ T1371] arch_do_signal_or_restart+0xbc/0x700 [ 77.323692][ T1371] ? __cfi_arch_do_signal_or_restart+0x10/0x10 [ 77.323713][ T1371] ? __kasan_check_read+0x15/0x20 [ 77.323733][ T1371] irqentry_exit_to_user_mode+0x4d/0xb0 [ 77.323758][ T1371] irqentry_exit+0x16/0x60 [ 77.323780][ T1371] exc_page_fault+0x65/0xc0 [ 77.323807][ T1371] asm_exc_page_fault+0x2b/0x30 [ 77.323828][ T1371] RIP: 0033:0xf61da3 [ 77.323847][ T1371] Code: Unable to access opcode bytes at 0xf61d79. [ 77.323855][ T1371] RSP: 002b:0000200000000068 EFLAGS: 00010217 [ 77.323873][ T1371] RAX: 0000000000000000 RBX: 00007fdfcc226090 RCX: 00007fdfcbf9f559 [ 77.323886][ T1371] RDX: 0000200000000080 RSI: 0000200000000060 RDI: 0000000001000200 [ 77.323899][ T1371] RBP: 00007fdfcc036b20 R08: 0000200000000100 R09: 0000200000000100 [ 77.323912][ T1371] R10: 00002000000000c0 R11: 0000000000000206 R12: 0000000000000000 [ 77.323923][ T1371] R13: 00007fdfcc226128 R14: 00007fdfcc226090 R15: 00007ffe2215cc68 [ 77.323939][ T1371] [ 77.323946][ T1371] memory: usage 303800kB, limit 307200kB, failcnt 44857 [ 77.810659][ T1371] memory+swap: usage 411996kB, limit 9007199254740988kB, failcnt 0 [ 77.862249][ T1371] kmem: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 77.907604][ T1371] Memory cgroup stats for /syz1: [ 77.907847][ T1371] cache 286883840 [ 77.920604][ T1371] rss 180224 [ 77.923890][ T1371] rss_huge 0 [ 77.927092][ T1371] shmem 286879744 [ 77.971204][ C1] cdc_ether 3-1:1.0 usb0: CDC: unexpected notification 68! [ 78.040618][ T1371] mapped_file 0 [ 78.044173][ T1371] dirty 0 [ 78.047169][ T1371] writeback 73728 [ 78.082249][ T36] audit: type=1400 audit(1793285152.133:359): avc: denied { setcurrent } for pid=1723 comm="syz.0.321" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 78.118023][ T1371] workingset_refault_anon 30 [ 78.154399][ T1371] workingset_refault_file 2788 [ 78.159222][ T1371] swap 127885312 [ 78.169375][ T1371] swapcached 110592 [ 78.173357][ T1371] pgpgin 244737 [ 78.176821][ T1371] pgpgout 175142 [ 78.180437][ T1371] pgfault 91163 [ 78.183917][ T1371] pgmajfault 39 [ 78.187406][ T1371] inactive_anon 102805504 [ 78.189764][ T311] usb 3-1: USB disconnect, device number 20 [ 78.191901][ T1371] active_anon 182476800 [ 78.200155][ T311] cdc_ether 3-1:1.0 usb0: unregister 'cdc_ether' usb-dummy_hcd.2-1, CDC Ethernet Device [ 78.204602][ T1371] inactive_file 0 [ 78.218938][ T1371] active_file 4096 [ 78.223084][ T1371] unevictable 0 [ 78.226590][ T1371] hierarchical_memory_limit 314572800 [ 78.243802][ T1371] hierarchical_memsw_limit 9223372036854771712 [ 78.259222][ T1371] total_cache 286883840 [ 78.276043][ T1371] total_rss 180224 [ 78.279891][ T1371] total_rss_huge 0 [ 78.295139][ T1371] total_shmem 286879744 [ 78.301591][ T1371] total_mapped_file 0 [ 78.308102][ T1371] total_dirty 0 [ 78.311718][ T1742] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 78.315129][ T36] audit: type=1400 audit(1793285152.363:360): avc: denied { mounton } for pid=1736 comm="syz.0.325" path="/86/file0" dev="fuse" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=file permissive=1 [ 78.330400][ T1742] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 78.342353][ T1371] total_writeback 73728 [ 78.351442][ T36] audit: type=1400 audit(1793285152.403:361): avc: denied { mount } for pid=1739 comm="syz.3.324" name="/" dev="configfs" ino=833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=filesystem permissive=1 [ 78.356072][ T1371] total_workingset_refault_anon 30 [ 78.386237][ T1371] total_workingset_refault_file 2788 [ 78.400622][ T1371] total_swap 127885312 [ 78.404744][ T1371] total_swapcached 110592 [ 78.413494][ T1371] total_pgpgin 244737 [ 78.417511][ T1371] total_pgpgout 175142 [ 78.421620][ T1371] total_pgfault 91163 [ 78.426900][ T1371] total_pgmajfault 39 [ 78.430991][ T1371] total_inactive_anon 102805504 [ 78.437947][ T1371] total_active_anon 182476800 [ 78.442686][ T1371] total_inactive_file 0 [ 78.446839][ T1371] total_active_file 4096 [ 78.451242][ T1371] total_unevictable 0 [ 78.451487][ T1745] overlayfs: missing 'lowerdir' [ 78.455266][ T1371] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz1,mems_allowed=0,oom_memcg=/syz1,task_memcg=/syz1,task=syz.1.263,pid=1366,uid=0 [ 78.462165][ T1742] overlayfs: missing 'lowerdir' [ 78.476244][ T1371] Memory cgroup out of memory: Killed process 1366 (syz.1.263) total-vm:90424kB, anon-rss:1264kB, file-rss:53828kB, shmem-rss:0kB, UID:0 pgtables:204kB oom_score_adj:1000 [ 78.540642][ T310] usb 4-1: new low-speed USB device number 30 using dummy_hcd [ 78.606075][ T1367] syz.1.263 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 78.627064][ T1367] CPU: 1 UID: 0 PID: 1367 Comm: syz.1.263 Not tainted syzkaller #0 5cdf496c3980d18a0efbb3b3e73d13bf69df874e [ 78.627107][ T1367] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 78.627120][ T1367] Call Trace: [ 78.627126][ T1367] [ 78.627133][ T1367] __dump_stack+0x21/0x30 [ 78.627166][ T1367] dump_stack_lvl+0x140/0x1c0 [ 78.627187][ T1367] ? __cfi_dump_stack_lvl+0x10/0x10 [ 78.627212][ T1367] ? ___ratelimit+0x41c/0x5c0 [ 78.627232][ T1367] ? __kasan_check_write+0x18/0x20 [ 78.627254][ T1367] dump_stack+0x19/0x20 [ 78.627276][ T1367] dump_header+0xd9/0x460 [ 78.627299][ T1367] oom_kill_process+0x35d/0x640 [ 78.627325][ T1367] out_of_memory+0x5d1/0xa20 [ 78.627349][ T1367] ? __cfi_out_of_memory+0x10/0x10 [ 78.627370][ T1367] ? mutex_lock_killable+0x97/0x1d0 [ 78.627393][ T1367] ? __cfi_mutex_lock_killable+0x10/0x10 [ 78.627417][ T1367] mem_cgroup_out_of_memory+0x2c5/0x390 [ 78.627439][ T1367] ? css_next_descendant_pre+0x1ec/0x210 [ 78.627466][ T1367] ? __kasan_check_write+0x18/0x20 [ 78.627487][ T1367] ? drain_obj_stock+0xec0/0xec0 [ 78.627511][ T1367] ? memcg1_oom_prepare+0x2c5/0x3a0 [ 78.627542][ T1367] try_charge_memcg+0x925/0xe10 [ 78.627561][ T1367] ? static_key_count+0x45/0x70 [ 78.627580][ T1367] ? lruvec_init+0x241/0x280 [ 78.627603][ T1367] ? __cfi_try_charge_memcg+0x10/0x10 [ 78.627623][ T1367] ? __alloc_pages_noprof+0x35a/0x7e0 [ 78.627644][ T1367] ? __cfi___alloc_pages_noprof+0x10/0x10 [ 78.627669][ T1367] __mem_cgroup_charge+0xfc/0x420 [ 78.627690][ T1367] ? folio_add_lru+0x116/0x400 [ 78.627708][ T1367] ? __cfi___mem_cgroup_charge+0x10/0x10 [ 78.627732][ T1367] shmem_alloc_and_add_folio+0x8e4/0x10b0 [ 78.627752][ T1367] ? shmem_replace_folio+0x9b0/0x9b0 [ 78.627768][ T1367] ? shmem_huge_global_enabled+0x2da/0x360 [ 78.627793][ T1367] ? shmem_allowable_huge_orders+0x1f7/0x430 [ 78.627817][ T1367] ? __kasan_check_write+0x18/0x20 [ 78.627838][ T1367] ? _raw_spin_lock+0x92/0x120 [ 78.627857][ T1367] shmem_get_folio_gfp+0x5cd/0x12e0 [ 78.627882][ T1367] ? shmem_get_folio+0xc0/0xc0 [ 78.627901][ T1367] ? follow_page_pte+0x8fb/0xba0 [ 78.627921][ T1367] ? inode_to_bdi+0x6d/0x100 [ 78.627940][ T1367] shmem_write_begin+0xf4/0x260 [ 78.627958][ T1367] generic_perform_write+0x32c/0x970 [ 78.627980][ T1367] ? __cfi_generic_perform_write+0x10/0x10 [ 78.627999][ T1367] ? generic_write_checks_count+0x426/0x540 [ 78.628019][ T1367] ? file_update_time+0xa3/0x210 [ 78.628040][ T1367] shmem_file_write_iter+0x105/0x130 [ 78.628060][ T1367] __kernel_write_iter+0x45f/0x900 [ 78.628084][ T1367] ? __cfi___kernel_write_iter+0x10/0x10 [ 78.628113][ T1367] ? get_dump_page+0x165/0x220 [ 78.628132][ T1367] ? __asan_memset+0x39/0x50 [ 78.628153][ T1367] ? iov_iter_bvec+0xc0/0x180 [ 78.628174][ T1367] dump_user_range+0xb8b/0xe60 [ 78.628199][ T1367] ? __cfi_dump_user_range+0x10/0x10 [ 78.628224][ T1367] ? elf_coredump_extra_notes_write+0x426/0x4b0 [ 78.628251][ T1367] ? __cfi_elf_coredump_extra_notes_write+0x10/0x10 [ 78.628277][ T1367] ? elf_core_dump+0x23cf/0x3840 [ 78.628296][ T1367] elf_core_dump+0x2d61/0x3840 [ 78.628317][ T1367] ? __cfi_elf_core_dump+0x10/0x10 [ 78.628335][ T1367] ? mas_next_slot+0xf01/0xfd0 [ 78.628363][ T1367] ? dump_interrupted+0xf0/0xf0 [ 78.628384][ T1367] ? filp_open+0x199/0x1f0 [ 78.628403][ T1367] ? 0xffffffffff600000 [ 78.628419][ T1367] do_coredump+0x20d5/0x3050 [ 78.628443][ T1367] ? __cfi_do_coredump+0x10/0x10 [ 78.628464][ T1367] ? asm_exc_page_fault+0x2b/0x30 [ 78.628491][ T1367] ? __kasan_slab_free+0x6a/0x80 [ 78.628509][ T1367] ? get_signal+0xa2a/0x1490 [ 78.628533][ T1367] get_signal+0x11bf/0x1490 [ 78.628558][ T1367] arch_do_signal_or_restart+0xbc/0x700 [ 78.628578][ T1367] ? __cfi_arch_do_signal_or_restart+0x10/0x10 [ 78.628599][ T1367] ? __kasan_check_read+0x15/0x20 [ 78.628621][ T1367] irqentry_exit_to_user_mode+0x4d/0xb0 [ 78.628646][ T1367] irqentry_exit+0x16/0x60 [ 78.628667][ T1367] exc_page_fault+0x65/0xc0 [ 78.628689][ T1367] asm_exc_page_fault+0x2b/0x30 [ 78.628710][ T1367] RIP: 0033:0xf61da3 [ 78.628729][ T1367] Code: Unable to access opcode bytes at 0xf61d79. [ 78.628738][ T1367] RSP: 002b:0000200000000068 EFLAGS: 00010217 [ 78.628757][ T1367] RAX: 0000000000000000 RBX: 00007fdfcc226090 RCX: 00007fdfcbf9f559 [ 78.628770][ T1367] RDX: 0000200000000080 RSI: 0000200000000060 RDI: 0000000001000200 [ 78.628784][ T1367] RBP: 00007fdfcc036b20 R08: 0000200000000100 R09: 0000200000000100 [ 78.628797][ T1367] R10: 00002000000000c0 R11: 0000000000000206 R12: 0000000000000000 [ 78.628809][ T1367] R13: 00007fdfcc226128 R14: 00007fdfcc226090 R15: 00007ffe2215cc68 [ 78.628825][ T1367] [ 78.628882][ T1367] memory: usage 306268kB, limit 307200kB, failcnt 47263 [ 78.885804][ T1755] netlink: 'syz.2.326': attribute type 32 has an invalid length. [ 78.888459][ T310] usb 4-1: device descriptor read/64, error -71 [ 78.896370][ T1755] netlink: 8 bytes leftover after parsing attributes in process `syz.2.326'. [ 78.897984][ T1367] memory+swap: usage 431580kB, limit 9007199254740988kB, failcnt 0 [ 78.973496][ T36] audit: type=1400 audit(1793285152.953:362): avc: denied { write } for pid=1754 comm="syz.2.326" name="usb_gadget" dev="configfs" ino=834 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 78.979263][ T1367] kmem: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 78.982931][ T36] audit: type=1400 audit(1793285152.953:363): avc: denied { add_name } for pid=1754 comm="syz.2.326" name="g1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 78.988065][ T1367] Memory cgroup stats for [ 78.994462][ T36] audit: type=1400 audit(1793285152.953:364): avc: denied { create } for pid=1754 comm="syz.2.326" name="g1" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:configfs_t tclass=dir permissive=1 [ 78.999291][ T1367] /syz1: [ 78.999393][ T1367] cache 314245120 [ 79.170635][ T9] usb 3-1: new low-speed USB device number 21 using dummy_hcd [ 79.190133][ T1367] rss 188416 [ 79.207086][ T1367] rss_huge 0 [ 79.210318][ T1367] shmem 314245120 [ 79.214141][ T1367] mapped_file 0 [ 79.217685][ T1367] dirty 0 [ 79.220658][ T1367] writeback 0 [ 79.223935][ T1367] workingset_refault_anon 31 [ 79.228526][ T1367] workingset_refault_file 4338 [ 79.233329][ T1367] swap 127770624 [ 79.236880][ T1367] swapcached 159744 [ 79.240710][ T1367] pgpgin 261828 [ 79.244159][ T1367] pgpgout 185539 [ 79.247700][ T1367] pgfault 91832 [ 79.251707][ T1367] pgmajfault 48 [ 79.255159][ T1367] inactive_anon 83492864 [ 79.259381][ T1367] active_anon 231079936 [ 79.263552][ T1367] inactive_file 0 [ 79.267190][ T1367] active_file 0 [ 79.270679][ T1367] unevictable 0 [ 79.274131][ T1367] hierarchical_memory_limit 314572800 [ 79.279489][ T1367] hierarchical_memsw_limit 9223372036854771712 [ 79.285844][ T1367] total_cache 314245120 [ 79.289996][ T1367] total_rss 188416 [ 79.293748][ T1367] total_rss_huge 0 [ 79.297461][ T1367] total_shmem 314245120 [ 79.301667][ T1367] total_mapped_file 0 [ 79.305638][ T1367] total_dirty 0 [ 79.309077][ T1367] total_writeback 0 [ 79.312909][ T1367] total_workingset_refault_anon 31 [ 79.318028][ T1367] total_workingset_refault_file 4338 [ 79.323325][ T1367] total_swap 127770624 [ 79.327405][ T1367] total_swapcached 159744 [ 79.331761][ T1367] total_pgpgin 261828 [ 79.335734][ T1367] total_pgpgout 185539 [ 79.339786][ T1367] total_pgfault 91832 [ 79.340659][ T9] usb 3-1: device descriptor read/64, error -71 [ 79.343825][ T310] usb 4-1: device descriptor read/64, error -71 [ 79.350537][ T1367] total_pgmajfault 48 [ 79.360326][ T1367] total_inactive_anon 83492864 [ 79.365218][ T1367] total_active_anon 231079936 [ 79.369896][ T1367] total_inactive_file 0 [ 79.374071][ T1367] total_active_file 0 [ 79.378104][ T1367] total_unevictable 0 [ 79.382139][ T1367] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz1,mems_allowed=0,oom_memcg=/syz1,task_memcg=/syz1,task=syz.1.263,pid=1367,uid=0 [ 79.396930][ T1367] Memory cgroup out of memory: Killed process 1367 (syz.1.263) total-vm:90424kB, anon-rss:1264kB, file-rss:53848kB, shmem-rss:0kB, UID:0 pgtables:212kB oom_score_adj:1000 [ 79.580621][ T9] usb 3-1: device descriptor read/64, error -71 [ 79.581348][ T1341] syz.1.263 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 79.596873][ T310] usb 4-1: new low-speed USB device number 31 using dummy_hcd [ 79.650919][ T1341] CPU: 1 UID: 0 PID: 1341 Comm: syz.1.263 Not tainted syzkaller #0 5cdf496c3980d18a0efbb3b3e73d13bf69df874e [ 79.650952][ T1341] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 79.650965][ T1341] Call Trace: [ 79.650970][ T1341] [ 79.650978][ T1341] __dump_stack+0x21/0x30 [ 79.651008][ T1341] dump_stack_lvl+0x140/0x1c0 [ 79.651031][ T1341] ? __cfi_dump_stack_lvl+0x10/0x10 [ 79.651054][ T1341] ? ___ratelimit+0x41c/0x5c0 [ 79.651076][ T1341] ? __kasan_check_write+0x18/0x20 [ 79.651099][ T1341] dump_stack+0x19/0x20 [ 79.651122][ T1341] dump_header+0xd9/0x460 [ 79.651145][ T1341] oom_kill_process+0x35d/0x640 [ 79.651171][ T1341] out_of_memory+0x5d1/0xa20 [ 79.651194][ T1341] ? __cfi_out_of_memory+0x10/0x10 [ 79.651218][ T1341] ? mutex_lock_killable+0x97/0x1d0 [ 79.651241][ T1341] ? __cfi_mutex_lock_killable+0x10/0x10 [ 79.651264][ T1341] mem_cgroup_out_of_memory+0x2c5/0x390 [ 79.651288][ T1341] ? css_next_descendant_pre+0x1ec/0x210 [ 79.651313][ T1341] ? __kasan_check_write+0x18/0x20 [ 79.651335][ T1341] ? drain_obj_stock+0xec0/0xec0 [ 79.651358][ T1341] ? memcg1_oom_prepare+0x2c5/0x3a0 [ 79.651382][ T1341] try_charge_memcg+0x925/0xe10 [ 79.651401][ T1341] ? static_key_count+0x45/0x70 [ 79.651420][ T1341] ? lruvec_init+0x241/0x280 [ 79.651456][ T1341] ? __cfi_try_charge_memcg+0x10/0x10 [ 79.651476][ T1341] ? __alloc_pages_noprof+0x35a/0x7e0 [ 79.651497][ T1341] ? __cfi___alloc_pages_noprof+0x10/0x10 [ 79.651518][ T1341] __mem_cgroup_charge+0xfc/0x420 [ 79.651540][ T1341] ? folio_add_lru+0x116/0x400 [ 79.651557][ T1341] ? __cfi___mem_cgroup_charge+0x10/0x10 [ 79.651580][ T1341] shmem_alloc_and_add_folio+0x8e4/0x10b0 [ 79.651599][ T1341] ? shmem_replace_folio+0x9b0/0x9b0 [ 79.651617][ T1341] ? shmem_huge_global_enabled+0x2da/0x360 [ 79.651642][ T1341] ? shmem_allowable_huge_orders+0x1f7/0x430 [ 79.651666][ T1341] ? __kasan_check_write+0x18/0x20 [ 79.651687][ T1341] ? _raw_spin_lock+0x92/0x120 [ 79.651705][ T1341] shmem_get_folio_gfp+0x5cd/0x12e0 [ 79.651732][ T1341] ? shmem_get_folio+0xc0/0xc0 [ 79.651754][ T1341] ? follow_page_pte+0x8fb/0xba0 [ 79.651774][ T1341] ? inode_to_bdi+0x6d/0x100 [ 79.651794][ T1341] shmem_write_begin+0xf4/0x260 [ 79.651811][ T1341] generic_perform_write+0x32c/0x970 [ 79.651832][ T1341] ? __cfi_generic_perform_write+0x10/0x10 [ 79.651851][ T1341] ? generic_write_checks_count+0x426/0x540 [ 79.651871][ T1341] ? file_update_time+0xa3/0x210 [ 79.651892][ T1341] shmem_file_write_iter+0x105/0x130 [ 79.651911][ T1341] __kernel_write_iter+0x45f/0x900 [ 79.651934][ T1341] ? __cfi___kernel_write_iter+0x10/0x10 [ 79.651956][ T1341] ? get_dump_page+0x165/0x220 [ 79.651975][ T1341] ? __asan_memset+0x39/0x50 [ 79.651997][ T1341] ? iov_iter_bvec+0xc0/0x180 [ 79.652018][ T1341] dump_user_range+0xb8b/0xe60 [ 79.652044][ T1341] ? __cfi_dump_user_range+0x10/0x10 [ 79.652067][ T1341] ? elf_coredump_extra_notes_write+0x426/0x4b0 [ 79.652094][ T1341] ? __cfi_elf_coredump_extra_notes_write+0x10/0x10 [ 79.652121][ T1341] ? elf_core_dump+0x23cf/0x3840 [ 79.652141][ T1341] elf_core_dump+0x2d61/0x3840 [ 79.652161][ T1341] ? __cfi_elf_core_dump+0x10/0x10 [ 79.652178][ T1341] ? mas_next_slot+0xf01/0xfd0 [ 79.652206][ T1341] ? dump_interrupted+0xf0/0xf0 [ 79.652227][ T1341] ? filp_open+0x199/0x1f0 [ 79.652246][ T1341] ? 0xffffffffff600000 [ 79.652261][ T1341] do_coredump+0x20d5/0x3050 [ 79.652286][ T1341] ? __cfi_do_coredump+0x10/0x10 [ 79.652308][ T1341] ? asm_exc_page_fault+0x2b/0x30 [ 79.652336][ T1341] ? __kasan_slab_free+0x6a/0x80 [ 79.652354][ T1341] ? get_signal+0xa2a/0x1490 [ 79.652378][ T1341] get_signal+0x11bf/0x1490 [ 79.652403][ T1341] arch_do_signal_or_restart+0xbc/0x700 [ 79.652423][ T1341] ? __cfi_arch_do_signal_or_restart+0x10/0x10 [ 79.652453][ T1341] ? __kasan_check_read+0x15/0x20 [ 79.652475][ T1341] irqentry_exit_to_user_mode+0x4d/0xb0 [ 79.652501][ T1341] irqentry_exit+0x16/0x60 [ 79.652524][ T1341] exc_page_fault+0x65/0xc0 [ 79.652546][ T1341] asm_exc_page_fault+0x2b/0x30 [ 79.652566][ T1341] RIP: 0033:0xf61da3 [ 79.652586][ T1341] Code: Unable to access opcode bytes at 0xf61d79. [ 79.652595][ T1341] RSP: 002b:0000200000000068 EFLAGS: 00010217 [ 79.652612][ T1341] RAX: 0000000000000000 RBX: 00007fdfcc226090 RCX: 00007fdfcbf9f559 [ 79.652626][ T1341] RDX: 0000200000000080 RSI: 0000200000000060 RDI: 0000000001000200 [ 79.652639][ T1341] RBP: 00007fdfcc036b20 R08: 0000200000000100 R09: 0000200000000100 [ 79.652653][ T1341] R10: 00002000000000c0 R11: 0000000000000206 R12: 0000000000000000 [ 79.652665][ T1341] R13: 00007fdfcc226128 R14: 00007fdfcc226090 R15: 00007ffe2215cc68 [ 79.652680][ T1341] [ 79.652730][ T1341] memory: usage 307200kB, limit 307200kB, failcnt 52800 [ 79.821262][ T9] usb 3-1: new low-speed USB device number 22 using dummy_hcd [ 79.822593][ T1341] memory+swap: usage 429312kB, limit 9007199254740988kB, failcnt 0 [ 79.960654][ T9] usb 3-1: device descriptor read/64, error -71 [ 79.963073][ T310] usb 4-1: device descriptor read/64, error -71 [ 79.994775][ T1341] kmem: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 80.142760][ T1341] Memory cgroup stats for /syz1: [ 80.142985][ T1341] cache 311021568 [ 80.157129][ T1341] rss 282624 [ 80.160362][ T1341] rss_huge 0 [ 80.163593][ T1341] shmem 311013376 [ 80.167220][ T1341] mapped_file 0 [ 80.170721][ T1341] dirty 0 [ 80.173854][ T1341] writeback 0 [ 80.177129][ T1341] workingset_refault_anon 31 [ 80.181727][ T1341] workingset_refault_file 6603 [ 80.186493][ T1341] swap 127737856 [ 80.190047][ T1341] swapcached 131072 [ 80.193903][ T1341] pgpgin 272461 [ 80.197370][ T1341] pgpgout 196912 [ 80.201108][ T1341] pgfault 92458 [ 80.204574][ T1341] pgmajfault 65 [ 80.208043][ T1341] inactive_anon 32661504 [ 80.212675][ T1341] active_anon 278695936 [ 80.216840][ T1341] inactive_file 8192 [ 80.221794][ T1341] active_file 0 [ 80.225407][ T1341] unevictable 0 [ 80.228873][ T1341] hierarchical_memory_limit 314572800 [ 80.234323][ T1341] hierarchical_memsw_limit 9223372036854771712 [ 80.240522][ T1341] total_cache 311021568 [ 80.244701][ T1341] total_rss 282624 [ 80.248420][ T1341] total_rss_huge 0 [ 80.252236][ T1341] total_shmem 311013376 [ 80.256389][ T1341] total_mapped_file 0 [ 80.260350][ T1341] total_dirty 0 [ 80.260656][ T310] usb 4-1: device descriptor read/64, error -71 [ 80.264105][ T1341] total_writeback 0 [ 80.273938][ T1341] total_workingset_refault_anon 31 [ 80.279062][ T1341] total_workingset_refault_file 6603 [ 80.284400][ T9] usb 3-1: device descriptor read/64, error -71 [ 80.290638][ T1341] total_swap 127737856 [ 80.294795][ T1341] total_swapcached 131072 [ 80.299143][ T1341] total_pgpgin 272461 [ 80.303202][ T1341] total_pgpgout 196912 [ 80.307353][ T1341] total_pgfault 92458 [ 80.311419][ T1341] total_pgmajfault 65 [ 80.315427][ T1341] total_inactive_anon 32661504 [ 80.320191][ T1341] total_active_anon 278695936 [ 80.324922][ T1341] total_inactive_file 8192 [ 80.329334][ T1341] total_active_file 0 [ 80.333516][ T1341] total_unevictable 0 [ 80.337494][ T1341] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz1,mems_allowed=0,oom_memcg=/syz1,task_memcg=/syz1,task=syz.1.263,pid=1358,uid=0 [ 80.352246][ T1341] Memory cgroup out of memory: Killed process 1358 (syz.1.263) total-vm:90424kB, anon-rss:1264kB, file-rss:55824kB, shmem-rss:0kB, UID:0 pgtables:212kB oom_score_adj:1000 [ 80.370714][ T310] usb usb4-port1: attempt power cycle [ 80.390624][ T10] usb 2-1: new high-speed USB device number 14 using dummy_hcd [ 80.400710][ T9] usb usb3-port1: attempt power cycle [ 80.488612][ T1364] syz.1.263 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 80.502931][ T1364] CPU: 0 UID: 0 PID: 1364 Comm: syz.1.263 Not tainted syzkaller #0 5cdf496c3980d18a0efbb3b3e73d13bf69df874e [ 80.502964][ T1364] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 80.502975][ T1364] Call Trace: [ 80.502981][ T1364] [ 80.502988][ T1364] __dump_stack+0x21/0x30 [ 80.503016][ T1364] dump_stack_lvl+0x140/0x1c0 [ 80.503038][ T1364] ? __cfi_dump_stack_lvl+0x10/0x10 [ 80.503061][ T1364] ? ___ratelimit+0x41c/0x5c0 [ 80.503082][ T1364] ? __kasan_check_write+0x18/0x20 [ 80.503106][ T1364] dump_stack+0x19/0x20 [ 80.503129][ T1364] dump_header+0xd9/0x460 [ 80.503150][ T1364] oom_kill_process+0x35d/0x640 [ 80.503175][ T1364] ? __set_cpus_allowed_ptr+0x1d6/0x2c0 [ 80.503196][ T1364] out_of_memory+0x5d1/0xa20 [ 80.503219][ T1364] ? __cfi_out_of_memory+0x10/0x10 [ 80.503242][ T1364] ? mutex_lock_killable+0x97/0x1d0 [ 80.503265][ T1364] ? __cfi_mutex_lock_killable+0x10/0x10 [ 80.503288][ T1364] mem_cgroup_out_of_memory+0x2c5/0x390 [ 80.503311][ T1364] ? css_next_descendant_pre+0x1ec/0x210 [ 80.503338][ T1364] ? __kasan_check_write+0x18/0x20 [ 80.503359][ T1364] ? drain_obj_stock+0xec0/0xec0 [ 80.503383][ T1364] ? memcg1_oom_prepare+0x2c5/0x3a0 [ 80.503407][ T1364] try_charge_memcg+0x925/0xe10 [ 80.503426][ T1364] ? static_key_count+0x45/0x70 [ 80.503444][ T1364] ? lruvec_init+0x241/0x280 [ 80.503468][ T1364] ? __cfi_try_charge_memcg+0x10/0x10 [ 80.503488][ T1364] ? __alloc_pages_noprof+0x35a/0x7e0 [ 80.503509][ T1364] ? __cfi___alloc_pages_noprof+0x10/0x10 [ 80.503531][ T1364] __mem_cgroup_charge+0xfc/0x420 [ 80.503552][ T1364] ? folio_add_lru+0x116/0x400 [ 80.503570][ T1364] ? __cfi___mem_cgroup_charge+0x10/0x10 [ 80.503593][ T1364] shmem_alloc_and_add_folio+0x8e4/0x10b0 [ 80.503613][ T1364] ? shmem_replace_folio+0x9b0/0x9b0 [ 80.503630][ T1364] ? shmem_huge_global_enabled+0x2da/0x360 [ 80.503655][ T1364] ? shmem_allowable_huge_orders+0x1f7/0x430 [ 80.503679][ T1364] ? __kasan_check_write+0x18/0x20 [ 80.503701][ T1364] ? _raw_spin_lock+0x92/0x120 [ 80.503719][ T1364] shmem_get_folio_gfp+0x5cd/0x12e0 [ 80.503745][ T1364] ? shmem_get_folio+0xc0/0xc0 [ 80.503767][ T1364] ? follow_page_pte+0x8fb/0xba0 [ 80.503792][ T1364] ? inode_to_bdi+0x6d/0x100 [ 80.503819][ T1364] shmem_write_begin+0xf4/0x260 [ 80.503836][ T1364] generic_perform_write+0x32c/0x970 [ 80.503855][ T1364] ? __cfi_generic_perform_write+0x10/0x10 [ 80.503873][ T1364] ? generic_write_checks_count+0x426/0x540 [ 80.503894][ T1364] ? file_update_time+0xa3/0x210 [ 80.503915][ T1364] shmem_file_write_iter+0x105/0x130 [ 80.503935][ T1364] __kernel_write_iter+0x45f/0x900 [ 80.503958][ T1364] ? __cfi___kernel_write_iter+0x10/0x10 [ 80.503981][ T1364] ? get_dump_page+0x165/0x220 [ 80.504000][ T1364] ? __asan_memset+0x39/0x50 [ 80.504021][ T1364] ? iov_iter_bvec+0xc0/0x180 [ 80.504042][ T1364] dump_user_range+0xb8b/0xe60 [ 80.504068][ T1364] ? __cfi_dump_user_range+0x10/0x10 [ 80.504091][ T1364] ? elf_coredump_extra_notes_write+0x426/0x4b0 [ 80.504118][ T1364] ? __cfi_elf_coredump_extra_notes_write+0x10/0x10 [ 80.504144][ T1364] ? elf_core_dump+0x23cf/0x3840 [ 80.504164][ T1364] elf_core_dump+0x2d61/0x3840 [ 80.504184][ T1364] ? __cfi_elf_core_dump+0x10/0x10 [ 80.504201][ T1364] ? mas_next_slot+0xf01/0xfd0 [ 80.504228][ T1364] ? dump_interrupted+0xf0/0xf0 [ 80.504250][ T1364] ? filp_open+0x199/0x1f0 [ 80.504269][ T1364] ? 0xffffffffff600000 [ 80.504285][ T1364] do_coredump+0x20d5/0x3050 [ 80.504309][ T1364] ? __cfi_do_coredump+0x10/0x10 [ 80.504331][ T1364] ? asm_exc_page_fault+0x2b/0x30 [ 80.504359][ T1364] ? __kasan_slab_free+0x6a/0x80 [ 80.504376][ T1364] ? get_signal+0xa2a/0x1490 [ 80.504400][ T1364] get_signal+0x11bf/0x1490 [ 80.504426][ T1364] arch_do_signal_or_restart+0xbc/0x700 [ 80.504446][ T1364] ? __cfi_arch_do_signal_or_restart+0x10/0x10 [ 80.504466][ T1364] ? __kasan_check_read+0x15/0x20 [ 80.504489][ T1364] irqentry_exit_to_user_mode+0x4d/0xb0 [ 80.504513][ T1364] irqentry_exit+0x16/0x60 [ 80.504535][ T1364] exc_page_fault+0x65/0xc0 [ 80.504557][ T1364] asm_exc_page_fault+0x2b/0x30 [ 80.504577][ T1364] RIP: 0033:0xf61da3 [ 80.504598][ T1364] Code: Unable to access opcode bytes at 0xf61d79. [ 80.504607][ T1364] RSP: 002b:0000200000000068 EFLAGS: 00010217 [ 80.504624][ T1364] RAX: 0000000000000000 RBX: 00007fdfcc226090 RCX: 00007fdfcbf9f559 [ 80.504638][ T1364] RDX: 0000200000000080 RSI: 0000200000000060 RDI: 0000000001000200 [ 80.504651][ T1364] RBP: 00007fdfcc036b20 R08: 0000200000000100 R09: 0000200000000100 [ 80.504663][ T1364] R10: 00002000000000c0 R11: 0000000000000206 R12: 0000000000000000 [ 80.504676][ T1364] R13: 00007fdfcc226128 R14: 00007fdfcc226090 R15: 00007ffe2215cc68 [ 80.504691][ T1364] [ 80.504699][ T1364] memory: usage 306880kB, limit 307200kB, failcnt 54845 [ 80.730693][ T310] usb 4-1: new low-speed USB device number 32 using dummy_hcd [ 80.731813][ T1364] memory+swap: usage 372112kB, limit 9007199254740988kB, failcnt 0 [ 80.771685][ T310] usb 4-1: device descriptor read/8, error -71 [ 80.773140][ T1364] kmem: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 80.921727][ T310] usb 4-1: device descriptor read/8, error -71 [ 80.923737][ T9] usb 3-1: new low-speed USB device number 23 using dummy_hcd [ 80.930406][ T1364] Memory cgroup stats for [ 80.938566][ T10] usb 2-1: device descriptor read/all, error -71 [ 80.947076][ T1364] /syz1 [ 80.971682][ T9] usb 3-1: device descriptor read/8, error -71 [ 80.980641][ T1759] x_tables: duplicate underflow at hook 1 [ 80.986037][ T1364] : [ 80.993343][ T1759] x_tables: duplicate underflow at hook 1 [ 80.999299][ T1364] cache 258068480 [ 81.010670][ T1759] x_tables: duplicate underflow at hook 1 [ 81.010985][ T1364] rss 118784 [ 81.027413][ T1759] x_tables: duplicate underflow at hook 1 [ 81.032143][ T1364] rss_huge 0 [ 81.038862][ T1759] x_tables: duplicate underflow at hook 1 [ 81.040619][ T1364] shmem 258064384 [ 81.044106][ T1759] x_tables: duplicate underflow at hook 1 [ 81.049506][ T1364] mapped_file 0 [ 81.049516][ T1364] dirty 0 [ 81.049522][ T1364] writeback 0 [ 81.049528][ T1364] workingset_refault_anon 32 [ 81.049534][ T1364] workingset_refault_file 6603 [ 81.049541][ T1364] swap 122572800 [ 81.049546][ T1364] swapcached 131072 [ 81.049552][ T1364] pgpgin 274321 [ 81.053643][ T1759] x_tables: duplicate underflow at hook 1 [ 81.079285][ T1364] pgpgout 211771 [ 81.080682][ T1759] x_tables: duplicate underflow at hook 1 [ 81.083259][ T1364] pgfault 92470 [ 81.086544][ T1759] x_tables: duplicate underflow at hook 1 [ 81.095522][ T1364] pgmajfault 66 [ 81.096070][ T1759] x_tables: duplicate underflow at hook 1 [ 81.104064][ T1364] inactive_anon 79380480 [ 81.144875][ T1364] active_anon 178913280 [ 81.151248][ T1364] inactive_file 0 [ 81.155298][ T9] usb 3-1: device descriptor read/8, error -71 [ 81.162447][ T1364] active_file 4096 [ 81.166629][ T1364] unevictable 0 [ 81.170189][ T1364] hierarchical_memory_limit 314572800 [ 81.176672][ T1364] hierarchical_memsw_limit 9223372036854771712 [ 81.183020][ T1364] total_cache 258068480 [ 81.187208][ T1364] total_rss 118784 [ 81.191049][ T310] usb 4-1: new low-speed USB device number 33 using dummy_hcd [ 81.191178][ T1364] total_rss_huge 0 [ 81.203403][ T1364] total_shmem 258064384 [ 81.208956][ T1364] total_mapped_file 0 [ 81.213093][ T1364] total_dirty 0 [ 81.216545][ T1364] total_writeback 0 [ 81.220339][ T1364] total_workingset_refault_anon 32 [ 81.221768][ T310] usb 4-1: device descriptor read/8, error -71 [ 81.225811][ T1364] total_workingset_refault_file 6603 [ 81.237369][ T1364] total_swap 122572800 [ 81.241592][ T1364] total_swapcached 131072 [ 81.245953][ T1364] total_pgpgin 274321 [ 81.249962][ T1364] total_pgpgout 211771 [ 81.254120][ T1364] total_pgfault 92470 [ 81.260642][ T1364] total_pgmajfault 66 [ 81.264779][ T1364] total_inactive_anon 79380480 [ 81.269223][ T1777] netlink: 104 bytes leftover after parsing attributes in process `syz.0.330'. [ 81.269600][ T1364] total_active_anon 178913280 [ 81.283481][ T1364] total_inactive_file 0 [ 81.287741][ T1364] total_active_file 4096 [ 81.292207][ T1364] total_unevictable 0 [ 81.296282][ T1364] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz1,mems_allowed=0,oom_memcg=/syz1,task_memcg=/syz1,task=syz.1.263,pid=1369,uid=0 [ 81.320148][ T1364] Memory cgroup out of memory: Killed process 1369 (syz.1.263) total-vm:90424kB, anon-rss:1264kB, file-rss:53880kB, shmem-rss:0kB, UID:0 pgtables:212kB oom_score_adj:1000 [ 81.376172][ T310] usb 4-1: device descriptor read/8, error -71 [ 81.382602][ T36] audit: type=1400 audit(1793285155.423:365): avc: denied { ioctl } for pid=1781 comm="syz.3.333" path="socket:[25268]" dev="sockfs" ino=25268 ioctlcmd=0x9206 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 81.410819][ T9] usb 3-1: new low-speed USB device number 24 using dummy_hcd [ 81.454733][ T9] usb 3-1: device descriptor read/8, error -71 [ 81.490748][ T310] usb usb4-port1: unable to enumerate USB device [ 81.575834][ T1788] .N: renamed from veth0_to_bond (while UP) [ 81.591641][ T9] usb 3-1: device descriptor read/8, error -71 [ 81.700734][ T9] usb usb3-port1: unable to enumerate USB device [ 81.790653][ T10] usb 2-1: new high-speed USB device number 15 using dummy_hcd [ 81.902879][ T36] audit: type=1400 audit(1793285155.943:366): avc: denied { unmount } for pid=294 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=filesystem permissive=1 [ 81.918298][ T1341] syz.1.263 invoked oom-killer: gfp_mask=0x100cca(GFP_HIGHUSER_MOVABLE), order=0, oom_score_adj=1000 [ 81.924577][ T312] usb 1-1: new high-speed USB device number 33 using dummy_hcd [ 81.943222][ T10] usb 2-1: Using ep0 maxpacket: 32 [ 81.950827][ T1341] CPU: 1 UID: 0 PID: 1341 Comm: syz.1.263 Not tainted syzkaller #0 5cdf496c3980d18a0efbb3b3e73d13bf69df874e [ 81.950857][ T1341] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 81.950868][ T1341] Call Trace: [ 81.950874][ T1341] [ 81.950881][ T1341] __dump_stack+0x21/0x30 [ 81.950910][ T1341] dump_stack_lvl+0x140/0x1c0 [ 81.950934][ T1341] ? __cfi_dump_stack_lvl+0x10/0x10 [ 81.950958][ T1341] ? ___ratelimit+0x41c/0x5c0 [ 81.950979][ T1341] ? __kasan_check_write+0x18/0x20 [ 81.951004][ T1341] dump_stack+0x19/0x20 [ 81.951027][ T1341] dump_header+0xd9/0x460 [ 81.951050][ T1341] oom_kill_process+0x35d/0x640 [ 81.951075][ T1341] out_of_memory+0x5d1/0xa20 [ 81.951099][ T1341] ? __cfi_out_of_memory+0x10/0x10 [ 81.951122][ T1341] ? mutex_lock_killable+0x97/0x1d0 [ 81.951144][ T1341] ? __cfi_mutex_lock_killable+0x10/0x10 [ 81.951169][ T1341] mem_cgroup_out_of_memory+0x2c5/0x390 [ 81.951193][ T1341] ? css_next_descendant_pre+0x1ec/0x210 [ 81.951219][ T1341] ? __kasan_check_write+0x18/0x20 [ 81.951240][ T1341] ? drain_obj_stock+0xec0/0xec0 [ 81.951264][ T1341] ? memcg1_oom_prepare+0x2c5/0x3a0 [ 81.951288][ T1341] try_charge_memcg+0x925/0xe10 [ 81.951309][ T1341] ? __cfi_try_charge_memcg+0x10/0x10 [ 81.951330][ T1341] ? __alloc_pages_noprof+0x35a/0x7e0 [ 81.951351][ T1341] __mem_cgroup_charge+0xfc/0x420 [ 81.951372][ T1341] ? filemap_get_entry+0x41b/0x490 [ 81.951389][ T1341] ? __cfi___mem_cgroup_charge+0x10/0x10 [ 81.951411][ T1341] filemap_add_folio+0x57/0x3e0 [ 81.951436][ T1341] __filemap_get_folio+0x829/0xe80 [ 81.951452][ T1341] ? downgrade_write+0x470/0x470 [ 81.951472][ T1341] ? __cfi___filemap_get_folio+0x10/0x10 [ 81.951485][ T1341] ? down_read+0x7f/0xe0 [ 81.951504][ T1341] ? __cfi_down_read+0x10/0x10 [ 81.951523][ T1341] ? filemap_map_pages+0x17c0/0x1b80 [ 81.951538][ T1341] ? filemap_fault_recheck_pte_none+0x78/0x250 [ 81.951555][ T1341] filemap_fault+0xb8e/0x1ad0 [ 81.951570][ T1341] ? __cfi_filemap_fault+0x10/0x10 [ 81.951586][ T1341] ? __cfi_filemap_map_pages+0x10/0x10 [ 81.951603][ T1341] ? vma_data_pages+0x105/0x140 [ 81.951623][ T1341] do_pte_missing+0x3649/0x4440 [ 81.951642][ T1341] ? shmem_alloc_and_add_folio+0xd84/0x10b0 [ 81.951660][ T1341] ? pte_marker_clear+0x1b0/0x1b0 [ 81.951678][ T1341] ? shmem_replace_folio+0x9b0/0x9b0 [ 81.951694][ T1341] ? pte_offset_map_rw_nolock+0x236/0x2c0 [ 81.951714][ T1341] handle_mm_fault+0x1189/0x1ba0 [ 81.951729][ T1341] ? __kasan_check_write+0x18/0x20 [ 81.951749][ T1341] ? __cfi_handle_mm_fault+0x10/0x10 [ 81.951772][ T1341] ? follow_page_pte+0x2c0/0xba0 [ 81.951791][ T1341] ? gup_must_unshare+0x1e0/0x1e0 [ 81.951810][ T1341] ? vma_is_secretmem+0x11/0x50 [ 81.951829][ T1341] ? check_vma_flags+0x337/0x3a0 [ 81.951848][ T1341] __get_user_pages+0x114b/0x22d0 [ 81.951866][ T1341] ? __kasan_check_write+0x18/0x20 [ 81.951888][ T1341] ? populate_vma_page_range+0x220/0x220 [ 81.951906][ T1341] ? __kernel_write_iter+0x709/0x900 [ 81.951929][ T1341] get_dump_page+0x10c/0x220 [ 81.951946][ T1341] ? __cfi_get_dump_page+0x10/0x10 [ 81.951963][ T1341] ? __asan_memset+0x39/0x50 [ 81.951985][ T1341] dump_user_range+0x18b/0xe60 [ 81.952011][ T1341] ? __cfi_dump_user_range+0x10/0x10 [ 81.952036][ T1341] ? elf_coredump_extra_notes_write+0x426/0x4b0 [ 81.952064][ T1341] ? __cfi_elf_coredump_extra_notes_write+0x10/0x10 [ 81.952091][ T1341] ? elf_core_dump+0x23cf/0x3840 [ 81.952111][ T1341] elf_core_dump+0x2d61/0x3840 [ 81.952132][ T1341] ? __cfi_elf_core_dump+0x10/0x10 [ 81.952151][ T1341] ? mas_next_slot+0xf01/0xfd0 [ 81.952180][ T1341] ? dump_interrupted+0xf0/0xf0 [ 81.952203][ T1341] ? filp_open+0x199/0x1f0 [ 81.952223][ T1341] ? 0xffffffffff600000 [ 81.952239][ T1341] do_coredump+0x20d5/0x3050 [ 81.952264][ T1341] ? __cfi_do_coredump+0x10/0x10 [ 81.952285][ T1341] ? asm_exc_page_fault+0x2b/0x30 [ 81.952315][ T1341] ? __kasan_slab_free+0x6a/0x80 [ 81.952333][ T1341] ? get_signal+0xa2a/0x1490 [ 81.952358][ T1341] get_signal+0x11bf/0x1490 [ 81.952384][ T1341] arch_do_signal_or_restart+0xbc/0x700 [ 81.952405][ T1341] ? __cfi_arch_do_signal_or_restart+0x10/0x10 [ 81.952427][ T1341] ? __kasan_check_read+0x15/0x20 [ 81.952449][ T1341] irqentry_exit_to_user_mode+0x4d/0xb0 [ 81.952477][ T1341] irqentry_exit+0x16/0x60 [ 81.952499][ T1341] exc_page_fault+0x65/0xc0 [ 81.952522][ T1341] asm_exc_page_fault+0x2b/0x30 [ 81.952542][ T1341] RIP: 0033:0xf61da3 [ 81.952562][ T1341] Code: Unable to access opcode bytes at 0xf61d79. [ 81.952570][ T1341] RSP: 002b:0000200000000068 EFLAGS: 00010217 [ 81.952588][ T1341] RAX: 0000000000000000 RBX: 00007fdfcc226090 RCX: 00007fdfcbf9f559 [ 81.952603][ T1341] RDX: 0000200000000080 RSI: 0000200000000060 RDI: 0000000001000200 [ 81.952616][ T1341] RBP: 00007fdfcc036b20 R08: 0000200000000100 R09: 0000200000000100 [ 81.952630][ T1341] R10: 00002000000000c0 R11: 0000000000000206 R12: 0000000000000000 [ 81.952642][ T1341] R13: 00007fdfcc226128 R14: 00007fdfcc226090 R15: 00007ffe2215cc68 [ 81.952657][ T1341] [ 81.952664][ T1341] memory: usage 307200kB, limit 307200kB, failcnt 58047 [ 81.954296][ T10] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 81.964449][ T1341] memory+swap: usage 432148kB, limit 9007199254740988kB, failcnt 0 [ 81.982657][ T10] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0xF has invalid maxpacket 1023, setting to 64 [ 81.988167][ T1341] kmem: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 81.990083][ T10] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0xE has invalid maxpacket 1024, setting to 64 [ 81.999414][ T1341] Memory cgroup stats for [ 81.999944][ T10] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x84 has invalid maxpacket 32 [ 82.004946][ T1341] /syz1 [ 82.009384][ T10] usb 2-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 8 [ 82.013432][ T1341] : [ 82.019779][ T10] usb 2-1: New USB device found, idVendor=1430, idProduct=474b, bcdDevice= 0.40 [ 82.022907][ T1341] cache 314331136 [ 82.028077][ T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 82.033222][ T1341] rss 221184 [ 82.038943][ T10] usb 2-1: Product: syz [ 82.044483][ T1341] rss_huge 0 [ 82.050521][ T10] usb 2-1: Manufacturer: syz [ 82.055388][ T1341] shmem 314318848 [ 82.060595][ T10] usb 2-1: SerialNumber: syz [ 82.065576][ T1341] mapped_file 0 [ 82.074831][ T1782] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 82.075727][ T1341] dirty 0 [ 82.131737][ T312] usb 1-1: config 0 has no interfaces? [ 82.137751][ T1341] writeback 0 [ 82.144433][ T312] usb 1-1: New USB device found, idVendor=04dd, idProduct=8005, bcdDevice= 0.00 [ 82.147862][ T1341] workingset_refault_anon 35 [ 82.153467][ T312] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 82.158473][ T1341] workingset_refault_file 8701 [ 82.163589][ T312] usb 1-1: Product: syz [ 82.169238][ T1341] swap 127946752 [ 82.174294][ T312] usb 1-1: Manufacturer: syz [ 82.179538][ T1341] swapcached 40960 [ 82.185305][ T312] usb 1-1: SerialNumber: syz [ 82.190223][ T1341] pgpgin 300981 [ 82.199802][ T312] usb 1-1: config 0 descriptor?? [ 82.200675][ T1341] pgpgout 224692 [ 82.290737][ T9] usb 3-1: new full-speed USB device number 25 using dummy_hcd [ 82.303054][ T1341] pgfault 93853 [ 82.471978][ T9] usb 3-1: config 14 has an invalid interface number: 217 but max is 0 [ 82.478980][ T1341] pgmajfault 99 [ 82.492323][ T597] usb 1-1: USB disconnect, device number 33 [ 82.493719][ T1341] inactive_anon 191143936 [ 82.504884][ T9] usb 3-1: config 14 contains an unexpected descriptor of type 0x1, skipping [ 82.521622][ T1341] active_anon 123416576 [ 82.531437][ T9] usb 3-1: config 14 has an invalid descriptor of length 0, skipping remainder of the config [ 82.542319][ T1341] inactive_file 12288 [ 82.547462][ T9] usb 3-1: config 14 has 2 interfaces, different from the descriptor's value: 1 [ 82.549724][ T1341] active_file 0 [ 82.552924][ T9] usb 3-1: config 14 has no interface number 1 [ 82.557735][ T1341] unevictable 0 [ 82.561307][ T9] usb 3-1: config 14 interface 217 has no altsetting 0 [ 82.565996][ T1341] hierarchical_memory_limit 314572800 [ 82.571380][ T9] usb 3-1: New USB device found, idVendor=0421, idProduct=0070, bcdDevice=46.26 [ 82.576553][ T1341] hierarchical_memsw_limit 9223372036854771712 [ 82.579610][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 82.584830][ T1341] total_cache 314331136 [ 82.584840][ T1341] total_rss 221184 [ 82.584846][ T1341] total_rss_huge 0 [ 82.584851][ T1341] total_shmem 314318848 [ 82.584858][ T1341] total_mapped_file 0 [ 82.584865][ T1341] total_dirty 0 [ 82.589017][ T9] usb 3-1: Product: syz [ 82.597814][ T1341] total_writeback 0 [ 82.601908][ T9] usb 3-1: Manufacturer: syz [ 82.610043][ T1341] total_workingset_refault_anon 35 [ 82.614623][ T9] usb 3-1: SerialNumber: syz [ 82.618927][ T1341] total_workingset_refault_file 8701 [ 82.650661][ T312] usb 4-1: new high-speed USB device number 34 using dummy_hcd [ 82.654716][ T1341] total_swap 127946752 [ 82.811692][ T312] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 82.815638][ T1341] total_swapcached 40960 [ 82.823382][ T312] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 82.827214][ T1341] total_pgpgin 300981 [ 82.827227][ T1341] total_pgpgout 224692 [ 82.827233][ T1341] total_pgfault 93853 [ 82.827239][ T1341] total_pgmajfault 99 [ 82.827246][ T1341] total_inactive_anon 191143936 [ 82.837949][ T312] usb 4-1: config 1 has no interface number 0 [ 82.850639][ T1341] total_active_anon 123416576 [ 82.856946][ T312] usb 4-1: config 1 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 54, changing to 9 [ 82.858728][ T1341] total_inactive_file 12288 [ 82.862616][ T312] usb 4-1: Duplicate descriptor for config 1 interface 1 altsetting 0, skipping [ 82.870618][ T1341] total_active_file 0 [ 82.871807][ T312] usb 4-1: config 1 interface 1 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 82.877706][ T1341] total_unevictable 0 [ 82.877720][ T1341] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz1,mems_allowed=0 [ 82.884040][ T312] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 82.893515][ T1341] ,oom_memcg= [ 82.898176][ T312] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 82.914900][ T1341] /syz1 [ 82.924524][ T312] usb 4-1: Product: syz [ 82.964680][ T1341] ,task_memcg=/syz1,task=syz.1.263,pid=1364,uid=0 [ 82.971329][ T1341] Memory cgroup out of memory: Killed process 1364 (syz.1.263) total-vm:90424kB, anon-rss:1264kB, file-rss:53936kB, shmem-rss:0kB, UID:0 pgtables:212kB oom_score_adj:1000 [ 83.000479][ T312] usb 4-1: Manufacturer: syz [ 83.005260][ T312] usb 4-1: SerialNumber: syz [ 83.052797][ T9] rndis_host 3-1:14.217: skipping garbage [ 83.062520][ T9] usb 3-1: bad CDC descriptors [ 83.067587][ T9] cdc_acm 3-1:14.217: skipping garbage [ 83.081312][ T9] usb 3-1: USB disconnect, device number 25 [ 83.090016][ T1335] syz.1.263 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 83.136850][ T36] audit: type=1400 audit(1793285157.183:367): avc: denied { getopt } for pid=1809 comm="syz.0.340" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 83.176683][ T36] audit: type=1400 audit(1793285157.203:368): avc: denied { bind } for pid=1809 comm="syz.0.340" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 83.200722][ T1335] CPU: 1 UID: 0 PID: 1335 Comm: syz.1.263 Not tainted syzkaller #0 5cdf496c3980d18a0efbb3b3e73d13bf69df874e [ 83.200754][ T1335] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 83.200767][ T1335] Call Trace: [ 83.200774][ T1335] [ 83.200782][ T1335] __dump_stack+0x21/0x30 [ 83.200812][ T1335] dump_stack_lvl+0x140/0x1c0 [ 83.200837][ T1335] ? __cfi_dump_stack_lvl+0x10/0x10 [ 83.200861][ T1335] ? ___ratelimit+0x41c/0x5c0 [ 83.200883][ T1335] ? __kasan_check_write+0x18/0x20 [ 83.200908][ T1335] dump_stack+0x19/0x20 [ 83.200931][ T1335] dump_header+0xd9/0x460 [ 83.200954][ T1335] oom_kill_process+0x35d/0x640 [ 83.200981][ T1335] out_of_memory+0x5d1/0xa20 [ 83.201005][ T1335] ? __cfi_out_of_memory+0x10/0x10 [ 83.201028][ T1335] ? mutex_lock_killable+0x97/0x1d0 [ 83.201051][ T1335] ? __cfi_mutex_lock_killable+0x10/0x10 [ 83.201076][ T1335] mem_cgroup_out_of_memory+0x2c5/0x390 [ 83.201100][ T1335] ? css_next_descendant_pre+0x1ec/0x210 [ 83.201124][ T1335] ? __kasan_check_write+0x18/0x20 [ 83.201146][ T1335] ? drain_obj_stock+0xec0/0xec0 [ 83.201170][ T1335] ? memcg1_oom_prepare+0x2c5/0x3a0 [ 83.201193][ T1335] try_charge_memcg+0x925/0xe10 [ 83.201211][ T1335] ? static_key_count+0x45/0x70 [ 83.201231][ T1335] ? lruvec_init+0x241/0x280 [ 83.201255][ T1335] ? __cfi_try_charge_memcg+0x10/0x10 [ 83.201275][ T1335] ? __alloc_pages_noprof+0x35a/0x7e0 [ 83.201297][ T1335] ? __cfi___alloc_pages_noprof+0x10/0x10 [ 83.201318][ T1335] __mem_cgroup_charge+0xfc/0x420 [ 83.201340][ T1335] ? do_pte_missing+0x3894/0x4440 [ 83.201358][ T1335] ? __cfi___mem_cgroup_charge+0x10/0x10 [ 83.201382][ T1335] shmem_alloc_and_add_folio+0x8e4/0x10b0 [ 83.201402][ T1335] ? shmem_replace_folio+0x9b0/0x9b0 [ 83.201420][ T1335] ? shmem_huge_global_enabled+0x2da/0x360 [ 83.201445][ T1335] ? shmem_allowable_huge_orders+0x1f7/0x430 [ 83.201469][ T1335] ? __kasan_check_write+0x18/0x20 [ 83.201491][ T1335] ? _raw_spin_lock+0x92/0x120 [ 83.201509][ T1335] shmem_get_folio_gfp+0x5cd/0x12e0 [ 83.201545][ T1335] ? shmem_get_folio+0xc0/0xc0 [ 83.201568][ T1335] ? __kasan_check_write+0x18/0x20 [ 83.201590][ T1335] ? inode_to_bdi+0x6d/0x100 [ 83.201620][ T1335] shmem_write_begin+0xf4/0x260 [ 83.201638][ T1335] generic_perform_write+0x32c/0x970 [ 83.201662][ T1335] ? inode_update_timestamps+0x4d1/0x6e0 [ 83.201685][ T1335] ? __cfi_generic_perform_write+0x10/0x10 [ 83.201704][ T1335] ? generic_write_checks_count+0x426/0x540 [ 83.201724][ T1335] ? mnt_get_write_access_file+0x1af/0x3b0 [ 83.201745][ T1335] ? mnt_put_write_access_file+0xc2/0x100 [ 83.201765][ T1335] ? file_update_time+0x1de/0x210 [ 83.201786][ T1335] shmem_file_write_iter+0x105/0x130 [ 83.201807][ T1335] __kernel_write_iter+0x45f/0x900 [ 83.201831][ T1335] ? __cfi___kernel_write_iter+0x10/0x10 [ 83.201854][ T1335] ? get_dump_page+0x165/0x220 [ 83.201874][ T1335] ? __asan_memset+0x39/0x50 [ 83.201895][ T1335] ? iov_iter_bvec+0xc0/0x180 [ 83.201917][ T1335] dump_user_range+0xb8b/0xe60 [ 83.201942][ T1335] ? __cfi_dump_user_range+0x10/0x10 [ 83.201962][ T1335] ? elf_coredump_extra_notes_write+0x426/0x4b0 [ 83.201986][ T1335] ? __cfi_elf_coredump_extra_notes_write+0x10/0x10 [ 83.202009][ T1335] ? elf_core_dump+0x23cf/0x3840 [ 83.202028][ T1335] elf_core_dump+0x2d61/0x3840 [ 83.202049][ T1335] ? __cfi_elf_core_dump+0x10/0x10 [ 83.202067][ T1335] ? mas_next_slot+0xf01/0xfd0 [ 83.202095][ T1335] ? dump_interrupted+0xf0/0xf0 [ 83.202116][ T1335] ? filp_open+0x199/0x1f0 [ 83.202136][ T1335] ? 0xffffffffff600000 [ 83.202151][ T1335] do_coredump+0x20d5/0x3050 [ 83.202176][ T1335] ? __cfi_do_coredump+0x10/0x10 [ 83.202198][ T1335] ? asm_exc_page_fault+0x2b/0x30 [ 83.202226][ T1335] ? __kasan_slab_free+0x6a/0x80 [ 83.202244][ T1335] ? get_signal+0xa2a/0x1490 [ 83.202269][ T1335] get_signal+0x11bf/0x1490 [ 83.202300][ T1335] arch_do_signal_or_restart+0xbc/0x700 [ 83.202320][ T1335] ? __cfi_arch_do_signal_or_restart+0x10/0x10 [ 83.202340][ T1335] ? __kasan_check_read+0x15/0x20 [ 83.202362][ T1335] irqentry_exit_to_user_mode+0x4d/0xb0 [ 83.202387][ T1335] irqentry_exit+0x16/0x60 [ 83.202410][ T1335] exc_page_fault+0x65/0xc0 [ 83.202433][ T1335] asm_exc_page_fault+0x2b/0x30 [ 83.202455][ T1335] RIP: 0033:0xf61da3 [ 83.202476][ T1335] Code: Unable to access opcode bytes at 0xf61d79. [ 83.202485][ T1335] RSP: 002b:0000200000000068 EFLAGS: 00010217 [ 83.202502][ T1335] RAX: 0000000000000000 RBX: 00007fdfcc226090 RCX: 00007fdfcbf9f559 [ 83.202516][ T1335] RDX: 0000200000000080 RSI: 0000200000000060 RDI: 0000000001000200 [ 83.202530][ T1335] RBP: 00007fdfcc036b20 R08: 0000200000000100 R09: 0000200000000100 [ 83.202543][ T1335] R10: 00002000000000c0 R11: 0000000000000206 R12: 0000000000000000 [ 83.202556][ T1335] R13: 00007fdfcc226128 R14: 00007fdfcc226090 R15: 00007ffe2215cc68 [ 83.202576][ T1335] [ 83.202584][ T1335] memory: usage 281652kB, limit 307200kB, failcnt 58687 [ 83.461641][ T1807] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 83.563992][ T1335] memory+swap: usage 408044kB, limit 9007199254740988kB, failcnt 0 [ 83.610462][ T1807] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 83.780619][ T1335] kmem: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 83.820637][ T1335] Memory cgroup stats for /syz1: [ 83.820800][ T1335] cache 301207552 [ 83.863166][ T1335] rss 192512 [ 83.881590][ T1335] rss_huge 0 [ 83.900083][ T1335] shmem 300265472 [ 83.930694][ T1335] mapped_file 720896 [ 83.950772][ T312] cdc_ncm 4-1:1.1: failed GET_NTB_PARAMETERS [ 83.956917][ T312] cdc_ncm 4-1:1.1: bind() failure [ 83.968270][ T312] usb 4-1: USB disconnect, device number 34 [ 83.982428][ T1820] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=1820 comm=syz.2.342 [ 84.006334][ T1821] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=1821 comm=syz.2.342 [ 84.009035][ T1335] dirty 0 [ 84.085676][ T1335] writeback 258048 [ 84.089467][ T1335] workingset_refault_anon 36 [ 84.137550][ T1830] netlink: 28 bytes leftover after parsing attributes in process `syz.2.345'. [ 84.150905][ T1335] workingset_refault_file 8928 [ 84.172410][ T10] usb 2-1: USB disconnect, device number 15 [ 84.200643][ T1335] swap 127717376 [ 84.211865][ T1335] swapcached 278528 [ 84.219301][ T1335] pgpgin 307531 [ 84.227265][ T1335] pgpgout 234395 [ 84.234305][ T1335] pgfault 93928 [ 84.242159][ T1335] pgmajfault 103 [ 84.249021][ T1335] inactive_anon 163405824 [ 84.259009][ T1335] active_anon 136617984 [ 84.268686][ T1335] inactive_file 0 [ 84.275905][ T1335] active_file 942080 [ 84.284187][ T1335] unevictable 0 [ 84.292047][ T1335] hierarchical_memory_limit 314572800 [ 84.303077][ T1335] hierarchical_memsw_limit 9223372036854771712 [ 84.315783][ T1335] total_cache 301207552 [ 84.320188][ T1335] total_rss 192512 [ 84.324394][ T1335] total_rss_huge 0 [ 84.328301][ T1335] total_shmem 300265472 [ 84.356470][ T1335] total_mapped_file 720896 [ 84.381493][ T1335] total_dirty 0 [ 84.396895][ T1335] total_writeback 258048 [ 84.410642][ T1335] total_workingset_refault_anon 36 [ 84.425820][ T1335] total_workingset_refault_file 8928 [ 84.443231][ T1335] total_swap 127717376 [ 84.456112][ T1335] total_swapcached 278528 [ 84.469940][ T1335] total_pgpgin 307531 [ 84.489698][ T1335] total_pgpgout 234395 [ 84.512808][ T1335] total_pgfault 93928 [ 84.529043][ T1335] total_pgmajfault 103 [ 84.552079][ T1335] total_inactive_anon 163405824 [ 84.583610][ T1335] total_active_anon 136617984 [ 84.600840][ T1335] total_inactive_file 0 [ 84.630638][ T1335] total_active_file 942080 [ 84.649406][ T1335] total_unevictable 0 [ 84.660646][ T1335] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz1,mems_allowed=0,oom_memcg=/syz1,task_memcg=/syz1,task=syz.1.263,pid=1357,uid=0 [ 84.695196][ T1335] Memory cgroup out of memory: OOM victim 1357 (syz.1.263) is already exiting. Skip killing the task [ 85.108146][ T1869] batadv_slave_0: entered promiscuous mode [ 85.181981][ T1867] batadv_slave_0: left promiscuous mode [ 85.268154][ T36] audit: type=1400 audit(1793285159.313:369): avc: denied { create } for pid=1877 comm="syz.2.352" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_dnrt_socket permissive=1 [ 85.390667][ T310] usb 1-1: new high-speed USB device number 34 using dummy_hcd [ 85.465526][ T1889] netlink: 8 bytes leftover after parsing attributes in process `syz.2.354'. [ 85.500664][ T312] usb 2-1: new high-speed USB device number 16 using dummy_hcd [ 85.510488][ T1889] dummy1: entered promiscuous mode [ 85.516060][ T1889] dummy1: entered allmulticast mode [ 85.551891][ T310] usb 1-1: config 0 has no interfaces? [ 85.558923][ T310] usb 1-1: New USB device found, idVendor=04dd, idProduct=8005, bcdDevice= 0.00 [ 85.572797][ T310] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 85.590678][ T310] usb 1-1: Product: syz [ 85.598261][ T310] usb 1-1: Manufacturer: syz [ 85.607442][ T310] usb 1-1: SerialNumber: syz [ 85.626159][ T310] usb 1-1: config 0 descriptor?? [ 85.660612][ T312] usb 2-1: Using ep0 maxpacket: 32 [ 85.676045][ T312] usb 2-1: config 0 has an invalid interface number: 67 but max is 0 [ 85.690102][ T312] usb 2-1: config 0 has no interface number 0 [ 85.700623][ T36] audit: type=1400 audit(1793285159.753:370): avc: denied { ioctl } for pid=1891 comm="syz.3.355" path="socket:[26722]" dev="sockfs" ino=26722 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 85.730099][ T312] usb 2-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 85.738317][ T36] audit: type=1400 audit(1793285159.753:371): avc: denied { bind } for pid=1891 comm="syz.3.355" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 85.748231][ T312] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 85.783022][ T36] audit: type=1400 audit(1793285159.833:372): avc: denied { execute } for pid=1893 comm="syz.3.356" path="/dev/loop5" dev="devtmpfs" ino=54 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 85.790638][ T312] usb 2-1: Product: syz [ 85.820611][ T312] usb 2-1: Manufacturer: syz [ 85.825319][ T312] usb 2-1: SerialNumber: syz [ 85.831003][ T312] usb 2-1: config 0 descriptor?? [ 85.836508][ T310] usb 1-1: USB disconnect, device number 34 [ 85.843690][ T312] smsc95xx v2.0.0 [ 86.220256][ T36] audit: type=1400 audit(1793285160.263:373): avc: denied { create } for pid=1898 comm="syz.2.357" name="midi.usb0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:configfs_t tclass=lnk_file permissive=1 [ 86.280628][ T312] smsc95xx 2-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -32 [ 86.307369][ T312] smsc95xx 2-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 86.363532][ T36] audit: type=1400 audit(1793285160.413:374): avc: denied { watch_reads } for pid=1910 comm="syz.2.359" path="/106" dev="tmpfs" ino=630 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 86.364000][ T1911] overlay: ./file0 is not a directory [ 86.414338][ T36] audit: type=1400 audit(1793285160.413:375): avc: denied { mounton } for pid=1910 comm="syz.2.359" path="/106/file0" dev="tmpfs" ino=636 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 86.450964][ T1913] netlink: 104 bytes leftover after parsing attributes in process `syz.0.360'. [ 86.698265][ T1942] kvm: Disabled LAPIC found during irq injection [ 86.723280][ T312] smsc95xx 2-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -71 [ 86.743504][ T312] smsc95xx 2-1:0.67: probe with driver smsc95xx failed with error -71 [ 86.760695][ T312] usb 2-1: USB disconnect, device number 16 [ 86.917070][ T36] kauditd_printk_skb: 2 callbacks suppressed [ 86.917087][ T36] audit: type=1400 audit(1793285160.963:378): avc: denied { create } for pid=1963 comm="syz.0.373" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=iucv_socket permissive=1 [ 86.945980][ T1957] incfs: Options parsing error. -22 [ 86.951479][ T1957] incfs: mount failed -22 [ 86.955971][ T36] audit: type=1400 audit(1793285160.993:379): avc: denied { mounton } for pid=1956 comm="syz.2.371" path="/113/file0" dev="tmpfs" ino=680 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=fifo_file permissive=1 [ 86.985921][ T1959] input: syz1 as /devices/virtual/input/input15 [ 87.051052][ T1968] tipc: Invalid UDP bearer configuration [ 87.051078][ T1968] tipc: Enabling of bearer rejected, failed to enable media [ 87.070627][ T45] usb 4-1: new high-speed USB device number 35 using dummy_hcd [ 87.144703][ T36] audit: type=1400 audit(1793285161.193:380): avc: denied { append } for pid=1963 comm="syz.0.373" name="cpu_dma_latency" dev="devtmpfs" ino=208 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:pmqos_device_t tclass=chr_file permissive=1 [ 87.190636][ T36] audit: type=1400 audit(1793285161.193:381): avc: denied { open } for pid=1963 comm="syz.0.373" path="/100/dev/cpu_dma_latency" dev="devtmpfs" ino=208 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:pmqos_device_t tclass=chr_file permissive=1 [ 87.228208][ T36] audit: type=1400 audit(1793285161.193:382): avc: denied { read write } for pid=1963 comm="syz.0.373" name="cpu_dma_latency" dev="devtmpfs" ino=208 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:pmqos_device_t tclass=chr_file permissive=1 [ 87.267887][ T45] usb 4-1: unable to get BOS descriptor or descriptor too short [ 87.276308][ T45] usb 4-1: config 1 has an invalid descriptor of length 102, skipping remainder of the config [ 87.283557][ T1980] input: syz0 as /devices/virtual/input/input16 [ 87.287598][ T45] usb 4-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 87.320623][ T45] usb 4-1: config 1 interface 1 altsetting 3 endpoint 0x1 has an invalid bInterval 35, changing to 7 [ 87.340630][ T45] usb 4-1: config 1 interface 1 has no altsetting 1 [ 87.348677][ T45] usb 4-1: New USB device found, idVendor=0582, idProduct=0016, bcdDevice= 0.40 [ 87.358032][ T45] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 87.368059][ T45] usb 4-1: Product: syz [ 87.379166][ T45] usb 4-1: Manufacturer: syz [ 87.383970][ T45] usb 4-1: SerialNumber: syz [ 87.592422][ T45] usb 4-1: 1:3 : no or invalid class specific endpoint descriptor [ 87.600361][ T45] usb 4-1: 1:3 : sample bitwidth 62 in over sample bytes 2 [ 87.607650][ T45] usb 4-1: parse_audio_format_rates_v2v3(): unable to find clock source (clock -22) [ 87.620534][ T45] usb 4-1: USB disconnect, device number 35 [ 87.670631][ T9] usb 1-1: new high-speed USB device number 35 using dummy_hcd [ 87.820624][ T9] usb 1-1: Using ep0 maxpacket: 8 [ 87.826692][ T9] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 87.836992][ T9] usb 1-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 87.847309][ T9] usb 1-1: New USB device found, idVendor=2b73, idProduct=001e, bcdDevice= 0.40 [ 87.856415][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 87.864427][ T9] usb 1-1: Product: syz [ 87.868610][ T9] usb 1-1: Manufacturer: syz [ 87.873239][ T9] usb 1-1: SerialNumber: syz [ 88.081350][ T9] usb 1-1: unit 255 not found! [ 88.088810][ T9] usb 1-1: USB disconnect, device number 35 [ 88.229459][ T2004] FAULT_INJECTION: forcing a failure. [ 88.229459][ T2004] name failslab, interval 1, probability 0, space 0, times 0 [ 88.242242][ T2004] CPU: 1 UID: 0 PID: 2004 Comm: syz.3.381 Not tainted syzkaller #0 5cdf496c3980d18a0efbb3b3e73d13bf69df874e [ 88.242269][ T2004] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 88.242281][ T2004] Call Trace: [ 88.242287][ T2004] [ 88.242293][ T2004] __dump_stack+0x21/0x30 [ 88.242324][ T2004] dump_stack_lvl+0x140/0x1c0 [ 88.242348][ T2004] ? __cfi_dump_stack_lvl+0x10/0x10 [ 88.242371][ T2004] ? __cfi_avc_has_perm+0x10/0x10 [ 88.242391][ T2004] dump_stack+0x19/0x20 [ 88.242414][ T2004] should_fail_ex+0x3c2/0x510 [ 88.242433][ T2004] should_failslab+0xac/0x100 [ 88.242451][ T2004] __kmalloc_cache_noprof+0x41/0x470 [ 88.242475][ T2004] ? proc_thread_self_get_link+0x11a/0x290 [ 88.242496][ T2004] proc_thread_self_get_link+0x11a/0x290 [ 88.242515][ T2004] ? bpf_lsm_inode_follow_link+0xd/0x20 [ 88.242541][ T2004] ? __cfi_proc_thread_self_get_link+0x10/0x10 [ 88.242563][ T2004] pick_link+0x6d7/0xe80 [ 88.242587][ T2004] step_into+0xc33/0xf10 [ 88.242609][ T2004] ? set_root+0x420/0x420 [ 88.242630][ T2004] ? lookup_fast+0x15f/0x540 [ 88.242650][ T2004] ? inode_permission+0xf3/0x4c0 [ 88.242674][ T2004] link_path_walk+0x746/0xeb0 [ 88.242698][ T2004] path_lookupat+0x8d/0x440 [ 88.242713][ T2004] filename_lookup+0x22d/0x5a0 [ 88.242729][ T2004] ? __cfi_filename_lookup+0x10/0x10 [ 88.242742][ T2004] ? check_stack_object+0x81/0x150 [ 88.242762][ T2004] ? strncpy_from_user+0x14f/0x280 [ 88.242776][ T2004] ? __kasan_check_write+0x18/0x20 [ 88.242793][ T2004] ? getname_flags+0x203/0x6b0 [ 88.242811][ T2004] ? memdup_user+0xb1/0x170 [ 88.242828][ T2004] user_path_at+0x42/0x60 [ 88.242841][ T2004] __se_sys_mount+0x28a/0x480 [ 88.242860][ T2004] ? __x64_sys_mount+0xf0/0xf0 [ 88.242879][ T2004] ? __kasan_check_write+0x18/0x20 [ 88.242895][ T2004] ? fpregs_restore_userregs+0x11c/0x260 [ 88.242914][ T2004] __x64_sys_mount+0xc3/0xf0 [ 88.242932][ T2004] x64_sys_call+0x2021/0x2ee0 [ 88.242946][ T2004] do_syscall_64+0x57/0xf0 [ 88.242961][ T2004] ? clear_bhb_loop+0x50/0xa0 [ 88.242980][ T2004] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 88.243005][ T2004] RIP: 0033:0x7f7c4019f559 [ 88.243018][ T2004] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 88.243031][ T2004] RSP: 002b:00007f7c41126028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 88.243047][ T2004] RAX: ffffffffffffffda RBX: 00007f7c40425fa0 RCX: 00007f7c4019f559 [ 88.243058][ T2004] RDX: 0000200000000380 RSI: 0000200000000340 RDI: 0000000000000000 [ 88.243068][ T2004] RBP: 00007f7c40236b20 R08: 0000000000000000 R09: 0000000000000000 [ 88.243078][ T2004] R10: 000000000210c810 R11: 0000000000000246 R12: 0000000000000000 [ 88.243087][ T2004] R13: 00007f7c40426038 R14: 00007f7c40425fa0 R15: 00007ffe7a92eff8 [ 88.243099][ T2004] [ 88.243281][ T36] audit: type=1400 audit(1793285162.293:383): avc: denied { mounton } for pid=2003 comm="syz.3.381" path="/89/proc/327/task/328/fail-nth" dev="proc" ino=27238 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=file permissive=1 [ 88.244273][ T2005] FAULT_INJECTION: forcing a failure. [ 88.244273][ T2005] name failslab, interval 1, probability 0, space 0, times 0 [ 88.283802][ T36] audit: type=1400 audit(1793285162.333:384): avc: denied { read } for pid=2007 comm="syz.1.382" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 88.286566][ T2005] CPU: 0 UID: 0 PID: 2005 Comm: syz.3.381 Not tainted syzkaller #0 5cdf496c3980d18a0efbb3b3e73d13bf69df874e [ 88.286594][ T2005] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 88.286606][ T2005] Call Trace: [ 88.286612][ T2005] [ 88.286619][ T2005] __dump_stack+0x21/0x30 [ 88.286649][ T2005] dump_stack_lvl+0x140/0x1c0 [ 88.286672][ T2005] ? __cfi_dump_stack_lvl+0x10/0x10 [ 88.286696][ T2005] ? __kasan_check_write+0x18/0x20 [ 88.286719][ T2005] dump_stack+0x19/0x20 [ 88.286747][ T2005] should_fail_ex+0x3c2/0x510 [ 88.286766][ T2005] should_failslab+0xac/0x100 [ 88.286783][ T2005] kmem_cache_alloc_noprof+0x42/0x410 [ 88.286809][ T2005] ? __kernfs_new_node+0xf1/0x740 [ 88.286827][ T2005] ? __kasan_check_write+0x18/0x20 [ 88.286848][ T2005] ? down_write+0xee/0x2b0 [ 88.286871][ T2005] __kernfs_new_node+0xf1/0x740 [ 88.286892][ T2005] ? __kasan_check_write+0x18/0x20 [ 88.286914][ T2005] ? kernfs_new_node+0x280/0x280 [ 88.286931][ T2005] ? kernfs_add_one+0x301/0x400 [ 88.286949][ T2005] ? __kernfs_create_file+0x203/0x280 [ 88.286970][ T2005] kernfs_new_node+0x154/0x280 [ 88.286988][ T2005] kernfs_create_link+0xa8/0x200 [ 88.287009][ T2005] sysfs_do_create_link_sd+0x8a/0x120 [ 88.287032][ T2005] sysfs_create_link+0x6c/0x90 [ 88.287058][ T2005] device_add_class_symlinks+0xbe/0x260 [ 88.287080][ T2005] device_add+0x4b8/0xbf0 [ 88.287100][ T2005] netdev_register_kobject+0x196/0x330 [ 88.287124][ T2005] register_netdevice+0x1042/0x1a80 [ 88.287143][ T2005] ? __cfi_register_netdevice+0x10/0x10 [ 88.287160][ T2005] ? alloc_netdev_mqs+0xd45/0x13d0 [ 88.287190][ T2005] br_add_bridge+0xa6/0xf0 [ 88.287208][ T2005] br_ioctl_stub+0x5b6/0xcd0 [ 88.287226][ T2005] ? __cfi_br_ioctl_stub+0x10/0x10 [ 88.287245][ T2005] ? selinux_file_ioctl+0x732/0x1480 [ 88.287269][ T2005] ? __kasan_check_write+0x18/0x20 [ 88.287294][ T2005] ? mutex_lock+0x97/0x1d0 [ 88.287315][ T2005] ? file_init_path+0x434/0x590 [ 88.287334][ T2005] ? __cfi_do_futex+0x10/0x10 [ 88.287352][ T2005] ? __cfi_br_ioctl_stub+0x10/0x10 [ 88.287370][ T2005] sock_ioctl+0x4e0/0x7e0 [ 88.287387][ T2005] ? __cfi_sock_ioctl+0x10/0x10 [ 88.287403][ T2005] ? __fget_files+0x2bc/0x330 [ 88.287419][ T2005] ? bpf_lsm_file_ioctl+0xd/0x20 [ 88.287438][ T2005] ? security_file_ioctl+0x3e/0x110 [ 88.287464][ T2005] ? __cfi_sock_ioctl+0x10/0x10 [ 88.287480][ T2005] __se_sys_ioctl+0x123/0x1b0 [ 88.287497][ T2005] __x64_sys_ioctl+0x7f/0xa0 [ 88.287513][ T2005] x64_sys_call+0x1878/0x2ee0 [ 88.287532][ T2005] do_syscall_64+0x57/0xf0 [ 88.287550][ T2005] ? clear_bhb_loop+0x50/0xa0 [ 88.287571][ T2005] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 88.287598][ T2005] RIP: 0033:0x7f7c4019f559 [ 88.287612][ T2005] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 88.287628][ T2005] RSP: 002b:00007f7c41105028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 88.287649][ T2005] RAX: ffffffffffffffda RBX: 00007f7c40426090 RCX: 00007f7c4019f559 [ 88.287663][ T2005] RDX: 0000200000000440 RSI: 00000000000089a0 RDI: 0000000000000008 [ 88.287680][ T2005] RBP: 00007f7c40236b20 R08: 0000000000000000 R09: 0000000000000000 [ 88.287692][ T2005] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 88.287704][ T2005] R13: 00007f7c40426128 R14: 00007f7c40426090 R15: 00007ffe7a92eff8 [ 88.287718][ T2005] [ 88.925175][ T36] audit: type=1400 audit(1793285162.973:385): avc: denied { create } for pid=2014 comm="syz.0.383" name="#15" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 88.947037][ T36] audit: type=1400 audit(1793285162.973:386): avc: denied { link } for pid=2014 comm="syz.0.383" name="#15" dev="tmpfs" ino=594 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 88.969542][ T36] audit: type=1400 audit(1793285162.973:387): avc: denied { rename } for pid=2014 comm="syz.0.383" name="#16" dev="tmpfs" ino=594 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 89.679446][ T2065] SELinux: Context system_u:object_r:hald_exec_t:s0 is not valid (left unmapped). [ 89.830086][ T2078] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=43 sclass=netlink_route_socket pid=2078 comm=syz.0.398 [ 89.844531][ T2078] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=57 sclass=netlink_route_socket pid=2078 comm=syz.0.398 [ 89.857381][ T2078] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=56 sclass=netlink_route_socket pid=2078 comm=syz.0.398 [ 89.870463][ T2078] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=39 sclass=netlink_route_socket pid=2078 comm=syz.0.398 [ 89.895869][ T2092] FAULT_INJECTION: forcing a failure. [ 89.895869][ T2092] name fail_futex, interval 1, probability 0, space 0, times 0 [ 89.908789][ T2092] CPU: 0 UID: 0 PID: 2092 Comm: syz.0.400 Not tainted syzkaller #0 5cdf496c3980d18a0efbb3b3e73d13bf69df874e [ 89.908822][ T2092] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 89.908835][ T2092] Call Trace: [ 89.908844][ T2092] [ 89.908853][ T2092] __dump_stack+0x21/0x30 [ 89.908883][ T2092] dump_stack_lvl+0x140/0x1c0 [ 89.908899][ T2092] ? __cfi_dump_stack_lvl+0x10/0x10 [ 89.908916][ T2092] dump_stack+0x19/0x20 [ 89.908931][ T2092] should_fail_ex+0x3c2/0x510 [ 89.908941][ T2092] should_fail+0xf/0x20 [ 89.908950][ T2092] get_futex_key+0x178/0x940 [ 89.908962][ T2092] ? __cfi___futex_wait+0x10/0x10 [ 89.908976][ T2092] ? __cfi_get_futex_key+0x10/0x10 [ 89.908985][ T2092] ? __cfi_futex_wake_mark+0x10/0x10 [ 89.908997][ T2092] futex_wake+0x150/0x950 [ 89.909009][ T2092] ? futex_wait+0x2b8/0x7c0 [ 89.909020][ T2092] ? __cfi_futex_wake+0x10/0x10 [ 89.909032][ T2092] ? vfs_write+0xbcf/0xfd0 [ 89.909046][ T2092] do_futex+0x37d/0x510 [ 89.909056][ T2092] ? __cfi_do_futex+0x10/0x10 [ 89.909069][ T2092] ? mutex_unlock+0x90/0x240 [ 89.909082][ T2092] __se_sys_futex+0x13c/0x320 [ 89.909092][ T2092] ? fput+0x1a4/0x230 [ 89.909102][ T2092] ? __x64_sys_futex+0x110/0x110 [ 89.909113][ T2092] ? __kasan_check_write+0x18/0x20 [ 89.909129][ T2092] __x64_sys_futex+0xe9/0x110 [ 89.909140][ T2092] x64_sys_call+0x227f/0x2ee0 [ 89.909152][ T2092] do_syscall_64+0x57/0xf0 [ 89.909164][ T2092] ? clear_bhb_loop+0x50/0xa0 [ 89.909177][ T2092] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 89.909190][ T2092] RIP: 0033:0x7ff6e9d9f559 [ 89.909201][ T2092] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 89.909209][ T2092] RSP: 002b:00007ff6eabc90e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 89.909222][ T2092] RAX: ffffffffffffffda RBX: 00007ff6ea025fa8 RCX: 00007ff6e9d9f559 [ 89.909229][ T2092] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007ff6ea025fac [ 89.909237][ T2092] RBP: 00007ff6ea025fa0 R08: 4000000000000000 R09: 0000000000000000 [ 89.909244][ T2092] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 89.909251][ T2092] R13: 00007ff6ea026038 R14: 00007fffae485ad0 R15: 00007fffae485bb8 [ 89.909260][ T2092] [ 90.130906][ T310] usb 3-1: new high-speed USB device number 26 using dummy_hcd [ 90.291738][ T310] usb 3-1: New USB device found, idVendor=057b, idProduct=0000, bcdDevice= 0.00 [ 90.300951][ T310] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 90.311251][ T310] usb-storage 3-1:32.0: USB Mass Storage device detected [ 90.319046][ T310] usb-storage 3-1:32.0: Quirks match for vid 057b pid 0000: 1 [ 90.380677][ T45] usb 4-1: new high-speed USB device number 36 using dummy_hcd [ 90.514699][ T2075] zram0: detected capacity change from 0 to 8 [ 90.521961][ T2075] netlink: 8 bytes leftover after parsing attributes in process `syz.2.397'. [ 90.531815][ T2075] loop7: detected capacity change from 0 to 7 [ 90.538254][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 90.547450][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 90.555428][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 90.564639][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 90.564849][ T45] usb 4-1: config 0 has no interfaces? [ 90.578156][ T2075] loop7: unable to read partition table [ 90.584115][ T2075] loop_reread_partitions: partition scan of loop7 (Cj̖P=ý?}X %`ր{֐ȵ4FLQk݊) failed (rc=-5) [ 90.598886][ T2102] netlink: 20 bytes leftover after parsing attributes in process `syz.1.403'. [ 90.599515][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 90.616972][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 90.625696][ T9] usb 3-1: USB disconnect, device number 26 [ 90.626836][ T45] usb 4-1: New USB device found, idVendor=04dd, idProduct=8005, bcdDevice= 0.00 [ 90.633878][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 90.646131][ T45] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 90.649889][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 90.659483][ T45] usb 4-1: Product: syz [ 90.668567][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 90.674532][ T2105] Bluetooth: ISO socket layer initialized [ 90.679118][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 90.687146][ T45] usb 4-1: Manufacturer: syz [ 90.693347][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 90.698864][ T2104] netlink: 8 bytes leftover after parsing attributes in process `syz.1.404'. [ 90.706470][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 90.706878][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 90.715399][ T45] usb 4-1: SerialNumber: syz [ 90.723092][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 90.734564][ T2104] netlink: 8 bytes leftover after parsing attributes in process `syz.1.404'. [ 90.754042][ T2104] netlink: 8 bytes leftover after parsing attributes in process `syz.1.404'. [ 90.763098][ T45] usb 4-1: config 0 descriptor?? [ 90.763136][ T2104] netlink: 8 bytes leftover after parsing attributes in process `syz.1.404'. [ 90.777031][ T2104] netlink: 8 bytes leftover after parsing attributes in process `syz.1.404'. [ 90.786114][ T2104] netlink: 8 bytes leftover after parsing attributes in process `syz.1.404'. [ 90.795068][ T2104] netlink: 8 bytes leftover after parsing attributes in process `syz.1.404'. [ 90.987670][ T9] usb 4-1: USB disconnect, device number 36 [ 91.160706][ T45] usb 2-1: new high-speed USB device number 17 using dummy_hcd [ 91.290664][ T45] usb 2-1: device descriptor read/64, error -71 [ 91.300696][ T310] usb 1-1: new full-speed USB device number 36 using dummy_hcd [ 91.390705][ T9] usb 3-1: new high-speed USB device number 27 using dummy_hcd [ 91.451706][ T310] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 91.462759][ T310] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 91.472595][ T310] usb 1-1: New USB device found, idVendor=27b8, idProduct=01ed, bcdDevice= 0.00 [ 91.481759][ T310] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 91.490360][ T310] usb 1-1: config 0 descriptor?? [ 91.540667][ T45] usb 2-1: device descriptor read/64, error -71 [ 91.542021][ T9] usb 3-1: unable to get BOS descriptor or descriptor too short [ 91.557575][ T9] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 91.569787][ T9] usb 3-1: New USB device found, idVendor=2b53, idProduct=0031, bcdDevice= 0.40 [ 91.580505][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 91.588591][ T9] usb 3-1: Product: syz [ 91.590618][ T2120] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 91.592869][ T9] usb 3-1: Manufacturer: syz [ 91.606157][ T9] usb 3-1: SerialNumber: syz [ 91.780633][ T45] usb 2-1: new high-speed USB device number 18 using dummy_hcd [ 91.815472][ T9] snd-usb-audio 3-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 91.825923][ T9] snd-usb-audio 3-1:1.1: probe with driver snd-usb-audio failed with error -22 [ 91.838938][ T9] snd-usb-audio 3-1:1.2: probe with driver snd-usb-audio failed with error -22 [ 91.849669][ T9] usb 3-1: USB disconnect, device number 27 [ 91.859976][ T422] udevd[422]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.2/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 91.880642][ T10] usb 4-1: new high-speed USB device number 37 using dummy_hcd [ 91.910665][ T45] usb 2-1: device descriptor read/64, error -71 [ 92.030640][ T10] usb 4-1: Using ep0 maxpacket: 32 [ 92.037226][ T10] usb 4-1: unable to get BOS descriptor or descriptor too short [ 92.045661][ T10] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 92.055821][ T10] usb 4-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 92.064861][ T10] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 92.077092][ T10] usb 4-1: New USB device found, idVendor=0763, idProduct=2003, bcdDevice= 0.40 [ 92.086200][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 92.094239][ T10] usb 4-1: Product: syz [ 92.098395][ T10] usb 4-1: Manufacturer: syz [ 92.103043][ T10] usb 4-1: SerialNumber: syz [ 92.150655][ T45] usb 2-1: device descriptor read/64, error -71 [ 92.260784][ T45] usb usb2-port1: attempt power cycle [ 92.314190][ T10] usb 4-1: 1:1 : no or invalid class specific endpoint descriptor [ 92.322170][ T10] usb 4-1: 1:1 : unsupported format bits 0x2002 [ 92.330630][ T10] usb 4-1: parse_audio_format_rates_v2v3(): unable to find clock source (clock -22) [ 92.346539][ T10] usb 4-1: unit 37 not found! [ 92.351540][ T10] usb 4-1: unit 0 not found! [ 92.364571][ T10] usb 4-1: USB disconnect, device number 37 [ 92.428090][ T36] kauditd_printk_skb: 6 callbacks suppressed [ 92.428106][ T36] audit: type=1400 audit(1793285166.473:394): avc: denied { map } for pid=2160 comm="syz.2.414" path="socket:[28972]" dev="sockfs" ino=28972 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 92.468104][ T36] audit: type=1400 audit(1793285166.513:395): avc: denied { mounton } for pid=2162 comm="syz.2.415" path="/proc/479/task" dev="proc" ino=28366 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=dir permissive=1 [ 92.610648][ T45] usb 2-1: new high-speed USB device number 19 using dummy_hcd [ 92.631594][ T45] usb 2-1: device descriptor read/8, error -71 [ 92.761589][ T45] usb 2-1: device descriptor read/8, error -71 [ 92.770668][ T31] usb 3-1: new high-speed USB device number 28 using dummy_hcd [ 92.921045][ T31] usb 3-1: too many configurations: 151, using maximum allowed: 8 [ 92.929822][ T31] usb 3-1: config 0 interface 0 has no altsetting 0 [ 92.937972][ T31] usb 3-1: config 0 interface 0 has no altsetting 0 [ 92.945540][ T31] usb 3-1: config 0 interface 0 has no altsetting 0 [ 92.953455][ T31] usb 3-1: config 0 interface 0 has no altsetting 0 [ 92.960796][ T31] usb 3-1: config 0 interface 0 has no altsetting 0 [ 92.968054][ T31] usb 3-1: config 0 interface 0 has no altsetting 0 [ 92.975620][ T31] usb 3-1: config 0 interface 0 has no altsetting 0 [ 92.982933][ T31] usb 3-1: config 0 interface 0 has no altsetting 0 [ 92.990998][ T31] usb 3-1: New USB device found, idVendor=04d8, idProduct=0082, bcdDevice=ce.b7 [ 93.000055][ T31] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=130 [ 93.008297][ T45] usb 2-1: new high-speed USB device number 20 using dummy_hcd [ 93.015934][ T31] usb 3-1: Product: syz [ 93.020108][ T31] usb 3-1: Manufacturer: syz [ 93.025385][ T31] usb 3-1: SerialNumber: syz [ 93.030545][ T31] usb 3-1: config 0 descriptor?? [ 93.041650][ T45] usb 2-1: device descriptor read/8, error -71 [ 93.171600][ T45] usb 2-1: device descriptor read/8, error -71 [ 93.220638][ T9] usb 4-1: new high-speed USB device number 38 using dummy_hcd [ 93.241183][ T2163] __nla_validate_parse: 26 callbacks suppressed [ 93.241220][ T2163] netlink: 5 bytes leftover after parsing attributes in process `syz.2.415'. [ 93.246694][ T36] audit: type=1400 audit(1793285167.293:396): avc: denied { associate } for pid=2171 comm="syz.2.415" name="core" scontext=root:object_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 93.247655][ T2163] 1{X: renamed from 30{X [ 93.282606][ T45] usb usb2-port1: unable to enumerate USB device [ 93.284776][ T2163] A link change request failed with some changes committed already. Interface 31{X may have been left with an inconsistent configuration, please check. [ 93.310744][ T45] usb 3-1: USB disconnect, device number 28 [ 93.381744][ T9] usb 4-1: config 0 has no interfaces? [ 93.388776][ T9] usb 4-1: New USB device found, idVendor=04dd, idProduct=8005, bcdDevice= 0.00 [ 93.397896][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 93.405924][ T9] usb 4-1: Product: syz [ 93.410086][ T9] usb 4-1: Manufacturer: syz [ 93.414763][ T9] usb 4-1: SerialNumber: syz [ 93.420084][ T9] usb 4-1: config 0 descriptor?? [ 93.628415][ T45] usb 4-1: USB disconnect, device number 38 [ 93.867229][ T2177] ================================================================== [ 93.875344][ T2177] BUG: KASAN: slab-use-after-free in snapshot_ctr+0x586/0x1350 [ 93.882903][ T2177] Read of size 8 at addr ffff88811b550b18 by task syz.1.419/2177 [ 93.890632][ T2177] [ 93.892966][ T2177] CPU: 0 UID: 0 PID: 2177 Comm: syz.1.419 Not tainted syzkaller #0 5cdf496c3980d18a0efbb3b3e73d13bf69df874e [ 93.892995][ T2177] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 93.893005][ T2177] Call Trace: [ 93.893010][ T2177] [ 93.893016][ T2177] __dump_stack+0x21/0x30 [ 93.893038][ T2177] dump_stack_lvl+0x140/0x1c0 [ 93.893053][ T2177] ? __cfi_dump_stack_lvl+0x10/0x10 [ 93.893081][ T2177] ? __cfi__printk+0x10/0x10 [ 93.893105][ T2177] print_address_description+0x71/0x210 [ 93.893132][ T2177] print_report+0x4a/0x70 [ 93.893150][ T2177] kasan_report+0x162/0x1a0 [ 93.893161][ T2177] ? snapshot_ctr+0x586/0x1350 [ 93.893174][ T2177] ? snapshot_ctr+0x586/0x1350 [ 93.893186][ T2177] __asan_report_load8_noabort+0x18/0x20 [ 93.893201][ T2177] snapshot_ctr+0x586/0x1350 [ 93.893225][ T2177] ? dm_split_args+0xa1/0x740 [ 93.893244][ T2177] ? __cfi_snapshot_ctr+0x10/0x10 [ 93.893265][ T2177] ? dm_split_args+0x5d0/0x740 [ 93.893284][ T2177] dm_table_add_target+0x59f/0xcb0 [ 93.893295][ T2177] table_load+0x2eb/0x7d0 [ 93.893309][ T2177] ? __check_object_size+0x99/0x870 [ 93.893322][ T2177] ? __cfi_table_load+0x10/0x10 [ 93.893336][ T2177] ? __kasan_check_write+0x18/0x20 [ 93.893353][ T2177] ? __cfi_table_load+0x10/0x10 [ 93.893378][ T2177] dm_ctl_ioctl+0x8f0/0xde0 [ 93.893404][ T2177] ? __cfi_dm_ctl_ioctl+0x10/0x10 [ 93.893429][ T2177] ? __fget_files+0x2bc/0x330 [ 93.893439][ T2177] ? bpf_lsm_file_ioctl+0xd/0x20 [ 93.893450][ T2177] ? security_file_ioctl+0x3e/0x110 [ 93.893464][ T2177] ? __cfi_dm_ctl_ioctl+0x10/0x10 [ 93.893477][ T2177] __se_sys_ioctl+0x123/0x1b0 [ 93.893498][ T2177] __x64_sys_ioctl+0x7f/0xa0 [ 93.893518][ T2177] x64_sys_call+0x1878/0x2ee0 [ 93.893539][ T2177] do_syscall_64+0x57/0xf0 [ 93.893561][ T2177] ? clear_bhb_loop+0x50/0xa0 [ 93.893579][ T2177] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 93.893592][ T2177] RIP: 0033:0x7fdfcbf9f559 [ 93.893604][ T2177] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 93.893613][ T2177] RSP: 002b:00007fdfccf3b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 93.893625][ T2177] RAX: ffffffffffffffda RBX: 00007fdfcc225fa0 RCX: 00007fdfcbf9f559 [ 93.893636][ T2177] RDX: 0000200000000180 RSI: 00000000c138fd09 RDI: 0000000000000003 [ 93.893649][ T2177] RBP: 00007fdfcc036b20 R08: 0000000000000000 R09: 0000000000000000 [ 93.893661][ T2177] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 93.893672][ T2177] R13: 00007fdfcc226038 R14: 00007fdfcc225fa0 R15: 00007ffe2215cc68 [ 93.893688][ T2177] [ 93.893696][ T2177] [ 94.078072][ T310] usbhid 1-1:0.0: can't add hid device: -71 [ 94.080429][ T2177] Allocated by task 2177: [ 94.080446][ T2177] kasan_save_track+0x3e/0x80 [ 94.104182][ T310] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 94.108487][ T2177] kasan_save_alloc_info+0x3a/0x50 [ 94.108523][ T2177] __kasan_kmalloc+0x96/0xb0 [ 94.108540][ T2177] __kmalloc_cache_node_noprof+0x225/0x430 [ 94.118193][ T310] usb 1-1: USB disconnect, device number 36 [ 94.124565][ T2177] dm_get_table_device+0x1e3/0x6c0 [ 94.124597][ T2177] dm_get_device+0x32b/0x7f0 [ 94.124612][ T2177] snapshot_ctr+0x292/0x1350 [ 94.124630][ T2177] dm_table_add_target+0x59f/0xcb0 [ 94.124646][ T2177] table_load+0x2eb/0x7d0 [ 94.124665][ T2177] dm_ctl_ioctl+0x8f0/0xde0 [ 94.124684][ T2177] __se_sys_ioctl+0x123/0x1b0 [ 94.124698][ T2177] __x64_sys_ioctl+0x7f/0xa0 [ 94.124712][ T2177] x64_sys_call+0x1878/0x2ee0 [ 94.124728][ T2177] do_syscall_64+0x57/0xf0 [ 94.124744][ T2177] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 94.124765][ T2177] [ 94.124769][ T2177] Freed by task 2177: [ 94.124779][ T2177] kasan_save_track+0x3e/0x80 [ 94.220775][ T31] usb 3-1: new high-speed USB device number 29 using dummy_hcd [ 94.221528][ T2177] kasan_save_free_info+0x44/0x50 [ 94.273811][ T2177] __kasan_slab_free+0x5f/0x80 [ 94.278579][ T2177] kfree+0x158/0x440 [ 94.282520][ T2177] dm_put_table_device+0x298/0x2e0 [ 94.287627][ T2177] dm_get_device+0x571/0x7f0 [ 94.292212][ T2177] snapshot_ctr+0x435/0x1350 [ 94.296799][ T2177] dm_table_add_target+0x59f/0xcb0 [ 94.301922][ T2177] table_load+0x2eb/0x7d0 [ 94.306269][ T2177] dm_ctl_ioctl+0x8f0/0xde0 [ 94.310791][ T2177] __se_sys_ioctl+0x123/0x1b0 [ 94.315469][ T2177] __x64_sys_ioctl+0x7f/0xa0 [ 94.320053][ T2177] x64_sys_call+0x1878/0x2ee0 [ 94.324730][ T2177] do_syscall_64+0x57/0xf0 [ 94.329148][ T2177] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 94.335068][ T2177] [ 94.337379][ T2177] The buggy address belongs to the object at ffff88811b550b00 [ 94.337379][ T2177] which belongs to the cache kmalloc-96 of size 96 [ 94.351246][ T2177] The buggy address is located 24 bytes inside of [ 94.351246][ T2177] freed 96-byte region [ffff88811b550b00, ffff88811b550b60) [ 94.364948][ T2177] [ 94.367268][ T2177] The buggy address belongs to the physical page: [ 94.373673][ T2177] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11b550 [ 94.382518][ T2177] anon flags: 0x4000000000000000(zone=1) [ 94.388141][ T2177] page_type: f5(slab) [ 94.392133][ T2177] raw: 4000000000000000 ffff888100041280 0000000000000000 dead000000000001 [ 94.400728][ T2177] raw: 0000000000000000 0000000080200020 00000001f5000000 0000000000000000 [ 94.409296][ T2177] page dumped because: kasan: bad access detected [ 94.415705][ T2177] page_owner tracks the page as allocated [ 94.421405][ T2177] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 116, tgid 116 (udevd), ts 6161018066, free_ts 0 [ 94.439031][ T2177] post_alloc_hook+0x37d/0x3b0 [ 94.443821][ T2177] prep_new_page+0x2d/0x180 [ 94.448319][ T2177] get_page_from_freelist+0x4aea/0x4ba0 [ 94.450624][ T31] usb 3-1: Using ep0 maxpacket: 32 [ 94.453964][ T2177] __alloc_pages_noprof+0x35a/0x7e0 [ 94.453992][ T2177] alloc_slab_page+0x6b/0x1e0 [ 94.460374][ T31] usb 3-1: config 0 has an invalid interface number: 184 but max is 0 [ 94.464352][ T2177] allocate_slab+0x69/0x430 [ 94.464378][ T2177] ___slab_alloc+0x591/0x8c0 [ 94.464402][ T2177] __kmalloc_node_noprof+0x2e7/0x500 [ 94.471701][ T31] usb 3-1: config 0 has no interface number 0 [ 94.477285][ T2177] __kvmalloc_node_noprof+0x128/0x300 [ 94.477318][ T2177] simple_xattr_alloc+0x67/0x140 [ 94.482335][ T31] usb 3-1: config 0 interface 184 has no altsetting 0 [ 94.486403][ T2177] simple_xattr_set+0x45/0x300 [ 94.486443][ T2177] shmem_xattr_handler_set+0x198/0x2d0 [ 94.493502][ T31] usb 3-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 94.497784][ T2177] __vfs_setxattr+0x453/0x4a0 [ 94.497814][ T2177] __vfs_setxattr_noperm+0x12d/0x670 [ 94.503639][ T31] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 94.508095][ T2177] __vfs_setxattr_locked+0x212/0x240 [ 94.508126][ T2177] vfs_setxattr+0x16b/0x2f0 [ 94.515344][ T31] usb 3-1: Product: syz [ 94.519641][ T2177] page_owner free stack trace missing [ 94.519672][ T2177] [ 94.519677][ T2177] Memory state around the buggy address: [ 94.519689][ T2177] ffff88811b550a00: 00 00 00 00 00 00 00 00 03 fc fc fc fc fc fc fc [ 94.525671][ T31] usb 3-1: Manufacturer: syz [ 94.534139][ T2177] ffff88811b550a80: 00 00 00 00 00 00 00 00 07 fc fc fc fc fc fc fc [ 94.534154][ T2177] >ffff88811b550b00: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc [ 94.534162][ T2177] ^ [ 94.534171][ T2177] ffff88811b550b80: 00 00 00 00 00 00 00 00 03 fc fc fc fc fc fc fc [ 94.534183][ T2177] ffff88811b550c00: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc [ 94.539297][ T31] usb 3-1: SerialNumber: syz [ 94.544108][ T2177] ================================================================== [ 94.545601][ T36] audit: type=1400 audit(1793285168.493:397): avc: denied { read } for pid=91 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 94.555629][ T31] usb 3-1: config 0 descriptor?? [ 94.558091][ T36] audit: type=1400 audit(1793285168.493:398): avc: denied { search } for pid=91 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 94.577192][ T31] smsc75xx v1.0.0 [ 94.579548][ T36] audit: type=1400 audit(1793285168.493:399): avc: denied { write search } for pid=91 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 94.610764][ T2177] Disabling lock debugging due to kernel taint [ 94.613425][ T36] audit: type=1400 audit(1793285168.493:400): avc: denied { add_name } for pid=91 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 94.621738][ T2177] device-mapper: table: 252:3: device 1:2 not in table devices list [ 94.629799][ T36] audit: type=1400 audit(1793285168.493:401): avc: denied { create } for pid=91 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 94.634493][ T2177] device-mapper: table: 252:3: snapshot-merge: COW device cannot be the same as origin device (-EINVAL) [ 94.642465][ T36] audit: type=1400 audit(1793285168.493:402): avc: denied { append open } for pid=91 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 94.664218][ T2177] device-mapper: ioctl: error adding target to table [ 94.669473][ T36] audit: type=1400 audit(1793285168.493:403): avc: denied { getattr } for pid=91 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 94.694131][ T2177] device-mapper: table: 252:3: dm_table_destroy: dm_put_device call missing for 1:2 [ 95.046008][ T31] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000040: -61 [ 95.056876][ T31] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 95.282754][ T31] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -71 [ 95.293647][ T31] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -71 [ 95.303400][ T31] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_reset [ 95.313680][ T31] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -71 [ 95.323131][ T31] smsc75xx 3-1:0.184: probe with driver smsc75xx failed with error -71 [ 95.335110][ T31] usb 3-1: USB disconnect, device number 29