last executing test programs: 17.224302025s ago: executing program 0 (id=1037): rseq(&(0x7f0000000280), 0x20, 0x0, 0x0) msgsnd(0x0, 0x0, 0x1d, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) mknod$loop(&(0x7f0000000140)='./file0\x00', 0xfff, 0x1) openat$fuse(0xffffffffffffff9c, &(0x7f0000000340), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=000000000100000,user_id', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) 17.04045797s ago: executing program 0 (id=1039): syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r1 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102380, 0x18fec) r3 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$FUSE_NOTIFY_RETRIEVE(r3, &(0x7f0000000200)={0x30}, 0x30) r4 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x0, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.io_wait_time\x00', 0x275a, 0x0) r6 = userfaultfd(0x801) ioctl$UFFDIO_API(r6, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r6, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1}) syz_kvm_setup_syzos_vm$x86(0xffffffffffffffff, &(0x7f0000c00000/0x400000)=nil) ioctl$UFFDIO_CONTINUE(r6, 0xc020aa08, &(0x7f0000000080)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}}) mknodat(0xffffffffffffff9c, 0x0, 0x21c0, 0x103) write$uinput_user_dev(r5, &(0x7f0000000b00)={'syz0\x00', {0x5, 0x7, 0x3, 0x7}, 0x50, [0x2, 0x9, 0x0, 0x1, 0x8, 0xea45, 0xe, 0x10, 0x63, 0x1, 0x6, 0x9, 0x2, 0x9, 0x1, 0x4, 0x8001000, 0x7fffffff, 0x51, 0x8, 0x800, 0xa4d, 0x3ff, 0x4, 0x6, 0x10001, 0xffff, 0x0, 0x4, 0x6, 0x401, 0xc, 0x9, 0x4, 0x2, 0x1, 0x5, 0x4, 0x1, 0x4, 0xa, 0x1000008, 0x2, 0x9, 0x804d7f, 0x2, 0x8c00, 0x6, 0x939, 0x5, 0x9, 0x2, 0x2, 0x4, 0xfffffffa, 0x6, 0x6, 0x5, 0x80000001, 0xd77, 0x5, 0x2a, 0x1, 0x23], [0x8, 0x20009, 0x9, 0x9, 0x80000005, 0x12, 0x800, 0x2c, 0x0, 0x2329, 0xfd8, 0x3, 0x7, 0x5, 0xffffffff, 0x24a, 0x2, 0xfffffff7, 0x0, 0x3, 0x0, 0x4009, 0x80, 0xb, 0x8001, 0x40, 0xa1, 0x4, 0xffffffff, 0x5, 0x10004, 0x9e, 0xffffff00, 0x7ff, 0x6, 0x7, 0x0, 0xe, 0xffff3f16, 0xc, 0xca4d, 0x9, 0xa, 0x5, 0x2, 0x207, 0x800, 0x5, 0xc5, 0x3, 0x1, 0x9, 0x8, 0x3, 0xffff7ff7, 0x3, 0x24c, 0x1ff, 0x2a0, 0x5, 0x6, 0x6, 0x280007, 0x8], [0x20002, 0x9, 0x1a9e1bfa, 0xfffffffc, 0x8, 0x7fffffff, 0x1, 0xc, 0x7aae, 0x5, 0x2, 0x7ffffff7, 0x1008000, 0x1, 0x1, 0x5, 0x400, 0x2, 0x2b0, 0x3, 0x97f82544, 0x8, 0x0, 0x0, 0x9, 0x5, 0x4, 0x10000, 0xc90, 0xffffff3c, 0x8b2, 0x10, 0x4, 0xff, 0x140, 0x2, 0x2, 0x1000000c, 0x0, 0x6, 0x7, 0x8007c12, 0x5, 0x1, 0x1b, 0x8000, 0xe, 0xf3, 0x4, 0x8, 0x1, 0xffffff00, 0x100, 0x3fff80, 0x2, 0x0, 0x8, 0xdd, 0x9, 0x9, 0xc3, 0x20ffff, 0x7a0], [0x9, 0x3a8d, 0xffff9a7f, 0x8000200, 0x6, 0x1, 0x1, 0xfffffff3, 0xd077, 0x2, 0xffffffff, 0x1f, 0x81, 0xa, 0x6, 0x2, 0x200, 0xfe, 0x2, 0x66608000, 0xde82, 0x7fb, 0x6, 0x0, 0x0, 0x5, 0x80000001, 0xffff, 0x101, 0x0, 0xfffffffd, 0x1, 0x10001, 0x61, 0x10, 0x1000, 0xc, 0x100, 0x8, 0x20000000, 0x8, 0x15, 0xb32a, 0xec000000, 0x8001, 0x1904, 0x2, 0xc, 0x8, 0x7ff, 0x196, 0x5, 0xfffffffb, 0x7, 0x6e79, 0x8, 0xc, 0x9371, 0x4f89, 0x7, 0x580, 0x2d1, 0x80, 0x8]}, 0x45c) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x12, r5, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r4, 0xc1105517, &(0x7f0000000340)={{0x0, 0x1, 0x0, 0xffffffff, 'syz0\x00', 0x71}, 0x1, 0x0, 0x4, 0xffffffffffffffff, 0x0, 0x0, 'syz0\x00', 0x0}) 16.98498987s ago: executing program 1 (id=1040): r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000040), 0x10) socket(0x8, 0x3, 0x1) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000001c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x0, 0x0, 0x2, 0x0, 0x9, 0x3, 0x100000000, 0x8000320, 0xffffffff}, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) r3 = socket(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) set_mempolicy(0x3, &(0x7f0000000080)=0x6, 0x5) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) openat$tun(0xffffffffffffff9c, 0x0, 0x40241, 0x0) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) sendmsg$nl_route_sched(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000480)=@getqdisc={0x48, 0x26, 0x300, 0x70bd2b, 0x25df9c00, {0x0, 0x0, 0x0, 0x0, {0x2, 0xfff2}, {0xc, 0xc}, {0x7, 0x9}}, [{0x4}, {0x4}, {0x4}, {0x4}, {0x4}, {0x4}, {0x4}, {0x4}, {0x4}]}, 0x48}, 0x1, 0x0, 0x0, 0x2}, 0x2000400c) socket$nl_route(0x10, 0x3, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB], 0x4c}, 0x1, 0x0, 0x0, 0x8000}, 0x20008000) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r4, 0x3ba0, &(0x7f0000000740)={0x48, 0x2, r6}) ioctl$IOMMU_IOAS_MAP$PAGES(r4, 0x3b85, &(0x7f00000007c0)={0x28, 0x5, r6, 0x0, &(0x7f0000000000/0x800000)=nil, 0x800000, 0x1004000}) accept$alg(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_SET(0xffffffffffffffff, &(0x7f0000000b40)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f0000000380)=ANY=[@ANYBLOB="50000000030801030000000000000000000000000000048008000640000000900800084000000005642230146d14a3b6fd29171aa75aba7c0800084000000b08000740000000050800094000008001050003002f0000000e4454a5b357bdbc62632d19119f160c1ef1bbd31bd93d0da876291719ef9dcb73d429b7b1accd856a733569cf7a074b65096d04bea6907f38a080cb7aeaac0b9c2c667570eec8268e6ee8a800233db4e38cdfc09d5f27cbb6feed17d456ebdf4d09aadd255ea32e3356e62a8d60d6edb0e228000000000000000000"], 0x50}, 0x1, 0x0, 0x0, 0x8000}, 0x4040884) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r8, 0xae60) ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x0) 15.36409638s ago: executing program 0 (id=1043): r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000040), 0x10) socket(0x8, 0x3, 0x1) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000001c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x0, 0x0, 0x2, 0x0, 0x9, 0x3, 0x100000000, 0x8000320, 0xffffffff}, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) r3 = socket(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) set_mempolicy(0x3, &(0x7f0000000080)=0x6, 0x5) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) sendmsg$nl_route_sched(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={0x0}, 0x1, 0x0, 0x0, 0x2}, 0x2000400c) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)=ANY=[@ANYBLOB="3400000020000100dcec51ecfbdbdf2502101004090000060620010008000200ac14142a08000b0006000000080001"], 0x34}, 0x1, 0x0, 0x0, 0x40}, 0x4000804) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB='L\x00\x00\x00!'], 0x4c}, 0x1, 0x0, 0x0, 0x8000}, 0x20008000) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r4, 0x3ba0, &(0x7f0000000740)={0x48, 0x2, r7}) ioctl$IOMMU_IOAS_MAP$PAGES(r4, 0x3b85, &(0x7f00000007c0)={0x28, 0x5, r7, 0x0, &(0x7f0000000000/0x800000)=nil, 0x800000, 0x1004000}) accept$alg(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_SET(0xffffffffffffffff, &(0x7f0000000b40)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f0000000380)=ANY=[@ANYBLOB="50000000030801030000000000000000000000000000048008000640000000900800084000000005642230146d14a3b6fd29171aa75aba7c0800084000000b08000740000000050800094000008001050003002f0000000e4454a5b357bdbc62632d19119f160c1ef1bbd31bd93d0da876291719ef9dcb73d429b7b1accd856a733569cf7a074b65096d04bea6907f38a080cb7aeaac0b9c2c667570eec8268e6ee8a800233db4e38cdfc09d5f27cbb6feed17d456ebdf4d09aadd255ea32e3356e62a8d60d6edb0e228000000000000000000"], 0x50}, 0x1, 0x0, 0x0, 0x8000}, 0x4040884) r8 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x0) 11.817476262s ago: executing program 3 (id=1049): ioctl$KVM_X86_SET_MSR_FILTER(0xffffffffffffffff, 0x4188aec6, &(0x7f0000002cc0)={0x0, [{0x0, 0x4d88, 0x6, &(0x7f0000000640)="7a650e526bd0998268bb5847d9beacc47a22df873eab4b8b91133675482eaa56ace8db59bed9aa07d4e390c7c9f98c462b55612196911e3c4e510ede3efde35eec990f22a76cf752e507c1e2de2920a9fc0790cc176bd2b901e4127b09835ae6d0d196048bb19a64d26f20a05b95c69f371882ef2e20c5606ed1b2ebcf09a4a333f6e1c3c4fb64d8182df4ab09d0a381d966977fc041cea9bdf0aa31fe51efe9211b9b8e6e4551b6438f8efcc41265574ff6504435eb22a678a99768f0327ded8fdcb41f27c2024d2b923f7dc5df5bf62af447b121dd9f94d766d6cebdeb02f611ab10e57af4b3268fb3f9777373bd5fd6b82f730e67c4eab113d8e65d7405be3e5d92dc5e7e85d34bb8b7c894cbed629ecc25c288b3d4556a85a1e2150cac5b686a8de29ab7c35040b77875bfa0e451dc0869cfe105bd115e7cf48f44dfdf26be65f3b727fd88d6395d051e49c060998e84b19377fcb20fe2eb392335e5a9d84555ef037aab37169ce761aa8a8ec08ea87e3a3b896f3d1b2380bc8256e0f7ea7dc488382e6112b53a7bb269d6261f87e0e0e0cef9152f8a67f412148f34880c970101fbd7b0e8fc49d6a5c87e487b7b175b15be26b6b8e1ed8527614dcefcfd80f8392560c8b706418b7de8fbb7a666a7e7f322dc70373606bf39efa04616cb99d662dfc591061bde5ed27a66aa7edbfec1eb0b1e843c372b84c3ed514a0aadf523b8669e526765d429824aeaa0a6f4c185754d437d977a1f586431dc256ce5aa7c25be259de3a0ae6e5bcdf56b4c7e8199fe6b461e78467cfac19de6956056ef57e93d3a7df8f646f4a9002b100edb0a6caa72b3f6eb29dc54de58120d27daff9cd61c64107e1bcb3b3212e1e2aa24fb24dc2dafc636c82ad25da9d934e46c7783d8f915337612feb348857ce2262240dfe51ec94d9d61074959f167b9840b20f003883bf167149228d7f03eafde851427cd1966a96aeae05b51ae4cd82f4b4dad60a070c01a8b500e2683f7136e331602e76845262825d7f3764cf1a05ad95d88aab71d41484f63fa6a43c044c7f03130552321933bc40b888fd0cc55939ff79a5059516f3b80c7ba8188ffb6a259a34567ee52c1f9df0f6c91737d688e36d076a49d1045cac30d5ed52a10381c96d9f22e469cc531bb06853d18b8f8625d2a917e795ffa4407fa75713510a3f5370e1ecbf7a5ff68a90a1eda077531cf4d399d4908f138c936e1931c72240070c6a6255f5fd03966e9a06c1d481e8e3d128e880776e572177780a3481c49bd86c174e152bafed245d58ef3428c645b08e48833960d1b5223d7be0c67a2b2c7531390d1837a84ed004a00cb4b0cd6e78824da032b48c49ec006d14206dc3d0c67d7ca87e9ea0faddc3e0b0c917c64eefeebf79e3a16c958db63a08a5d4d7210273aba3e56a4cd4cccb044750ff97749505ff1332b2dd30990849ab1500e1947d0abfb0c59760f0a502806ee1bce56fbb42251dd6ac8b709c73a6b8c548c2b23cf351dc498810e477bd082464e76702703b56d3cd2f3d8a2e00f19d8ffa3c236d3601f169c9dfe9c316f8cbe63c3801a51ea5ac785694a0c653cd28d68c5a81c2590d2aeea8c8688b2e88f46c4f99890e51b42cce485fcb4d91557fb3912b36b0dbeac8df44e945eb9937141402fb2aa1476185e1f8c37f6c98bc937f36d9c7237135132a54a03067b002b9c657ab0daa253af66eee78b0309cb8532dd2dee800c8349b731da0efa66ead82eebe0102279df5aa281fe1d86c0dbf154910d5e8a113ecbddbd046367b9e2acfa7cc406f61b472bbec6919534615ed81b664da956ce6586bf4c92d63ef371dfec5f9ce748931d585cadc9372a95a1372c7213e2c52fca253945afeee02e9f2de2d9452c85fd2dbdc87cb6c25697dfcbed8a0eba381835e6c360f3861367ec98a9a9ccf956d6cbfb706fee0d391cf82a0d4662792274f52fc2b5d72a43ec74a86400e62d3652f607774cfad1504bc0476570d532b527bf0d7012804b2e6fdf9a9414f10b16c9374f2b065348d865b309e37750d3a7e12394e356c48c9fa0d4a9a43f689f6cbf70b09a3b9782cc3d5d93480f8a7a21a049780fc6bf21f1eca938a37afcbb2b929a0c502e164d2571e78d214b359d97e3edc0ad5c7fd1625b4ece33e1f569676e9a7262ead857873f77ef149d2f8c5a09ab19ae384a7f957f612a24283c35327aa969b20711309644c5b3e6c89da94e1f5da54246bd771468a1adc8a8d601e0b12769604f0f07ca43ce2a8a2f4b5654c0b76b146c49038e07db54dae702580b97096911f034fc1797029de8b7c213c902d1d754e77ff85e6222e745db9d5d2d45c5d29a8b6de0f27e5701fdf12b09fd6c70baa0f85a424c21ce0796dbe1fd366b94fcdf64ea232b3e88b89a38d728de77e84decc804f07a48f2716ca6f76b24923cea1a4da0d1f1dc73611269e784c4fd921f9b26c11f35b5cda45842a81b603ce2155d95c273fa0743a571b52e68c9ea3f28009fc37406b9e329ce50fedfb20dfb4cdf3a94769aee2586c2a17e68a07abfcd18aceddfd3876b14558e4d092eadb9120796c44e89610494085117bc41b5c4619a8c160b97811df49fc7d9bf222d7a002640644337ef5af53ed50661131f7c042665b276c0adf0c9a74f3542729beb7632a6027e65eddff7bb27915826701ec9b6a4c672f08877eefd859e0aa6e75a2e841e1ea98dff994e5a58be628df86bff17497a4d0f92ab39db421eb1062a2a393656bbb1d92becbb91a59619156b51585cd2eafd8a18d6326166312efeaa7258bddad63e0c7372ffb7ce1f1adf1ac2ffa0f278e4be6684d762f8971ed7bb04096b96f8126bf5fd32142e745d421f495327dde0f1e2d9a1d8ba63c1453101396a2e54e89cdabac2c6a01f23a5c1d5a2dfa2a3c634176e97c9c62b41ea28102b5a08af2fba1d311bb323df086ea97726c9d8c7b7b53a3399a80f040d434fdcc2148fb1da3b7d7f0f3e3fd56471a310ee275da611c79f86be8ed6343f6ed0ad91dfeffebc3ab6389d0566d6db904c1db499ae7d2698fdc7170320f85cc3d3d0d9d0d0c7d45db7b53c5eb79a2fed2a048d9d74419532122fac62f6315a9e13b461cb4e26514491debd366927987271be963ea5805a49b8b480c6a393fda1b11fd5634890cf02948cb5bfea237afb30d081c7403cd334a02e5bb8db542c4d5fa5ec5c8a0dd36b62156881c98e01948b4775a502c5d8453439fd930df52caac9d71c28b712000b306b913c10918ca0bc194f2533334462e5cd2b2e6c978a4838febfbc2d4375b8108bd0aa32aeaf05e7ba30c781cace6470ead574f5cbfa68aa8c8d835e9b3ab2bd7dd90b5e3e6cd62d8e04c3b45326e1f560a8dd8f3db4177e9e5ccd61f21dacb5c40c8030559cdfe88f7aa98bdcde90c1214cf293b3df093d0630bc3073cbaffa025b1f5537b49d799731745de7d36cded4a9db25915a511ba505b4ddd885cd226c24ea37fd926dbd90b887"}, {0x0, 0xffffffffffffffe8, 0x1ff, 0x0}, {0x0, 0x0, 0x5, 0x0}, {0x2, 0x0, 0x3d7, 0x0}, {0x3, 0x0, 0x9, 0x0}, {0x3, 0x0, 0x3, 0x0}, {0x3, 0x0, 0xa2d, 0x0}, {0x0, 0x0, 0x5, 0x0}, {0x1, 0x0, 0xf40, 0x0}, {0x5, 0x0, 0x1001, 0x0}, {0x3, 0x0, 0x6, 0x0}, {0x2, 0x0, 0x1000, 0x0}, {0x0, 0x0, 0x0, 0x0}, {0x0, 0x0, 0x3, 0x0}, {0x2, 0x0, 0x9, 0x0}, {0x1, 0x0, 0x10040007, 0x0}]}) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r0, &(0x7f0000032680)=""/102392, 0x18ff8) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000480)={0x4c, 0x2, 0x6, 0x3, 0x0, 0x0, {0x7}, [@IPSET_ATTR_TYPENAME={0xe, 0x3, 'bitmap:ip\x00'}, @IPSET_ATTR_TYPENAME={0xd, 0x3, 'hash:net\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x3}]}, 0x4c}}, 0x400c001) openat$sw_sync_info(0xffffffffffffff9c, &(0x7f0000000040), 0x440, 0x0) syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="040e0a"], 0xd) r2 = socket$rds(0x15, 0x5, 0x0) bind$rds(r2, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendmsg$rds(r2, &(0x7f0000001600)={&(0x7f0000000000)={0x2, 0x0, @remote}, 0x10, 0x0}, 0x0) sendmsg$IPSET_CMD_ADD(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000540)={0x44, 0x9, 0x6, 0x201, 0x0, 0x0, {0x0, 0x0, 0x5}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x1c, 0x7, 0x0, 0x1, [@IPSET_ATTR_NAMEREF={0x9, 0x13, 'syz1\x00'}, @IPSET_ATTR_PACKETS={0xc, 0x19, 0x1, 0x0, 0x796c}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x10000047}, 0x4000050) keyctl$instantiate(0xc, 0x0, &(0x7f0000000100)=@encrypted_new={'new ', 'default', 0x20, 'user:', 'syz', 0x20, 0xffd}, 0x2a, 0x0) socket$netlink(0x10, 0x3, 0xf) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0xfffff000, 0x2000, &(0x7f0000000000/0x2000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) sched_setaffinity(0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x92fda000) openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./file1\x00', 0x347902, 0x32) ftruncate(r6, 0x6000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, 0xffffffffffffffff, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) 11.804931449s ago: executing program 1 (id=1050): r0 = io_uring_setup(0x3ced, &(0x7f0000000540)={0x0, 0xf822, 0x1, 0x1, 0x38e}) add_key$keyring(&(0x7f0000000740), 0x0, 0x0, 0x0, 0xfffffffffffffffd) io_uring_register$IORING_REGISTER_PERSONALITY(r0, 0x9, 0x0, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="10000000040000000800000002"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000750000001801000020646c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000e00000095"], 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000440)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f00000000c0), 0x80200, 0x0) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100), 0x101e01, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000140)=0x15) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_io_uring_setup(0x5131, &(0x7f00000003c0)={0x0, 0x6118, 0x40000, 0x0, 0xdc}, &(0x7f0000000300), 0x0, 0x0) openat$sysfs(0xffffffffffffff9c, 0x0, 0x800, 0x4) pselect6(0x40, &(0x7f0000000240)={0x3, 0x0, 0x202, 0x1, 0x3, 0x8000, 0x4, 0x1}, 0x0, &(0x7f00000002c0)={0x8000000000000000, 0x9, 0xffffffffffffffff, 0x7fff, 0x4, 0xf, 0x40, 0x7f}, 0x0, 0x0) r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x8, 0x94, 0x7fff0000}]}) close_range(r4, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_emit_ethernet(0x56, &(0x7f00000005c0)={@local, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, @val={@void, {0x8100, 0x3, 0x1, 0x3}}, {@ipv4={0x800, @tcp={{0xc, 0x4, 0x0, 0x0, 0x44, 0x0, 0x0, 0x0, 0x6, 0x0, @rand_addr=0x64010101, @multicast1, {[@lsrr={0x83, 0x13, 0xf4, [@loopback, @multicast2, @remote, @loopback]}, @noop, @lsrr={0x83, 0x3, 0x23}, @noop, @end]}}, {{0x4e21, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0xc2}}}}}}, 0x0) open(&(0x7f00000001c0)='./file1\x00', 0x14927e, 0xb3) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file2\x00', 0x3a4) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8}, 0x0) setxattr$security_capability(&(0x7f0000000140)='./file0/file1\x00', &(0x7f0000000040), 0x0, 0x0, 0x1) bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0d00000004000000040000000c00000000000000", @ANYRES32=r1], 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="1500"], 0x0}, 0x94) 11.134486807s ago: executing program 4 (id=1051): openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x28, 0x0, @thr={&(0x7f0000000300)="85250409b6d7ddb9873a21de343f88f9b5a0c711a29976a40c38125477f7e814f0524f59e6c7b4d705fa8fbcdb5f23a2a23d46c5befd9df81db0a5c6a2bf21864afb47cf7d65db46aad0e415dfb6", &(0x7f0000000380)="b00fc988b1301ddd1fea828199429310dd4ba72d"}}, &(0x7f00000000c0)=0x0) r2 = getpgid(r0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10049, 0x5, r2}) mprotect(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x100000f) timer_settime(0x0, 0x1, &(0x7f0000000280)={{0x0, 0x3938700}}, 0x0) timer_getoverrun(r1) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r3 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r3, 0x107, 0x14, &(0x7f0000000080)=0xfff, 0x4) socketpair(0xa, 0x100000005, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) getpeername$packet(r4, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000001c0)=0x14) sendmmsg(r3, &(0x7f0000000440)=[{{&(0x7f0000000700)=@pppol2tp={0x18, 0x1, {0x0, r3, {0x2, 0x4e23, @loopback}, 0x0, 0x2, 0x2, 0x2}}, 0x80, &(0x7f00000004c0)}}], 0x1, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r5 = getpid() sched_setscheduler(r5, 0x1, &(0x7f0000000100)=0x5) setresuid(0x0, 0xee00, 0x0) setreuid(0xee01, 0xee00) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r7, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) openat(0xffffffffffffff9c, 0x0, 0x42, 0x0) inotify_init1(0x80000) r8 = socket$inet_smc(0x2b, 0x1, 0x0) getsockopt$IPT_SO_GET_INFO(r8, 0x11e, 0x40, 0x0, &(0x7f0000000040)) capset(&(0x7f0000000140)={0x19980330, r2}, &(0x7f0000000240)={0x6, 0x6, 0x1000002, 0x87, 0x0, 0x3fe}) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="0200000004000000080000000100000080000000", @ANYRES32=0x0, @ANYBLOB="00006675186c4b1c3389d20071a00eb47ecf8f0cae7285b9bb2e18d32e2163c0a74f1c1e1618a3ccc03f6e0dae89c4343db024ccc34d5991868e0eba49cd3bd08e5caa2a07ce3d494972772a411455b46f05bf18439ac33e3de416ff4379d517606679ae4865b80973710785148888413d99c6751aaecaec8eda1ad5346a013923cf4fc17a357e6841d06421749e772b95032502acca1fe3c0558b4db4485ddf37b7b233846473", @ANYRES8=r8, @ANYRES32, @ANYRESOCT=r2], 0x50) 10.495705606s ago: executing program 1 (id=1052): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x900, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_dev$usbfs(&(0x7f0000000000), 0x1ff, 0x2) dup(r1) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x2, 0x0, 0x80008001, 0x2}) r2 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x26a580, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000000)=0x15) socket$inet6_sctp(0xa, 0x5, 0x84) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, 0x0) poll(&(0x7f0000000000), 0x20000000000000b5, 0x9) close(0xffffffffffffffff) r3 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/power/sync_on_suspend', 0x2000, 0x8) lseek(r3, 0xc, 0x4) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x40}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f00000002c0), r3) sendmsg$NL80211_CMD_RELOAD_REGDB(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, r5, 0x400, 0x70bd2d, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x20008001}, 0x40) sched_setscheduler(0x0, 0x3, &(0x7f0000002200)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x6) r6 = syz_open_dev$MSR(&(0x7f0000000140), 0x0, 0x0) ioctl$FITRIM(r0, 0xc0185879, &(0x7f0000000280)={0xdb2, 0x7, 0x7}) read$msr(r6, &(0x7f0000032680)=""/102400, 0x19000) shmat(0x0, &(0x7f0000ffc000/0x3000)=nil, 0x4000) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f00000006c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10800000}, 0xffffffffffffff0a, 0x0, 0x1, 0x0, 0x0, 0x4004815}, 0x2040001) getrlimit(0xb, &(0x7f0000000180)) fstat(r3, 0x0) shmctl$IPC_SET(0x0, 0x1, &(0x7f0000000340)={{0x2, 0x0, 0x0, 0x0, 0xee01, 0x100, 0x91f}, 0x9, 0xc, 0x4, 0x4, 0x0, 0x0, 0x8}) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) 10.241415479s ago: executing program 3 (id=1054): r0 = openat$adsp1(0xffffffffffffff9c, 0x0, 0x200, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r0, 0xc004500a, &(0x7f0000000040)=0x18) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x3, 0x7, &(0x7f0000006680)) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x2, 0x7}, 0x0) sched_setscheduler(0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000005580)=""/102392, 0x18ff8) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, 0x0) r2 = socket$netlink(0x10, 0x3, 0x4) quotactl_fd$Q_SETINFO(0xffffffffffffffff, 0xffffffff80000600, 0x0, 0x0) writev(r2, &(0x7f0000000100)=[{&(0x7f0000000000)="580000001400192340834b80043f679a10ff3d425f9cc3f4ff7f4e32f61bcdf1e422000000000100804824cabecc4b381eaadc28f23457e792945f64009400050028925aaa000000c600000000000000feff2c707f8f00ff", 0x58}], 0x1) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={{0x14}, [@NFT_MSG_NEWRULE={0x2c, 0x6, 0xa, 0x409, 0x0, 0x0, {0x2}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}, @NFT_MSG_DELRULE={0x20, 0x8, 0xa, 0x5, 0x0, 0x0, {0x2}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_DELRULE={0x20, 0x8, 0xa, 0x301, 0x0, 0x0, {0x2}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0x94}}, 0x0) 10.131937022s ago: executing program 4 (id=1055): r0 = syz_usb_connect(0x0, 0x36, &(0x7f00000004c0)=ANY=[@ANYBLOB="1a0100005c6b4408070a64006e40010203030902240001a8230800090400bc6435fb4d00090503034d00ff99090805", @ANYRES32], &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000a80)=""/188, 0xba) write$char_usb(r1, 0x0, 0x0) read$char_usb(r1, 0x0, 0x0) syz_usb_disconnect(r0) r2 = syz_open_dev$evdev(0x0, 0x0, 0x800) ioctl$EVIOCGPHYS(r2, 0x80404507, &(0x7f0000003ac0)=""/229) syz_usb_control_io$uac3(0xffffffffffffffff, 0x0, 0x0) syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100009690342058200510f6b50102030109021b00020000000009043d0000518e3f000904620000d1d8a3ff72699780f0"], 0x0) syz_usb_disconnect(0xffffffffffffffff) syz_usb_connect(0x1, 0x4e7, &(0x7f0000000080)={{0x12, 0x1, 0x310, 0x9b, 0x9f, 0x23, 0x20, 0xbb4, 0xa6b, 0x6fbc, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x4d5, 0x2, 0x8, 0x5, 0x20, 0x6, "", [{{0x9, 0x4, 0x25, 0x4d, 0x8, 0x6e, 0xac, 0xc6, 0xe, [@generic={0x91, 0x23, "0291170647bfa7ce6124bb41064eb65d8fb95c4af7f927c818687a80f5b59e1327cf5844f8ca16788969bc97af354ffade310c1683a4304edb1a0f56f001f83ddf81cf0a8035a0418a796addf26946543413da52d985771ff4fca1c803c43acad638a9d2065bd58cdd738c712e5c4864139814781408ca77b2d141e91c060597783a0b28c7d68c0ea779c832e84e81"}, @generic={0x26, 0xf, "f5ff4732637d3c78779cea6f6860bdbcce02055446d2bc90d11777307499e75a9173aa2d"}], [{{0x9, 0x5, 0x9, 0x10, 0x8, 0x4, 0x50, 0x6, [@generic={0x1a, 0x31, "0b429d579e7dcdf5b06aaeb949b6565ee76a9321d4223efc"}, @generic={0x50, 0x5, "aa96183b9473dca9522bdf2768a092050ae0e02a3a709e229167178201433fb409d767c35d7ad27b38b0b71a53f9fbe98324ebe10aeccde93cb0543cb80edc9cd5a410bb812a8de3a3db8a520f82"}]}}, {{0x9, 0x5, 0xb, 0x18, 0x10, 0x7, 0x2, 0xf, [@generic={0x79, 0x22, "d07ad0dc6ad9a76e7039f48f5c3ac2857fc491f512091e0d71f731823045f0f38cd3c30792f5129890c40d5574fa435018329a48af9afcabf4442603b7e362c51a11d468432c96b4d51cd105cebe317ef699a90084c57ba3afd9eb3429e64e3c7f3f1a2535209d2ad1ad20e7d8a4391342d7f48949c7ca"}, @generic={0x9e, 0x21, "e12daa75a8bdbf215497f99381c002ce603e4d0e190566d74ae912e42b9300fc6712d06396c05f0c730c22906a22e3252ba8d84f53adabfe7b5a2ba4376883275df8e8f65e67d855d4626b52bde97505e7c36579720b237878604d16dad4d517b3f8cede40f2bec7691aa449271e32183d80baa58851bec4238727a3434a33f8f06b614a71e2631fa6e419a3a76898c56375fdbb35de0e2bd11dde60"}]}}, {{0x9, 0x5, 0x4, 0x8, 0x3ff, 0x8, 0x0, 0x10, [@uac_iso={0x7, 0x25, 0x1, 0xa180bb86c0377f5d, 0x5, 0x9}]}}, {{0x9, 0x5, 0x80, 0x0, 0x8, 0xe, 0x1, 0x2, [@uac_iso={0x7, 0x25, 0x1, 0x8, 0x8}, @uac_iso={0x7, 0x25, 0x1, 0xc, 0x0, 0xc}]}}, {{0x9, 0x5, 0x4, 0xc, 0x10, 0xfb, 0x4, 0x8}}, {{0x9, 0x5, 0x0, 0x10, 0x40, 0x7, 0x9, 0x7, [@generic={0x2, 0x23}, @uac_iso={0x7, 0x25, 0x1, 0x8, 0x4, 0x1000}]}}, {{0x9, 0x5, 0x7, 0x2, 0x40, 0x95, 0x20, 0x32, [@generic={0xe5, 0x3, "528beb315fa6952fb17af036f0c205d7da81f64938fe0b54fea7cf961734b04ffd8e063cd04893aa6d3da4ec088abb641d59ca6a8e9a3dabe4eb5679f034a3186c4d7b65b795f0a1de0ef84651648c2a8e1ce8b75e9cf3f3544b32673a0b10b7cba8f2419abaeb426047a0aa0ec47ae19e90e271409ecc7169d182be6c68569da00b79ac737af75de5ca912efa4eb611e7637c4eab1bfea4d224afc915942e02fb3c8260efdd4d125b1df75b84109111f60fcb0ac8d29b499e1a721df1d7823310240cf9217a3ebeaac45e9df4691ed1d8c0306ecf5445a72b85642c9ac786bc4e0d4b"}]}}, {{0x9, 0x5, 0x9, 0x0, 0x3ff, 0x40, 0x41, 0x9, [@generic={0xf, 0x7, "e876d07846edfb8650d52b00a1"}]}}]}}, {{0x9, 0x4, 0xb4, 0x2, 0x6, 0xc9, 0xef, 0x1d, 0xf, [], [{{0x9, 0x5, 0x80, 0x0, 0x400, 0xe, 0x81, 0xff, [@uac_iso={0x7, 0x25, 0x1, 0xc, 0x8, 0xc2d}]}}, {{0x9, 0x5, 0x7, 0xc, 0x400, 0xf7, 0x2, 0x9, [@generic={0x9b, 0x3, "0c98835983bb5fd0f053cbc47697a5f9a17e31f374e02a8342a6667730d47e4496750a36ed227a4175c47b65868020da6cea8f49c88fcc43c541635a8aa97b060253fc6566551964b7fc339cb9c643a3f33dc95f2def12580306ccb492bd2b9f44a92929f270668939aee8ba5fa398cae4845ee3f3334f27f5b47565993f0d569a517e601d551ba411b9f253379471f534a18cbad27b77c0e5"}]}}, {{0x9, 0x5, 0xa, 0x10, 0x3ff, 0xe, 0x6, 0x1d, [@generic={0x45, 0x21, "343c2c3373b054d026201c460a70ad4ff1e72f94972bfa0ba707d29a562c899b32c10468a7b54ae0886fdde3e5205e5913219552ee22ca940bf2a2bef066fbf512fd29"}, @generic={0x4, 0x7, "2813"}]}}, {{0x9, 0x5, 0xe, 0xc, 0x10, 0x81, 0x0, 0x2, [@uac_iso={0x7, 0x25, 0x1, 0x4, 0x4, 0x1000}]}}, {{0x9, 0x5, 0x4, 0x0, 0x40, 0x3, 0x59, 0x5}}, {{0x9, 0x5, 0xd, 0x3, 0x8, 0x5, 0x1, 0x6a}}]}}]}}]}}, 0x0) r3 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x40, 0x258a, 0x6a88, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0xff, 0xf0, 0x6, "", [{{0x9, 0x4, 0x0, 0xd, 0x1, 0x3, 0x1, 0x2, 0x0, {0x9, 0x21, 0xff7f, 0x77, 0x1, {0x22, 0xfb1}}, {{{0x9, 0x5, 0x81, 0x3, 0x200, 0x3, 0x8, 0x64}}}}}]}}]}}, 0x0) syz_usb_control_io(r3, 0x0, 0x0) syz_usb_connect$sierra_net(0x3, 0x3f, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0x1199, 0x68a3, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0x0, 0x80, 0xfa, "", {{0x9, 0x4, 0x7, 0x0, 0x3, 0xff, 0x0, 0x0, 0x0, "", {{0x9, 0x5, 0xb, 0x2, 0x400, 0x7, 0x1a, 0x3}, {0x9, 0x5, 0xa, 0x2, 0x10, 0x6, 0x7, 0x2}, {0x9, 0x5, 0xc, 0x3, 0x3ff, 0x0, 0x8, 0x9}}}}}}]}}, 0x0) 8.1354463s ago: executing program 2 (id=1057): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x32, 0x0) read$msr(r0, &(0x7f0000032680)=""/102392, 0x18ff8) syz_open_dev$vim2m(0x0, 0x4, 0x2) socket$igmp6(0xa, 0x3, 0x2) mount$tmpfs(0x0, 0x0, &(0x7f00000001c0), 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='quota,grpquota_block_hardlim']) creat(&(0x7f0000000100)='./file0\x00', 0x59) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff8000}]}) r2 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r2, &(0x7f0000000340)=@nameseq={0x1e, 0x1, 0x3, {0x43}}, 0x10) setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000300)={0x43, 0x3, 0x3, 0x3}, 0x10) close_range(r1, 0xffffffffffffffff, 0x0) 8.122989027s ago: executing program 0 (id=1058): r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000040), 0x10) socket(0x8, 0x3, 0x1) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000001c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x0, 0x0, 0x2, 0x0, 0x9, 0x3, 0x100000000, 0x8000320, 0xffffffff}, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) r3 = socket(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) set_mempolicy(0x3, &(0x7f0000000080)=0x6, 0x5) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) openat$tun(0xffffffffffffff9c, 0x0, 0x40241, 0x0) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) sendmsg$nl_route_sched(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000480)=@getqdisc={0x48, 0x26, 0x300, 0x70bd2b, 0x25df9c00, {0x0, 0x0, 0x0, 0x0, {0x2, 0xfff2}, {0xc, 0xc}, {0x7, 0x9}}, [{0x4}, {0x4}, {0x4}, {0x4}, {0x4}, {0x4}, {0x4}, {0x4}, {0x4}]}, 0x48}, 0x1, 0x0, 0x0, 0x2}, 0x2000400c) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)=ANY=[@ANYBLOB="3400000020000100dcec51ecfbdbdf2502101004090000060620010008000200ac14142a"], 0x34}, 0x1, 0x0, 0x0, 0x40}, 0x4000804) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB='L\x00\x00\x00!'], 0x4c}, 0x1, 0x0, 0x0, 0x8000}, 0x20008000) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r4, 0x3ba0, 0x0) ioctl$IOMMU_IOAS_MAP$PAGES(r4, 0x3b85, &(0x7f00000007c0)={0x28, 0x5, r7, 0x0, &(0x7f0000000000/0x800000)=nil, 0x800000, 0x1004000}) accept$alg(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_SET(0xffffffffffffffff, &(0x7f0000000b40)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f0000000380)=ANY=[@ANYBLOB="50000000030801030000000000000000000000000000048008000640000000900800084000000005642230146d14a3b6fd29171aa75aba7c0800084000000b08000740000000050800094000008001050003002f0000000e4454a5b357bdbc62632d19119f160c1ef1bbd31bd93d0da876291719ef9dcb73d429b7b1accd856a733569cf7a074b65096d04bea6907f38a080cb7aeaac0b9c2c667570eec8268e6ee8a800233db4e38cdfc09d5f27cbb6feed17d456ebdf4d09aadd255ea32e3356e62a8d60d6edb0e228000000000000000000"], 0x50}, 0x1, 0x0, 0x0, 0x8000}, 0x4040884) r8 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r9 = ioctl$KVM_CREATE_VM(r8, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r9, 0xae60) ioctl$KVM_CREATE_VCPU(r9, 0xae41, 0x0) 7.781114163s ago: executing program 1 (id=1059): r0 = socket(0x10, 0x3, 0x0) r1 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'bridge_slave_0\x00', 0x0}) socket$xdp(0x2c, 0x3, 0x0) r3 = socket(0x1, 0x5, 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0xb, 0x31, 0xffffffffffffffff, 0x0) r4 = socket$xdp(0x2c, 0x3, 0x0) r5 = syz_open_dev$MSR(&(0x7f00000000c0), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) setsockopt$XDP_UMEM_REG(r4, 0x11b, 0x4, &(0x7f0000000080)={&(0x7f0000000000)=""/59, 0x23a000, 0x1000, 0x0, 0x3}, 0x20) ioctl$sock_SIOCETHTOOL(r3, 0x89fe, &(0x7f0000000340)={'bridge0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x23, &(0x7f00000001c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="3c00000013000100000000000000000007000001", @ANYRES32=r2, @ANYBLOB="00000000000000001c001a8018000480"], 0x3c}, 0x1, 0x0, 0x0, 0x4080}, 0x4004000) r6 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000013c0), 0x82000, 0x0) ioctl$TIOCPKT(r6, 0x5420, &(0x7f00000026c0)=0x3d) ioctl$TCSETS2(r6, 0x402c542b, &(0x7f0000000200)={0x3, 0xb, 0x3, 0x2, 0x9, "3651d60cb79b2293c9f32d3f1da5db4f2db21b", 0x9531, 0x3}) ioctl$TCSETS(r6, 0x5402, &(0x7f0000000040)={0x800, 0x0, 0x21f, 0x3, 0x17, "0d693e0100003700000000c700d17700000001"}) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0xfff0) 7.600129134s ago: executing program 4 (id=1060): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x50440, 0x0) r1 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) r2 = syz_usb_connect(0x0, 0x3f, &(0x7f00000000c0)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0) syz_usb_control_io(r2, 0x0, 0x0) syz_usb_disconnect(0xffffffffffffffff) syz_usb_control_io(r2, 0x0, &(0x7f0000000780)={0x84, &(0x7f00000002c0)=ANY=[@ANYBLOB="f7a5ba777a8879895b5cd59d93fcad93"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$EVIOCGMASK(r3, 0x5b01, 0x0) read(r1, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r4) r5 = socket$nl_route(0x10, 0x3, 0x0) chdir(0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) r6 = getpid() sched_setscheduler(r6, 0x2, &(0x7f0000000200)=0x7) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x14000000) setsockopt$MRT6_ADD_MFC(0xffffffffffffffff, 0x29, 0x22, 0x0, 0x0) sync() sync() sync() sync() ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'netpci0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r7, {0x0, 0xb}, {0xffff, 0x2}, {0x0, 0xfff3}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x7, 0xae0, 0x6361, 0xd03, 0x8, 0x20076f1}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r5, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x240408a0}, 0x20004890) sync() ioctl$SIOCSIFHWADDR(r0, 0x8914, &(0x7f0000002280)={'netpci0\x00', @multicast}) socket$packet(0x11, 0x3, 0x300) 7.464780434s ago: executing program 3 (id=1061): r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$vhost_msg(r0, &(0x7f0000000180)={0x1, {&(0x7f0000000040)=""/46, 0x2e, &(0x7f0000000080)=""/232, 0x2, 0x1}}, 0x48) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket(0x2, 0x80805, 0x0) sendmmsg$inet(r1, &(0x7f0000002180)=[{{&(0x7f0000000280)={0x2, 0x4e20, @private=0xa010101}, 0x10, &(0x7f0000001140)=[{0x0}], 0x1}}, {{&(0x7f0000000180)={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x33}}, 0x10, &(0x7f0000000480)=[{&(0x7f0000000500)="c4", 0x1}], 0x1}}], 0x2, 0x48000) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r2 = userfaultfd(0x1) mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x2000009, 0x32, 0xffffffffffffffff, 0x91c6b000) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f00000002c0)={0xaa, 0x100}) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000000000/0x400000)=nil, 0x400000}, 0x1}) syz_open_procfs(0x0, &(0x7f0000001040)='net/nf_conntrack_expect\x00') ioctl$UFFDIO_UNREGISTER(r2, 0x8010aa01, &(0x7f0000000000)={&(0x7f0000000000/0x800000)=nil, 0x800000}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @broadcast, 'ip6gre0\x00'}}) sched_setaffinity(0x0, 0xfffffffffffffccc, &(0x7f00000002c0)=0x400000bce) r3 = syz_open_dev$MSR(&(0x7f0000000100), 0xdc, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) io_setup(0x5, &(0x7f0000000040)=0x0) pselect6(0x900, 0x0, 0x0, &(0x7f0000000240)={0x1f}, &(0x7f0000000280)={0x0, 0x3938700}, 0x0) io_submit(r6, 0x1, &(0x7f0000000240)=[&(0x7f0000000540)={0x0, 0x0, 0x0, 0x5, 0xfffd, r4, 0x0}]) write(r4, 0x0, 0x0) connect$unix(r5, &(0x7f0000000100)=@abs={0x0, 0x0, 0x4e21}, 0x6e) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'wlan0\x00'}) 6.371275861s ago: executing program 3 (id=1062): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x32, 0x0) read$msr(r0, &(0x7f0000032680)=""/102392, 0x18ff8) keyctl$dh_compute(0x17, 0x0, 0x0, 0x0, 0x0) socket$igmp6(0xa, 0x3, 0x2) mount$tmpfs(0x0, &(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x0) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff8000}]}) r2 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r2, &(0x7f0000000340)=@nameseq={0x1e, 0x1, 0x3, {0x43}}, 0x10) r3 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r3, 0x10f, 0x87, &(0x7f0000000300)={0x43, 0x3, 0x3, 0x3}, 0x10) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000180)={0x43, 0x3, 0x0, 0x3}, 0x10) close_range(r1, 0xffffffffffffffff, 0x0) quotactl_fd$Q_GETNEXTQUOTA(0xffffffffffffffff, 0xffffffff80000900, 0x0, &(0x7f0000000500)) chroot(0x0) ioctl$SNDCTL_SEQ_GETTIME(0xffffffffffffffff, 0x80045113, 0x0) r4 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/unix\x00') r5 = socket$unix(0x1, 0x5, 0x0) bind$unix(r5, &(0x7f0000000000)=@abs={0x1}, 0x3) pread64(r4, &(0x7f0000000780)=""/185, 0xb9, 0x3c) 5.873238737s ago: executing program 2 (id=1063): openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0xe8001, 0x0) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000300), 0x20040) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000001c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_DEL_KEY(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)={0x24, 0x0, 0x1, 0x70bd28, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r0}, @void}}, [@NL80211_ATTR_KEY_IDX={0x5, 0x8, 0x5}]}, 0x24}, 0x1, 0x0, 0x0, 0x8}, 0x8010) sendmsg$NL80211_CMD_GET_WIPHY(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000340)={&(0x7f00000001c0)={0x1c, 0x0, 0x10, 0x70bd2d, 0x25dfdbff, {{}, {@val={0x8, 0x1, 0x61}, @void, @void}}, ["", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x24000010}, 0x20000840) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000c00)={&(0x7f0000000600)=ANY=[@ANYBLOB="140000001000010000000000000000000300000a28000000000a010200000000000000000200000908000240000000030900010073797a300000000098000000160a030000000000000000000200000a6c000380180003801400010064756d6d7930000000000000000000000800014000000000400003801400010073797a6b616c6c65723100000000000014000100697036677265746170edffadf3000000140001006970366772657461703000000000000008000240000000020900020073797a31000000000900010073797a300000000014"], 0xe8}, 0x1, 0x0, 0x0, 0x4000000}, 0x80) r2 = syz_open_dev$usbfs(&(0x7f0000000240), 0xf, 0x101301) syz_open_procfs(0xffffffffffffffff, &(0x7f00000000c0)='comm\x00') bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYRES32], 0x0, 0xfffffffb, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x1f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94) socket$nl_netfilter(0x10, 0x3, 0xc) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8c}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r3 = syz_open_dev$MSR(&(0x7f0000000040), 0x0, 0x0) read$msr(r3, &(0x7f0000032680)=""/102384, 0x18ff0) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, 0x0, 0x4000000) r4 = socket$pppl2tp(0x18, 0x1, 0x1) r5 = socket$inet6_udp(0xa, 0x2, 0x0) syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="043ef50d"], 0xf8) connect$pppl2tp(r4, &(0x7f0000001140)=@pppol2tpv3={0x18, 0x1, {0x3, r5, {0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x20}}, 0x2}}, 0x2e) r6 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r6, &(0x7f0000000280)={0x0, 0x18, 0xfa00, {0x3, 0x0, 0x106, 0x1}}, 0x20) write$RDMA_USER_CM_CMD_LISTEN(r6, &(0x7f0000000100)={0x7, 0x8, 0xfa00, {0xffffffffffffffff, 0x9}}, 0x10) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x89f1, &(0x7f00000002c0)={'ip6gre0\x00', &(0x7f0000000480)=@ethtool_rx_ntuple={0x35, {0xd, @tcp_ip4_spec={@multicast1, @multicast1, 0x4e22, 0x4e21, 0x7}, @ether_spec={@local, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, 0x7}, 0x4, 0x1, 0x2, 0x8, 0xfffffffffffffffe}}}) openat$snapshot(0xffffffffffffff9c, &(0x7f0000001580), 0x1041, 0x0) ioctl$USBDEVFS_IOCTL(r2, 0xc0105512, &(0x7f0000000200)) ioctl$USBDEVFS_SETCONFIGURATION(r2, 0x80045505, &(0x7f0000000000)=0x1) 4.959918296s ago: executing program 4 (id=1064): ioctl$vim2m_VIDIOC_ENUM_FRAMESIZES(0xffffffffffffffff, 0xc02c564a, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x3, 0x0) get_mempolicy(0x0, 0x0, 0x2, &(0x7f0000240000/0x1000)=nil, 0x3) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() prctl$PR_SCHED_CORE(0x3e, 0x1, r0, 0x1, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r1, &(0x7f0000032680)=""/102392, 0x18ff8) fsopen(&(0x7f0000000000)='cifs\x00', 0x1) r2 = add_key(0x0, &(0x7f0000000200)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffe) pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff}, 0x80) keyctl$KEYCTL_WATCH_KEY(0x20, r2, r3, 0x28) keyctl$invalidate(0x15, r2) r4 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_RX_RING(r4, 0x11b, 0x2, 0x0, 0x0) syslog(0x3, &(0x7f0000000140)=""/4096, 0x1000) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000a80), 0x101200, 0x0) r6 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x40980, 0x0) ioctl$TIOCSETD(r6, 0x5423, &(0x7f00000000c0)=0xf) ioctl$TCFLSH(r6, 0x400455c8, 0x4) close(0x3) syz_usb_connect$uac1(0x4, 0x72, 0x0, 0x0) ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) 4.875052029s ago: executing program 2 (id=1065): r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$vhost_msg(r0, &(0x7f0000000180)={0x1, {&(0x7f0000000040)=""/46, 0x2e, &(0x7f0000000080)=""/232, 0x2, 0x1}}, 0x48) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket(0x2, 0x80805, 0x0) sendmmsg$inet(r1, &(0x7f0000002180)=[{{&(0x7f0000000280)={0x2, 0x4e20, @private=0xa010101}, 0x10, &(0x7f0000001140)=[{0x0}], 0x1}}, {{&(0x7f0000000180)={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x33}}, 0x10, &(0x7f0000000480)=[{&(0x7f0000000500)="c4", 0x1}], 0x1}}], 0x2, 0x48000) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r2 = userfaultfd(0x1) mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x2000009, 0x32, 0xffffffffffffffff, 0x91c6b000) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f00000002c0)={0xaa, 0x100}) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000000000/0x400000)=nil, 0x400000}, 0x1}) syz_open_procfs(0x0, &(0x7f0000001040)='net/nf_conntrack_expect\x00') ioctl$UFFDIO_UNREGISTER(r2, 0x8010aa01, &(0x7f0000000000)={&(0x7f0000000000/0x800000)=nil, 0x800000}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x0, @broadcast, 'ip6gre0\x00'}}) sched_setaffinity(0x0, 0xfffffffffffffccc, &(0x7f00000002c0)=0x400000bce) r3 = syz_open_dev$MSR(&(0x7f0000000100), 0xdc, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) io_setup(0x5, &(0x7f0000000040)=0x0) pselect6(0x900, 0x0, 0x0, &(0x7f0000000240)={0x1f}, &(0x7f0000000280)={0x0, 0x3938700}, 0x0) io_submit(r6, 0x1, &(0x7f0000000240)=[&(0x7f0000000540)={0x0, 0x0, 0x0, 0x5, 0xfffd, r4, 0x0}]) write(r4, 0x0, 0x0) connect$unix(r5, &(0x7f0000000100)=@abs={0x0, 0x0, 0x4e21}, 0x6e) r7 = socket$unix(0x1, 0x2, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f0000000100)={'wlan0\x00'}) 3.699440233s ago: executing program 1 (id=1066): mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000340), 0x90443, 0x0) r1 = socket$pptp(0x18, 0x1, 0x2) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(r0, 0xc018937e, &(0x7f0000000380)={{0x1, 0x1, 0x18, r1, {0x4}}, './file0/file0\x00'}) syz_emit_ethernet(0xbe, &(0x7f0000000240)=ANY=[@ANYBLOB="aaaaaaaaaaaaffffffffffff0800450000b00000000000119078000000000000000000000e21009c907801000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000776f67e098952100"/197], 0x0) pipe2$9p(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) syz_usb_connect(0x5, 0x36, &(0x7f0000000200)=ANY=[@ANYBLOB="1201000092ecc620ac0500773aeb010203010902240001000020000904c40102fffd01"], 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xc, 0xe, &(0x7f0000001700)=ANY=[@ANYBLOB="b702000000000000bfa300000000000007030000f0ffffff7a0af0ff0200000079a4f0ff00000000b706000000000081ad64020000000000450404000100ff0f1704000001130a00b7050000010000006a0af2fe000000008500000009000000b700000000000000950000000000000000e154cd8445974b26c933f7ffffffffe4fbffffff55bb2007ee51050512b5b42128aa090a79507df79f298129daa7a6b2f91af50342115e17392ac627c87881c000006146001e04aeacea799a22a2fa798b5adc43eb27d53319d0ad229e5752548300000000dbc2777df150b7cdd77b85b941092314fd085f028f2ed1a4535550614e09d6378198a6097a670838337af2abd55a87ac0394b2f92ffab7d153d62058d0a413b2173619ccf55520f22c9ca8b6712f3024b7041b1df65b3e1b9bf115646d14ce53d13d0ccacda1ef0900094fa737c28b99938512c816fdcceaede3faedc51d29a47fc813a2ec00f4c7a53ac271d6d7f4ea6bf97f2f33e2ea2e534300bcb3fdc4b4861004eefbda7f54f82a804da4f85db47a4a69bf9bc5fa96ee293fbd165a5a68488e40b030166565a097b1b44b451de736bb6d43db8db03d4b7745fef1d04ec633dee254a6d491b849a5a787e814c4fd21a18986252a70f8f92eb6f0e8c7db4bf23242a1f2c28159f09943b1b0452d1b72183aacf4a84f9130b775dd4e9e3070756f97ad791fa99dac06b57479321a0574fb30ff0000001989328c8ddc20ea011bf5742e0e0d4334db8b20ce3f9f16cb7fc20fb4791ec85821d0c48fb657c29b309c73f0977e7cde65a82b94c461d7962b0d2277a84af326f37f3e2c25a61ec45c3af97a8f17da954aff3fc8c108755f75ca13fb7c8bbd8b6e7dac1aba4b20dc7de058a4dfa7e85a8bdf1d41a2d8bda74d66f47cc180f82c5f573c6d294d3665016ab99dda0fde4745db06753a7ac74a2d32f7528751313694bf5700b20ef0c248ddd3da32396a614cacad4aff2066bb5d4045c958559b7dcb98a6273b8c651e24d9f679e4fbe948dfb4cc4a389469608241730459f0123fd39206000000000000eb55dad46de56ef907b059b90b8aa49afb9a79ae5498f6589880ed6eea7f9c670012be05e7de0940313c5870786554df26236ebced9390cb6941b8375d936a7d2120eca291963eb2d537d8ee4de5c183c960119451c31539b22809e1d7f0cda06a9fa87d64cb77872a2cd8a104e16bb1a2bacf13464ca03aff14a9aa4bd9539f5096412b92012e095b84c20243ff98df3347f0e399d1b9f27e3c33269c0e153b28b2d4410572bc45b9d3fa02208d304d455c36300000000022320178b00cc6ed7966130b547dbf8b497af002000000cd1d00000020000000ef19349ee7f31abc11c800000000000000000000000928ee53595a779d243a48cea769470424d28804c04b2c4324ab7f4a5c81921f0128dfd70b438af60b060000000000000056642b49b745f3bf2cf7908b6d7d748308eea09fc361b4735efbf3411718d6ee7aebf9ef679dbfae9fb4a79f8a836804ed3a1079b0282a12043408cd60b687dcff91af19010000000000000000456f7d2a42bd13da202274f20675eb781925441578e93046aaddea8ec4ca37f71c2710a7ea8ae0dc214e1cc275b26adfa892e6de92000000000000000000ddff004cff9ec7ffff35e62f4eeee50e5bafecea4d4134f9d006c8d6883eca5c9c58c9e93311ab5009c68c73de2f04f15d005387577f480000ea65559eb00e76e9d0ada201bcbb5c252b28a60ca770663da451790cc36000906d5a9fad98c308e39bd5ffb6151d79c1cee1cd102e3c8e63e9fba05e3633be3f00000015762e5f5a3a0bc33fdbe28a5ffc83f2b485185cc92fe7f791e8f6429309d6adab4b7e508e5bf024ed8f8a005f2bbf96c89739f5cf1e750d50517a59a3ad09e8802e8f4f535447cc0fc9d5f99a73145dfcedad69da9cd4375c624600e78f4458542b14f29611f95d4a31838eeb20c20bb82aa31771cd379ec83554cea5e6539db7384e1f58d81f2f2653c4d9818708e27c89b552d7fcd116bce9c764c714c9402c21d181aac59efb28d4f91652f6750b6ec962802c0320f8059195729d60c534ee8e8ff0755b67fe4c25edb85bcff24c757aa8090000000000008c420eb4304f66e3a37aaf000000c42a570f0e9dd5fd545470f862f8c3c14fa9ecd1e877b0d8ca84c044859e85e6158f9184bc61a9a284db80e4636c25b96174327d82761c26e329555f9290af4100000000000000749efd3763655500344bae34137f5ab0d534b8d63e4ca3b671f2de1cdf519192c6b59a601fd419adc16e2055b85058f793484305d7a1759782e4c571ee855a47bc00edf5e9020c41ab004321610b857e8717764b633b21cb32f0e03280e09758bd445ab91d20baca005452b79d7b574a247f1d2fe45b3c4e93da3d51de647c10dd49944dc87c92332af00f191b66b6a6f732a91f0e2e9120be61e58c79d497247d278888901d442ad7f8536605a644e9e3d769db497c3960dfde12182334caee994adc38a436367a54b9e182b78e9a0ceb9a2c4f63902c1ad1a7c5a08d0920a23c2a86abbdf357849a651733e57f31019876026888c8ccb85c86b4f8ffffff7f000000002c331fca0e541b7ca211c28ed61c525708a13d115b43f8b1894c8fa8a14dc4810f61ae96c18cc7130000000000002100000000000000000001000027c9a46157a3609b6fd9843ee19ec647249a9375de5858818f3c4a4fa6ce46f4d42b07199de8b99231ace58c77819ee214e49666c464d35ca9b5143ed3b3dc8c17a23692759ccf5a205311b7ab22532697b861dfb54609fd88e6043bd52ae84c1bb0c8a6c769f952283a1f4e3842edb3d42cea68bef67422ecc13968a27ef6a1296dfff4a979369b0e8ebc62887aa46e824d86869ec4ab392b0a74f91381dcc198e353047db70686d147357024eb3cb94f1e89cb5ba0a56aa046b4dc521a3d9356b4b8b5917c4c860495b240e80063bde261fd00000000007271e28ef6806bc8e139c49b91c76bea3858f78fbd8d31330d89069f9648a2ff93060ff073b3a113e47edf76f7d116d2b0976cf2ec447c030931651dd315003b7a6a5433a2bb3c035fc6846abe389b25c988f0bbb889560ae99ec4b227eda2e63a1c31a2c2bd48a822cbe92b6524e0cd8020ecaa34e19e7141d5e221509342bfe7d294d1eb3de6a50ca0301f89c2ee627e949c68b3a4a412a9b7d503a26e9a714ee5f72d8805dd1bfbd081f6a5d1f1289dfe14cb9194e26a44fac273461fc5c0e0a33db7f2d43ea8086cf059f40fa2640b6bfb74dd35f5a31059c01517cf4b6641fce9a24b96767b837ca037a1199735c375c705c798e0e208e4a5259d0bfa526b462af45a6eab34000000000000000000000000c4426344ec1a3366515dee221e747f55d7dd02534bc503b9b28277c253e410986bef2111a99cc448d652929f8a67a6a1d3f00dcad91aff428aade3f85714a1d3ef29acd4d49b62339c10c2ec0dac090000000000000084d8223edbccbf9258b7374e79a1f8bf3fb73c8c6dbb7bbdfc399847a11921f97eba0ea14c4fed9a71eedb97c02461792e3a49dac16c60c3fcaab222025d78963c3ac899fa8b63f58a30212c9b2d7fe751e2046b78f86e22861b6504c667350244dd6d9189a8b9c45f8aaff9db694811ca86ed978f23eed7459c0382074170cf1e25b0e9ba3d1cc309353eea4cd8ab96bafda393276bdd8d32ead8db9e1b54d2d3d50e2815268fc1a6ec566981bc8ca2a4583f3d40e817433d0f4f25cfe6cc1897449ba5f26a9d66ac73e6f5c401376f23a314e0b9ff997d22f381ba6e0363d0a4a8a813edaa626f0000000000000000004f9e02a3b51a97c4b1c1b411cc6bee2a56f29c55a6aac46a0cfc318fae02922a403431d4e5a4396cad2c8dd34037bc041a2ba1505ba2c4889122ca04e85881aad5f8bfc12e6741872aad21bf5301cd4c60"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f00000001c0), 0xfffffedf, 0x10, &(0x7f0000000040), 0x0, 0x0, 0xffffffffffffffff, 0xd}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000140)={r4, 0x0, 0x11, 0x0, &(0x7f0000000700)="26807800fb206f0100cf61e0b954112e11", 0x0, 0x41ff, 0x2000, 0x0, 0x0, 0x0, 0x0}, 0x50) r5 = dup(r3) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(r5, 0xc018937a, &(0x7f0000000100)={{0x1, 0x1, 0x18, r2, {0x61}}, './file0\x00'}) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000180), 0x100800, &(0x7f00000003c0)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r6, @ANYBLOB="2c52c74a01e9ab644d7766756e6f3d", @ANYRESHEX=r5, @ANYBLOB=',msize=0x0000000000001000,defcontext=user_u,k']) 3.524632832s ago: executing program 2 (id=1067): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x32, 0x0) read$msr(r0, &(0x7f0000032680)=""/102392, 0x18ff8) syz_open_dev$vim2m(&(0x7f0000000080), 0x4, 0x2) keyctl$dh_compute(0x17, 0x0, 0x0, 0x0, 0x0) socket$igmp6(0xa, 0x3, 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file0\x00', 0x31) mount$tmpfs(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='quota,grpquota_block_hardlimit=3']) chdir(&(0x7f0000000100)='./file0\x00') creat(&(0x7f0000000100)='./file0\x00', 0x59) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff8000}]}) r2 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r2, &(0x7f0000000340)=@nameseq={0x1e, 0x1, 0x3, {0x43}}, 0x10) r3 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r3, 0x10f, 0x87, &(0x7f0000000300)={0x43, 0x3, 0x3, 0x3}, 0x10) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000180)={0x43, 0x3, 0x0, 0x3}, 0x10) close_range(r1, 0xffffffffffffffff, 0x0) quotactl_fd$Q_GETNEXTQUOTA(0xffffffffffffffff, 0xffffffff80000900, 0x0, &(0x7f0000000500)) chroot(0x0) ioctl$SNDCTL_SEQ_GETTIME(0xffffffffffffffff, 0x80045113, 0x0) r4 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/unix\x00') r5 = socket$unix(0x1, 0x5, 0x0) bind$unix(r5, &(0x7f0000000000)=@abs={0x1}, 0x3) pread64(r4, &(0x7f0000000780)=""/185, 0xb9, 0x3c) 3.250868621s ago: executing program 3 (id=1068): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CAP_EXIT_HYPERCALL(r1, 0x4068aea3, &(0x7f00000023c0)={0x79}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x5) ioctl$KVM_CAP_HYPERV_SYNIC2(r2, 0x4068aea3, &(0x7f00000000c0)) ioctl$KVM_SET_GSI_ROUTING(r1, 0x4008ae6a, &(0x7f0000000080)={0x1, 0x0, [{0x0, 0x4, 0x0, 0x0, @sint={0x200, 0x3}}]}) r3 = syz_usb_connect$uac2(0x5, 0xa8, &(0x7f0000000000)=ANY=[], &(0x7f00000004c0)={0x0, 0x0, 0x0, 0x0}) setxattr$incfs_id(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040), &(0x7f0000000080)={'0000000000000000000000000000000', 0x31}, 0x20, 0x0) syz_usb_control_io(r3, &(0x7f0000000700)={0x2c, 0x0, &(0x7f00000005c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x44a}}, 0x0, 0x0, 0x0}, 0x0) sendmsg$TIPC_CMD_DISABLE_BEARER(0xffffffffffffffff, &(0x7f0000000b40)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16, @ANYBLOB="01002abd7000fbdbdf2501"], 0x30}, 0x1, 0x0, 0x0, 0x200000c1}, 0x4040) syz_usb_control_io$uac2(r3, 0x0, 0x0) syz_usb_control_io$uac2(r3, 0x0, &(0x7f0000000880)={0x44, &(0x7f0000000140)=ANY=[@ANYRESHEX=r3], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac2(r3, 0x0, &(0x7f0000000800)={0x44, &(0x7f0000000000)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 2.938236397s ago: executing program 2 (id=1069): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=@ipv4_newroute={0x24, 0x1a, 0x1, 0x2000000, 0x0, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3800}, [@RTA_DST={0x8, 0x1, @remote}]}, 0x24}}, 0x0) 2.835207014s ago: executing program 2 (id=1070): r0 = syz_usb_connect(0x0, 0x36, &(0x7f00000004c0)=ANY=[@ANYBLOB="1a0100005c6b4408070a64006e40010203030902240001a8230800090400bc6435fb4d00090503034d00ff99090805", @ANYRES32], &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000a80)=""/188, 0xba) write$char_usb(r1, 0x0, 0x0) read$char_usb(r1, 0x0, 0x0) syz_usb_disconnect(r0) r2 = syz_open_dev$evdev(0x0, 0x0, 0x800) ioctl$EVIOCGPHYS(r2, 0x80404507, &(0x7f0000003ac0)=""/229) syz_usb_control_io$uac3(0xffffffffffffffff, 0x0, 0x0) syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100009690342058200510f6b50102030109021b00020000000009043d0000518e3f000904620000d1d8a3ff72699780f0"], 0x0) syz_usb_disconnect(0xffffffffffffffff) syz_usb_connect(0x1, 0x4e7, &(0x7f0000000080)={{0x12, 0x1, 0x310, 0x9b, 0x9f, 0x23, 0x20, 0xbb4, 0xa6b, 0x6fbc, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x4d5, 0x2, 0x8, 0x5, 0x20, 0x6, "", [{{0x9, 0x4, 0x25, 0x4d, 0x8, 0x6e, 0xac, 0xc6, 0xe, [@generic={0x91, 0x23, "0291170647bfa7ce6124bb41064eb65d8fb95c4af7f927c818687a80f5b59e1327cf5844f8ca16788969bc97af354ffade310c1683a4304edb1a0f56f001f83ddf81cf0a8035a0418a796addf26946543413da52d985771ff4fca1c803c43acad638a9d2065bd58cdd738c712e5c4864139814781408ca77b2d141e91c060597783a0b28c7d68c0ea779c832e84e81"}, @generic={0x26, 0xf, "f5ff4732637d3c78779cea6f6860bdbcce02055446d2bc90d11777307499e75a9173aa2d"}], [{{0x9, 0x5, 0x9, 0x10, 0x8, 0x4, 0x50, 0x6, [@generic={0x1a, 0x31, "0b429d579e7dcdf5b06aaeb949b6565ee76a9321d4223efc"}, @generic={0x50, 0x5, "aa96183b9473dca9522bdf2768a092050ae0e02a3a709e229167178201433fb409d767c35d7ad27b38b0b71a53f9fbe98324ebe10aeccde93cb0543cb80edc9cd5a410bb812a8de3a3db8a520f82"}]}}, {{0x9, 0x5, 0xb, 0x18, 0x10, 0x7, 0x2, 0xf, [@generic={0x79, 0x22, "d07ad0dc6ad9a76e7039f48f5c3ac2857fc491f512091e0d71f731823045f0f38cd3c30792f5129890c40d5574fa435018329a48af9afcabf4442603b7e362c51a11d468432c96b4d51cd105cebe317ef699a90084c57ba3afd9eb3429e64e3c7f3f1a2535209d2ad1ad20e7d8a4391342d7f48949c7ca"}, @generic={0x9e, 0x21, "e12daa75a8bdbf215497f99381c002ce603e4d0e190566d74ae912e42b9300fc6712d06396c05f0c730c22906a22e3252ba8d84f53adabfe7b5a2ba4376883275df8e8f65e67d855d4626b52bde97505e7c36579720b237878604d16dad4d517b3f8cede40f2bec7691aa449271e32183d80baa58851bec4238727a3434a33f8f06b614a71e2631fa6e419a3a76898c56375fdbb35de0e2bd11dde60"}]}}, {{0x9, 0x5, 0x4, 0x8, 0x3ff, 0x8, 0x0, 0x10, [@uac_iso={0x7, 0x25, 0x1, 0xa180bb86c0377f5d, 0x5, 0x9}]}}, {{0x9, 0x5, 0x80, 0x0, 0x8, 0xe, 0x1, 0x2, [@uac_iso={0x7, 0x25, 0x1, 0x8, 0x8}, @uac_iso={0x7, 0x25, 0x1, 0xc, 0x0, 0xc}]}}, {{0x9, 0x5, 0x4, 0xc, 0x10, 0xfb, 0x4, 0x8}}, {{0x9, 0x5, 0x0, 0x10, 0x40, 0x7, 0x9, 0x7, [@generic={0x2, 0x23}, @uac_iso={0x7, 0x25, 0x1, 0x8, 0x4, 0x1000}]}}, {{0x9, 0x5, 0x7, 0x2, 0x40, 0x95, 0x20, 0x32, [@generic={0xe5, 0x3, "528beb315fa6952fb17af036f0c205d7da81f64938fe0b54fea7cf961734b04ffd8e063cd04893aa6d3da4ec088abb641d59ca6a8e9a3dabe4eb5679f034a3186c4d7b65b795f0a1de0ef84651648c2a8e1ce8b75e9cf3f3544b32673a0b10b7cba8f2419abaeb426047a0aa0ec47ae19e90e271409ecc7169d182be6c68569da00b79ac737af75de5ca912efa4eb611e7637c4eab1bfea4d224afc915942e02fb3c8260efdd4d125b1df75b84109111f60fcb0ac8d29b499e1a721df1d7823310240cf9217a3ebeaac45e9df4691ed1d8c0306ecf5445a72b85642c9ac786bc4e0d4b"}]}}, {{0x9, 0x5, 0x9, 0x0, 0x3ff, 0x40, 0x41, 0x9, [@generic={0xf, 0x7, "e876d07846edfb8650d52b00a1"}]}}]}}, {{0x9, 0x4, 0xb4, 0x2, 0x6, 0xc9, 0xef, 0x1d, 0xf, [], [{{0x9, 0x5, 0x80, 0x0, 0x400, 0xe, 0x81, 0xff, [@uac_iso={0x7, 0x25, 0x1, 0xc, 0x8, 0xc2d}]}}, {{0x9, 0x5, 0x7, 0xc, 0x400, 0xf7, 0x2, 0x9, [@generic={0x9b, 0x3, "0c98835983bb5fd0f053cbc47697a5f9a17e31f374e02a8342a6667730d47e4496750a36ed227a4175c47b65868020da6cea8f49c88fcc43c541635a8aa97b060253fc6566551964b7fc339cb9c643a3f33dc95f2def12580306ccb492bd2b9f44a92929f270668939aee8ba5fa398cae4845ee3f3334f27f5b47565993f0d569a517e601d551ba411b9f253379471f534a18cbad27b77c0e5"}]}}, {{0x9, 0x5, 0xa, 0x10, 0x3ff, 0xe, 0x6, 0x1d, [@generic={0x45, 0x21, "343c2c3373b054d026201c460a70ad4ff1e72f94972bfa0ba707d29a562c899b32c10468a7b54ae0886fdde3e5205e5913219552ee22ca940bf2a2bef066fbf512fd29"}, @generic={0x4, 0x7, "2813"}]}}, {{0x9, 0x5, 0xe, 0xc, 0x10, 0x81, 0x0, 0x2, [@uac_iso={0x7, 0x25, 0x1, 0x4, 0x4, 0x1000}]}}, {{0x9, 0x5, 0x4, 0x0, 0x40, 0x3, 0x59, 0x5}}, {{0x9, 0x5, 0xd, 0x3, 0x8, 0x5, 0x1, 0x6a}}]}}]}}]}}, 0x0) r3 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x40, 0x258a, 0x6a88, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0xff, 0xf0, 0x6, "", [{{0x9, 0x4, 0x0, 0xd, 0x1, 0x3, 0x1, 0x2, 0x0, {0x9, 0x21, 0xff7f, 0x77, 0x1, {0x22, 0xfb1}}, {{{0x9, 0x5, 0x81, 0x3, 0x200, 0x3, 0x8, 0x64}}}}}]}}]}}, 0x0) syz_usb_control_io(r3, 0x0, 0x0) syz_usb_connect$sierra_net(0x3, 0x3f, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0x1199, 0x68a3, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0x0, 0x80, 0xfa, "", {{0x9, 0x4, 0x7, 0x0, 0x3, 0xff, 0x0, 0x0, 0x0, "", {{0x9, 0x5, 0xb, 0x2, 0x400, 0x7, 0x1a, 0x3}, {0x9, 0x5, 0xa, 0x2, 0x10, 0x6, 0x7, 0x2}, {0x9, 0x5, 0xc, 0x3, 0x3ff, 0x0, 0x8, 0x9}}}}}}]}}, 0x0) 2.487361912s ago: executing program 0 (id=1071): memfd_create(&(0x7f0000000000)='\xfd\x0fm3#/\x00n\xaa\xaa\xe4\x01U\x8b\xc2\f\x03\x19\x9c\x8e\xcb\x90\x00\x00\xaegQ\x0e\x94\\y\x0fU2@\'\x8a\x80\x00$\x12\xfc\xe4.)\x9b\xf2@\xf0\xe0\xdb\x1f\xe6\xb4gc\xe4\xda\xf9\xcd7el\xb7\xe6\b\x00\xd8\x8f\x00\xef\xff\x00vob/~\xc2\x00\b\x00\x00\x00\x00\x00\x00 \xff\xf1\xdem\x9c;%\xb5\"\xe4\xf1x2\x8a\x19p\x04\\\xaa-\x93\xd1\xc4 )\xbfK\xf7E\xf3\x05\xa0\xd0\xe6%\x97\x15\xf0\xab\x86\x90k\x10\xcer\x14\xe0a\xaf\xab\xfe\xd9V\x19\xa5d\x16\x8e]:3\xff\t\xe6\xf7\xb3\xbf\xa3\b[?\xb5\x14t\xd3\x8e\xc0\xe8\xefd\x88\xddz\xa25)\x17\xef\xfb4\xff\xdb\t\x8e\xeb\x1d\\\xf9\x14\xc7\v\xa8\x89\xdb A\xbaBAj\xfe\x18\xc3-+\xd6\xb0K\xee\x1b+\xc7lA\x84\xa6\xfe\x8bU<&\x1a\xe7m\x86\xb7\xa1A\xf9\x02S;C\x99\a.$K\x833\x82\x7f\x1b\'nj\x06\b\xb7\xe8] \x87A[y\xdc\x14\f\xcet\x00\x1f\x0f\xef\xca\xcfz\x7f\an0\xebB\xb8}&\xdd\xc9\xa7\x1dp\t\x92\xceb \x81\xaaq{H\x88\xdf\xf8\x80\\\x1c8\xfe\xc4\xe3\xb0\x90\xcb\x8b1r\x94\x9f\x00\xce\xc8\xc3\x84\xa0\xc9\b\x00uKs\xba\xbbC6\xd6\x13\xb5\xe086EzD\x18\xd5\x16\x88E\xc6\xf0A9\xf1u\xb3\x85\x02\x12\\Sp\xf4\x9a\xe8\x96^\xd9\xa8K\x12\b}\xff\xcb{\xc6\xf6\xb4\x8b\xb6\xa8Y\xf2\x91\xeeR\v#\xb5)\xb0\x99\x9b-p\xe3\x17\x04\xb0\xdc\x0fk\x11\xe1\x9a\a\x16\xb7\x9b\x88\xfa\x1e`\x84$\xfc\xd7\xf5^X\xd8[}\x032\xd0\x84\xdby\x94Vp\xa5\xcd(\xab\xb6\x95sR\xab\xfc\x8c\'\x9c\x16Q\xad\xbc\xb04%\xb7\xe5\x141<\xd9\xad\x9f\x12@!\xfaI\x88\xab\xef\x86\xe9\a>\xdd7\xb7\x8e\x9c0-o\xc9\xec_|\x02\xc8Ru\x95\xa8#U\xd6J\x87\xf6X\xb6{\x11$\x00\xc8\x14\xcb\xd1nK\xd8\xb9\x0e\x9bA\xed\xbcs\x1fS\r\x12O\x83\x15\xcb(\xdb\xb1S\x1f%\x04\x9a\xa0l\xa3}\xe7\xf2\xa0D-N\xf9\xba!L]h;F[\xe2\x1c\xe26 \x19k&.\x7f\x1d~\xdaI\xd4\x99\a+\xdf]\xbc\xa6\xc3\x0f\x99W\x9c-t\v\xc7J\xfd\x91\x853\xd1j;\x19W\x96V\x8az+\xf9\x82#\xfaC\xa3YN:\xe8\xda\xbc\xb2h\x8f\xe0\xc6d\x96\xccy\xb3\xc2\x98\x1c\xca\xde\"\xaeW\x89\x83\xc2sB\xe7\b\x9b9~}\xc2\xb3\x1d\xcc?\xd1\x89\xef\xca\x00\x00\x00\x00\x00\x00\x00\x00\x00J[\xc4\x04\xc1\xa6\x10\xc2\x9d\x11\t|\xc0\t\xd9(\x80\xe6s\xaa\x88\x8a\xd6\xa2\x01\x10W]Z\x8d\xf7\xd1P\xf9d\x01|\xa3\x03hSq\x95\x8f\xe1J\xd3#/fcCz\xff\x80\xe2M\xa3-r\xf6\x1a\xd74\xdc\xe1\xe4\xc3\x9dU t}\x02\xb7>j0S\xf4\x98\x05\xb9\x15}\xfa\"\xdc\xc2r\xf9\a\xadnD\xb6\x06\xd3\'\x10\x9f|\x17\xd6\x89O\f\x98@\x85\xa5m\x9d\\&\x17o\x11Z=l\xfb\x93\x8exZ\x00\x00\xeaq\xbb\x03&\xb4mi\xc7\xff\xca\xd8\x9f\xae\xa3\x04\xaa\x10\xe7\x98\xe48\x8d', 0x3) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) write$UHID_INPUT(r0, &(0x7f0000001040)={0xc, {"a2e3ad21ed0d52f91b5d390887f70e06d038e7ff7fc6e5539b323a298b089b07081b4d090890e0878f0e1ac6e7049b334a959bfc9a240d2567f3988f7ef319520100ffe8d178708c523c921b1b9b39070d075d0936cd3b78130daa61d8e809ea882f5802b77f07227227b7ba67e0e78657a6f5c2a874e62a9ccdc0d31a0c9f6f30e065cd5b91cd0ae193973735b36d5b1b63dd1c00305d3f46635eb056d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000000000075271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498be0800000000000000f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1f416e56c71b1931870262f5e801119242ca026bfc825d8e524b2451138e495bb80c617669314e2fbe70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d546850a27af9544ae15a7e454dea05918b4fd42513f000000000000000a3621c56cea8d20fa911a0c41db6efcffac64f17679141d54b34bbc9963ac4f4bb3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ec126c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6a62fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce3803f465e41e610c20d80421d653a5520000008213b704c7fb082ff27590678ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc946813591ad8deff4b05f60cea0da7710ac0000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b8247068ae949ed06e288e810bac9c76600025e19c9000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4fb8a48a76eafc9a9a0270e4c10d64cfe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d97b9a6d6d5495c198045651cf4778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2aed9e53803ed0ca4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4350aeae9ca1207e78283cd0b20ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdc80c47ee4f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034ef655b253ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2691491abf8ab9c015073014d9e08d4338b8780bdecd436cf0541e4505bc3a45237f104b962102de9efed496f42355bc7872c827467cfa5c4e72730d56bd068ed211cf847535edecb7b373f78ff95b68441a34cb51682a8ae4d24ad0465f3927f889b813076038e79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd735892892448039ef799cf0630becdcce04579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93aec92a5de203717aa49c2d284acfabe262fccfcbb2b75a2183c46eb65ca8104e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43eaeb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e94265c803b35ee5f83a2b210520106b8a358b50ab7a1fa89af0000807e0000000002d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369dde50e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aae501b20f7694a00f16e2d0174035a2c22656dc29880acebdbe8ddbd75c2f998d8ac2dfad2ba3a504767b6b45a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40426db6fe29068c0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf46366e7205dd8d6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c5409711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7c5407000000e3ad038f2211f1033195563c7f93cd54b9094f226e78b271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b4051db55e0510a6e4114a53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaee5ee6cf1d0ab378dd4dd891e937c2ea5410e0513005008000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3144345f48843dd014e5c5ad8fe995754bd9cf32fce1e24919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6d594f88a4facfd4c735a20307c737afae5136651b1b9bd522d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a3766d5439020484f4113c4c859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02dae17b118e5d6787463183b4b87c1050000002f7809959bc048850613d17ca51055f2f416a44fe180d2d50c312cca7cb14a2bdc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb42913777c06376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a6d8f0011e8f74e82d7f96093530e76692839d7961939adfdeeeaff19d11efcafb6d546def271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7348663a52190202c7af288a4510de03dab19d26285eda89156d50dd385a60333ba5bbf5d77cd7007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f00000000000000000000b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf652770711935f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f42f1fe687c7e8a60c28b82b6528341b648cdd56fed7cdcbb1575912d5ecd36dea3bca0b7427d53588a0f9455e8f8d2ab2242729251ae033a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a3cd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08758897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb784ed7148b6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d664130bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b8081c128ad2706f48261f7899484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599af40005b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fd30d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c971d90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb84d9a88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36d7d3e5db21b094b8b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ea4cd8d884836174faf1aa609e5f1ee1162dfa13bdc1fa7cfaadba85c72e9758f031755d0be53f8d2a1dfb1c68cc164b0a0780d971a96ea2c4d4ca0398c2235980a9307b3d5bd3b01faffd0a5dbed2881a9700af561ac8c7e36bb2fc4c40e9cf96f06817fb903729a7db6ff957697c9ede7885d94ffb0969be0daf60af93109eb24ee72e4363f51af62af6fb2a6df3bec89822a7a0b678458fa3fef86faec216eb6992162f8dcbf719c148cd2f9c55f4901203a9a8a2c3e90f3943dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d0fc5a752f9000000000000000000000000bd700", 0x1000}}, 0x1006) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a3200000000140000001100"], 0x7c}, 0x1, 0x0, 0x0, 0x20004001}, 0x4000018) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, 0x0, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000600)=ANY=[@ANYBLOB="700000000001050500000000000000000a0000001800028006000340000300000c00028005000100000000003c0001800c00028005000100000000002c00018014000300fe8000000000000000000000000000aa14000400fe88000000000000000000000000000108000740000000015fc9dbd54bbfa3f767088915e48386d9da9cb11c5c7a4b54a48ec23e65e341dc98b001b52d1d7f4a2fc0b522809bbb46a9dcccccf12ed65636fe37cb568c3fd604a39ac799de0e3c59f096d852904846ca9db7e40ce63b7d97ef339018bc789bfc2c0b65c7c15b988fe90a27e1e5d53c2a2384aba64ea81844af3a686e6adc7bb932cffcb484828e02685899e03842e9069079c05907af7c15838c53cf6d197cf2d64937d92bad9f3769bb84d7a15e"], 0x70}}, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="5400000000010104000000000006000000000000000002802c00018014000300fe800000f900000000000000000000aa14000400fe8800000000000000000000000000010c000280050001000000000004000d80"], 0x54}}, 0x0) prlimit64(0x0, 0xe, &(0x7f00000003c0)={0xfff, 0x4000000007}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_open_dev$MSR(&(0x7f0000000080), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) prctl$PR_SET_MM_MAP(0x23, 0xe, 0x0, 0x0) r5 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_int(r5, 0x29, 0x1000000000021, 0x0, 0x0) connect$inet6(r5, &(0x7f0000000000)={0xa, 0x0, 0x380000, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, 0x1c) r6 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r7 = socket$nl_rdma(0x10, 0x3, 0x14) r8 = socket$kcm(0x29, 0x2, 0x0) close(r8) r9 = socket$kcm(0x2b, 0x6, 0x0) ioctl$vim2m_VIDIOC_S_FMT(r6, 0xc0d05605, &(0x7f0000000500)={0x0, @pix_mp={0x3, 0x5, 0x32435750, 0x0, 0x3, [{0x100, 0x2}, {0x186ca048, 0x7}, {0xe96f, 0x1}, {0x6, 0x6}, {0x6, 0x2b}, {0x8, 0x4}, {0x3, 0xffffffff}, {0x3, 0x8}], 0x2, 0x2, 0x7, 0x2, 0x3}}) setsockopt$sock_attach_bpf(r8, 0x1, 0xd, &(0x7f00000000c0), 0xfe11) close(r9) sendmsg$RDMA_NLDEV_CMD_RES_MR_GET(r7, &(0x7f0000002440)={0x0, 0x0, &(0x7f0000002400)={&(0x7f0000000100)=ANY=[@ANYBLOB="380000000d1471aa26bd7000fbdbdf250800010000000000080003000100000008003e0000800000070003"], 0x38}, 0x1, 0x0, 0x0, 0x4000045}, 0xc010) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) 1.870527971s ago: executing program 1 (id=1072): r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000040), 0x10) socket(0x8, 0x3, 0x1) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000001c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x0, 0x0, 0x2, 0x0, 0x9, 0x3, 0x100000000, 0x8000320, 0xffffffff}, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) r3 = socket(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) set_mempolicy(0x3, &(0x7f0000000080)=0x6, 0x5) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) sendmsg$nl_route_sched(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000480)=@getqdisc={0x48, 0x26, 0x300, 0x70bd2b, 0x25df9c00, {0x0, 0x0, 0x0, 0x0, {0x2, 0xfff2}, {0xc, 0xc}, {0x7, 0x9}}, [{0x4}, {0x4}, {0x4}, {0x4}, {0x4}, {0x4}, {0x4}, {0x4}, {0x4}]}, 0x48}, 0x1, 0x0, 0x0, 0x2}, 0x2000400c) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)=ANY=[@ANYBLOB], 0x34}, 0x1, 0x0, 0x0, 0x40}, 0x4000804) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB='L\x00\x00\x00!'], 0x4c}, 0x1, 0x0, 0x0, 0x8000}, 0x20008000) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r4, 0x3ba0, &(0x7f0000000740)={0x48, 0x2, r7}) ioctl$IOMMU_IOAS_MAP$PAGES(r4, 0x3b85, &(0x7f00000007c0)={0x28, 0x5, r7, 0x0, &(0x7f0000000000/0x800000)=nil, 0x800000, 0x1004000}) 1.308474082s ago: executing program 4 (id=1073): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x32, 0x0) read$msr(r0, &(0x7f0000032680)=""/102392, 0x18ff8) syz_open_dev$vim2m(0x0, 0x4, 0x2) socket$igmp6(0xa, 0x3, 0x2) mount$tmpfs(0x0, 0x0, &(0x7f00000001c0), 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='quota,grpquota_block_hardlimit']) creat(&(0x7f0000000100)='./file0\x00', 0x59) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff8000}]}) r2 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r2, &(0x7f0000000340)=@nameseq={0x1e, 0x1, 0x3, {0x43}}, 0x10) setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000300)={0x43, 0x3, 0x3, 0x3}, 0x10) close_range(r1, 0xffffffffffffffff, 0x0) 766.606052ms ago: executing program 0 (id=1074): r0 = openat$adsp1(0xffffffffffffff9c, 0x0, 0x200, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r0, 0xc004500a, &(0x7f0000000040)=0x18) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x3, 0x7, &(0x7f0000006680)) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x2, 0x7}, 0x0) sched_setscheduler(0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000005580)=""/102392, 0x18ff8) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, 0x0) r2 = socket$netlink(0x10, 0x3, 0x4) quotactl_fd$Q_SETINFO(0xffffffffffffffff, 0xffffffff80000600, 0x0, 0x0) writev(r2, &(0x7f0000000100)=[{&(0x7f0000000000)="580000001400192340834b80043f679a10ff3d425f9cc3f4ff7f4e32f61bcdf1e422000000000100804824cabecc4b381eaadc28f23457e792945f64009400050028925aaa000000c600000000000000feff2c707f8f00ff", 0x58}], 0x1) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={{0x14}, [@NFT_MSG_NEWRULE={0x2c, 0x6, 0xa, 0x409, 0x0, 0x0, {0x2}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}, @NFT_MSG_DELRULE={0x20, 0x8, 0xa, 0x5, 0x0, 0x0, {0x2}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_DELRULE={0x20, 0x8, 0xa, 0x301, 0x0, 0x0, {0x2}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0x94}}, 0x0) 189.14547ms ago: executing program 4 (id=1075): openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0xe8001, 0x0) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000300), 0x20040) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000001c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_DEL_KEY(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)={0x24, 0x0, 0x1, 0x70bd28, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r0}, @void}}, [@NL80211_ATTR_KEY_IDX={0x5, 0x8, 0x5}]}, 0x24}, 0x1, 0x0, 0x0, 0x8}, 0x8010) sendmsg$NL80211_CMD_GET_WIPHY(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000340)={&(0x7f00000001c0)={0x1c, 0x0, 0x10, 0x70bd2d, 0x25dfdbff, {{}, {@val={0x8, 0x1, 0x61}, @void, @void}}, ["", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x24000010}, 0x20000840) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000c00)={&(0x7f0000000600)=ANY=[@ANYBLOB="140000001000010000000000000000000300000a28000000000a010200000000000000000200000908000240000000030900010073797a300000000098000000160a030000000000000000000200000a6c000380180003801400010064756d6d7930000000000000000000000800014000000000400003801400010073797a6b616c6c65723100000000000014000100697036677265746170edffadf3000000140001006970366772657461703000000000000008000240000000020900020073797a31000000000900010073797a300000000014"], 0xe8}, 0x1, 0x0, 0x0, 0x4000000}, 0x80) r2 = syz_open_dev$usbfs(&(0x7f0000000240), 0xf, 0x101301) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000000c0)='comm\x00') bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYRES32], 0x0, 0xfffffffb, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x1f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94) socket$nl_netfilter(0x10, 0x3, 0xc) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8c}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r4 = syz_open_dev$MSR(&(0x7f0000000040), 0x0, 0x0) read$msr(r4, &(0x7f0000032680)=""/102384, 0x18ff0) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, 0x0, 0x4000000) r5 = socket$pppl2tp(0x18, 0x1, 0x1) r6 = socket$inet6_udp(0xa, 0x2, 0x0) syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="043ef50d"], 0xf8) connect$pppl2tp(r5, &(0x7f0000001140)=@pppol2tpv3={0x18, 0x1, {0x3, r6, {0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x20}}, 0x2}}, 0x2e) r7 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r7, &(0x7f0000000280)={0x0, 0x18, 0xfa00, {0x3, 0x0, 0x106, 0x1}}, 0x20) write$RDMA_USER_CM_CMD_LISTEN(r7, &(0x7f0000000100)={0x7, 0x8, 0xfa00, {0xffffffffffffffff, 0x9}}, 0x10) openat$snapshot(0xffffffffffffff9c, &(0x7f0000001580), 0x1041, 0x0) write$binfmt_format(r3, 0x0, 0x0) ioctl$USBDEVFS_IOCTL(r2, 0xc0105512, &(0x7f0000000200)) ioctl$USBDEVFS_SETCONFIGURATION(r2, 0x80045505, &(0x7f0000000000)=0x1) 0s ago: executing program 3 (id=1076): clock_adjtime(0x0, &(0x7f0000000340)={0x37db, 0x82000000002f4246, 0xfffffffffffffffc, 0x6, 0x8, 0x5, 0x80, 0x4, 0x4, 0x80000, 0x2, 0x1, 0x100, 0x0, 0x9, 0x2000000000000, 0x9, 0x5, 0x800000009, 0x4000000000200, 0x0, 0x2, 0x0, 0x10000000000f48, 0x8, 0x25}) r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x41, &(0x7f0000000540)=0x18dc, 0x4) recvmmsg(r0, &(0x7f0000006dc0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000600)={&(0x7f00000004c0)=ANY=[@ANYBLOB="9feb010018000000000000003c0000003c00000002000000000000000000000d00000000000000000000000d01000000000000000000000a02000000000000000000000b000000000000000000000005"], 0x0, 0x56}, 0x20) kernel console output (not intermixed with test programs): -71 [ 384.405233][ C1] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 384.405263][ C1] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 384.405293][ C1] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 384.502157][ T8869] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 384.589456][ T5712] usb 3-1: USB disconnect, device number 14 [ 384.674916][ T8891] usbtmc 4-1:16.0: INDICATOR_PULSE returned 0 [ 384.860990][ T5732] usb 4-1: USB disconnect, device number 25 [ 384.892836][ T29] audit: type=1400 audit(1784567823.203:757): avc: denied { map } for pid=8899 comm="syz.1.764" path="/dev/binderfs/binder0" dev="binder" ino=10 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 385.046910][ T8902] input: syz0 as /devices/virtual/input/input32 [ 385.071737][ T8889] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 385.268808][ T5612] usb 2-1: new high-speed USB device number 18 using dummy_hcd [ 385.521092][ T5612] usb 2-1: Using ep0 maxpacket: 16 [ 385.534357][ T5612] usb 2-1: config index 0 descriptor too short (expected 16456, got 72) [ 385.550873][ T8906] JFS: discard option not supported on device [ 385.551396][ T5612] usb 2-1: config 0 has an invalid interface number: 125 but max is 1 [ 385.569780][ T8906] Mount JFS Failure: -5 [ 385.571350][ T5612] usb 2-1: config 0 has an invalid interface number: 125 but max is 1 [ 385.583704][ T8906] jfs_mount failed w/return code = -5 [ 385.584701][ T5612] usb 2-1: config 0 has an invalid interface number: 125 but max is 1 [ 385.634575][ T5612] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 385.702860][ T5612] usb 2-1: config 0 has no interface number 0 [ 385.733008][ T5612] usb 2-1: config 0 interface 125 altsetting 4 endpoint 0x4 has invalid maxpacket 21760, setting to 64 [ 385.786298][ T5612] usb 2-1: config 0 interface 125 altsetting 4 endpoint 0xB has invalid wMaxPacketSize 0 [ 385.824503][ T5612] usb 2-1: config 0 interface 125 altsetting 4 endpoint 0x2 has invalid wMaxPacketSize 0 [ 385.867597][ T5612] usb 2-1: config 0 interface 125 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 385.915864][ T5612] usb 2-1: config 0 interface 125 has no altsetting 0 [ 385.949944][ T5612] usb 2-1: config 0 interface 125 has no altsetting 2 [ 385.984664][ T5612] usb 2-1: New USB device found, idVendor=050d, idProduct=0002, bcdDevice=23.27 [ 385.995722][ T5612] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 386.006242][ T5612] usb 2-1: Product: syz [ 386.012922][ T5612] usb 2-1: Manufacturer: syz [ 386.018722][ T5612] usb 2-1: SerialNumber: syz [ 386.106571][ T5612] usb 2-1: config 0 descriptor?? [ 386.146975][ T5612] usb 2-1: selecting invalid altsetting 2 [ 386.321799][ T5712] usb 4-1: new high-speed USB device number 26 using dummy_hcd [ 386.471878][ T5712] usb 4-1: device descriptor read/64, error -71 [ 386.731019][ T5712] usb 4-1: new high-speed USB device number 27 using dummy_hcd [ 386.902409][ T5712] usb 4-1: device descriptor read/64, error -71 [ 386.981450][ T5732] usb 3-1: new high-speed USB device number 15 using dummy_hcd [ 387.002755][ C1] usb 2-1: async_complete: urb error -71 [ 387.008438][ C1] usb 2-1: async_complete: urb error -71 [ 387.017655][ T5612] get_1284_register: usb error -71 [ 387.025257][ T5712] usb usb4-port1: attempt power cycle [ 387.070072][ T5612] usb 2-1: USB disconnect, device number 18 [ 387.180958][ T5732] usb 3-1: Using ep0 maxpacket: 32 [ 387.197977][ T5732] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 387.235584][ T5732] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 387.272172][ T5732] usb 3-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 387.309070][ T5732] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 387.360019][ T5732] usb 3-1: config 0 descriptor?? [ 387.372150][ T5732] hub 3-1:0.0: USB hub found [ 387.412282][ T5712] usb 4-1: new high-speed USB device number 28 using dummy_hcd [ 387.452975][ T5712] usb 4-1: device descriptor read/8, error -71 [ 387.576107][ T5732] hub 3-1:0.0: 1 port detected [ 387.701182][ T5712] usb 4-1: new high-speed USB device number 29 using dummy_hcd [ 387.754069][ T5712] usb 4-1: device descriptor read/8, error -71 [ 388.737003][ T5732] hub 3-1:0.0: hub_hub_status failed (err = -32) [ 388.744066][ T5732] hub 3-1:0.0: config failed, can't get hub status (err -32) [ 388.758118][ T5732] usbhid 3-1:0.0: can't add hid device: -32 [ 388.764299][ T5712] usb usb4-port1: unable to enumerate USB device [ 388.785257][ T5732] usbhid 3-1:0.0: probe with driver usbhid failed with error -32 [ 389.955361][ T8939] FAULT_INJECTION: forcing a failure. [ 389.955361][ T8939] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 389.980487][ T8937] JFS: discard option not supported on device [ 389.991816][ T8937] Mount JFS Failure: -5 [ 389.999195][ T8937] jfs_mount failed w/return code = -5 [ 390.008782][ T8939] CPU: 0 UID: 0 PID: 8939 Comm: syz.0.775 Tainted: G L syzkaller #0 PREEMPT(full) [ 390.008811][ T8939] Tainted: [L]=SOFTLOCKUP [ 390.008818][ T8939] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/10/2026 [ 390.008831][ T8939] Call Trace: [ 390.008837][ T8939] [ 390.008844][ T8939] dump_stack_lvl+0x100/0x190 [ 390.008874][ T8939] should_fail_ex.cold+0x5/0xa [ 390.008901][ T8939] copy_fpstate_to_sigframe+0x82d/0xae0 [ 390.008929][ T8939] ? __pfx_copy_fpstate_to_sigframe+0x10/0x10 [ 390.008956][ T8939] ? posixtimer_deliver_signal+0x19d/0x6e0 [ 390.008985][ T8939] ? x86_task_fpu+0x5f/0x90 [ 390.009017][ T8939] get_sigframe+0x3fb/0x940 [ 390.009042][ T8939] ? __pfx_get_sigframe+0x10/0x10 [ 390.009060][ T8939] ? rcu_is_watching+0x12/0xc0 [ 390.009090][ T8939] ? siginfo_layout+0x156/0x290 [ 390.009117][ T8939] x64_setup_rt_frame+0x12f/0xce0 [ 390.009142][ T8939] ? __pfx_x64_setup_rt_frame+0x10/0x10 [ 390.009170][ T8939] arch_do_signal_or_restart+0x5ee/0x7e0 [ 390.009193][ T8939] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 390.009220][ T8939] ? fput+0x79/0x100 [ 390.009247][ T8939] exit_to_user_mode_loop+0x139/0x6f0 [ 390.009271][ T8939] ? rcu_is_watching+0x12/0xc0 [ 390.009300][ T8939] do_syscall_64+0x666/0x870 [ 390.009318][ T8939] ? clear_bhb_loop+0x40/0x90 [ 390.009343][ T8939] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 390.009364][ T8939] RIP: 0033:0x7f6b8ad5e6ce [ 390.009380][ T8939] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 390.009399][ T8939] RSP: 002b:00007f6b8bcdffe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 390.009418][ T8939] RAX: 0000000000000001 RBX: 00007f6b8bce06c0 RCX: 00007f6b8ad5e6ce [ 390.009429][ T8939] RDX: 0000000000000001 RSI: 00007f6b8bce0090 RDI: 0000000000000004 [ 390.009441][ T8939] RBP: 00007f6b8bce0090 R08: 0000000000000000 R09: 0000000000000000 [ 390.009454][ T8939] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 390.009466][ T8939] R13: 00007f6b8b026038 R14: 00007f6b8b025fa0 R15: 00007fffee94d998 [ 390.009494][ T8939] [ 390.389477][ T8948] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 390.478469][ T8948] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 390.622386][ T8948] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 390.726251][ T8948] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 390.905974][ T8945] netlink: 24 bytes leftover after parsing attributes in process `syz.0.777'. [ 391.057383][ T8945] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 392.046164][ T8955] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 392.079659][ T8955] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 392.994479][ T5712] usb 3-1: USB disconnect, device number 15 [ 393.254290][ T8955] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 393.270068][ T8955] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 393.411082][ T5712] usb 3-1: new high-speed USB device number 16 using dummy_hcd [ 393.500004][ T8955] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 393.511430][ T8955] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 393.554199][ T8955] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 393.585987][ T8955] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 393.601077][ T5712] usb 3-1: Using ep0 maxpacket: 8 [ 393.636297][ T5712] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 393.641488][ T8955] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 393.680058][ T8955] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 393.684180][ T5712] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 393.729992][ T5712] usb 3-1: config 16 interface 0 altsetting 0 has an endpoint descriptor with address 0xB6, changing to 0x86 [ 393.873481][ T5712] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x86 has invalid maxpacket 55305, setting to 1024 [ 393.885872][ T5712] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x86 has invalid maxpacket 1024 [ 393.896982][ T5712] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 393.931381][ T5712] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 393.956291][ T5712] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 394.165097][ T29] audit: type=1400 audit(1784567832.393:758): avc: denied { mount } for pid=8962 comm="syz.1.783" name="/" dev="rpc_pipefs" ino=23435 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:rpc_pipefs_t tclass=filesystem permissive=1 [ 394.858592][ T5712] usb 3-1: usb_control_msg returned -32 [ 395.687682][ T8970] netlink: 4 bytes leftover after parsing attributes in process `syz.0.784'. [ 395.697391][ T8970] bridge_slave_1: left allmulticast mode [ 395.703157][ T8970] bridge_slave_1: left promiscuous mode [ 395.708933][ T8970] bridge0: port 2(bridge_slave_1) entered disabled state [ 395.909606][ T8970] bridge_slave_0: left allmulticast mode [ 395.915613][ T8970] bridge_slave_0: left promiscuous mode [ 395.921433][ T8970] bridge0: port 1(bridge_slave_0) entered disabled state [ 395.946412][ T5712] usbtmc 3-1:16.0: can't read capabilities [ 395.954072][ T8960] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 395.962982][ T8960] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 396.145914][ T5704] usb 3-1: USB disconnect, device number 16 [ 398.686652][ T29] audit: type=1400 audit(1784567836.933:759): avc: denied { lock } for pid=8990 comm="syz.1.792" path="socket:[24583]" dev="sockfs" ino=24583 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 399.131619][ T29] audit: type=1400 audit(1784567837.083:760): avc: denied { lock } for pid=8990 comm="syz.1.792" path="socket:[24577]" dev="sockfs" ino=24577 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 399.764555][ T9010] netlink: 20 bytes leftover after parsing attributes in process `syz.2.795'. [ 401.146461][ T29] audit: type=1400 audit(1784567839.493:761): avc: denied { read write } for pid=9016 comm="syz.4.797" name="autofs" dev="devtmpfs" ino=98 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_device_t tclass=chr_file permissive=1 [ 401.473359][ T29] audit: type=1400 audit(1784567839.493:762): avc: denied { open } for pid=9016 comm="syz.4.797" path="/dev/autofs" dev="devtmpfs" ino=98 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_device_t tclass=chr_file permissive=1 [ 401.566000][ T29] audit: type=1400 audit(1784567839.553:763): avc: denied { ioctl } for pid=9016 comm="syz.4.797" path="/dev/autofs" dev="devtmpfs" ino=98 ioctlcmd=0x9376 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_device_t tclass=chr_file permissive=1 [ 402.359776][ T9026] netlink: 12 bytes leftover after parsing attributes in process `syz.3.799'. [ 402.420061][ T5704] libceph: connect (1)[c::]:6789 error -101 [ 402.457005][ T5704] libceph: mon0 (1)[c::]:6789 connect error [ 402.495453][ T9029] FAULT_INJECTION: forcing a failure. [ 402.495453][ T9029] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 402.514850][ T9029] CPU: 1 UID: 0 PID: 9029 Comm: syz.4.800 Tainted: G L syzkaller #0 PREEMPT(full) [ 402.514885][ T9029] Tainted: [L]=SOFTLOCKUP [ 402.514893][ T9029] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/10/2026 [ 402.514904][ T9029] Call Trace: [ 402.514912][ T9029] [ 402.514919][ T9029] dump_stack_lvl+0x100/0x190 [ 402.514949][ T9029] should_fail_ex.cold+0x5/0xa [ 402.514966][ T9029] _copy_from_iter+0x1f4/0x1690 [ 402.514983][ T9029] ? __lock_acquire+0x49f/0x1a40 [ 402.514996][ T9029] ? __pfx__copy_from_iter+0x10/0x10 [ 402.515016][ T9029] vhost_chr_write_iter+0xcb/0x1190 [ 402.515027][ T9029] ? get_pid_task+0xfc/0x250 [ 402.515045][ T9029] ? __pfx_vhost_chr_write_iter+0x10/0x10 [ 402.515055][ T9029] ? avc_policy_seqno+0x9/0x20 [ 402.515069][ T9029] ? bpf_lsm_file_permission+0x9/0x10 [ 402.515084][ T9029] ? security_file_permission+0x76/0x210 [ 402.515101][ T9029] ? rw_verify_area+0xce/0x6d0 [ 402.515117][ T9029] vfs_write+0x6ac/0x1050 [ 402.515132][ T9029] ? __pfx_vhost_net_chr_write_iter+0x10/0x10 [ 402.515150][ T9029] ? __pfx_vfs_write+0x10/0x10 [ 402.515164][ T9029] ? find_held_lock+0x2b/0x80 [ 402.515181][ T9029] ? lock_release+0xa/0x310 [ 402.515199][ T9029] ksys_write+0x12a/0x250 [ 402.515214][ T9029] ? __pfx_ksys_write+0x10/0x10 [ 402.515233][ T9029] do_syscall_64+0x115/0x870 [ 402.515244][ T9029] ? clear_bhb_loop+0x40/0x90 [ 402.515258][ T9029] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 402.515269][ T9029] RIP: 0033:0x7f578db9de99 [ 402.515279][ T9029] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 402.515289][ T9029] RSP: 002b:00007f578eaa9028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 402.515300][ T9029] RAX: ffffffffffffffda RBX: 00007f578de25fa0 RCX: 00007f578db9de99 [ 402.515308][ T9029] RDX: 0000000000000048 RSI: 00002000000003c0 RDI: 0000000000000003 [ 402.515314][ T9029] RBP: 00007f578eaa9090 R08: 0000000000000000 R09: 0000000000000000 [ 402.515323][ T9029] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 402.515334][ T9029] R13: 00007f578de26038 R14: 00007f578de25fa0 R15: 00007ffd26fb4148 [ 402.515363][ T9029] [ 403.084847][ T5704] libceph: connect (1)[c::]:6789 error -101 [ 403.091813][ T5704] libceph: mon0 (1)[c::]:6789 connect error [ 403.093265][ T9022] ceph: No mds server is up or the cluster is laggy [ 403.250710][ T9034] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 403.265655][ T9037] FAULT_INJECTION: forcing a failure. [ 403.265655][ T9037] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 403.271861][ T9034] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 403.301427][ T9037] CPU: 1 UID: 0 PID: 9037 Comm: syz.2.804 Tainted: G L syzkaller #0 PREEMPT(full) [ 403.301460][ T9037] Tainted: [L]=SOFTLOCKUP [ 403.301467][ T9037] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/10/2026 [ 403.301479][ T9037] Call Trace: [ 403.301485][ T9037] [ 403.301493][ T9037] dump_stack_lvl+0x100/0x190 [ 403.301522][ T9037] should_fail_ex.cold+0x5/0xa [ 403.301548][ T9037] _copy_from_user+0x2e/0xd0 [ 403.301574][ T9037] copy_msghdr_from_user+0x9f/0x4c0 [ 403.301605][ T9037] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 403.301639][ T9037] ? __pfx__kstrtoull+0x10/0x10 [ 403.301674][ T9037] ___sys_sendmsg+0x106/0x1e0 [ 403.301704][ T9037] ? __pfx____sys_sendmsg+0x10/0x10 [ 403.301747][ T9037] ? find_held_lock+0x2b/0x80 [ 403.301800][ T9037] __sys_sendmmsg+0x20c/0x440 [ 403.301826][ T9037] ? __pfx___sys_sendmmsg+0x10/0x10 [ 403.301847][ T9037] ? ksys_write+0x190/0x250 [ 403.301897][ T9037] ? fput+0x79/0x100 [ 403.301918][ T9037] ? ksys_write+0x1ac/0x250 [ 403.301945][ T9037] ? __pfx_ksys_write+0x10/0x10 [ 403.301978][ T9037] __x64_sys_sendmmsg+0x9c/0x100 [ 403.302000][ T9037] ? lockdep_hardirqs_on+0x78/0x100 [ 403.302032][ T9037] do_syscall_64+0x115/0x870 [ 403.302049][ T9037] ? clear_bhb_loop+0x40/0x90 [ 403.302075][ T9037] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 403.302096][ T9037] RIP: 0033:0x7f3c8339de99 [ 403.302112][ T9037] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 403.302131][ T9037] RSP: 002b:00007f3c8424a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 403.302151][ T9037] RAX: ffffffffffffffda RBX: 00007f3c83625fa0 RCX: 00007f3c8339de99 [ 403.302165][ T9037] RDX: 040000000000009f RSI: 00002000000002c0 RDI: 0000000000000005 [ 403.302178][ T9037] RBP: 00007f3c8424a090 R08: 0000000000000000 R09: 0000000000000000 [ 403.302191][ T9037] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 403.302203][ T9037] R13: 00007f3c83626038 R14: 00007f3c83625fa0 R15: 00007ffc697c6538 [ 403.302231][ T9037] [ 403.652399][ T9042] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 403.674778][ T9042] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 404.708013][ T9044] netlink: 24 bytes leftover after parsing attributes in process `syz.3.802'. [ 404.721856][ T9050] netlink: 24 bytes leftover after parsing attributes in process `syz.1.801'. [ 404.793050][ T9055] syzkaller0: entered promiscuous mode [ 404.800798][ T9055] syzkaller0: entered allmulticast mode [ 404.845619][ T29] audit: type=1400 audit(1784567843.193:764): avc: denied { ioctl } for pid=9056 comm="syz.2.808" path="socket:[24706]" dev="sockfs" ino=24706 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 405.168987][ T9040] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 406.099800][ T9041] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 406.355441][ T9072] netlink: 12 bytes leftover after parsing attributes in process `syz.1.812'. [ 406.717709][ T9083] netlink: 20 bytes leftover after parsing attributes in process `syz.4.814'. [ 406.901029][ T5704] usb 3-1: new high-speed USB device number 17 using dummy_hcd [ 407.123935][ T5704] usb 3-1: unable to get BOS descriptor or descriptor too short [ 407.140689][ T5704] usb 3-1: config 1 has an invalid interface number: 43 but max is 1 [ 407.174038][ T5704] usb 3-1: config 1 has no interface number 1 [ 407.224511][ T5704] usb 3-1: config 1 interface 0 altsetting 247 endpoint 0x4 has invalid maxpacket 600, setting to 64 [ 407.242746][ T5704] usb 3-1: config 1 interface 0 has no altsetting 0 [ 407.284411][ T5704] usb 3-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice=f6.75 [ 407.334735][ T5704] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 407.353410][ T5704] usb 3-1: Product: syz [ 407.359702][ T5704] usb 3-1: Manufacturer: syz [ 407.369852][ T5704] usb 3-1: SerialNumber: syz [ 407.651762][ T9081] xt_hashlimit: size too large, truncated to 1048576 [ 407.739256][ T9090] bridge_slave_0 (unregistering): left allmulticast mode [ 407.869971][ T9090] bridge_slave_0 (unregistering): left promiscuous mode [ 408.005744][ T9090] bridge0: port 1(bridge_slave_0) entered disabled state [ 408.101948][ T9095] FAULT_INJECTION: forcing a failure. [ 408.101948][ T9095] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 408.144039][ T9095] CPU: 1 UID: 0 PID: 9095 Comm: syz.3.820 Tainted: G L syzkaller #0 PREEMPT(full) [ 408.144068][ T9095] Tainted: [L]=SOFTLOCKUP [ 408.144075][ T9095] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/10/2026 [ 408.144087][ T9095] Call Trace: [ 408.144094][ T9095] [ 408.144102][ T9095] dump_stack_lvl+0x100/0x190 [ 408.144130][ T9095] should_fail_ex.cold+0x5/0xa [ 408.144156][ T9095] _copy_from_user+0x2e/0xd0 [ 408.144183][ T9095] copy_msghdr_from_user+0x9f/0x4c0 [ 408.144214][ T9095] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 408.144250][ T9095] ? __pfx__kstrtoull+0x10/0x10 [ 408.144287][ T9095] ___sys_sendmsg+0x106/0x1e0 [ 408.144317][ T9095] ? __pfx____sys_sendmsg+0x10/0x10 [ 408.144367][ T9095] ? find_held_lock+0x2b/0x80 [ 408.144417][ T9095] __sys_sendmmsg+0x20c/0x440 [ 408.144444][ T9095] ? __pfx___sys_sendmmsg+0x10/0x10 [ 408.144466][ T9095] ? ksys_write+0x190/0x250 [ 408.144517][ T9095] ? fput+0x79/0x100 [ 408.144538][ T9095] ? ksys_write+0x1ac/0x250 [ 408.144567][ T9095] ? __pfx_ksys_write+0x10/0x10 [ 408.144602][ T9095] __x64_sys_sendmmsg+0x9c/0x100 [ 408.144625][ T9095] ? lockdep_hardirqs_on+0x78/0x100 [ 408.144657][ T9095] do_syscall_64+0x115/0x870 [ 408.144676][ T9095] ? clear_bhb_loop+0x40/0x90 [ 408.144702][ T9095] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 408.144723][ T9095] RIP: 0033:0x7f82a5b9de99 [ 408.144741][ T9095] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 408.144761][ T9095] RSP: 002b:00007f82a69cf028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 408.144780][ T9095] RAX: ffffffffffffffda RBX: 00007f82a5e25fa0 RCX: 00007f82a5b9de99 [ 408.144794][ T9095] RDX: 0000000000000002 RSI: 00002000000024c0 RDI: 0000000000000003 [ 408.144807][ T9095] RBP: 00007f82a69cf090 R08: 0000000000000000 R09: 0000000000000000 [ 408.144819][ T9095] R10: 0000000000004800 R11: 0000000000000246 R12: 0000000000000001 [ 408.144832][ T9095] R13: 00007f82a5e26038 R14: 00007f82a5e25fa0 R15: 00007ffe8da00ee8 [ 408.144860][ T9095] [ 408.542158][ T29] audit: type=1804 audit(1784567846.883:765): pid=9100 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=ToMToU comm="syz.4.822" name="/newroot/172/file1" dev="fuse" ino=1 res=1 errno=0 [ 408.603620][ T29] audit: type=1800 audit(1784567846.883:766): pid=9100 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed(directio) comm="syz.4.822" name="/" dev="fuse" ino=1 res=0 errno=0 [ 408.871296][ T5732] usb 2-1: new high-speed USB device number 19 using dummy_hcd [ 409.149524][ T5704] gspca_main: spca501-2.14.0 probing 0000:0000 [ 409.161392][ T5704] gspca_spca501: reg write: error -71 [ 409.172322][ T5704] spca501 3-1:1.0: Reg write failed for 0x02,0x0f,0x05 [ 409.206161][ T5704] spca501 3-1:1.0: probe with driver spca501 failed with error -22 [ 409.229215][ T5704] usb 3-1: USB disconnect, device number 17 [ 409.291616][ T5732] usb 2-1: Using ep0 maxpacket: 8 [ 409.303331][ T9109] netlink: 24 bytes leftover after parsing attributes in process `syz.3.823'. [ 409.311840][ T5732] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 409.323380][ T5732] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 409.337244][ T5732] usb 2-1: config 16 interface 0 altsetting 0 has an endpoint descriptor with address 0xB6, changing to 0x86 [ 409.356856][ T5732] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x86 has invalid maxpacket 55305, setting to 1024 [ 409.385184][ T5732] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x86 has invalid maxpacket 1024 [ 409.429129][ T5732] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 409.460649][ T5732] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 409.485323][ T5732] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 409.647082][ T9108] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 409.685243][ T9114] vti0: entered promiscuous mode [ 409.720457][ T5732] usb 2-1: usb_control_msg returned -32 [ 409.737037][ T9106] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 409.749696][ T5732] usbtmc 2-1:16.0: can't read capabilities [ 409.751684][ T9106] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 409.817107][ T5732] usb 2-1: USB disconnect, device number 19 [ 409.828596][ T29] audit: type=1400 audit(1784567848.163:767): avc: denied { read } for pid=9113 comm="syz.0.826" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 409.915345][ T29] audit: type=1400 audit(1784567848.253:768): avc: denied { read } for pid=9117 comm="syz.2.827" path="socket:[24958]" dev="sockfs" ino=24958 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 410.285135][ T9126] FAULT_INJECTION: forcing a failure. [ 410.285135][ T9126] name failslab, interval 1, probability 0, space 0, times 0 [ 410.298923][ T9126] CPU: 1 UID: 0 PID: 9126 Comm: syz.3.829 Tainted: G L syzkaller #0 PREEMPT(full) [ 410.298941][ T9126] Tainted: [L]=SOFTLOCKUP [ 410.298945][ T9126] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/10/2026 [ 410.298952][ T9126] Call Trace: [ 410.298956][ T9126] [ 410.298961][ T9126] dump_stack_lvl+0x100/0x190 [ 410.298979][ T9126] should_fail_ex.cold+0x5/0xa [ 410.298993][ T9126] should_failslab+0xc2/0x120 [ 410.299007][ T9126] __kmalloc_noprof+0xfc/0x820 [ 410.299018][ T9126] ? rcu_is_watching+0x12/0xc0 [ 410.299034][ T9126] ? tomoyo_realpath_from_path+0xb6/0x690 [ 410.299055][ T9126] tomoyo_realpath_from_path+0xb6/0x690 [ 410.299074][ T9126] tomoyo_path_number_perm+0x23c/0x580 [ 410.299088][ T9126] ? tomoyo_path_number_perm+0x22e/0x580 [ 410.299102][ T9126] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 410.299132][ T9126] ? find_held_lock+0x2b/0x80 [ 410.299148][ T9126] ? __fget_files+0x215/0x3d0 [ 410.299164][ T9126] ? hook_file_ioctl_common+0x140/0x440 [ 410.299175][ T9126] ? __fget_files+0x215/0x3d0 [ 410.299188][ T9126] ? __fget_files+0x21f/0x3d0 [ 410.299200][ T9126] security_file_ioctl+0xd3/0x230 [ 410.299216][ T9126] __x64_sys_ioctl+0xb7/0x210 [ 410.299232][ T9126] do_syscall_64+0x115/0x870 [ 410.299243][ T9126] ? clear_bhb_loop+0x40/0x90 [ 410.299257][ T9126] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 410.299268][ T9126] RIP: 0033:0x7f82a5b9de99 [ 410.299278][ T9126] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 410.299288][ T9126] RSP: 002b:00007f82a69cf028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 410.299300][ T9126] RAX: ffffffffffffffda RBX: 00007f82a5e25fa0 RCX: 00007f82a5b9de99 [ 410.299307][ T9126] RDX: 0000200000000000 RSI: 00000000800448d3 RDI: 0000000000000004 [ 410.299314][ T9126] RBP: 00007f82a69cf090 R08: 0000000000000000 R09: 0000000000000000 [ 410.299321][ T9126] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 410.299327][ T9126] R13: 00007f82a5e26038 R14: 00007f82a5e25fa0 R15: 00007ffe8da00ee8 [ 410.299350][ T9126] [ 410.299407][ T9126] ERROR: Out of memory at tomoyo_realpath_from_path. [ 410.320999][ T5732] usb 1-1: new high-speed USB device number 18 using dummy_hcd [ 410.650970][ T5732] usb 1-1: device descriptor read/64, error -71 [ 410.707989][ T9129] JFS: discard option not supported on device [ 410.716053][ T9129] Mount JFS Failure: -5 [ 410.720308][ T9129] jfs_mount failed w/return code = -5 [ 410.931181][ T5732] usb 1-1: new high-speed USB device number 19 using dummy_hcd [ 411.151756][ T5732] usb 1-1: device descriptor read/64, error -71 [ 411.302106][ T5732] usb usb1-port1: attempt power cycle [ 411.380378][ T9134] netlink: 20 bytes leftover after parsing attributes in process `syz.3.832'. [ 411.511471][ T5612] usb 3-1: new high-speed USB device number 18 using dummy_hcd [ 411.652002][ T5612] usb 3-1: device descriptor read/64, error -71 [ 411.661003][ T5732] usb 1-1: new high-speed USB device number 20 using dummy_hcd [ 411.691678][ T5732] usb 1-1: device descriptor read/8, error -71 [ 411.837362][ T9139] SELinux: security_context_str_to_sid (system_u) failed with errno=-22 [ 411.941091][ T5732] usb 1-1: new high-speed USB device number 21 using dummy_hcd [ 411.941299][ T5612] usb 3-1: new high-speed USB device number 19 using dummy_hcd [ 412.011623][ T5732] usb 1-1: device descriptor read/8, error -71 [ 412.131054][ T5612] usb 3-1: device descriptor read/64, error -71 [ 412.139106][ T5732] usb usb1-port1: unable to enumerate USB device [ 412.253058][ T5612] usb usb3-port1: attempt power cycle [ 412.714640][ T5612] usb 3-1: new high-speed USB device number 20 using dummy_hcd [ 413.006405][ T29] audit: type=1400 audit(1784567851.163:769): avc: denied { write } for pid=9147 comm="syz.3.837" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_crypto_socket permissive=1 [ 413.713769][ T5612] usb 3-1: device descriptor read/8, error -71 [ 414.271199][ T5612] usb 3-1: new high-speed USB device number 21 using dummy_hcd [ 414.272478][ T29] audit: type=1400 audit(1784567852.623:770): avc: denied { create } for pid=9123 comm="syz.0.828" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 414.521404][ T5732] usb 4-1: new high-speed USB device number 30 using dummy_hcd [ 414.568749][ T9144] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 414.620982][ T5612] usb 3-1: device not accepting address 21, error -71 [ 414.656049][ T5612] usb usb3-port1: unable to enumerate USB device [ 414.702464][ T5732] usb 4-1: Using ep0 maxpacket: 16 [ 414.724036][ T5732] usb 4-1: New USB device found, idVendor=054c, idProduct=0038, bcdDevice=16.f5 [ 414.756419][ T5732] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 414.783735][ T5732] usb 4-1: Product: syz [ 414.798561][ T5732] usb 4-1: Manufacturer: syz [ 414.818336][ T5732] usb 4-1: SerialNumber: syz [ 414.850371][ T5732] usb 4-1: config 0 descriptor?? [ 414.877812][ T5732] visor 4-1:0.0: Sony Clie 3.5 converter detected [ 416.273753][ T5732] usb 4-1: clie_3_5_startup: get config number failed: -71 [ 416.350847][ T5732] visor 4-1:0.0: probe with driver visor failed with error -71 [ 416.436773][ T5732] usb 4-1: USB disconnect, device number 30 [ 417.523247][ T9164] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(8) [ 417.529789][ T9164] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 417.689428][ T9178] vhci_hcd: connection closed [ 417.690083][ T9164] vhci_hcd vhci_hcd.0: Device attached [ 417.717482][ T6080] vhci_hcd vhci_hcd.0: stop threads [ 417.723352][ T6080] vhci_hcd vhci_hcd.0: release socket [ 417.726865][ T9184] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 417.731479][ T6080] vhci_hcd vhci_hcd.0: disconnect device [ 417.759989][ T9184] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 417.840682][ T9184] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 417.869270][ T9184] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 418.352877][ T9187] netlink: 20 bytes leftover after parsing attributes in process `syz.1.846'. [ 419.856562][ T9204] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 419.870569][ T29] audit: type=1400 audit(1784567858.213:771): avc: denied { map } for pid=9200 comm="syz.3.849" path="/dev/dri/card1" dev="devtmpfs" ino=628 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 419.926047][ T5624] Bluetooth: hci3: unexpected subevent 0x10 length: 5 > 2 [ 420.498152][ T29] audit: type=1400 audit(1784567858.803:772): avc: denied { ioctl } for pid=9199 comm="syz.1.850" path="/dev/nullb0" dev="devtmpfs" ino=696 ioctlcmd=0x127f scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 421.281055][ T9224] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 421.469734][ T9230] SELinux: security_context_str_to_sid (system_u) failed with errno=-22 [ 422.016492][ T9233] input: syz0 as /devices/virtual/input/input33 [ 423.340445][ T9223] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 424.175965][ T9251] vivid-000: disconnect [ 424.418151][ T9251] NILFS (nullb0): couldn't find nilfs on the device [ 424.707825][ T9248] vivid-000: reconnect [ 425.193252][ T9256] JFS: discard option not supported on device [ 425.201140][ T9256] Mount JFS Failure: -5 [ 425.205395][ T9256] jfs_mount failed w/return code = -5 [ 425.845086][ T9259] netlink: 12 bytes leftover after parsing attributes in process `syz.3.863'. [ 426.233342][ T5612] usb 3-1: new high-speed USB device number 22 using dummy_hcd [ 426.379764][ T9257] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(8) [ 426.386296][ T9257] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 426.413403][ T9272] netlink: 28 bytes leftover after parsing attributes in process `syz.1.866'. [ 426.424935][ T9257] vhci_hcd vhci_hcd.0: Device attached [ 426.497955][ T5612] usb 3-1: Using ep0 maxpacket: 8 [ 426.543454][ T9269] vhci_hcd: connection closed [ 426.546227][ T145] vhci_hcd vhci_hcd.0: stop threads [ 426.630662][ T5612] usb 3-1: config 168 descriptor has 1 excess byte, ignoring [ 426.655444][ T5612] usb 3-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 426.761409][ T42] usb 34-1: SetAddress Request (17) to port 0 [ 426.962288][ T42] usb 34-1: new SuperSpeed USB device number 17 using vhci_hcd [ 426.972390][ T5612] usb 3-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 427.147612][ T5612] usb 3-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 427.178257][ T5612] usb 3-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 427.241348][ T5612] usb 3-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 427.242312][ T145] vhci_hcd vhci_hcd.0: release socket [ 427.276264][ T5612] usb 3-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 427.304254][ T5612] usb 3-1: config 168 interface 0 has no altsetting 0 [ 427.389471][ T145] vhci_hcd vhci_hcd.0: disconnect device [ 427.419250][ T5612] usb 3-1: config 168 descriptor has 1 excess byte, ignoring [ 427.428960][ T5612] usb 3-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 427.482993][ T5612] usb 3-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 427.509729][ T5612] usb 3-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 427.539195][ T5612] usb 3-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 427.577753][ T5612] usb 3-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 427.593657][ T806] usb 4-1: new high-speed USB device number 31 using dummy_hcd [ 427.615420][ T5612] usb 3-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 427.652123][ T5612] usb 3-1: config 168 interface 0 has no altsetting 0 [ 427.671501][ T5612] usb 3-1: config 168 descriptor has 1 excess byte, ignoring [ 427.683250][ T5612] usb 3-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 427.820457][ T5612] usb 3-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 428.022784][ T5612] usb 3-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 428.052577][ T9267] netlink: 24 bytes leftover after parsing attributes in process `syz.4.865'. [ 428.073416][ T5612] usb 3-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 428.117378][ T806] usb 4-1: Using ep0 maxpacket: 8 [ 428.148251][ T9267] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 428.156646][ T5612] usb 3-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 428.623290][ T5612] usb 3-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 428.805149][ T806] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 428.842545][ T5612] usb 3-1: config 168 interface 0 has no altsetting 0 [ 428.849705][ T806] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 428.873550][ T806] usb 4-1: config 16 interface 0 altsetting 0 has an endpoint descriptor with address 0xB6, changing to 0x86 [ 428.919992][ T806] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x86 has invalid maxpacket 55305, setting to 1024 [ 428.946436][ T806] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x86 has invalid maxpacket 1024 [ 428.970048][ T806] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 428.990862][ T5612] usb 3-1: string descriptor 0 read error: -22 [ 428.997341][ T806] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 429.007143][ T5612] usb 3-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 429.017605][ T806] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 429.026135][ T5612] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 429.082178][ T5612] usb 3-1: can't set config #168, error -71 [ 429.120430][ T5612] usb 3-1: USB disconnect, device number 22 [ 429.258757][ T9281] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 429.266449][ T9291] FAULT_INJECTION: forcing a failure. [ 429.266449][ T9291] name failslab, interval 1, probability 0, space 0, times 0 [ 429.276062][ T806] usb 4-1: usb_control_msg returned -32 [ 429.300086][ T9281] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 429.308730][ T806] usbtmc 4-1:16.0: can't read capabilities [ 429.350307][ T9291] CPU: 0 UID: 0 PID: 9291 Comm: syz.0.869 Tainted: G L syzkaller #0 PREEMPT(full) [ 429.350338][ T9291] Tainted: [L]=SOFTLOCKUP [ 429.350345][ T9291] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/10/2026 [ 429.350361][ T9291] Call Trace: [ 429.350367][ T9291] [ 429.350374][ T9291] dump_stack_lvl+0x100/0x190 [ 429.350404][ T9291] should_fail_ex.cold+0x5/0xa [ 429.350431][ T9291] should_failslab+0xc2/0x120 [ 429.350456][ T9291] __kmalloc_noprof+0xfc/0x820 [ 429.350476][ T9291] ? rcu_is_watching+0x12/0xc0 [ 429.350505][ T9291] ? tomoyo_realpath_from_path+0xb6/0x690 [ 429.350542][ T9291] tomoyo_realpath_from_path+0xb6/0x690 [ 429.350579][ T9291] tomoyo_path_number_perm+0x23c/0x580 [ 429.350605][ T9291] ? tomoyo_path_number_perm+0x22e/0x580 [ 429.350633][ T9291] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 429.350689][ T9291] ? find_held_lock+0x2b/0x80 [ 429.350718][ T9291] ? __fget_files+0x215/0x3d0 [ 429.350736][ T9291] ? hook_file_ioctl_common+0x140/0x440 [ 429.350756][ T9291] ? __fget_files+0x215/0x3d0 [ 429.350780][ T9291] ? __fget_files+0x21f/0x3d0 [ 429.350804][ T9291] security_file_ioctl+0xd3/0x230 [ 429.350834][ T9291] __x64_sys_ioctl+0xb7/0x210 [ 429.350864][ T9291] do_syscall_64+0x115/0x870 [ 429.350884][ T9291] ? clear_bhb_loop+0x40/0x90 [ 429.350909][ T9291] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 429.350935][ T9291] RIP: 0033:0x7f6b8ad9de99 [ 429.350952][ T9291] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 429.350971][ T9291] RSP: 002b:00007f6b8bcbf028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 429.350995][ T9291] RAX: ffffffffffffffda RBX: 00007f6b8b026090 RCX: 00007f6b8ad9de99 [ 429.351009][ T9291] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 00000000000000a3 [ 429.351021][ T9291] RBP: 00007f6b8bcbf090 R08: 0000000000000000 R09: 0000000000000000 [ 429.351034][ T9291] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 429.351046][ T9291] R13: 00007f6b8b026128 R14: 00007f6b8b026090 R15: 00007fffee94d998 [ 429.351076][ T9291] [ 429.351083][ T9291] ERROR: Out of memory at tomoyo_realpath_from_path. [ 429.572499][ T9295] binder: 9294:9295 ioctl c0306201 200000000080 returned -14 [ 429.589323][ T29] audit: type=1400 audit(1784567867.878:773): avc: denied { write } for pid=9294 comm="syz.1.871" name="binder0" dev="binder" ino=10 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 429.638563][ T5725] usb 4-1: USB disconnect, device number 31 [ 429.653594][ T9295] binder: 9294:9295 ioctl c0306201 2000000003c0 returned -14 [ 430.062785][ T9298] input: syz0 as /devices/virtual/input/input34 [ 430.093918][ T29] audit: type=1400 audit(1784567868.394:774): avc: denied { execute } for pid=9309 comm="syz.1.874" path=2F616E6F6E5F6875676570616765202864656C6574656429 dev="hugetlbfs" ino=25383 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:hugetlbfs_t tclass=file permissive=1 [ 430.434286][ T29] audit: type=1400 audit(1784567868.732:775): avc: denied { ioctl } for pid=9315 comm="syz.1.876" path="socket:[23985]" dev="sockfs" ino=23985 ioctlcmd=0x89ed scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 430.591077][ T9321] netlink: 12 bytes leftover after parsing attributes in process `syz.0.877'. [ 431.703527][ T9329] ip6_tunnel: non-ECT from db5b:6861:58bb:cfe8:875a:6596:9ff5:7b00 with DS=0x31 [ 431.713298][ T9329] ip6_tunnel: non-ECT from db5b:6861:58bb:cfe8:875a:6596:9ff5:7b00 with DS=0x31 [ 431.722408][ T9329] ip6_tunnel: non-ECT from db5b:6861:58bb:cfe8:875a:6596:9ff5:7b00 with DS=0x31 [ 431.731479][ T9329] ip6_tunnel: non-ECT from db5b:6861:58bb:cfe8:875a:6596:9ff5:7b00 with DS=0x31 [ 431.740526][ T9329] ip6_tunnel: non-ECT from db5b:6861:58bb:cfe8:875a:6596:9ff5:7b00 with DS=0x31 [ 431.749596][ T9329] ip6_tunnel: non-ECT from db5b:6861:58bb:cfe8:875a:6596:9ff5:7b00 with DS=0x31 [ 431.758645][ T9329] ip6_tunnel: non-ECT from db5b:6861:58bb:cfe8:875a:6596:9ff5:7b00 with DS=0x31 [ 431.767701][ T9329] ip6_tunnel: non-ECT from db5b:6861:58bb:cfe8:875a:6596:9ff5:7b00 with DS=0x31 [ 431.776761][ T9329] ip6_tunnel: non-ECT from db5b:6861:58bb:cfe8:875a:6596:9ff5:7b00 with DS=0x31 [ 431.785816][ T9329] ip6_tunnel: non-ECT from db5b:6861:58bb:cfe8:875a:6596:9ff5:7b00 with DS=0x31 [ 432.541444][ T42] usb 34-1: device descriptor read/8, error -110 [ 433.002579][ T29] audit: type=1400 audit(1784567871.214:776): avc: denied { read } for pid=9336 comm="syz.4.881" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 433.379115][ T5624] Bluetooth: hci1: unexpected event for opcode 0x6b2f [ 433.380924][ T42] usb usb34-port1: attempt power cycle [ 433.436337][ T806] usb 4-1: new high-speed USB device number 32 using dummy_hcd [ 433.894835][ T9347] netlink: 24 bytes leftover after parsing attributes in process `syz.0.882'. [ 433.912817][ T806] usb 4-1: Using ep0 maxpacket: 32 [ 433.935488][ T806] usb 4-1: unable to get BOS descriptor or descriptor too short [ 433.965796][ T806] usb 4-1: config 14 has an invalid interface number: 57 but max is 1 [ 433.976790][ T806] usb 4-1: config 14 has an invalid interface number: 228 but max is 1 [ 433.992324][ T9348] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 434.006332][ T806] usb 4-1: config 14 has no interface number 0 [ 434.014418][ T806] usb 4-1: config 14 has no interface number 1 [ 434.023593][ T806] usb 4-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 434.034371][ T806] usb 4-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 434.070634][ T806] usb 4-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 434.095420][ T806] usb 4-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 434.232348][ T806] usb 4-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 434.336969][ T806] usb 4-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 434.463431][ T42] usb usb34-port1: unable to enumerate USB device [ 434.537762][ T806] usb 4-1: config 14 interface 57 has no altsetting 0 [ 434.662444][ T806] usb 4-1: config 14 interface 228 has no altsetting 0 [ 435.020345][ T806] usb 4-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 435.125418][ T806] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 435.170514][ T806] usb 4-1: Product: syz [ 435.178524][ T806] usb 4-1: Manufacturer: syz [ 435.183345][ T806] usb 4-1: SerialNumber: syz [ 436.044492][ T9371] ubi: mtd0 is already attached to ubi0 [ 436.358447][ T5803] usb 3-1: new full-speed USB device number 23 using dummy_hcd [ 436.370066][ T806] legousbtower 4-1:14.57: interrupt endpoints not found [ 436.540330][ T5803] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 436.580384][ T5803] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 436.615707][ T806] legousbtower 4-1:14.228: LEGO USB Tower firmware version is 118.106 build 21646 [ 436.661431][ T5803] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 436.700059][ T5803] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 437.574459][ T806] legousbtower 4-1:14.228: LEGO USB Tower #-160 now attached to major 180 minor 0 [ 437.716014][ T9386] fuse: Bad value for 'fd' [ 437.796745][ T5803] usb 3-1: usb_control_msg returned -32 [ 437.806004][ T5803] usbtmc 3-1:16.0: can't read capabilities [ 437.848632][ T29] audit: type=1400 audit(1784567876.102:777): avc: denied { ioctl } for pid=9358 comm="syz.2.888" path="/dev/infiniband/rdma_cm" dev="devtmpfs" ino=1271 ioctlcmd=0x940e scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:infiniband_device_t tclass=chr_file permissive=1 [ 438.152594][ T9393] JFS: discard option not supported on device [ 438.160753][ T9393] Mount JFS Failure: -5 [ 438.165178][ T9393] jfs_mount failed w/return code = -5 [ 438.672270][ T806] usb 4-1: USB disconnect, device number 32 [ 438.689509][ T9398] usb 4-1: LEGO USB Tower reset control request failed [ 438.765740][ T806] legousbtower 4-1:14.228: LEGO USB Tower #-160 now disconnected [ 439.846388][ T1312] ieee802154 phy0 wpan0: encryption failed: -22 [ 439.852747][ T1312] ieee802154 phy1 wpan1: encryption failed: -22 [ 439.895901][ T9411] FAULT_INJECTION: forcing a failure. [ 439.895901][ T9411] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 439.945916][ T5612] usb 3-1: USB disconnect, device number 23 [ 440.000689][ T9411] CPU: 0 UID: 0 PID: 9411 Comm: syz.3.905 Tainted: G L syzkaller #0 PREEMPT(full) [ 440.000718][ T9411] Tainted: [L]=SOFTLOCKUP [ 440.000726][ T9411] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/10/2026 [ 440.000737][ T9411] Call Trace: [ 440.000744][ T9411] [ 440.000751][ T9411] dump_stack_lvl+0x100/0x190 [ 440.000781][ T9411] should_fail_ex.cold+0x5/0xa [ 440.000808][ T9411] _copy_to_user+0x32/0xd0 [ 440.000837][ T9411] simple_read_from_buffer+0xcb/0x170 [ 440.000872][ T9411] proc_fail_nth_read+0x1af/0x230 [ 440.000901][ T9411] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 440.000933][ T9411] ? rw_verify_area+0xce/0x6d0 [ 440.000959][ T9411] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 440.000986][ T9411] vfs_read+0x1e4/0xb40 [ 440.001016][ T9411] ? __pfx_vfs_read+0x10/0x10 [ 440.001043][ T9411] ? __fget_files+0x215/0x3d0 [ 440.001068][ T9411] ? __fget_files+0x21f/0x3d0 [ 440.001093][ T9411] ksys_read+0x12a/0x250 [ 440.001119][ T9411] ? __pfx_ksys_read+0x10/0x10 [ 440.001156][ T9411] do_syscall_64+0x115/0x870 [ 440.001176][ T9411] ? clear_bhb_loop+0x40/0x90 [ 440.001202][ T9411] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 440.001224][ T9411] RIP: 0033:0x7f82a5b5e6ce [ 440.001242][ T9411] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 440.001262][ T9411] RSP: 002b:00007f82a69adfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 440.001282][ T9411] RAX: ffffffffffffffda RBX: 00007f82a69ae6c0 RCX: 00007f82a5b5e6ce [ 440.001296][ T9411] RDX: 000000000000000f RSI: 00007f82a69ae0a0 RDI: 0000000000000006 [ 440.001309][ T9411] RBP: 00007f82a69ae090 R08: 0000000000000000 R09: 0000000000000000 [ 440.001323][ T9411] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 440.001336][ T9411] R13: 00007f82a5e26128 R14: 00007f82a5e26090 R15: 00007ffe8da00ee8 [ 440.001364][ T9411] [ 440.809192][ T9425] netlink: 5164 bytes leftover after parsing attributes in process `syz.2.908'. [ 441.218421][ T5704] usb 1-1: new high-speed USB device number 22 using dummy_hcd [ 441.809311][ T5704] usb 1-1: config 0 interface 0 altsetting 16 endpoint 0x81 has invalid maxpacket 9865, setting to 1024 [ 441.862117][ T5704] usb 1-1: config 0 interface 0 has no altsetting 0 [ 441.906903][ T5704] usb 1-1: New USB device found, idVendor=1044, idProduct=7a4d, bcdDevice= 0.00 [ 441.947304][ T5704] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 441.988451][ T5704] usb 1-1: config 0 descriptor?? [ 442.153454][ T9420] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 442.268834][ T29] audit: type=1400 audit(1784567880.484:778): avc: denied { getopt } for pid=9432 comm="syz.3.911" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 442.318086][ T9440] netlink: 'syz.3.911': attribute type 2 has an invalid length. [ 442.326378][ T9440] netlink: 'syz.3.911': attribute type 2 has an invalid length. [ 442.934681][ T5732] usb 4-1: new high-speed USB device number 33 using dummy_hcd [ 443.317581][ T9441] netlink: 8 bytes leftover after parsing attributes in process `syz.2.910'. [ 443.954930][ T5732] usb 4-1: Using ep0 maxpacket: 16 [ 443.971394][ T5732] usb 4-1: unable to get BOS descriptor or descriptor too short [ 443.991306][ T5704] usbhid 1-1:0.0: can't add hid device: -71 [ 444.013391][ T5704] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 444.021710][ T5732] usb 4-1: config 16 has an invalid interface number: 44 but max is 0 [ 444.068934][ T5732] usb 4-1: config 16 has no interface number 0 [ 444.098458][ T5704] usb 1-1: USB disconnect, device number 22 [ 444.119158][ T5732] usb 4-1: config 16 interface 44 altsetting 10 bulk endpoint 0x1 has invalid maxpacket 32 [ 444.184986][ T5732] usb 4-1: config 16 interface 44 has no altsetting 0 [ 444.218050][ T5732] usb 4-1: New USB device found, idVendor=0a2c, idProduct=0008, bcdDevice=1d.64 [ 444.250509][ T5732] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 444.276369][ T5732] usb 4-1: Product: syz [ 444.299694][ T5732] usb 4-1: Manufacturer: syz [ 444.309409][ T5732] usb 4-1: SerialNumber: syz [ 444.331117][ T9440] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 444.444496][ T29] audit: type=1400 audit(1784567882.651:779): avc: denied { associate } for pid=9449 comm="syz.4.915" name="pfkey" scontext=root:object_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 444.586207][ T9436] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 444.595017][ T9436] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 446.015469][ T5732] cypress_cy7c63 4-1:16.44: Cypress CY7C63xxx device now attached [ 446.045805][ T5732] usb 4-1: USB disconnect, device number 33 [ 446.173177][ T5732] cypress_cy7c63 4-1:16.44: Cypress CY7C63xxx device now disconnected [ 446.577144][ T5732] usb 4-1: new high-speed USB device number 34 using dummy_hcd [ 446.748102][ T5732] usb 4-1: Using ep0 maxpacket: 8 [ 446.779763][ T9448] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 446.795121][ T5732] usb 4-1: config 168 descriptor has 1 excess byte, ignoring [ 446.808340][ T5732] usb 4-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 446.839172][ T5732] usb 4-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 446.897153][ T5732] usb 4-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 446.974449][ T5732] usb 4-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 447.039998][ T5732] usb 4-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 447.066809][ T5732] usb 4-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 447.122571][ T5732] usb 4-1: config 168 interface 0 has no altsetting 0 [ 447.143966][ T5732] usb 4-1: config 168 descriptor has 1 excess byte, ignoring [ 447.166346][ T5732] usb 4-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 447.204133][ T5732] usb 4-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 447.267506][ T5732] usb 4-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 447.293837][ T5732] usb 4-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 447.352979][ T5732] usb 4-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 447.422818][ T5732] usb 4-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 447.497111][ T5732] usb 4-1: config 168 interface 0 has no altsetting 0 [ 447.520840][ T5732] usb 4-1: config 168 descriptor has 1 excess byte, ignoring [ 447.544103][ T5732] usb 4-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 448.033535][ T9488] bond0: invalid NS target ff00:: specified for addition [ 448.041450][ T9488] bond0: option ns_ip6_target: invalid value (18446744073709551615) [ 448.065760][ T5732] usb 4-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 448.080907][ T5732] usb 4-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 448.087380][ T9486] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(8) [ 448.099224][ T9486] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 448.108420][ T9486] vhci_hcd vhci_hcd.0: Device attached [ 448.147350][ T9482] JFS: discard option not supported on device [ 448.155400][ T9482] Mount JFS Failure: -5 [ 448.159707][ T9482] jfs_mount failed w/return code = -5 [ 448.207887][ T5732] usb 4-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 448.219299][ T5732] usb 4-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 448.231027][ T5732] usb 4-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 448.251596][ T5732] usb 4-1: config 168 interface 0 has no altsetting 0 [ 448.627235][ T9489] vhci_hcd: connection closed [ 448.633502][ T161] vhci_hcd vhci_hcd.4: stop threads [ 448.645413][ T5732] usb 4-1: string descriptor 0 read error: -22 [ 448.661053][ T5732] usb 4-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 448.678113][ T161] vhci_hcd vhci_hcd.4: release socket [ 448.697188][ T161] vhci_hcd vhci_hcd.4: disconnect device [ 448.707204][ T5732] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 448.749218][ T5803] usb 42-1: enqueue for inactive port 0 [ 448.766161][ T5732] adutux 4-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 448.828653][ T9495] Illegal XDP return value 1972611665 on prog (id 54) dev N/A, expect packet loss! [ 449.223256][ T806] usb 4-1: USB disconnect, device number 34 [ 449.517997][ T5803] usb usb42-port1: attempt power cycle [ 449.686577][ T29] audit: type=1400 audit(1784567887.872:780): avc: denied { create } for pid=9498 comm="syz.4.926" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_nflog_socket permissive=1 [ 449.865320][ T9507] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 449.893640][ T9507] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 450.088754][ T5803] usb usb42-port1: unable to enumerate USB device [ 450.209309][ T29] audit: type=1804 audit(1784567888.380:781): pid=9519 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz.3.929" name="/newroot/198/file1" dev="tmpfs" ino=1059 res=1 errno=0 [ 450.236485][ T42] usb 2-1: new high-speed USB device number 20 using dummy_hcd [ 450.291820][ T9519] netlink: 168 bytes leftover after parsing attributes in process `syz.3.929'. [ 450.382399][ T9519] netlink: 168 bytes leftover after parsing attributes in process `syz.3.929'. [ 450.469861][ T42] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 450.497164][ T42] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 450.524710][ T42] usb 2-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 450.557260][ T42] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 450.585198][ T42] usb 2-1: SerialNumber: syz [ 450.931943][ T42] usb 2-1: 0:2 : does not exist [ 451.019787][ T42] usb 2-1: USB disconnect, device number 20 [ 451.143506][ T9514] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 451.194731][ T5852] udevd[5852]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 452.056518][ T5704] usb 2-1: new high-speed USB device number 21 using dummy_hcd [ 452.205307][ T29] audit: type=1400 audit(1784567890.369:782): avc: denied { mounton } for pid=9534 comm="syz.4.934" path="/189/file0" dev="tmpfs" ino=1039 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=fifo_file permissive=1 [ 452.257899][ T5704] usb 2-1: Using ep0 maxpacket: 16 [ 452.270444][ T5704] usb 2-1: config 184 has an invalid interface number: 156 but max is 0 [ 452.290737][ T9535] FAULT_INJECTION: forcing a failure. [ 452.290737][ T9535] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 452.330202][ T5704] usb 2-1: config 184 contains an unexpected descriptor of type 0x1, skipping [ 452.348076][ T9535] CPU: 0 UID: 0 PID: 9535 Comm: syz.4.934 Tainted: G L syzkaller #0 PREEMPT(full) [ 452.348107][ T9535] Tainted: [L]=SOFTLOCKUP [ 452.348114][ T9535] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/10/2026 [ 452.348127][ T9535] Call Trace: [ 452.348133][ T9535] [ 452.348141][ T9535] dump_stack_lvl+0x100/0x190 [ 452.348171][ T9535] should_fail_ex.cold+0x5/0xa [ 452.348197][ T9535] _copy_from_user+0x2e/0xd0 [ 452.348224][ T9535] io_submit_one+0xbd/0x1fb0 [ 452.348252][ T9535] ? __lock_acquire+0x49f/0x1a40 [ 452.348276][ T9535] ? lockdep_hardirqs_on+0x78/0x100 [ 452.348311][ T9535] ? __pfx_io_submit_one+0x10/0x10 [ 452.348344][ T9535] ? __might_fault+0xc5/0x140 [ 452.348384][ T9535] ? __x64_sys_io_submit+0x1b1/0x3a0 [ 452.348407][ T9535] __x64_sys_io_submit+0x1b1/0x3a0 [ 452.348434][ T9535] ? __pfx___x64_sys_io_submit+0x10/0x10 [ 452.348458][ T9535] ? fput+0x79/0x100 [ 452.348492][ T9535] do_syscall_64+0x115/0x870 [ 452.348511][ T9535] ? clear_bhb_loop+0x40/0x90 [ 452.348536][ T9535] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 452.348557][ T9535] RIP: 0033:0x7f578db9de99 [ 452.348574][ T9535] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 452.348594][ T9535] RSP: 002b:00007f578eaa9028 EFLAGS: 00000246 ORIG_RAX: 00000000000000d1 [ 452.348614][ T9535] RAX: ffffffffffffffda RBX: 00007f578de25fa0 RCX: 00007f578db9de99 [ 452.348628][ T9535] RDX: 00002000000003c0 RSI: 0000000000000001 RDI: 00007f578ea5f000 [ 452.348642][ T9535] RBP: 00007f578eaa9090 R08: 0000000000000000 R09: 0000000000000000 [ 452.348654][ T9535] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 452.348666][ T9535] R13: 00007f578de26038 R14: 00007f578de25fa0 R15: 00007ffd26fb4148 [ 452.348695][ T9535] [ 452.538533][ T5704] usb 2-1: config 184 has no interface number 0 [ 452.544865][ T5704] usb 2-1: config 184 interface 156 altsetting 1 bulk endpoint 0x7 has invalid maxpacket 64 [ 452.554967][ T5704] usb 2-1: config 184 interface 156 altsetting 1 endpoint 0xA has invalid maxpacket 1024, setting to 64 [ 452.566117][ T5704] usb 2-1: config 184 interface 156 altsetting 1 has an invalid descriptor for endpoint zero, skipping [ 452.577162][ T5704] usb 2-1: config 184 interface 156 altsetting 1 has a duplicate endpoint with address 0xA, skipping [ 452.588037][ T5704] usb 2-1: config 184 interface 156 altsetting 1 endpoint 0xB has an invalid bInterval 174, changing to 11 [ 452.599474][ T5704] usb 2-1: config 184 interface 156 altsetting 1 has a duplicate endpoint with address 0xA, skipping [ 452.611086][ T5704] usb 2-1: config 184 interface 156 altsetting 1 endpoint 0xC has an invalid bInterval 110, changing to 10 [ 452.622526][ T5704] usb 2-1: config 184 interface 156 altsetting 1 endpoint 0xF has invalid maxpacket 1024, setting to 64 [ 452.633703][ T5704] usb 2-1: config 184 interface 156 altsetting 1 has a duplicate endpoint with address 0x8, skipping [ 452.645537][ T5704] usb 2-1: config 184 interface 156 altsetting 1 has a duplicate endpoint with address 0xE, skipping [ 452.656430][ T5704] usb 2-1: config 184 interface 156 has no altsetting 0 [ 452.677403][ T5704] usb 2-1: New USB device found, idVendor=8087, idProduct=0a5a, bcdDevice= 3.cf [ 452.686749][ T5704] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 452.694789][ T5704] usb 2-1: Product: ࠌ [ 452.698951][ T5704] usb 2-1: Manufacturer: 馕ﴯ﯈蹸䂰쿁ﯓᇨண┲噒앂ꂖퟟ鯻맜槵ꊃ晏鿴鏉䫮܌줦ﮇ猴䡜՚᫩迬餖삠ᜀ퉈⩻雂켇䁜鞖῕㎠錜볩췂證瑍뇐庁鶁ꢫ䞭휑懱ꋠ஁勉⚹㺼脨짏硚ᜊ恄彝믙첷嘆ኊ眬㌺ﭸី粔뢑蚮욉觘ᨹ㽙⢙ℯ稵 [ 452.729441][ T5704] usb 2-1: SerialNumber: ÿⳃ锬㌹ڝ㍎縶鉬伢喫◖ꙣ⩬㱆Ꙫ齙ꁁ纡ी⮺ᴵᨯᬬ豧껝ኃ吘痑㫯ﱊ酬虒ꝏ쐠띷句郍̤寘鵥ﻑ儸쳥餻ᯥ昒ꑷ纴徘ꉭ唨␌쭱窂쩠䶫憆ﾵ≐ǜー鈴띑￷곗㳢弛薻룋찏郺頷㔌਀䝂徏ꀫྤ됪ޮࣶ돼ʍ冓勹㜟囁㶠⫇躘쵗蕿 [ 452.775508][ T9530] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 453.004216][ T29] audit: type=1400 audit(1784567891.175:783): avc: denied { setattr } for pid=9529 comm="syz.1.932" path="/dev/dri/renderD128" dev="devtmpfs" ino=626 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 454.159526][ T9549] bond0: invalid NS target ff00:: specified for addition [ 454.167563][ T9549] bond0: option ns_ip6_target: invalid value (18446744073709551615) [ 454.259575][ T9547] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(8) [ 454.266082][ T9547] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 454.274906][ T9547] vhci_hcd vhci_hcd.0: Device attached [ 454.293434][ T9550] vhci_hcd: connection closed [ 454.293989][ T7008] vhci_hcd vhci_hcd.4: stop threads [ 454.324565][ T5704] usb 2-1: USB disconnect, device number 21 [ 454.384569][ T7008] vhci_hcd vhci_hcd.4: release socket [ 454.418245][ T7008] vhci_hcd vhci_hcd.4: disconnect device [ 454.506287][ T9558] fuse: Invalid rootmode [ 454.865567][ T9568] FAULT_INJECTION: forcing a failure. [ 454.865567][ T9568] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 454.886892][ T9568] CPU: 0 UID: 0 PID: 9568 Comm: syz.3.942 Tainted: G L syzkaller #0 PREEMPT(full) [ 454.886922][ T9568] Tainted: [L]=SOFTLOCKUP [ 454.886929][ T9568] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/10/2026 [ 454.886941][ T9568] Call Trace: [ 454.886948][ T9568] [ 454.886956][ T9568] dump_stack_lvl+0x100/0x190 [ 454.886986][ T9568] should_fail_ex.cold+0x5/0xa [ 454.887012][ T9568] _copy_from_user+0x2e/0xd0 [ 454.887039][ T9568] copy_msghdr_from_user+0x9f/0x4c0 [ 454.887070][ T9568] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 454.887113][ T9568] ___sys_sendmsg+0x106/0x1e0 [ 454.887152][ T9568] ? __pfx____sys_sendmsg+0x10/0x10 [ 454.887178][ T9568] ? __lock_acquire+0x49f/0x1a40 [ 454.887200][ T9568] ? get_pid_task+0x106/0x250 [ 454.887261][ T9568] __sys_sendmsg+0x160/0x210 [ 454.887286][ T9568] ? __pfx___sys_sendmsg+0x10/0x10 [ 454.887324][ T9568] do_syscall_64+0x115/0x870 [ 454.887344][ T9568] ? clear_bhb_loop+0x40/0x90 [ 454.887369][ T9568] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 454.887390][ T9568] RIP: 0033:0x7f82a5b9de99 [ 454.887406][ T9568] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 454.887426][ T9568] RSP: 002b:00007f82a69cf028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 454.887445][ T9568] RAX: ffffffffffffffda RBX: 00007f82a5e25fa0 RCX: 00007f82a5b9de99 [ 454.887459][ T9568] RDX: 000000000000c000 RSI: 0000200000000000 RDI: 0000000000000003 [ 454.887471][ T9568] RBP: 00007f82a69cf090 R08: 0000000000000000 R09: 0000000000000000 [ 454.887484][ T9568] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 454.887496][ T9568] R13: 00007f82a5e26038 R14: 00007f82a5e25fa0 R15: 00007ffe8da00ee8 [ 454.887523][ T9568] [ 455.732965][ T5624] Bluetooth: hci1: unexpected event for opcode 0x6b2f [ 458.505625][ T9592] bond0: invalid NS target ff00:: specified for addition [ 458.512717][ T9592] bond0: option ns_ip6_target: invalid value (18446744073709551615) [ 461.019816][ T9617] bond0: invalid NS target ff00:: specified for addition [ 461.027656][ T9617] bond0: option ns_ip6_target: invalid value (18446744073709551615) [ 461.108987][ T9616] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(8) [ 461.115486][ T9616] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 461.124380][ T9616] vhci_hcd vhci_hcd.0: Device attached [ 461.146705][ T9613] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 461.160005][ T5725] usb 3-1: new high-speed USB device number 24 using dummy_hcd [ 461.185941][ T9613] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 461.330767][ T5725] usb 3-1: Using ep0 maxpacket: 8 [ 461.343639][ T5725] usb 3-1: unable to get BOS descriptor or descriptor too short [ 461.362757][ T5725] usb 3-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 142, changing to 7 [ 461.383194][ T9618] vhci_hcd: connection closed [ 461.383826][ T161] vhci_hcd vhci_hcd.0: stop threads [ 461.392749][ T5725] usb 3-1: New USB device found, idVendor=0582, idProduct=0089, bcdDevice= 0.40 [ 461.395372][ T161] vhci_hcd vhci_hcd.0: release socket [ 461.410194][ T161] vhci_hcd vhci_hcd.0: disconnect device [ 461.413466][ T5725] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 461.416916][ T5803] usb 34-1: SetAddress Request (21) to port 0 [ 461.431661][ T5803] usb 34-1: new SuperSpeed USB device number 21 using vhci_hcd [ 461.434143][ T5725] usb 3-1: Product: syz [ 461.456104][ T5725] usb 3-1: Manufacturer: syz [ 461.466734][ T5725] usb 3-1: SerialNumber: syz [ 461.545577][ T5803] usb 34-1: enqueue for inactive port 0 [ 461.699087][ T5725] usb 3-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 461.719631][ T5725] usb 3-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 461.829832][ T5725] usb 3-1: USB disconnect, device number 24 [ 462.081800][ T5803] usb usb34-port1: attempt power cycle [ 462.893351][ T5624] Bluetooth: hci2: unexpected event for opcode 0x6b2f [ 463.081102][ T5704] usb 4-1: new high-speed USB device number 35 using dummy_hcd [ 463.215619][ T5803] usb usb34-port1: unable to enumerate USB device [ 463.329480][ T5704] usb 4-1: device descriptor read/64, error -71 [ 463.550419][ T5725] usb 3-1: new high-speed USB device number 25 using dummy_hcd [ 463.580585][ T5704] usb 4-1: new high-speed USB device number 36 using dummy_hcd [ 463.791802][ T5725] usb 3-1: Using ep0 maxpacket: 32 [ 463.807380][ T5704] usb 4-1: device descriptor read/64, error -71 [ 463.864829][ T5725] usb 3-1: config 0 has an invalid interface number: 67 but max is 0 [ 463.875074][ T5725] usb 3-1: config 0 has no interface number 0 [ 463.884340][ T5725] usb 3-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 463.893903][ T5725] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 463.908887][ T5725] usb 3-1: Product: syz [ 463.913927][ T5725] usb 3-1: Manufacturer: syz [ 463.918810][ T5725] usb 3-1: SerialNumber: syz [ 463.951274][ T5725] usb 3-1: config 0 descriptor?? [ 463.963485][ T5704] usb usb4-port1: attempt power cycle [ 464.303735][ T5704] usb 4-1: new high-speed USB device number 37 using dummy_hcd [ 464.334619][ T5704] usb 4-1: device descriptor read/8, error -71 [ 464.403433][ T9635] ip6t_rpfilter: unknown options [ 464.408486][ T5725] smsc95xx 3-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -32 [ 464.426805][ T5725] smsc95xx 3-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 464.575198][ T5704] usb 4-1: new high-speed USB device number 38 using dummy_hcd [ 464.606940][ T5704] usb 4-1: device descriptor read/8, error -71 [ 464.717593][ T5704] usb usb4-port1: unable to enumerate USB device [ 464.762582][ T13] Bluetooth: hci5: Frame reassembly failed (-84) [ 464.851035][ T5725] smsc95xx 3-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -32 [ 464.881197][ T5725] smsc95xx 3-1:0.67: probe with driver smsc95xx failed with error -32 [ 465.020182][ T9652] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 465.245783][ T29] audit: type=1400 audit(1784567903.349:784): avc: denied { name_bind } for pid=9654 comm="syz.0.966" src=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:reserved_port_t tclass=tcp_socket permissive=1 [ 466.672812][ T29] audit: type=1400 audit(1784567904.753:785): avc: denied { mount } for pid=9667 comm="syz.3.969" name="/" dev="devpts" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:devpts_t tclass=filesystem permissive=1 [ 466.716102][ T29] audit: type=1400 audit(1784567904.803:786): avc: denied { remount } for pid=9667 comm="syz.3.969" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:devpts_t tclass=filesystem permissive=1 [ 466.824763][ T5624] Bluetooth: hci5: Opcode 0x1003 failed: -110 [ 467.803498][ T806] usb 3-1: USB disconnect, device number 25 [ 469.304852][ T9694] FAULT_INJECTION: forcing a failure. [ 469.304852][ T9694] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 469.324180][ T9694] CPU: 0 UID: 0 PID: 9694 Comm: syz.1.975 Tainted: G L syzkaller #0 PREEMPT(full) [ 469.324211][ T9694] Tainted: [L]=SOFTLOCKUP [ 469.324218][ T9694] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/10/2026 [ 469.324230][ T9694] Call Trace: [ 469.324237][ T9694] [ 469.324244][ T9694] dump_stack_lvl+0x100/0x190 [ 469.324274][ T9694] should_fail_ex.cold+0x5/0xa [ 469.324301][ T9694] _copy_from_user+0x2e/0xd0 [ 469.324334][ T9694] copy_msghdr_from_user+0x9f/0x4c0 [ 469.324366][ T9694] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 469.324408][ T9694] ___sys_sendmsg+0x106/0x1e0 [ 469.324439][ T9694] ? __pfx____sys_sendmsg+0x10/0x10 [ 469.324466][ T9694] ? __lock_acquire+0x49f/0x1a40 [ 469.324490][ T9694] ? get_pid_task+0x106/0x250 [ 469.324552][ T9694] __sys_sendmsg+0x160/0x210 [ 469.324576][ T9694] ? __pfx___sys_sendmsg+0x10/0x10 [ 469.324614][ T9694] do_syscall_64+0x115/0x870 [ 469.324635][ T9694] ? clear_bhb_loop+0x40/0x90 [ 469.324660][ T9694] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 469.324681][ T9694] RIP: 0033:0x7fdfe999de99 [ 469.324698][ T9694] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 469.324717][ T9694] RSP: 002b:00007fdfea92a028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 469.324737][ T9694] RAX: ffffffffffffffda RBX: 00007fdfe9c25fa0 RCX: 00007fdfe999de99 [ 469.324751][ T9694] RDX: 0000000020040084 RSI: 0000200000000740 RDI: 0000000000000006 [ 469.324764][ T9694] RBP: 00007fdfea92a090 R08: 0000000000000000 R09: 0000000000000000 [ 469.324777][ T9694] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 469.324789][ T9694] R13: 00007fdfe9c26038 R14: 00007fdfe9c25fa0 R15: 00007ffcfae55908 [ 469.324818][ T9694] [ 470.053975][ T29] audit: type=1400 audit(1784567908.140:787): avc: denied { write } for pid=9696 comm="syz.1.976" name="snapshot" dev="devtmpfs" ino=92 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 470.095520][ T9697] random: crng reseeded on system resumption [ 470.134813][ T29] audit: type=1400 audit(1784567908.140:788): avc: denied { open } for pid=9696 comm="syz.1.976" path="/dev/snapshot" dev="devtmpfs" ino=92 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 470.480674][ T9699] FAULT_INJECTION: forcing a failure. [ 470.480674][ T9699] name failslab, interval 1, probability 0, space 0, times 0 [ 470.586308][ T9699] CPU: 1 UID: 0 PID: 9699 Comm: syz.1.977 Tainted: G L syzkaller #0 PREEMPT(full) [ 470.586342][ T9699] Tainted: [L]=SOFTLOCKUP [ 470.586348][ T9699] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/10/2026 [ 470.586357][ T9699] Call Trace: [ 470.586361][ T9699] [ 470.586366][ T9699] dump_stack_lvl+0x100/0x190 [ 470.586384][ T9699] should_fail_ex.cold+0x5/0xa [ 470.586399][ T9699] should_failslab+0xc2/0x120 [ 470.586413][ T9699] __kmalloc_noprof+0xfc/0x820 [ 470.586425][ T9699] ? rcu_is_watching+0x12/0xc0 [ 470.586441][ T9699] ? tomoyo_realpath_from_path+0xb6/0x690 [ 470.586461][ T9699] tomoyo_realpath_from_path+0xb6/0x690 [ 470.586480][ T9699] tomoyo_path_number_perm+0x23c/0x580 [ 470.586494][ T9699] ? tomoyo_path_number_perm+0x22e/0x580 [ 470.586509][ T9699] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 470.586538][ T9699] ? find_held_lock+0x2b/0x80 [ 470.586553][ T9699] ? __fget_files+0x215/0x3d0 [ 470.586563][ T9699] ? hook_file_ioctl_common+0x140/0x440 [ 470.586574][ T9699] ? __fget_files+0x215/0x3d0 [ 470.586587][ T9699] ? __fget_files+0x21f/0x3d0 [ 470.586599][ T9699] security_file_ioctl+0xd3/0x230 [ 470.586616][ T9699] __x64_sys_ioctl+0xb7/0x210 [ 470.586632][ T9699] do_syscall_64+0x115/0x870 [ 470.586643][ T9699] ? clear_bhb_loop+0x40/0x90 [ 470.586657][ T9699] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 470.586668][ T9699] RIP: 0033:0x7fdfe999de99 [ 470.586678][ T9699] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 470.586689][ T9699] RSP: 002b:00007fdfea92a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 470.586704][ T9699] RAX: ffffffffffffffda RBX: 00007fdfe9c25fa0 RCX: 00007fdfe999de99 [ 470.586711][ T9699] RDX: 0000200000000080 RSI: 00000000c0105512 RDI: 0000000000000003 [ 470.586718][ T9699] RBP: 00007fdfea92a090 R08: 0000000000000000 R09: 0000000000000000 [ 470.586725][ T9699] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 470.586732][ T9699] R13: 00007fdfe9c26038 R14: 00007fdfe9c25fa0 R15: 00007ffcfae55908 [ 470.586747][ T9699] [ 470.980937][ T9699] ERROR: Out of memory at tomoyo_realpath_from_path. [ 471.098040][ T29] audit: type=1400 audit(1784567909.186:789): avc: denied { read } for pid=9700 comm="syz.2.978" name="btrfs-control" dev="devtmpfs" ino=1315 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 471.208184][ T29] audit: type=1400 audit(1784567909.186:790): avc: denied { open } for pid=9700 comm="syz.2.978" path="/dev/btrfs-control" dev="devtmpfs" ino=1315 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 471.303067][ T9704] netlink: 8 bytes leftover after parsing attributes in process `syz.1.979'. [ 471.328868][ T29] audit: type=1400 audit(1784567909.235:791): avc: denied { ioctl } for pid=9700 comm="syz.2.978" path="/dev/btrfs-control" dev="devtmpfs" ino=1315 ioctlcmd=0x9404 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 471.501313][ T29] audit: type=1400 audit(1784567909.584:792): avc: denied { unmount } for pid=5607 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:devpts_t tclass=filesystem permissive=1 [ 471.716107][ T9707] netlink: 8 bytes leftover after parsing attributes in process `syz.3.980'. [ 472.009089][ T9716] overlayfs: failed to resolve './file0': -2 [ 472.237713][ T9715] loop4: detected capacity change from 0 to 7 [ 472.664830][ T9721] kvm: kvm [9719]: vcpu0, guest rIP: 0x9134 Unhandled WRMSR(0x11e) = 0xbe702111 [ 472.871458][ T5615] Buffer I/O error on dev loop4, logical block 0, async page read [ 472.893302][ T5615] Buffer I/O error on dev loop4, logical block 0, async page read [ 472.915661][ T5615] Buffer I/O error on dev loop4, logical block 0, async page read [ 472.946840][ T5615] Buffer I/O error on dev loop4, logical block 0, async page read [ 472.991469][ T5615] Buffer I/O error on dev loop4, logical block 0, async page read [ 473.309558][ T9727] netlink: 12 bytes leftover after parsing attributes in process `syz.4.985'. [ 473.362291][ T9730] FAULT_INJECTION: forcing a failure. [ 473.362291][ T9730] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 473.395928][ T9730] CPU: 0 UID: 0 PID: 9730 Comm: syz.3.987 Tainted: G L syzkaller #0 PREEMPT(full) [ 473.395966][ T9730] Tainted: [L]=SOFTLOCKUP [ 473.395973][ T9730] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/10/2026 [ 473.395985][ T9730] Call Trace: [ 473.395992][ T9730] [ 473.396000][ T9730] dump_stack_lvl+0x100/0x190 [ 473.396030][ T9730] should_fail_ex.cold+0x5/0xa [ 473.396056][ T9730] _copy_from_user+0x2e/0xd0 [ 473.396085][ T9730] __sys_bpf+0x2f5/0x4e80 [ 473.396126][ T9730] ? __pfx___sys_bpf+0x10/0x10 [ 473.396157][ T9730] ? find_held_lock+0x2b/0x80 [ 473.396186][ T9730] ? get_pid_task+0xfc/0x250 [ 473.396214][ T9730] ? get_pid_task+0xfc/0x250 [ 473.396253][ T9730] ? find_held_lock+0x2b/0x80 [ 473.396292][ T9730] ? rcu_read_lock_any_held+0x6a/0xa0 [ 473.396323][ T9730] ? find_held_lock+0x2b/0x80 [ 473.396351][ T9730] ? ksys_write+0x190/0x250 [ 473.396380][ T9730] ? ksys_write+0x190/0x250 [ 473.396427][ T9730] ? fput+0x79/0x100 [ 473.396454][ T9730] ? __x64_sys_bpf+0xce/0x140 [ 473.396472][ T9730] __x64_sys_bpf+0xce/0x140 [ 473.396492][ T9730] ? do_syscall_64+0x90/0x870 [ 473.396513][ T9730] do_syscall_64+0x115/0x870 [ 473.396532][ T9730] ? clear_bhb_loop+0x40/0x90 [ 473.396559][ T9730] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 473.396581][ T9730] RIP: 0033:0x7f82a5b9de99 [ 473.396598][ T9730] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 473.396618][ T9730] RSP: 002b:00007f82a69cf028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 473.396638][ T9730] RAX: ffffffffffffffda RBX: 00007f82a5e25fa0 RCX: 00007f82a5b9de99 [ 473.396652][ T9730] RDX: 0000000000000050 RSI: 0000200000000080 RDI: 000000000000000a [ 473.396665][ T9730] RBP: 00007f82a69cf090 R08: 0000000000000000 R09: 0000000000000000 [ 473.396676][ T9730] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 473.396688][ T9730] R13: 00007f82a5e26038 R14: 00007f82a5e25fa0 R15: 00007ffe8da00ee8 [ 473.396717][ T9730] [ 473.776261][ T9739] random: crng reseeded on system resumption [ 473.801001][ T9739] usb 5-1: USB disconnect, device number 8 [ 473.832313][ T5616] Bluetooth: hci3: Malformed LE Event: 0x0d [ 474.446972][ T9745] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 474.472602][ T9745] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 474.554104][ T9746] JFS: discard option not supported on device [ 474.560880][ T9746] Mount JFS Failure: -5 [ 474.565182][ T9746] jfs_mount failed w/return code = -5 [ 475.046666][ T9751] random: crng reseeded on system resumption [ 475.156955][ T5616] Bluetooth: hci3: Malformed LE Event: 0x0d [ 476.781752][ T5725] usb 4-1: new high-speed USB device number 39 using dummy_hcd [ 476.882312][ T155] netdevsim netdevsim2 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 476.911087][ T155] netdevsim netdevsim2 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 476.949120][ T155] netdevsim netdevsim2 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 476.977012][ T5725] usb 4-1: Using ep0 maxpacket: 8 [ 476.989558][ T155] netdevsim netdevsim2 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 477.009239][ T5725] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 477.029456][ T5725] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 477.060728][ T5725] usb 4-1: config 16 interface 0 altsetting 0 has an endpoint descriptor with address 0xB6, changing to 0x86 [ 477.108532][ T5725] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x86 has invalid maxpacket 55305, setting to 1024 [ 477.151287][ T5725] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x86 has invalid maxpacket 1024 [ 477.187015][ T5725] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 477.232293][ T5725] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 477.276486][ T5725] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 477.525495][ T5725] usb 4-1: usb_control_msg returned -32 [ 477.541723][ T9763] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 477.556747][ T5725] usbtmc 4-1:16.0: can't read capabilities [ 477.571852][ T9763] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 477.642765][ T5725] usb 4-1: USB disconnect, device number 39 [ 478.050922][ T9777] JFS: discard option not supported on device [ 478.057698][ T9777] Mount JFS Failure: -5 [ 478.061906][ T9777] jfs_mount failed w/return code = -5 [ 478.522687][ T9779] ubi: mtd0 is already attached to ubi0 [ 478.879462][ T9783] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 479.408799][ T29] audit: type=1400 audit(1784567917.466:793): avc: denied { create } for pid=9782 comm="syz.2.1002" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 479.433318][ T9783] FAULT_INJECTION: forcing a failure. [ 479.433318][ T9783] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 479.442020][ T29] audit: type=1400 audit(1784567917.486:794): avc: denied { ioctl } for pid=9782 comm="syz.2.1002" path="socket:[28202]" dev="sockfs" ino=28202 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 479.446349][ T9783] CPU: 1 UID: 0 PID: 9783 Comm: syz.2.1002 Tainted: G L syzkaller #0 PREEMPT(full) [ 479.446377][ T9783] Tainted: [L]=SOFTLOCKUP [ 479.446384][ T9783] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/10/2026 [ 479.446395][ T9783] Call Trace: [ 479.446401][ T9783] [ 479.446408][ T9783] dump_stack_lvl+0x100/0x190 [ 479.446439][ T9783] should_fail_ex.cold+0x5/0xa [ 479.446464][ T9783] _copy_from_user+0x2e/0xd0 [ 479.446490][ T9783] copy_msghdr_from_user+0x9f/0x4c0 [ 479.446519][ T9783] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 479.446560][ T9783] ___sys_sendmsg+0x106/0x1e0 [ 479.446589][ T9783] ? __pfx____sys_sendmsg+0x10/0x10 [ 479.446615][ T9783] ? __lock_acquire+0x49f/0x1a40 [ 479.446638][ T9783] ? get_pid_task+0x106/0x250 [ 479.446696][ T9783] __sys_sendmsg+0x160/0x210 [ 479.446718][ T9783] ? __pfx___sys_sendmsg+0x10/0x10 [ 479.446755][ T9783] do_syscall_64+0x115/0x870 [ 479.446773][ T9783] ? clear_bhb_loop+0x40/0x90 [ 479.446797][ T9783] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 479.446817][ T9783] RIP: 0033:0x7f3c8339de99 [ 479.446833][ T9783] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 479.446852][ T9783] RSP: 002b:00007f3c8424a028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 479.446884][ T9783] RAX: ffffffffffffffda RBX: 00007f3c83625fa0 RCX: 00007f3c8339de99 [ 479.446897][ T9783] RDX: 0000000000000000 RSI: 0000200000000200 RDI: 0000000000000003 [ 479.446909][ T9783] RBP: 00007f3c8424a090 R08: 0000000000000000 R09: 0000000000000000 [ 479.446921][ T9783] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 479.446932][ T9783] R13: 00007f3c83626038 R14: 00007f3c83625fa0 R15: 00007ffc697c6538 [ 479.446959][ T9783] [ 479.650230][ T29] audit: type=1400 audit(1784567917.486:795): avc: denied { write } for pid=9782 comm="syz.2.1002" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 479.670764][ T29] audit: type=1400 audit(1784567917.486:796): avc: denied { read } for pid=9782 comm="syz.2.1002" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 479.703182][ T29] audit: type=1400 audit(1784567917.755:797): avc: denied { read write } for pid=5608 comm="syz-executor" name="loop1" dev="devtmpfs" ino=648 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 479.727637][ T29] audit: type=1400 audit(1784567917.755:798): avc: denied { open } for pid=5608 comm="syz-executor" path="/dev/loop1" dev="devtmpfs" ino=648 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 479.894701][ T29] audit: type=1400 audit(1784567917.755:799): avc: denied { ioctl } for pid=5608 comm="syz-executor" path="/dev/loop1" dev="devtmpfs" ino=648 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 479.966938][ T29] audit: type=1400 audit(1784567917.934:800): avc: denied { read write } for pid=9790 comm="syz.3.1004" name="raw-gadget" dev="devtmpfs" ino=816 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 480.011414][ T29] audit: type=1400 audit(1784567917.934:801): avc: denied { open } for pid=9790 comm="syz.3.1004" path="/dev/raw-gadget" dev="devtmpfs" ino=816 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 480.139877][ T5725] usb 4-1: new high-speed USB device number 40 using dummy_hcd [ 480.232760][ T9791] JFS: discard option not supported on device [ 480.239962][ T9791] Mount JFS Failure: -5 [ 480.244299][ T9791] jfs_mount failed w/return code = -5 [ 480.305514][ T29] audit: type=1400 audit(1784567917.934:802): avc: denied { ioctl } for pid=9790 comm="syz.3.1004" path="/dev/raw-gadget" dev="devtmpfs" ino=816 ioctlcmd=0x5500 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 480.469436][ T5725] usb 4-1: Using ep0 maxpacket: 8 [ 480.579542][ T5725] usb 4-1: config index 0 descriptor too short (expected 301, got 45) [ 480.611970][ T5725] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 480.661777][ T5725] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 480.704205][ T5725] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 480.751777][ T5725] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 480.797853][ T5725] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 480.818175][ T9796] FAULT_INJECTION: forcing a failure. [ 480.818175][ T9796] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 480.837041][ T5725] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 480.853535][ T9796] CPU: 0 UID: 0 PID: 9796 Comm: syz.2.1005 Tainted: G L syzkaller #0 PREEMPT(full) [ 480.853564][ T9796] Tainted: [L]=SOFTLOCKUP [ 480.853571][ T9796] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/10/2026 [ 480.853583][ T9796] Call Trace: [ 480.853590][ T9796] [ 480.853597][ T9796] dump_stack_lvl+0x100/0x190 [ 480.853626][ T9796] should_fail_ex.cold+0x5/0xa [ 480.853653][ T9796] _copy_from_user+0x2e/0xd0 [ 480.853679][ T9796] do_ip_vs_set_ctl+0x53c/0xc90 [ 480.853709][ T9796] ? __pfx_do_ip_vs_set_ctl+0x10/0x10 [ 480.853731][ T9796] ? rcu_is_watching+0x12/0xc0 [ 480.853773][ T9796] ? find_held_lock+0x2b/0x80 [ 480.853804][ T9796] ? nf_sockopt_find.isra.0+0x222/0x290 [ 480.853825][ T9796] ? nf_sockopt_find.isra.0+0x222/0x290 [ 480.853858][ T9796] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 480.853897][ T9796] ? nf_setsockopt+0x8d/0xf0 [ 480.853916][ T9796] nf_setsockopt+0x8d/0xf0 [ 480.853940][ T9796] ip_setsockopt+0xcb/0xf0 [ 480.853966][ T9796] raw_setsockopt+0x60/0x1b0 [ 480.853989][ T9796] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 480.854018][ T9796] do_sock_setsockopt+0xf3/0x1d0 [ 480.854052][ T9796] __sys_setsockopt+0x195/0x220 [ 480.854080][ T9796] __x64_sys_setsockopt+0xbd/0x160 [ 480.854101][ T9796] ? do_syscall_64+0x90/0x870 [ 480.854120][ T9796] ? lockdep_hardirqs_on+0x78/0x100 [ 480.854152][ T9796] do_syscall_64+0x115/0x870 [ 480.854171][ T9796] ? clear_bhb_loop+0x40/0x90 [ 480.854197][ T9796] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 480.854219][ T9796] RIP: 0033:0x7f3c8339de99 [ 480.854237][ T9796] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 480.854256][ T9796] RSP: 002b:00007f3c84229028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 480.854276][ T9796] RAX: ffffffffffffffda RBX: 00007f3c83626090 RCX: 00007f3c8339de99 [ 480.854290][ T9796] RDX: 0000000000000483 RSI: 0000000000000000 RDI: 0000000000000003 [ 480.854303][ T9796] RBP: 00007f3c84229090 R08: 000000000000002c R09: 0000000000000000 [ 480.854315][ T9796] R10: 0000200000001280 R11: 0000000000000246 R12: 0000000000000001 [ 480.854329][ T9796] R13: 00007f3c83626128 R14: 00007f3c83626090 R15: 00007ffc697c6538 [ 480.854358][ T9796] [ 481.139826][ T5704] IPVS: starting estimator thread 0... [ 481.238111][ T9797] IPVS: using max 40 ests per chain, 96000 per kthread [ 481.435237][ T5725] usb 4-1: usb_control_msg returned -32 [ 481.440882][ T5725] usbtmc 4-1:16.0: can't read capabilities [ 481.467518][ T9] usb 2-1: new high-speed USB device number 22 using dummy_hcd [ 481.657941][ T9] usb 2-1: Using ep0 maxpacket: 8 [ 481.673880][ T9] usb 2-1: config 254 has 0 interfaces, different from the descriptor's value: 1 [ 481.699318][ T9] usb 2-1: New USB device found, idVendor=110a, idProduct=1450, bcdDevice=62.cb [ 481.718367][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 481.740250][ T9] usb 2-1: Product: syz [ 481.748438][ T9] usb 2-1: Manufacturer: syz [ 481.765436][ T9] usb 2-1: SerialNumber: syz [ 481.959000][ T5616] Bluetooth: hci2: Malformed LE Event: 0x0d [ 481.962908][ T9816] random: crng reseeded on system resumption [ 482.374734][ T9818] usbtmc 4-1:16.0: INDICATOR_PULSE returned 0 [ 482.744573][ T9828] 9p: Bad value for 'msize' [ 482.928629][ T5803] usb 4-1: USB disconnect, device number 40 [ 483.578020][ T9834] input: syz0 as /devices/virtual/input/input35 [ 484.075919][ T5725] usb 3-1: new high-speed USB device number 26 using dummy_hcd [ 484.215532][ T9841] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1013'. [ 484.228452][ T9841] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 484.311674][ T9] usb 2-1: USB disconnect, device number 22 [ 484.324069][ T5725] usb 3-1: Using ep0 maxpacket: 8 [ 484.361965][ T5725] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 484.384953][ T5725] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 484.415354][ T5803] usb 1-1: new high-speed USB device number 23 using dummy_hcd [ 484.433169][ T5725] usb 3-1: config 16 interface 0 altsetting 0 has an endpoint descriptor with address 0xB6, changing to 0x86 [ 484.607440][ T5725] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x86 has invalid maxpacket 55305, setting to 1024 [ 484.642573][ T5725] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x86 has invalid maxpacket 1024 [ 484.767079][ T29] kauditd_printk_skb: 58 callbacks suppressed [ 484.767162][ T29] audit: type=1400 audit(1784567922.759:861): avc: denied { open } for pid=9846 comm="syz.1.1016" path="/dev/ptyq7" dev="devtmpfs" ino=126 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bsdpty_device_t tclass=chr_file permissive=1 [ 484.798774][ T29] audit: type=1400 audit(1784567922.779:862): avc: denied { ioctl } for pid=9846 comm="syz.1.1016" path="/dev/ptyq7" dev="devtmpfs" ino=126 ioctlcmd=0x5431 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bsdpty_device_t tclass=chr_file permissive=1 [ 485.050909][ T5725] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 485.071640][ T5725] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 485.083517][ T5725] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 485.123243][ T5803] usb 1-1: New USB device found, idVendor=046d, idProduct=0870, bcdDevice=61.47 [ 485.141682][ T5803] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 485.167965][ T5803] usb 1-1: config 0 descriptor?? [ 485.366433][ T5725] usb 3-1: usb_control_msg returned -32 [ 485.389928][ T29] audit: type=1400 audit(1784567923.417:863): avc: denied { create } for pid=9840 comm="syz.2.1014" anonclass=[io_uring] scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 485.392178][ T5725] usbtmc 3-1:16.0: can't read capabilities [ 485.413228][ T5803] gspca_main: STV06xx-2.14.0 probing 046d:0870 [ 485.427012][ T9842] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 485.461540][ T9842] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 485.511165][ T9851] FAULT_INJECTION: forcing a failure. [ 485.511165][ T9851] name failslab, interval 1, probability 0, space 0, times 0 [ 485.603383][ T9851] CPU: 0 UID: 0 PID: 9851 Comm: syz.1.1017 Tainted: G L syzkaller #0 PREEMPT(full) [ 485.603414][ T9851] Tainted: [L]=SOFTLOCKUP [ 485.603421][ T9851] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/10/2026 [ 485.603433][ T9851] Call Trace: [ 485.603440][ T9851] [ 485.603448][ T9851] dump_stack_lvl+0x100/0x190 [ 485.603477][ T9851] should_fail_ex.cold+0x5/0xa [ 485.603504][ T9851] should_failslab+0xc2/0x120 [ 485.603529][ T9851] __kmalloc_noprof+0xfc/0x820 [ 485.603550][ T9851] ? rcu_is_watching+0x12/0xc0 [ 485.603578][ T9851] ? tomoyo_realpath_from_path+0xb6/0x690 [ 485.603614][ T9851] tomoyo_realpath_from_path+0xb6/0x690 [ 485.603650][ T9851] tomoyo_path_number_perm+0x23c/0x580 [ 485.603675][ T9851] ? tomoyo_path_number_perm+0x22e/0x580 [ 485.603703][ T9851] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 485.603757][ T9851] ? find_held_lock+0x2b/0x80 [ 485.603785][ T9851] ? __fget_files+0x215/0x3d0 [ 485.603806][ T9851] ? hook_file_ioctl_common+0x140/0x440 [ 485.603825][ T9851] ? __fget_files+0x215/0x3d0 [ 485.603848][ T9851] ? __fget_files+0x21f/0x3d0 [ 485.603872][ T9851] security_file_ioctl+0xd3/0x230 [ 485.603902][ T9851] __x64_sys_ioctl+0xb7/0x210 [ 485.603931][ T9851] do_syscall_64+0x115/0x870 [ 485.603950][ T9851] ? clear_bhb_loop+0x40/0x90 [ 485.603976][ T9851] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 485.603997][ T9851] RIP: 0033:0x7fdfe999de99 [ 485.604013][ T9851] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 485.604032][ T9851] RSP: 002b:00007fdfea92a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 485.604052][ T9851] RAX: ffffffffffffffda RBX: 00007fdfe9c25fa0 RCX: 00007fdfe999de99 [ 485.604066][ T9851] RDX: 0000200000000a40 RSI: 00000000c058560f RDI: 0000000000000003 [ 485.604078][ T9851] RBP: 00007fdfea92a090 R08: 0000000000000000 R09: 0000000000000000 [ 485.604090][ T9851] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 485.604102][ T9851] R13: 00007fdfe9c26038 R14: 00007fdfe9c25fa0 R15: 00007ffcfae55908 [ 485.604131][ T9851] [ 485.604666][ T9851] ERROR: Out of memory at tomoyo_realpath_from_path. [ 485.630816][ T29] audit: type=1400 audit(1784567923.676:864): avc: denied { create } for pid=9840 comm="syz.2.1014" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 485.716949][ T5725] usb 3-1: USB disconnect, device number 26 [ 486.023285][ T29] audit: type=1400 audit(1784567923.756:865): avc: denied { shutdown } for pid=9840 comm="syz.2.1014" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 486.063792][ T29] audit: type=1400 audit(1784567923.756:866): avc: denied { getopt } for pid=9840 comm="syz.2.1014" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 486.127100][ T29] audit: type=1400 audit(1784567923.756:867): avc: denied { connect } for pid=9840 comm="syz.2.1014" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 486.204027][ T29] audit: type=1400 audit(1784567923.756:868): avc: denied { name_connect } for pid=9840 comm="syz.2.1014" dest=20003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=sctp_socket permissive=1 [ 486.418777][ T29] audit: type=1400 audit(1784567924.454:869): avc: denied { create } for pid=9856 comm="syz.4.1019" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 486.422029][ T5616] Bluetooth: hci2: unexpected event for opcode 0x6b2f [ 486.495548][ T29] audit: type=1400 audit(1784567924.454:870): avc: denied { bind } for pid=9856 comm="syz.4.1019" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 487.294445][ T9866] bond0: invalid NS target ff00:: specified for addition [ 487.301564][ T9866] bond0: option ns_ip6_target: invalid value (18446744073709551615) [ 487.734898][ T9869] syzkaller0: entered promiscuous mode [ 487.741877][ T9869] syzkaller0: entered allmulticast mode [ 487.768534][ T9869] autofs: Unknown parameter '' [ 488.258805][ T5725] usb 4-1: new high-speed USB device number 41 using dummy_hcd [ 488.380252][ T9879] FAULT_INJECTION: forcing a failure. [ 488.380252][ T9879] name failslab, interval 1, probability 0, space 0, times 0 [ 488.394317][ T9879] CPU: 0 UID: 0 PID: 9879 Comm: syz.2.1025 Tainted: G L syzkaller #0 PREEMPT(full) [ 488.394347][ T9879] Tainted: [L]=SOFTLOCKUP [ 488.394354][ T9879] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/10/2026 [ 488.394366][ T9879] Call Trace: [ 488.394372][ T9879] [ 488.394380][ T9879] dump_stack_lvl+0x100/0x190 [ 488.394410][ T9879] should_fail_ex.cold+0x5/0xa [ 488.394437][ T9879] should_failslab+0xc2/0x120 [ 488.394462][ T9879] __kmalloc_noprof+0xfc/0x820 [ 488.394483][ T9879] ? rcu_is_watching+0x12/0xc0 [ 488.394513][ T9879] ? tomoyo_realpath_from_path+0xb6/0x690 [ 488.394551][ T9879] tomoyo_realpath_from_path+0xb6/0x690 [ 488.394589][ T9879] tomoyo_path_number_perm+0x23c/0x580 [ 488.394615][ T9879] ? tomoyo_path_number_perm+0x22e/0x580 [ 488.394643][ T9879] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 488.394698][ T9879] ? find_held_lock+0x2b/0x80 [ 488.394726][ T9879] ? __fget_files+0x215/0x3d0 [ 488.394744][ T9879] ? hook_file_ioctl_common+0x140/0x440 [ 488.394763][ T9879] ? __fget_files+0x215/0x3d0 [ 488.394785][ T9879] ? __fget_files+0x21f/0x3d0 [ 488.394808][ T9879] security_file_ioctl+0xd3/0x230 [ 488.394837][ T9879] __x64_sys_ioctl+0xb7/0x210 [ 488.394866][ T9879] do_syscall_64+0x115/0x870 [ 488.394886][ T9879] ? clear_bhb_loop+0x40/0x90 [ 488.394911][ T9879] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 488.394931][ T9879] RIP: 0033:0x7f3c8339de99 [ 488.394948][ T9879] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 488.394967][ T9879] RSP: 002b:00007f3c8424a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 488.394989][ T9879] RAX: ffffffffffffffda RBX: 00007f3c83625fa0 RCX: 00007f3c8339de99 [ 488.395002][ T9879] RDX: 0000200000000140 RSI: 000000004140aecd RDI: 0000000000000005 [ 488.395014][ T9879] RBP: 00007f3c8424a090 R08: 0000000000000000 R09: 0000000000000000 [ 488.395027][ T9879] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 488.395039][ T9879] R13: 00007f3c83626038 R14: 00007f3c83625fa0 R15: 00007ffc697c6538 [ 488.395066][ T9879] [ 488.397971][ T9879] ERROR: Out of memory at tomoyo_realpath_from_path. [ 488.628112][ T9889] fuse: Unknown parameter 'user_id00000000000000000000' [ 488.639253][ T5725] usb 4-1: Using ep0 maxpacket: 8 [ 488.645898][ T5725] usb 4-1: config index 0 descriptor too short (expected 301, got 45) [ 488.661117][ T5725] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 488.684447][ T5725] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 488.734573][ T5725] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 488.756338][ T5725] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 488.770015][ T5725] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 488.779090][ T5725] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 488.803072][ T9892] FAULT_INJECTION: forcing a failure. [ 488.803072][ T9892] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 488.820976][ T9892] CPU: 0 UID: 0 PID: 9892 Comm: syz.1.1027 Tainted: G L syzkaller #0 PREEMPT(full) [ 488.821007][ T9892] Tainted: [L]=SOFTLOCKUP [ 488.821014][ T9892] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/10/2026 [ 488.821025][ T9892] Call Trace: [ 488.821032][ T9892] [ 488.821039][ T9892] dump_stack_lvl+0x100/0x190 [ 488.821074][ T9892] should_fail_ex.cold+0x5/0xa [ 488.821100][ T9892] _copy_from_user+0x2e/0xd0 [ 488.821127][ T9892] core_sys_select+0x2d0/0xbb0 [ 488.821164][ T9892] ? __pfx_core_sys_select+0x10/0x10 [ 488.821192][ T9892] ? find_held_lock+0x2b/0x80 [ 488.821221][ T9892] ? get_pid_task+0xfc/0x250 [ 488.821278][ T9892] ? __pfx_set_user_sigmask+0x10/0x10 [ 488.821298][ T9892] ? __pfx_vfs_write+0x10/0x10 [ 488.821326][ T9892] ? do_sys_openat2+0x159/0x1e0 [ 488.821354][ T9892] do_pselect.constprop.0+0x238/0x270 [ 488.821389][ T9892] ? __pfx_do_pselect.constprop.0+0x10/0x10 [ 488.821425][ T9892] ? ksys_write+0x1ac/0x250 [ 488.821457][ T9892] __x64_sys_pselect6+0x149/0x1c0 [ 488.821491][ T9892] do_syscall_64+0x115/0x870 [ 488.821510][ T9892] ? clear_bhb_loop+0x40/0x90 [ 488.821534][ T9892] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 488.821554][ T9892] RIP: 0033:0x7fdfe999de99 [ 488.821571][ T9892] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 488.821590][ T9892] RSP: 002b:00007fdfea92a028 EFLAGS: 00000246 ORIG_RAX: 000000000000010e [ 488.821610][ T9892] RAX: ffffffffffffffda RBX: 00007fdfe9c25fa0 RCX: 00007fdfe999de99 [ 488.821624][ T9892] RDX: 0000000000000000 RSI: 0000200000000100 RDI: 0000000000000040 [ 488.821636][ T9892] RBP: 00007fdfea92a090 R08: 0000000000000000 R09: 0000000000000000 [ 488.821649][ T9892] R10: 0000200000000240 R11: 0000000000000246 R12: 0000000000000001 [ 488.821661][ T9892] R13: 00007fdfe9c26038 R14: 00007fdfe9c25fa0 R15: 00007ffcfae55908 [ 488.821690][ T9892] [ 489.129766][ T5732] usb 1-1: USB disconnect, device number 23 [ 489.228349][ T5725] usb 4-1: usb_control_msg returned -32 [ 489.233992][ T5725] usbtmc 4-1:16.0: can't read capabilities [ 489.815143][ T145] Bluetooth: hci5: Frame reassembly failed (-84) [ 489.852463][ T9909] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 489.875132][ T29] kauditd_printk_skb: 36 callbacks suppressed [ 489.875146][ T29] audit: type=1400 audit(1784567927.904:907): avc: denied { write } for pid=9911 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 490.002570][ T29] audit: type=1400 audit(1784567927.934:908): avc: denied { remove_name } for pid=9911 comm="rm" name="resolv.conf.sl0.link" dev="tmpfs" ino=6780 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 490.002620][ T9918] usbtmc 4-1:16.0: INDICATOR_PULSE returned 0 [ 490.026449][ T5732] usb 1-1: new high-speed USB device number 24 using dummy_hcd [ 490.051828][ T29] audit: type=1400 audit(1784567927.934:909): avc: denied { unlink } for pid=9911 comm="rm" name="resolv.conf.sl0.link" dev="tmpfs" ino=6780 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 490.187624][ T5732] usb 1-1: Using ep0 maxpacket: 32 [ 490.195348][ T5732] usb 1-1: config 155 has an invalid descriptor of length 0, skipping remainder of the config [ 490.212966][ T5732] usb 1-1: config 155 interface 0 altsetting 0 has an endpoint descriptor with address 0xE2, changing to 0x82 [ 490.268131][ T5732] usb 1-1: config 155 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 490.319854][ T5732] usb 1-1: config 155 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 11 [ 490.392956][ T5732] usb 1-1: New USB device found, idVendor=15c2, idProduct=ffdc, bcdDevice=bd.30 [ 490.413785][ T5732] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 490.453285][ T5732] usb 1-1: Product: syz [ 490.467117][ T29] audit: type=1400 audit(1784567928.482:910): avc: denied { create } for pid=9928 comm="syz.2.1033" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 490.493153][ T5732] usb 1-1: Manufacturer: syz [ 490.503284][ T5732] usb 1-1: SerialNumber: syz [ 490.557020][ C0] imon 1-1:155.0: imon usb_rx_callback_intf0: status(-71) [ 490.575369][ T29] audit: type=1400 audit(1784567928.492:911): avc: denied { bind } for pid=9928 comm="syz.2.1033" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 490.609086][ T5732] input: iMON Panel, Knob and Mouse(15c2:ffdc) as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:155.0/input/input36 [ 490.640231][ T806] usb 4-1: USB disconnect, device number 41 [ 490.819501][ T9914] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 490.879687][ T9914] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 490.986334][ T5732] imon 1-1:155.0: Unknown 0xffdc device, defaulting to VFD and iMON IR [ 491.031082][ T5732] (id 0x00) [ 491.214921][ T29] audit: type=1400 audit(1784567929.230:912): avc: denied { write } for pid=9921 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 491.270442][ T5732] rc_core: IR keymap rc-imon-pad not found [ 491.337142][ T5732] Registered IR keymap rc-empty [ 491.349939][ T5732] imon 1-1:155.0: Looks like you're trying to use an IR protocol this device does not support [ 491.374401][ T5732] imon 1-1:155.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 491.660221][ T5732] rc rc0: iMON Remote (15c2:ffdc) as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:155.0/rc/rc0 [ 491.673137][ T29] audit: type=1400 audit(1784567929.679:913): avc: denied { write } for pid=9941 comm="rm" name="hook-state" dev="tmpfs" ino=1776 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 491.713274][ T5732] input: iMON Remote (15c2:ffdc) as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:155.0/rc/rc0/input37 [ 491.902587][ T5624] Bluetooth: hci5: command 0x1003 tx timeout [ 491.906925][ T5616] Bluetooth: hci5: Opcode 0x1003 failed: -110 [ 491.974501][ T5732] imon 1-1:155.0: iMON device (15c2:ffdc, intf0) on usb<1:24> initialized [ 492.473238][ T29] audit: type=1400 audit(1784567930.496:914): avc: denied { read } for pid=9955 comm="syz.1.1035" name="vhost-net" dev="devtmpfs" ino=1273 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 492.623849][ T29] audit: type=1400 audit(1784567930.526:915): avc: denied { open } for pid=9955 comm="syz.1.1035" path="/dev/vhost-net" dev="devtmpfs" ino=1273 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 493.159688][ T29] audit: type=1400 audit(1784567930.536:916): avc: denied { create } for pid=9955 comm="syz.1.1035" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 493.208291][ T9] usb 1-1: USB disconnect, device number 24 [ 493.352559][ T5725] usb 3-1: new high-speed USB device number 27 using dummy_hcd [ 493.376082][ T9962] fuse: Unknown parameter 'user_id00000000000000000000' [ 493.513469][ T5725] usb 3-1: Using ep0 maxpacket: 8 [ 493.534967][ T5725] usb 3-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 493.552126][ T5725] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 493.749836][ T5725] pvrusb2: Hardware description: Terratec Grabster AV400 [ 493.956945][ T5725] pvrusb2: ********** [ 494.059375][ T9973] vivid-001: disconnect [ 494.338220][ T9972] NILFS (nullb0): couldn't find nilfs on the device [ 494.358227][ T5725] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 494.409056][ T5725] pvrusb2: Important functionality might not be entirely working. [ 494.445960][ T5725] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 494.490065][ T5725] pvrusb2: ********** [ 494.527641][ T2362] pvrusb2: Invalid write control endpoint [ 494.574457][ T9968] vivid-001: reconnect [ 494.899651][ T2362] pvrusb2: Invalid write control endpoint [ 494.915844][ T2362] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 494.927275][ T29] kauditd_printk_skb: 6 callbacks suppressed [ 494.927298][ T29] audit: type=1400 audit(1784567932.947:923): avc: denied { remount } for pid=9979 comm="syz.3.1042" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 494.931746][ T9980] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1042'. [ 494.965685][ T2362] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 494.975287][ T2362] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 495.005295][ T2362] pvrusb2: Device being rendered inoperable [ 495.058172][ T2362] cx25840 1-0044: Unable to detect h/w, assuming cx23887 [ 495.126211][ T2362] cx25840 1-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_a) [ 495.202516][ T2362] pvrusb2: Attached sub-driver cx25840 [ 495.225133][ T2362] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 495.257249][ T2362] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 495.373907][ T5732] usb 3-1: USB disconnect, device number 27 [ 495.622117][ T9994] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1045'. [ 495.647909][ T9971] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 495.691771][ T5725] usb 4-1: new high-speed USB device number 42 using dummy_hcd [ 495.947161][ T5725] usb 4-1: Using ep0 maxpacket: 8 [ 495.976192][ T5725] usb 4-1: config index 0 descriptor too short (expected 301, got 45) [ 495.997273][ T5725] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 496.048061][ T9999] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1041'. [ 496.064403][ T5725] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 496.085037][ T5725] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 496.112091][ T5725] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 496.167577][ T9983] netlink: 40 bytes leftover after parsing attributes in process `syz.4.1041'. [ 496.218512][ T5725] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 496.239565][ T9992] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1043'. [ 496.261878][ T5725] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 496.551121][ T5725] usb 4-1: usb_control_msg returned -32 [ 496.591289][ T5725] usbtmc 4-1:16.0: can't read capabilities [ 496.659047][ T9992] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 497.113540][T10002] usbtmc 4-1:16.0: INDICATOR_PULSE returned 0 [ 497.520126][ T7008] Bluetooth: hci5: Frame reassembly failed (-84) [ 497.877321][ T5725] usb 4-1: USB disconnect, device number 42 [ 498.438597][T10016] ubi: mtd0 is already attached to ubi0 [ 498.451051][ T29] audit: type=1400 audit(1784567936.401:924): avc: denied { setopt } for pid=10013 comm="syz.4.1048" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 499.361880][ T29] audit: type=1400 audit(1784567937.314:925): avc: denied { read } for pid=10021 comm="syz.1.1050" name="binder0" dev="binder" ino=10 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 499.410589][T10025] capability: warning: `syz.4.1051' uses 32-bit capabilities (legacy support in use) [ 499.509752][ T5616] Bluetooth: hci5: Opcode 0x1003 failed: -110 [ 499.589123][ T29] audit: type=1400 audit(1784567937.314:926): avc: denied { open } for pid=10021 comm="syz.1.1050" path="/dev/binderfs/binder0" dev="binder" ino=10 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 499.834805][ T29] audit: type=1400 audit(1784567937.334:927): avc: denied { setopt } for pid=10023 comm="syz.4.1051" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 499.950096][ T29] audit: type=1400 audit(1784567937.334:928): avc: denied { write } for pid=10023 comm="syz.4.1051" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 500.008476][ T29] audit: type=1400 audit(1784567937.394:929): avc: denied { getopt } for pid=10023 comm="syz.4.1051" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 500.522004][T10039] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 500.605294][T10040] vivid-004: disconnect [ 500.811154][T10040] NILFS (nullb0): couldn't find nilfs on the device [ 500.906666][T10039] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 501.145090][T10039] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 501.159815][T10033] vivid-004: reconnect [ 501.199189][T10039] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 501.503384][T10039] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 501.533351][ T1312] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.549136][ T1312] ieee802154 phy1 wpan1: encryption failed: -22 [ 501.626403][ T5616] Bluetooth: hci3: Malformed LE Event: 0x0d [ 501.638444][T10045] random: crng reseeded on system resumption [ 501.994590][T10039] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 502.037229][T10039] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 502.079457][T10039] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 502.117189][T10039] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 502.175354][T10039] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 503.075171][T10057] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 503.141596][T10057] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 503.142942][T10058] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1058'. [ 503.744578][T10058] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1058'. [ 503.990770][T10056] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1059'. [ 504.398204][ T29] audit: type=1400 audit(1784567942.330:930): avc: denied { setopt } for pid=10071 comm="syz.3.1062" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 504.933329][T10077] random: crng reseeded on system resumption [ 504.950460][ T5616] Bluetooth: hci3: Malformed LE Event: 0x0d [ 506.095936][ T145] Bluetooth: hci5: Frame reassembly failed (-84) [ 507.114066][ T5732] usb 2-1: new high-speed USB device number 23 using dummy_hcd [ 507.150539][ T29] audit: type=1400 audit(1784567945.070:931): avc: denied { mount } for pid=10088 comm="syz.2.1067" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 507.265732][ T5732] usb 2-1: Using ep0 maxpacket: 32 [ 507.273500][ T5732] usb 2-1: config 0 has an invalid interface number: 196 but max is 0 [ 507.283858][ T5732] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 507.312527][ T5732] usb 2-1: config 0 has no interface number 0 [ 507.324896][ T5732] usb 2-1: config 0 interface 196 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 507.364972][ T5732] usb 2-1: config 0 interface 196 has no altsetting 0 [ 507.399336][ T5732] usb 2-1: New USB device found, idVendor=05ac, idProduct=7700, bcdDevice=eb.3a [ 507.410671][ T5732] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 507.422034][ T5732] usb 2-1: Product: syz [ 507.438159][ T5732] usb 2-1: Manufacturer: syz [ 507.448297][ T5732] usb 2-1: SerialNumber: syz [ 507.465949][ T5732] usb 2-1: config 0 descriptor?? [ 507.493573][ T5732] ipheth 2-1:0.196: Unable to find endpoints [ 507.617681][ T5803] usb 4-1: new high-speed USB device number 43 using dummy_hcd [ 507.746394][ T5732] usb 2-1: USB disconnect, device number 23 [ 507.769336][ T5803] usb 4-1: device descriptor read/64, error -71 [ 507.889627][ T5616] Bluetooth: hci5: Opcode 0x1003 failed: -110 [ 507.929946][ T5612] usb 3-1: new high-speed USB device number 28 using dummy_hcd [ 508.021205][ T5803] usb 4-1: new high-speed USB device number 44 using dummy_hcd [ 508.091078][ T5612] usb 3-1: Using ep0 maxpacket: 8 [ 508.093229][ T5612] usb 3-1: config 168 descriptor has 1 excess byte, ignoring [ 508.093260][ T5612] usb 3-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 508.093322][ T5612] usb 3-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 508.093349][ T5612] usb 3-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 508.093376][ T5612] usb 3-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 508.093392][ T5612] usb 3-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 508.093418][ T5612] usb 3-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 508.093443][ T5612] usb 3-1: config 168 interface 0 has no altsetting 0 [ 508.094758][ T5612] usb 3-1: config 168 descriptor has 1 excess byte, ignoring [ 508.094779][ T5612] usb 3-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 508.094812][ T5612] usb 3-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 508.094838][ T5612] usb 3-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 508.094863][ T5612] usb 3-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 508.094879][ T5612] usb 3-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 508.094904][ T5612] usb 3-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 508.094929][ T5612] usb 3-1: config 168 interface 0 has no altsetting 0 [ 508.096278][ T5612] usb 3-1: config 168 descriptor has 1 excess byte, ignoring [ 508.096315][ T5612] usb 3-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 508.096346][ T5612] usb 3-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 508.096363][ T5612] usb 3-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 508.096388][ T5612] usb 3-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 508.096413][ T5612] usb 3-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 508.096430][ T5612] usb 3-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 508.096456][ T5612] usb 3-1: config 168 interface 0 has no altsetting 0 [ 508.100443][ T5612] usb 3-1: string descriptor 0 read error: -22 [ 508.100534][ T5612] usb 3-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 508.100548][ T5612] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 508.119691][ T5612] adutux 3-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 508.129121][T10099] netlink: 64 bytes leftover after parsing attributes in process `syz.0.1071'. [ 508.183699][ T5803] usb 4-1: device descriptor read/64, error -71 [ 508.257125][ T29] audit: type=1400 audit(1784567946.172:932): avc: denied { create } for pid=10097 comm="syz.0.1071" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_rdma_socket permissive=1 [ 508.261297][ T29] audit: type=1400 audit(1784567946.172:933): avc: denied { create } for pid=10097 comm="syz.0.1071" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 508.264815][ T29] audit: type=1400 audit(1784567946.182:934): avc: denied { write } for pid=10097 comm="syz.0.1071" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_rdma_socket permissive=1 [ 508.274010][T10100] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1071'. [ 508.292797][ T5803] usb usb4-port1: attempt power cycle [ 509.116948][ T5612] usb 3-1: USB disconnect, device number 28 [ 509.390150][ T5803] usb 4-1: new high-speed USB device number 45 using dummy_hcd [ 509.431068][ T5803] usb 4-1: device descriptor read/8, error -71 [ 509.601827][ T5612] usb 3-1: new high-speed USB device number 29 using dummy_hcd [ 509.693019][ T5803] usb 4-1: new high-speed USB device number 46 using dummy_hcd [ 509.745524][ T5803] usb 4-1: device descriptor read/8, error -71 [ 509.772902][ T5612] usb 3-1: Using ep0 maxpacket: 8 [ 509.794671][ T5612] usb 3-1: config 168 descriptor has 1 excess byte, ignoring [ 509.812476][ T5612] usb 3-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 509.863604][ T5803] usb usb4-port1: unable to enumerate USB device [ 509.870998][ T5612] usb 3-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 509.927898][ T5612] usb 3-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 509.981020][ T5612] usb 3-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 510.029791][ T5612] usb 3-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 510.081521][ T5612] usb 3-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 510.141929][ T5612] usb 3-1: config 168 interface 0 has no altsetting 0 [ 510.177924][ T5612] usb 3-1: config 168 descriptor has 1 excess byte, ignoring [ 510.200895][ T5612] usb 3-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 510.245364][ T5612] usb 3-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 510.292775][ T5612] usb 3-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 510.371142][ T5612] usb 3-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 510.418107][ T5612] usb 3-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 510.534709][ T5616] Bluetooth: hci2: Malformed LE Event: 0x0d [ 510.545228][T10116] random: crng reseeded on system resumption [ 510.908326][ T5612] usb 3-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 616.419693][ C0] rcu: INFO: rcu_preempt detected stalls on CPUs/tasks: [ 616.426694][ C0] rcu: Tasks blocked on level-0 rcu_node (CPUs 0-1): P9974/1:b..l [ 616.435039][ C0] rcu: (detected by 0, t=10502 jiffies, g=52853, q=213 ncpus=2) [ 616.442744][ C0] task:syz.0.1039 state:R running task stack:23408 pid:9974 tgid:9974 ppid:5623 task_flags:0x40064c flags:0x00080001 [ 616.456859][ C0] Call Trace: [ 616.460128][ C0] [ 616.463049][ C0] __schedule+0x125c/0x6730 [ 616.467584][ C0] ? __pfx___schedule+0x10/0x10 [ 616.472436][ C0] ? rcu_is_watching+0x12/0xc0 [ 616.477203][ C0] preempt_schedule_irq+0x50/0x90 [ 616.482228][ C0] irqentry_exit+0x205/0xa00 [ 616.486815][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 616.492788][ C0] RIP: 0010:unwind_next_frame+0x4d2/0x2090 [ 616.498597][ C0] Code: f9 4c 89 c7 e8 6f f3 ff ff 48 89 c1 48 85 c0 0f 84 dc 06 00 00 48 b8 00 00 00 00 00 fc ff df 4c 8d 79 05 4c 89 fa 48 c1 ea 03 <0f> b6 04 02 4c 89 fa 83 e2 07 38 d0 7f 08 84 c0 0f 85 51 15 00 00 [ 616.518194][ C0] RSP: 0000:ffffc90007456f30 EFLAGS: 00000a07 [ 616.524251][ C0] RAX: dffffc0000000000 RBX: 0000000000000001 RCX: ffffffff91d59138 [ 616.532209][ C0] RDX: 1ffffffff23ab227 RSI: 0000000000000000 RDI: ffffffff9146c1dc [ 616.540166][ C0] RBP: ffffc90007456fe8 R08: ffffffff91d59162 R09: 0000000000000007 [ 616.548125][ C0] R10: 0000000000000200 R11: 0000000000019570 R12: ffffc90007456ff0 [ 616.556091][ C0] R13: ffffc90007456fa0 R14: ffffc90007456fd5 R15: ffffffff91d5913d [ 616.564067][ C0] ? dentry_unlink_inode+0x284/0x470 [ 616.569349][ C0] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 616.575514][ C0] arch_stack_walk+0x94/0xf0 [ 616.580118][ C0] ? dentry_unlink_inode+0x284/0x470 [ 616.585403][ C0] stack_trace_save+0x8e/0xc0 [ 616.590068][ C0] ? __pfx_stack_trace_save+0x10/0x10 [ 616.595432][ C0] ? __lock_acquire+0x49f/0x1a40 [ 616.600373][ C0] ? lockdep_hardirqs_on+0x78/0x100 [ 616.605594][ C0] save_stack+0x162/0x1e0 [ 616.609916][ C0] ? __pfx_save_stack+0x10/0x10 [ 616.614762][ C0] ? free_unref_folios+0xa44/0x1710 [ 616.619962][ C0] ? folios_put_refs+0x585/0xaa0 [ 616.624920][ C0] ? shmem_undo_range+0x5e5/0x1570 [ 616.630029][ C0] ? shmem_evict_inode+0x3a5/0xbe0 [ 616.635127][ C0] ? evict+0x3c2/0xad0 [ 616.639223][ C0] ? iput.part.0+0x989/0x1050 [ 616.643895][ C0] ? iput+0x35/0x40 [ 616.647695][ C0] ? dentry_unlink_inode+0x284/0x470 [ 616.652980][ C0] ? page_ext_put+0x3e/0xd0 [ 616.657482][ C0] __reset_page_owner+0x84/0x190 [ 616.662418][ C0] free_unref_folios+0xa44/0x1710 [ 616.667453][ C0] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 616.673265][ C0] folios_put_refs+0x585/0xaa0 [ 616.678034][ C0] ? __pfx_folios_put_refs+0x10/0x10 [ 616.683346][ C0] ? folio_batch_remove_exceptionals+0x115/0x1a0 [ 616.689671][ C0] shmem_undo_range+0x5e5/0x1570 [ 616.694608][ C0] ? __pfx_shmem_undo_range+0x10/0x10 [ 616.700033][ C0] shmem_evict_inode+0x3a5/0xbe0 [ 616.704967][ C0] ? inode_wait_for_writeback+0x171/0x390 [ 616.710697][ C0] ? __pfx_shmem_evict_inode+0x10/0x10 [ 616.716146][ C0] ? __pfx_inode_wait_for_writeback+0x10/0x10 [ 616.722227][ C0] ? find_held_lock+0x2b/0x80 [ 616.726907][ C0] ? evict+0x37e/0xad0 [ 616.730972][ C0] ? evict+0x37e/0xad0 [ 616.735036][ C0] ? __pfx_shmem_evict_inode+0x10/0x10 [ 616.740484][ C0] evict+0x3c2/0xad0 [ 616.744378][ C0] ? __pfx_evict+0x10/0x10 [ 616.748794][ C0] ? iput.part.0+0x981/0x1050 [ 616.753479][ C0] iput.part.0+0x989/0x1050 [ 616.757984][ C0] iput+0x35/0x40 [ 616.761612][ C0] dentry_unlink_inode+0x284/0x470 [ 616.766717][ C0] dentry_kill+0x25d/0xc20 [ 616.771133][ C0] dput.part.0+0xd7/0x240 [ 616.775459][ C0] dput+0x1f/0x30 [ 616.779089][ C0] __fput+0x519/0xb50 [ 616.783067][ C0] ? _raw_spin_unlock_irq+0x23/0x50 [ 616.788267][ C0] task_work_run+0x150/0x240 [ 616.792851][ C0] ? __pfx_task_work_run+0x10/0x10 [ 616.797955][ C0] ? do_raw_spin_unlock+0x145/0x1e0 [ 616.803159][ C0] do_exit+0x951/0x2ae0 [ 616.807329][ C0] ? __pfx_do_exit+0x10/0x10 [ 616.811915][ C0] ? __pfx_proc_coredump_connector+0x10/0x10 [ 616.817908][ C0] do_group_exit+0xd5/0x2a0 [ 616.822416][ C0] get_signal+0x1ec7/0x21e0 [ 616.826950][ C0] ? __pfx_get_signal+0x10/0x10 [ 616.831812][ C0] arch_do_signal_or_restart+0x91/0x7e0 [ 616.837352][ C0] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 616.843512][ C0] irqentry_exit+0x402/0xa00 [ 616.848101][ C0] asm_exc_page_fault+0x26/0x30 [ 616.852947][ C0] RIP: 0033:0x7f6b8ad9dea1 [ 616.857357][ C0] RSP: 002b:fffffffffffffe70 EFLAGS: 00010217 [ 616.863412][ C0] RAX: 0000000000000000 RBX: 00007f6b8b026090 RCX: 00007f6b8ad9de99 [ 616.871369][ C0] RDX: 0000000000000000 RSI: fffffffffffffe70 RDI: 0000000000008000 [ 616.879334][ C0] RBP: 00007f6b8ae33eaf R08: 0000000000000000 R09: 0000000000000000 [ 616.887298][ C0] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 616.895255][ C0] R13: 00007f6b8b026128 R14: 00007f6b8b026090 R15: 00007fffee94d998 [ 616.903229][ C0] [ 616.906246][ C0] rcu: rcu_preempt kthread timer wakeup didn't happen for 10499 jiffies! g52853 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x402 [ 616.918554][ C0] rcu: Possible timer handling issue on cpu=1 timer-softirq=24674 [ 616.926427][ C0] rcu: rcu_preempt kthread starved for 10500 jiffies! g52853 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x402 ->cpu=1 [ 616.937778][ C0] rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior. [ 616.947730][ C0] rcu: RCU grace-period kthread stack dump: [ 616.953600][ C0] task:rcu_preempt state:I stack:28352 pid:16 tgid:16 ppid:2 task_flags:0x208040 flags:0x00080000 [ 616.965521][ C0] Call Trace: [ 616.968819][ C0] [ 616.971740][ C0] __schedule+0x125c/0x6730 [ 616.976262][ C0] ? __pfx___schedule+0x10/0x10 [ 616.981117][ C0] ? find_held_lock+0x2b/0x80 [ 616.985792][ C0] ? schedule+0x225/0x2c0 [ 616.990126][ C0] schedule+0xdd/0x2c0 [ 616.994195][ C0] schedule_timeout+0x127/0x280 [ 616.999040][ C0] ? __pfx_schedule_timeout+0x10/0x10 [ 617.004409][ C0] ? __pfx_process_timeout+0x10/0x10 [ 617.009702][ C0] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 617.015508][ C0] ? prepare_to_swait_event+0xdf/0x4a0 [ 617.020965][ C0] rcu_gp_fqs_loop+0x1a9/0x900 [ 617.025723][ C0] ? __pfx_rcu_gp_fqs_loop+0x10/0x10 [ 617.031002][ C0] ? __pfx_rcu_gp_init+0x10/0x10 [ 617.035939][ C0] ? __pfx_rcu_gp_cleanup+0x10/0x10 [ 617.041126][ C0] ? rcu_is_watching+0x12/0xc0 [ 617.045895][ C0] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 617.051729][ C0] rcu_gp_kthread+0x179/0x230 [ 617.056413][ C0] ? __pfx_rcu_gp_kthread+0x10/0x10 [ 617.061601][ C0] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 617.067409][ C0] ? __kthread_parkme+0x18c/0x230 [ 617.072436][ C0] ? kthread+0x13a/0x450 [ 617.076712][ C0] ? __pfx_rcu_gp_kthread+0x10/0x10 [ 617.081915][ C0] kthread+0x370/0x450 [ 617.085982][ C0] ? __pfx_kthread+0x10/0x10 [ 617.090576][ C0] ret_from_fork+0x72b/0xd50 [ 617.095171][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 617.100281][ C0] ? __switch_to+0x800/0x10f0 [ 617.104951][ C0] ? __pfx_kthread+0x10/0x10 [ 617.109543][ C0] ret_from_fork_asm+0x1a/0x30 [ 617.114321][ C0] [ 617.117328][ C0] rcu: Stack dump where RCU GP kthread last ran: [ 617.123630][ C0] Sending NMI from CPU 0 to CPUs 1: [ 617.128829][ C1] NMI backtrace for cpu 1 [ 617.128846][ C1] CPU: 1 UID: 0 PID: 10118 Comm: syz.3.1076 Tainted: G L syzkaller #0 PREEMPT(full) [ 617.128871][ C1] Tainted: [L]=SOFTLOCKUP [ 617.128877][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/10/2026 [ 617.128888][ C1] RIP: 0010:its_return_thunk+0x0/0x10 [ 617.128911][ C1] Code: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 e9 0b 69 b8 f5 cc [ 617.128927][ C1] RSP: 0018:ffffc90000a08e48 EFLAGS: 00000046 [ 617.128941][ C1] RAX: 0000000080010002 RBX: ffff8880236aa300 RCX: ffffffff81f57312 [ 617.128953][ C1] RDX: ffff888022f40000 RSI: ffffffff81f57320 RDI: ffff888022f40000 [ 617.128965][ C1] RBP: ffff8880b8528640 R08: 0000000000000001 R09: 0000000000000000 [ 617.128975][ C1] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 [ 617.128985][ C1] R13: ffff8880b8528400 R14: 0000000000000000 R15: 0000000000000000 [ 617.128997][ C1] FS: 00007f82a69cf6c0(0000) GS:ffff888123ee6000(0000) knlGS:0000000000000000 [ 617.129014][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 617.129026][ C1] CR2: 00007f82a69ceff8 CR3: 000000002a652000 CR4: 00000000003526f0 [ 617.129037][ C1] Call Trace: [ 617.129043][ C1] [ 617.129049][ C1] __remove_hrtimer+0x130/0x440 [ 617.129093][ C1] __hrtimer_run_queues+0x352/0x9c0 [ 617.129122][ C1] hrtimer_interrupt+0x3e5/0x940 [ 617.129154][ C1] __sysvec_apic_timer_interrupt+0x109/0x470 [ 617.129180][ C1] sysvec_apic_timer_interrupt+0x9e/0xc0 [ 617.129207][ C1] [ 617.129212][ C1] [ 617.129218][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 617.129238][ C1] RIP: 0010:_raw_spin_unlock_irqrestore+0x31/0x80 [ 617.129264][ C1] Code: f5 53 48 8b 74 24 10 48 89 fb 48 83 c7 18 e8 56 a0 28 f6 48 89 df e8 de ef 28 f6 f7 c5 00 02 00 00 75 23 9c 58 f6 c4 02 75 37 01 00 00 00 e8 a5 ff 17 f6 65 8b 05 ee c8 a6 08 85 c0 74 16 5b [ 617.129281][ C1] RSP: 0018:ffffc90005357b28 EFLAGS: 00000246 [ 617.129294][ C1] RAX: 0000000000000006 RBX: ffffffff9b7353d8 RCX: 0000000000000000 [ 617.129305][ C1] RDX: 0000000000000000 RSI: ffffffff8e1a4784 RDI: ffffffff8c401380 [ 617.129317][ C1] RBP: 0000000000000286 R08: 0000000000000001 R09: 0000000000000000 [ 617.129327][ C1] R10: 0000000000000001 R11: ffffffffffffffff R12: ffffffff9b735140 [ 617.129339][ C1] R13: 0000000000000002 R14: ffffc90005357c80 R15: ffffffff9b73531c [ 617.129358][ C1] __do_adjtimex+0x892/0xe70 [ 617.129380][ C1] ? __pfx___do_adjtimex+0x10/0x10 [ 617.129403][ C1] ? __lock_acquire+0x49f/0x1a40 [ 617.129429][ C1] do_adjtimex+0xa0/0x370 [ 617.129451][ C1] ? __pfx_do_adjtimex+0x10/0x10 [ 617.129481][ C1] ? __pfx_posix_clock_realtime_adj+0x10/0x10 [ 617.129504][ C1] __do_sys_clock_adjtime+0x177/0x290 [ 617.129528][ C1] ? __pfx___do_sys_clock_adjtime+0x10/0x10 [ 617.129562][ C1] ? kcov_ioctl+0x17a/0x750 [ 617.129584][ C1] do_syscall_64+0x115/0x870 [ 617.129599][ C1] ? clear_bhb_loop+0x40/0x90 [ 617.129619][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 617.129636][ C1] RIP: 0033:0x7f82a5b9de99 [ 617.129651][ C1] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 617.129668][ C1] RSP: 002b:00007f82a69cf028 EFLAGS: 00000246 ORIG_RAX: 0000000000000131 [ 617.129683][ C1] RAX: ffffffffffffffda RBX: 00007f82a5e25fa0 RCX: 00007f82a5b9de99 [ 617.129695][ C1] RDX: 0000000000000000 RSI: 0000200000000340 RDI: 0000000000000000 [ 617.129706][ C1] RBP: 00007f82a5c33eaf R08: 0000000000000000 R09: 0000000000000000 [ 617.129717][ C1] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 617.129727][ C1] R13: 00007f82a5e26038 R14: 00007f82a5e25fa0 R15: 00007ffe8da00ee8 [ 617.129747][ C1]