last executing test programs: 59.329231053s ago: executing program 0 (id=130): r0 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x3}, 0x0, 0x0, 0xffffffffffffffff) mmap(0x0, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000240)={'sit0\x00', &(0x7f0000000640)={'syztnl0\x00', 0x0, 0x0, 0x8, 0x100, 0xa, {{0x17, 0x4, 0x0, 0x0, 0x5c, 0xfffe, 0x0, 0x0, 0x0, 0x0, @broadcast, @empty, {[@lsrr={0x83, 0x7, 0x5b, [@remote]}, @lsrr={0x83, 0x1b, 0x84, [@dev={0xac, 0x14, 0x14, 0x18}, @multicast1, @initdev={0xac, 0x1e, 0x1, 0x0}, @empty, @rand_addr=0x64010101, @local]}, @lsrr={0x83, 0x1f, 0xff, [@empty, @multicast2, @initdev={0xac, 0x1e, 0x1, 0x0}, @rand_addr=0x64010101, @private=0xa010100, @private=0xa010101, @rand_addr=0x64010100]}, @rr={0x7, 0x7, 0x89, [@empty]}]}}}}}) r3 = openat$md(0xffffffffffffff9c, &(0x7f00000005c0)={'/dev/md', @num=0x0}, 0x2, 0x0) fcntl$addseals(r3, 0x409, 0x2) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f5, &(0x7f00000002c0)={'syztnl0\x00', &(0x7f0000000300)={'erspan0\x00', r2, 0x0, 0x0, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14, 0xd}, @multicast2}}}}) mkdirat(0xffffffffffffffff, &(0x7f0000000400)='./tracing/per_cpu/cpu0/trace_pipe_raw\x00', 0x1ff) mount(0x0, &(0x7f0000000480)='./tracing\x00', &(0x7f00000004c0)='tracefs\x00', 0x0, 0x0) socket$igmp6(0xa, 0x3, 0x2) r4 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./tracing/per_cpu/cpu0/trace_pipe_raw\x00', 0x0, 0x22) ioctl$OCFS2_IOC_GROUP_EXTEND(r4, 0x5220, 0x0) syz_clone(0xb88280, 0x0, 0x0, 0x0, 0x0, 0x0) r5 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r5, 0x89f5, &(0x7f0000000340)={'syztnl0\x00', 0x0}) r6 = socket$inet_udp(0x2, 0x2, 0x0) r7 = syz_open_dev$tty1(0xc, 0x4, 0x1) r8 = dup(r7) ioctl$TIOCL_SETSEL(r8, 0x4bfa, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r6, 0x89f4, &(0x7f0000000380)={'syztnl0\x00', 0x0}) keyctl$search(0xa, r0, &(0x7f0000000100)='syzkaller\x00', &(0x7f0000000200)={'syz', 0x1}, r0) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r0, &(0x7f0000000080)='cifs.idmap\x00', &(0x7f00000000c0)=@secondary) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./sys\x00', &(0x7f00000001c0)='sysfs\x00', 0x800040, 0x0) r9 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./sys/devices/system/cpu/smt/control\x00', 0x80001, 0x0) r10 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./sys/devices/system/memory/memory35/state\x00', 0x2, 0x28) write(r10, &(0x7f0000000580)='offline', 0x7) write(r9, &(0x7f0000000440)='on', 0x2) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000880)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_SET_ACKREQ_DEFAULT(0xffffffffffffffff, &(0x7f0000000980)={&(0x7f0000000600)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000940)={&(0x7f00000008c0)=ANY=[@ANYBLOB='d\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="000428bd7000ffdbdf251300000005001a000000000c08000600", @ANYRES32=0x0, @ANYBLOB="08000300", @ANYRES32=0x0, @ANYBLOB="08000300", @ANYRES32=0x0, @ANYBLOB="05001a000100000008000300", @ANYRES32=r11, @ANYBLOB="0c000600010000000100000005001a00000000000c0006000300000003000000"], 0x64}, 0x1, 0x0, 0x0, 0xc88bfebc5e5ff6b9}, 0x1) 58.944367702s ago: executing program 0 (id=132): openat$udambuf(0xffffffffffffff9c, &(0x7f0000000200), 0x2) 58.894131017s ago: executing program 0 (id=133): r0 = openat(0xffffffffffffff9c, &(0x7f0000000940)='./sys/bus/serio/devices/serio0/drvctl\x00', 0x1, 0x0) write(r0, &(0x7f0000000980)='re', 0x2) 58.893629977s ago: executing program 0 (id=134): ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2) r0 = openat(0xffffffffffffff9c, &(0x7f0000000680)='./file0\x00', 0x42, 0x1ff) mmap(&(0x7f0000800000/0x1000)=nil, 0x1000, 0x100000d, 0x12, r0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000006c0)='./tracing\x00', 0x1ff) read$FUSE(r0, 0x0, 0x0) write$FUSE_INTERRUPT(r0, &(0x7f0000000040)={0xfffffffffffffeed}, 0x10) mount(0x0, &(0x7f0000000700)='./tracing\x00', &(0x7f0000000740)='tracefs\x00', 0x0, 0x0) msync(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0xf5e8d0b131c6a560) r1 = openat(0xffffffffffffff9c, 0x0, 0x401, 0x0) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f0000004a80)={@mcast2, 0x57}) write(r1, &(0x7f00000007c0)='p:s/p ./file0:0', 0xf) r2 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./tracing/events/s/p/enable\x00', 0x1, 0x0) write(r2, &(0x7f0000000840)='1', 0x1) 58.893345437s ago: executing program 0 (id=136): madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x66) r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = getpid() sched_setscheduler(r1, 0x1, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000b40)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000b80)='./sys\x00', &(0x7f0000000bc0)='sysfs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000c00)='./sys/bus/acpi/devices/PNP0C0F:00/status\x00', 0x0, 0x0) read(r2, &(0x7f0000000c40)=""/10, 0x5b) getsockopt$inet_buf(r0, 0x0, 0x29, &(0x7f0000000180)=""/135, &(0x7f0000000240)=0x87) r3 = syz_usb_connect$hid(0x0, 0x0, 0xfffffffffffffffe, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000040)={0x2, &(0x7f0000000300)=[{}, {0x6, 0x0, 0x0, 0x7fff0000}]}) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000340), r4) sendmsg$ETHTOOL_MSG_EEE_GET(r4, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000400)={0x2c, r5, 0x1, 0x70bd27, 0x25dfdbfc, {}, [@HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_vlan\x00'}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x80880}, 0x0) r6 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r6) mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0x100000a, 0x4082172, 0xffffffffffffffff, 0x0) setresuid(0x0, 0xee01, 0x0) mremap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1000, 0x0, &(0x7f0000006000/0x1000)=nil) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000580)) ptrace$getregset(0x4204, r6, 0x202, &(0x7f0000000500)={0x0}) ptrace$getenv(0x4201, r6, 0xff, &(0x7f0000000540)) syz_open_dev$evdev(&(0x7f00000004c0), 0x6, 0x4100) prctl$PR_SET_SECCOMP(0x16, 0x1, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$netlink(r7, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000600)=[{&(0x7f0000000640)={0x30, 0x10, 0x1, 0x70bd2b, 0x25dfdbfb, "", [@nested={0x4, 0x4f}, @nested={0x4, 0x71}, @nested={0x18, 0xbc, 0x0, 0x1, [@nested={0x4, 0xc3}, @nested={0x8, 0x13, 0x0, 0x1, [@generic="3a48ad04"]}, @typed={0x8, 0x1c, 0x0, 0x0, @pid}]}]}, 0x30}], 0x1, 0x0, 0x0, 0x8000}, 0x8880) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000480)={0x6, &(0x7f0000000440)=[{0xa2, 0x36, 0x7f, 0x10000000}, {0x90b0, 0x5, 0xc8, 0xad7}, {0xfffe, 0x1, 0xfa, 0x9}, {0xc914, 0x4, 0x7, 0x7}, {0x1, 0x80, 0xd}, {0x5, 0x2, 0x5, 0xd07}]}) syz_usb_control_io$hid(r3, 0x0, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x172000, 0x0) 58.322344655s ago: executing program 0 (id=150): r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20, 0x1, @empty, 0x4000ca}, 0x1c) recvmmsg(r0, &(0x7f0000000080)=[{{0x0, 0x0, 0x0}, 0x5}], 0x1, 0x40000020, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x4098884, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c) sendto$inet6(r1, &(0x7f0000000100), 0x3000, 0x0, 0x0, 0x0) r2 = socket(0x1000000000000010, 0x80802, 0x0) sendmsg(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000140)="5500000018007fd500fe01b2a4a280930a06000000c7315c1f9dd6cb0400080008000c00080000002d000f009b2c136ef75afb83de448daa72540d8102d2c55327c43ab82286ef1fdd0e642383656d4d2449155037", 0x55}, {&(0x7f0000000040)="6ab13922c09d927d661b2639c81bfd8c0dc1bc236864cddc16261916", 0x1c}], 0x2}, 0x20004000) 43.006117431s ago: executing program 32 (id=150): r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20, 0x1, @empty, 0x4000ca}, 0x1c) recvmmsg(r0, &(0x7f0000000080)=[{{0x0, 0x0, 0x0}, 0x5}], 0x1, 0x40000020, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x4098884, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c) sendto$inet6(r1, &(0x7f0000000100), 0x3000, 0x0, 0x0, 0x0) r2 = socket(0x1000000000000010, 0x80802, 0x0) sendmsg(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000140)="5500000018007fd500fe01b2a4a280930a06000000c7315c1f9dd6cb0400080008000c00080000002d000f009b2c136ef75afb83de448daa72540d8102d2c55327c43ab82286ef1fdd0e642383656d4d2449155037", 0x55}, {&(0x7f0000000040)="6ab13922c09d927d661b2639c81bfd8c0dc1bc236864cddc16261916", 0x1c}], 0x2}, 0x20004000) 10.242016287s ago: executing program 4 (id=503): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = dup3(r0, r0, 0x0) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), r1) sendmsg$ETHTOOL_MSG_STRSET_GET(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x6c, r2, 0x400, 0x70bd2b, 0x25dfdbfc, {}, [@ETHTOOL_A_STRSET_STRINGSETS={0x50, 0x2, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x39}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x2}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x7}, @ETHTOOL_A_STRINGSET_ID={0x8}]}, {0x1c, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x1}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x2}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x5}]}, {0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x4}]}]}, @ETHTOOL_A_STRSET_STRINGSETS={0x8}]}, 0x6c}, 0x1, 0x0, 0x0, 0x141}, 0x80c0) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000100), r0) sendmsg$TIPC_CMD_SET_NODE_ADDR(r1, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000200)={&(0x7f0000000140)={0x24, r3, 0x20, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x8, 0x11, 0x38}}, ["", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x40000}, 0x40) syz_usb_connect(0x3, 0x38, &(0x7f0000000780)={{0x12, 0x1, 0x110, 0x91, 0x8, 0x31, 0x20, 0x5ac, 0x1402, 0xe9d2, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x26, 0x2, 0x6, 0xa4, 0x20, 0x1, "", [{{0x9, 0x4, 0xfb, 0x3, 0x1, 0x23, 0x58, 0xd7, 0x4, [@generic={0x2, 0x3b}], [{{0x9, 0x5, 0x9, 0x10, 0x10, 0x3, 0x7, 0x8}}]}}, {{0x9, 0x4, 0x9, 0x8, 0x0, 0x52, 0xef, 0x77, 0x40}}]}}]}}, 0x0) 7.166796347s ago: executing program 4 (id=520): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuset.effective_cpus\x00', 0x275a, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000080)=0x10) r1 = epoll_create(0x5) r2 = timerfd_create(0x0, 0x80800) epoll_ctl$EPOLL_CTL_ADD(r1, 0x300, r2, &(0x7f0000000100)={0x32000000}) ioctl$EXT4_IOC_MOVE_EXT(r0, 0x40305829, &(0x7f00000000c0)={0x0, 0xffffffffffffffff, 0x0, 0x4}) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dev/sda\x00', 0x101042, 0x5) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r3, 0x2202, 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$TIOCL_UNBLANKSCREEN(r0, 0x541c, &(0x7f0000000340)) ioctl(r4, 0x6, &(0x7f0000000000)="fed8971c6d4cbfe0f2bd7a3944235ed96c38e809b7ec81fb384a06e007f3f532466234f0af09c712b3f96c4b61bbad1d136d0a68e3") ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f00000002c0)={'syztnl2\x00', &(0x7f0000000240)={'tunl0\x00', 0x0, 0x20, 0x20, 0x1, 0xfffff801, {{0xf, 0x4, 0x3, 0x3a, 0x3c, 0x67, 0x0, 0x0, 0x4, 0x0, @local, @local, {[@noop, @rr={0x7, 0x27, 0x78, [@local, @initdev={0xac, 0x1e, 0x0, 0x0}, @initdev={0xac, 0x1e, 0x0, 0x0}, @initdev={0xac, 0x1e, 0x1, 0x0}, @rand_addr=0x64010101, @multicast2, @broadcast, @empty, @empty]}]}}}}}) setsockopt$MRT_DEL_VIF(r3, 0x0, 0xcb, &(0x7f0000000300)={0x0, 0x4, 0xfa, 0xfffffffc, @vifc_lcl_ifindex=r5, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10) 7.131035331s ago: executing program 4 (id=521): sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000440)=ANY=[@ANYRES16, @ANYBLOB="01000000000000000000030000005800018044000400200001000a00000000005b582d"], 0x6c}, 0x1, 0x0, 0x0, 0x1}, 0x4000) (async) r0 = socket(0x18, 0x2, 0x800000a) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000000)={0x9, 0xffffffff, 0x4e, 0x567}, 0x13) (async) sendmsg$nl_generic(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB="180000001600010000000000080000000a000a00"], 0x18}}, 0x0) (async) socket$netlink(0x10, 0x3, 0x1c) (async) socket$netlink(0x10, 0x3, 0x4) socket(0x10, 0x3, 0x0) (async) r1 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0xc, &(0x7f00000000c0)={0x2ffc, 0x4000006, 0xfffffefc, 0x6}, 0x10) (async) sendmsg$nl_generic(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000160001f47efde4be701161000a000000040000800400", @ANYRES32=r1], 0x1c}}, 0x804) sendmsg$netlink(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000440)=ANY=[], 0xa4}], 0x1, 0x0, 0x0, 0x4000001}, 0x0) (async) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000300), 0x408000, 0x0) ioctl$PPPIOCSMRU1(r2, 0x40047452, &(0x7f0000000340)=0x2) 7.073728146s ago: executing program 4 (id=523): r0 = syz_usb_connect(0x5, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000772904202404019957c2010203010902240001000010000904430002317d5500090502020002020000090582020002"], 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f00000000c0)={0x1c, &(0x7f0000000100)={0x0, 0x16, 0x4, "f655f94c"}, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000140)={0x2c, &(0x7f0000000180)={0x0, 0xb, 0x4, "0e477e6d"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f00000001c0)={0x2c, &(0x7f0000000200)={0x20, 0x7, 0x4, "60aadbbb"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000280)={0x44, &(0x7f0000000300)={0x40, 0x0, 0x4, "82116383"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 4.702223576s ago: executing program 1 (id=546): ioctl$KVM_X86_SET_MSR_FILTER(0xffffffffffffffff, 0x4188aec6, &(0x7f0000000080)={0x0, [{0x0, 0x4d88, 0x6, &(0x7f0000000880)="7a650e526bd0998268bb5847d9beacc47a22df873eab4b8b91133675482eaa56ace8db59bed9aa07d4e390c7c9f98c462b55612196911e3c4e510ede3efde35eec990f22a76cf752e507c1e2de2920a9fc0790cc176bd2b901e4127b09835ae6d0d196048bb19a64d26f20a05b95c69f371882ef2e20c5606ed1b2ebcf09a4a333f6e1c3c4fb64d8182df4ab09d0a381d966977fc041cea9bdf0aa31fe51efe9211b9b8e6e4551b6438f8efcc41265574ff6504435eb22a678a99768f0327ded8fdcb41f27c2024d2b923f7dc5df5bf62af447b121dd9f94d766d6cebdeb02f611ab10e57af4b3268fb3f9777373bd5fd6b82f730e67c4eab113d8e65d7405be3e5d92dc5e7e85d34bb8b7c894cbed629ecc25c288b3d4556a85a1e2150cac5b686a8de29ab7c35040b77875bfa0e451dc0869cfe105bd115e7cf48f44dfdf26be65f3b727fd88d6395d051e49c060998e84b19377fcb20fe2eb392335e5a9d84555ef037aab37169ce761aa8a8ec08ea87e3a3b896f3d1b2380bc8256e0f7ea7dc488382e6112b53a7bb269d6261f87e0e0e0cef9152f8a67f412148f34880c970101fbd7b0e8fc49d6a5c87e487b7b175b15be26b6b8e1ed8527614dcefcfd80f8392560c8b706418b7de8fbb7a666a7e7f322dc70373606bf39efa04616cb99d662dfc591061bde5ed27a66aa7edbfec1eb0b1e843c372b84c3ed514a0aadf523b8669e526765d429824aeaa0a6f4c185754d437d977a1f586431dc256ce5aa7c25be259de3a0ae6e5bcdf56b4c7e8199fe6b461e78467cfac19de6956056ef57e93d3a7df8f646f4a9002b100edb0a6caa72b3f6eb29dc54de58120d27daff9cd61c64107e1bcb3b3212e1e2aa24fb24dc2dafc636c82ad25da9d934e46c7783d8f915337612feb348857ce2262240dfe51ec94d9d61074959f167b9840b20f003883bf167149228d7f03eafde851427cd1966a96aeae05b51ae4cd82f4b4dad60a070c01a8b500e2683f7136e331602e76845262825d7f3764cf1a05ad95d88aab71d41484f63fa6a43c044c7f03130552321933bc40b888fd0cc55939ff79a5059516f3b80c7ba8188ffb6a259a34567ee52c1f9df0f6c91737d688e36d076a49d1045cac30d5ed52a10381c96d9f22e469cc531bb06853d18b8f8625d2a917e795ffa4407fa75713510a3f5370e1ecbf7a5ff68a90a1eda077531cf4d399d4908f138c936e1931c72240070c6a6255f5fd03966e9a06c1d481e8e3d128e880776e572177780a3481c49bd86c174e152bafed245d58ef3428c645b08e48833960d1b5223d7be0c67a2b2c7531390d1837a84ed004a00cb4b0cd6e78824da032b48c49ec006d14206dc3d0c67d7ca87e9ea0faddc3e0b0c917c64eefeebf79e3a16c958db63a08a5d4d7210273aba3e56a4cd4cccb044750ff97749505ff1332b2dd30990849ab1500e1947d0abfb0c59760f0a502806ee1bce56fbb42251dd6ac8b709c73a6b8c548c2b23cf351dc498810e477bd082464e76702703b56d3cd2f3d8a2e00f19d8ffa3c236d3601f169c9dfe9c316f8cbe63c3801a51ea5ac785694a0c653cd28d68c5a81c2590d2aeea8c8688b2e88f46c4f99890e51b42cce485fcb4d91557fb3912b36b0dbeac8df44e945eb9937141402fb2aa1476185e1f8c37f6c98bc937f36d9c7237135132a54a03067b002b9c657ab0daa253af66eee78b0309cb8532dd2dee800c8349b731da0efa66ead82eebe0102279df5aa281fe1d86c0dbf154910d5e8a113ecbddbd046367b9e2acfa7cc406f61b472bbec6919534615ed81b664da956ce6586bf4c92d63ef371dfec5f9ce748931d585cadc9372a95a1372c7213e2c52fca253945afeee02e9f2de2d9452c85fd2dbdc87cb6c25697dfcbed8a0eba381835e6c360f3861367ec98a9a9ccf956d6cbfb706fee0d391cf82a0d4662792274f52fc2b5d72a43ec74a86400e62d3652f607774cfad1504bc0476570d532b527bf0d7012804b2e6fdf9a9414f10b16c9374f2b065348d865b309e37750d3a7e12394e356c48c9fa0d4a9a43f689f6cbf70b09a3b9782cc3d5d93480f8a7a21a049780fc6bf21f1eca938a37afcbb2b929a0c502e164d2571e78d214b359d97e3edc0ad5c7fd1625b4ece33e1f569676e9a7262ead857873f77ef149d2f8c5a09ab19ae384a7f957f612a24283c35327aa969b20711309644c5b3e6c89da94e1f5da54246bd771468a1adc8a8d601e0b12769604f0f07ca43ce2a8a2f4b5654c0b76b146c49038e07db54dae702580b97096911f034fc1797029de8b7c213c902d1d754e77ff85e6222e745db9d5d2d45c5d29a8b6de0f27e5701fdf12b09fd6c70baa0f85a424c21ce0796dbe1fd366b94fcdf64ea232b3e88b89a38d728de77e84decc804f07a48f2716ca6f76b24923cea1a4da0d1f1dc73611269e784c4fd921f9b26c11f35b5cda45842a81b603ce2155d95c273fa0743a571b52e68c9ea3f28009fc37406b9e329ce50fedfb20dfb4cdf3a94769aee2586c2a17e68a07abfcd18aceddfd3876b14558e4d092eadb9120796c44e89610494085117bc41b5c4619a8c160b97811df49fc7d9bf222d7a002640644337ef5af53ed50661131f7c042665b276c0adf0c9a74f3542729beb7632a6027e65eddff7bb27915826701ec9b6a4c672f08877eefd859e0aa6e75a2e841e1ea98dff994e5a58be628df86bff17497a4d0f92ab39db421eb1062a2a393656bbb1d92becbb91a59619156b51585cd2eafd8a18d6326166312efeaa7258bddad63e0c7372ffb7ce1f1adf1ac2ffa0f278e4be6684d762f8971ed7bb04096b96f8126bf5fd32142e745d421f495327dde0f1e2d9a1d8ba63c1453101396a2e54e89cdabac2c6a01f23a5c1d5a2dfa2a3c634176e97c9c62b41ea28102b5a08af2fba1d311bb323df086ea97726c9d8c7b7b53a3399a80f040d434fdcc2148fb1da3b7d7f0f3e3fd56471a310ee275da611c79f86be8ed6343f6ed0ad91dfeffebc3ab6389d0566d6db904c1db499ae7d2698fdc7170320f85cc3d3d0d9d0d0c7d45db7b53c5eb79a2fed2a048d9d74419532122fac62f6315a9e13b461cb4e26514491debd366927987271be963ea5805a49b8b480c6a393fda1b11fd5634890cf02948cb5bfea237afb30d081c7403cd334a02e5bb8db542c4d5fa5ec5c8a0dd36b62156881c98e01948b4775a502c5d8453439fd930df52caac9d71c28b712000b306b913c10918ca0bc194f2533334462e5cd2b2e6c978a4838febfbc2d4375b8108bd0aa32aeaf05e7ba30c781cace6470ead574f5cbfa68aa8c8d835e9b3ab2bd7dd90b5e3e6cd62d8e04c3b45326e1f560a8dd8f3db4177e9e5ccd61f21dacb5c40c8030559cdfe88f7aa98bdcde90c1214cf293b3df093d0630bc3073cbaffa025b1f5537b49d799731745de7d36cded4a9db25915a511ba505b4ddd885cd226c24ea37fd926dbd90b887"}, {0x0, 0x0, 0x1ff, 0x0}, {0x3, 0x0, 0x100f5b6, 0x0}, {0x2, 0xffffffffffffff46, 0x31b7, 0x0}, {0x0, 0x0, 0x9, 0x0}, {0x1, 0x0, 0x3, 0x0}, {0x2, 0x0, 0x1ff, 0x0}, {0x0, 0x0, 0xe0, 0x0}, {0x1, 0x0, 0xf3f, 0x0}, {0x0, 0x0, 0x1000, 0x0}, {0x3, 0x0, 0x6, 0x0}, {0x3, 0x0, 0x1000, 0x0}, {0x0, 0x0, 0x9, 0x0}, {0x0, 0x0, 0x1545, 0x0}, {0x2, 0x0, 0x9, 0x0}, {0x2, 0x0, 0x86a, 0x0}]}) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000001280)={0x0, 0x0, 0xfffff000, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f00000012c0)={0x4, 0x1, 0x0, 0x2000, &(0x7f0000002000/0x2000)=nil}) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) 4.56708753s ago: executing program 1 (id=547): r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = socket$vsock_stream(0x28, 0x1, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f00000003c0), r2) prlimit64(0x0, 0xe, &(0x7f0000000400)={0x8, 0x80000000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000440)=0x7) r4 = getpid() sched_setscheduler(r4, 0x2, &(0x7f0000000480)=0x6) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r5 = syz_open_dev$MSR(&(0x7f00000004c0), 0x0, 0x0) read$msr(r5, &(0x7f0000000500)=""/102392, 0x18ff8) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000019500)={0x0, 0x0, &(0x7f0000019540)={&(0x7f00000198c0)=ANY=[@ANYBLOB="f000000010000100feffffff00010000fe880000000000000000000000000001fc0100000000000000000000000000004e2407144e070005000020003a58eb64ece7336c8b0000004b868ccdbeb4b2e2a9b07bf089cf609c8954ec7dae92b52edfc2b6fc043ee3fb7dc70e8423e20b8019272d8cc692d069e605127dbba9df2df6f4", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="e0000002000000000000000000000000000004d46c00000000000000000000000000000000000001000000000000000092010000000000000600000000000000ffff0000000000001c250800000000000200000000000000f8ffffffffffffff0000000000000000ffffffffffffffff000000000000000026ae000000000000000000000000000002000000fcffffff000000002abd700005350000020001002000000000000000"], 0xf0}, 0x1, 0x0, 0x0, 0x8801}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000019680)={0x0, 0x0, &(0x7f00000196c0)={&(0x7f0000019700)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01040000000000000000010000030900010073797a30000000002c000000030a01010000000000000000010000000900010073797a30000000000900030073797a320000000090000000060a010400000000000000000100000308000b4000003ce013ad000068000480340001800b000100657874686472000024000280080001400000000b080003400000004d0500020007000000080004400000002f3000018008000100636d7000240002801000038009000100910d000000000000080001400000000208000240000000000900010073797a3000000000"], 0x104}, 0x1, 0x0, 0x0, 0x180}, 0x0) sendmsg$ETHTOOL_MSG_PAUSE_SET(r2, &(0x7f0000019800)={0x0, 0x0, &(0x7f0000019840)={&(0x7f0000019880)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="01fffc00000000000000200100000c000280080002006c6f000018000380040001000800020005000000080004"], 0x38}}, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x1000008, 0x20812, r1, 0x830c5000) prctl$PR_SET_SECUREBITS(0x1c, 0x2c) setuid(0xee00) syz_clone(0x800000, 0x0, 0x0, 0x0, 0x0, 0x0) r6 = syz_open_procfs(0x0, &(0x7f0000000080)='task\x00') fchdir(r6) mount(0x0, &(0x7f0000000200)='.\x00', &(0x7f0000000240)='proc\x00', 0x80, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f00000199c0), 0x0, 0x0) getsockopt$inet_IP_XFRM_POLICY(r5, 0x0, 0x11, &(0x7f0000019b00)={{{@in6=@private1, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}, 0x0, @in6=@private1}}, &(0x7f0000019c00)=0xe8) setsockopt$inet_IP_IPSEC_POLICY(r6, 0x0, 0x10, &(0x7f0000019c40)={{{@in6=@rand_addr=' \x01\x00', @in6=@remote, 0x4e24, 0x9, 0x4e20, 0x0, 0x2, 0x80, 0x60, 0x2f, 0x0, r7}, {0xffffffff7fffffff, 0x5, 0x2, 0xda, 0x2, 0x80000000, 0xeb, 0x1}, {0x3, 0xc, 0x2, 0x80000001}, 0x1, 0x6e6bc0, 0x2, 0x1, 0x2, 0x3}, {{@in6=@loopback, 0x4d3, 0x32}, 0xa, @in=@rand_addr=0x64010100, 0x3506, 0x0, 0x2, 0x5, 0x5, 0x3, 0x80}}, 0xe8) readlinkat(0xffffffffffffffff, &(0x7f00000002c0)='./mnt\x00', &(0x7f0000000300)=""/163, 0xa3) write$UHID_CREATE(r0, &(0x7f00000000c0)={0x0, {'syz0\x00', 'syz1\x00', 'syz0\x00', 0x0, 0x0, 0xdde, 0xffffffff, 0x4, 0x3, 0x10000000}}, 0x120) 4.566805679s ago: executing program 1 (id=548): r0 = socket$inet6(0xa, 0x3, 0x7) sendmmsg$inet6(r0, &(0x7f0000000440)=[{{&(0x7f0000000480)={0xa, 0x0, 0x0, @mcast2}, 0x1c, 0x0, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB='$\x00\x00\x00\x00\x00\x00\v)\x00\x00\x002'], 0x28}}], 0x1, 0x0) 4.534896102s ago: executing program 1 (id=549): r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000000080)={@my=0x1}) r1 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r1, &(0x7f00000000c0)={0x28, 0x0, 0x0, @my=0x1}, 0x10) r2 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r2, &(0x7f0000000100)={0x28, 0x0, 0xffffffff, @my=0x1}, 0x10) syz_usb_connect(0x3, 0x24, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0x50123f, 0x0) 4.086348668s ago: executing program 4 (id=554): symlinkat(&(0x7f0000000080)='.\x00', 0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00') r0 = socket$packet(0x11, 0xa, 0x300) setsockopt$sock_int(r0, 0x1, 0x28, &(0x7f0000000000)=0x1, 0x4) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setns(0xc9, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./sys\x00', &(0x7f00000001c0)='sysfs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./sys/class/net/eth0/dev_port\x00', 0x0, 0x0) read(r2, &(0x7f0000000780)=""/64, 0x40) bind$inet(r1, &(0x7f0000000040)={0x2, 0x4e21, @broadcast}, 0x2f) r3 = syz_usb_connect$midi(0x3, 0x24, &(0x7f00000007c0)={{0x12, 0x1, 0x250, 0x0, 0x0, 0x0, 0x20, 0xccd, 0xb1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x1, 0xa7, 0x0, 0x1, "", {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x3, 0x0, 0x3}}}}}]}}, &(0x7f0000000800)={0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r3, &(0x7f0000000840)={0x14, 0x0, &(0x7f0000000880)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x1001}}}, 0x0) syz_usb_control_io(r3, &(0x7f00000008c0)={0x2c, 0x0, &(0x7f0000000900)=ANY=[@ANYBLOB="f102020000000203"], 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r3, 0x0, 0x0) r4 = socket$igmp6(0xa, 0x3, 0x2) sendto$inet6(r4, &(0x7f0000000240)="06e19545a06ba010de5d52e5bd56a572472f73278cd33ae5728a5bc6bb6436bec57e8092bdb4c9962c803490683d06d8d5172c5457951eb673105781ed7592bae179320c6da17e746983eec25115aea52da15330f22ae8cf70de1aef9ea7fe4362306196943be5998b65ffcab813cf1a7641a2b66142df5b8e22d0faa4507aff82af8c3a02a2927e68f2fd5795ef35d43db6a52d3ac73ed3a8ff2127f10b45d8ee9b29286644888578e33cc1691ae6655bb230", 0xb3, 0x8024, &(0x7f00000005c0)={0xa, 0x4e21, 0x4, @mcast1, 0x8}, 0x1c) pwritev(r0, &(0x7f00000006c0)=[{&(0x7f0000000340)="53c6a0d7e7e51080d2a9e8b1fa66d880c7959f1f0534f96e6d5792ccc6480b99296b9aff38a5ce31a544a82e25f919b1356ab2b4448f28cd5167db4e33821ec059196652686aa15a7a147771b5414a383d82412828f447576bd5e9b18be38deb91acd92ec0a9c5c995a714ba54014fbad5383095c7fdb215e1b2d858f7a3bc55add15d0339ea893ad8ebb4e5312f4408a9ce4e9b264eec72dbacd90f3c6033a54704995a1fe192f2ef5bf8fe33cc4f3935fce2b56c340466530cad999a84d721950917f3", 0xc4}, {&(0x7f0000000440)="2b319c5e73714dcdc3320edea0fa6ab403af7f62173b4c04655c76718aa8cc3a8f04dd6c4d3caffa", 0x28}, {&(0x7f0000000480)="bbb187eb1b98beb49f8119a145204c10eadfc49576beade14ee48e6cb1e7e101a399e2551140c462778e4feb35f4a13a4c7137792b0468aa94d793d4b7af1a3e46ced1593e8a48ccd60326354631e7fbf72efd00f9cde675d6a39658982d132e9c25d397857b45b23b9d1033e8ed11bbe56d0d189a5b7415cffc94d276a4435d193fef24002e9f014d2d7321057bc0d517379297e457e92f4d0f9ff46f7dc52ecb26c6e28bc45ea576130d5de13432e72f8da61e27e5f7c8a728e0b5edc88f552e198b4c19fd19e6ff2ea26f13963f4853f2ec921d9089d869f2d7e538c72d61", 0xffffffffffffff00}, {&(0x7f0000000580)="d8f62fc15b71861c39358d3f86aaabb7de9f52a89f50d9cffd4a79cf98dd7603fc467845b77260ea8d08d7c64ab4f3", 0x2f}, {&(0x7f0000000100)}, {&(0x7f0000000600)="8e", 0x1}, {&(0x7f0000000640)="f37c61ef6f3440eeb4c9fd3fbf7440f465673bf055a97ccfb3eafec6a6b2c535897b", 0x22}, {&(0x7f0000000680)="94f762e98f24a8ba2a10a44a0d3ce1e05688c78282f151858d0e36", 0x1b}], 0x8, 0x0, 0x0) connect$inet(r1, &(0x7f00000000c0)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1b}}, 0x10) openat2$dir(0xffffffffffffff9c, &(0x7f0000000180)='./file0/file0/../file0\x00', &(0x7f0000000300)={0x2000, 0x0, 0x10}, 0x18) 1.804165828s ago: executing program 1 (id=577): syz_usb_connect$uac2(0x2, 0xa0, &(0x7f0000000340)={{0x12, 0x1, 0x310, 0x0, 0x0, 0x0, 0x40, 0x582, 0x4c, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x8e, 0x3, 0x1, 0x5, 0x30, 0x9, {0x8, 0xb, 0x0, 0x1, 0x1, 0x7, 0x20, 0x8c}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0x4000, 0x4, 0x15, 0x7}, [@output_terminal={0xc, 0x24, 0x3, 0x2, 0x307, 0x0, 0x4, 0x0, 0x7, 0x81}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x200, 0x3, 0xb, 0x4, {0x8, 0x25, 0x1, 0x0, 0x0, 0x40, 0x4}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {[@format_type_ii_discrete={0x9, 0x24, 0x2, 0x2, 0x4, 0x1ccc, 0x5}, @as_header={0x10, 0x24, 0x1, 0x2, 0x1, 0x0, 0x4, 0x8, 0xb8, 0x3}]}, {{0x9, 0x5, 0x82, 0x9, 0x8, 0x40, 0x6, 0x3, {0x8, 0x25, 0x1, 0x82, 0x3, 0xf3, 0x6}}}}}}}}]}}, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0}) r0 = syz_usb_connect(0x5, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000772904202404019957c2010203010902240001000010000904430002317d5500090502020002020000090582020002"], 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f00000000c0)={0x1c, &(0x7f0000000100)={0x20, 0x16, 0x4, "54f505ad"}, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000140)={0x2c, &(0x7f0000000180)={0x0, 0xb, 0x4, "0e477e6d"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f00000001c0)={0x2c, &(0x7f0000000200)={0x20, 0x7, 0x4, "60aadbbb"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000280)={0x44, &(0x7f0000000300)={0x40, 0x0, 0x4, "82116383"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 1.088067101s ago: executing program 2 (id=587): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000580)) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x11, 0x5, 0x8000, 0xf, "ff000d00009a468e0cd912098d00"}) r1 = syz_open_pts(r0, 0x101200) ioctl$TIOCSTI(r1, 0x5412, &(0x7f0000000140)=0x13) ioctl$TIOCSTI(r1, 0x5412, &(0x7f0000000180)) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000200)={0xfff, 0x81, 0xbd40, 0xb2, 0xc, "8b14d4570100"}) syz_io_uring_setup(0x5f68, &(0x7f0000000440)={0x0, 0x37ca, 0x1000, 0xffffffff, 0x4e}, &(0x7f00000001c0), &(0x7f0000000500), &(0x7f0000000540)) setns(0xc9, 0x0) (async) setns(0xc9, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x22, &(0x7f00000019c0)=0x1, 0x4) (async) setsockopt$inet_tcp_int(r2, 0x6, 0x22, &(0x7f00000019c0)=0x1, 0x4) sendmmsg$inet(r2, &(0x7f0000001a00)=[{{&(0x7f0000001a40)={0x2, 0x4e23, @remote}, 0x10, &(0x7f0000001a80)=[{&(0x7f0000001ac0)='o', 0x1}], 0x1}}], 0x1, 0x2400c040) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000600)='/sys/power/pm_debug_messages', 0x400000, 0x4) (async) r3 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000600)='/sys/power/pm_debug_messages', 0x400000, 0x4) syz_clone(0x102311, 0x0, 0x0, 0x0, 0x0, 0x0) (async) syz_clone(0x102311, 0x0, 0x0, 0x0, 0x0, 0x0) select(0x0, 0x0, 0x0, 0x0, 0x0) (async) select(0x0, 0x0, 0x0, 0x0, 0x0) socket$netlink(0x10, 0x3, 0x0) (async) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r4, &(0x7f0000001b00)={0x0, 0x0, &(0x7f0000001b40)=[{&(0x7f0000001b80)=ANY=[@ANYBLOB="1c0000005e00010000000000000000000c000080080000000a"], 0x1c}], 0x1}, 0x44046) syz_ublk_setup_queues(0xffffffffffffffff, 0x0, &(0x7f0000001c40)={0x0, 0x8ff4, 0x4000, 0x3, 0xe2}, &(0x7f0000001cc0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x96df, 0x80, 0x1, 0x3ae}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x41b9, 0x8, 0x0, 0x341, 0x0, r3}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xa886, 0x10000, 0x3, 0x178}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7b49, 0x1000, 0x0, 0x184}}], 0x4, &(0x7f0000001900)={0x2e, 0x52, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0xff6c}, 0x0, 0x0, '\x00', {0x0, 0x625, 0x0, &(0x7f0000000900)=@buf_512="f3fb7dc842e37e9a539f80b257f160ff919ea51c4d2a9dda62aacfe4ad40348af7779265c4b21482f38e2f1274a6814d001cbbfb4f8c93a62c1b1d4fc299d4adcb14de7413c96cded7f53c2bcc509ff69af87e18a8174e6e01c311246895618cf4170c6babd747f452ba3d3acb6ca139bbf2f7737c6db4be6a37b21740705d695f174065caed98f0b90ff6c9ef5eef0c2f3046b3680d989ac8d2ab04fc44b5abb198f6dbaac589ced60ff59ab94cccfba27929705a68b1fa8a91afa1745c12037a4b1944437cfbd3dc0c8f6888e686fcf173a1d9eabf7e741f7982a96b773921609a47c8ffed5bf3e50e7b59256264a6cc871b7575da151454d661fc886fdccdd77c9aadcfd71b3095bc0157aae453d5dc4622eeaf33608deaf2dd85221736cee4c182318bb5130e1d55c89e9086bdf5313dfdb4f86867daddd7a95676106daadb750ffa5439f22e29bc6ad5fc0aab09b5aabb321890ee32a931af9518e3d3f1d314ce14e9fee8e26654e214fd32f52eaa428ee7ea5f2df4dfbd9c84cd31b7d6670e75b4ba70751fb26c7aacf20c28e441ec662466a4a772395826277a4a3637a446502710db973d9c48209d9d014b63298db3f1836fb1bf54f8eeffd228a03f6e52528c73fd2193577b203401a93b1b58b6a74d7a49664cead53d0d1d2ee6fa1f3b66f861cb93ace3f1762922d6c20fc28ce4aa6df56c86bcb2e3bf0dd8be91"}}, &(0x7f0000001980)) (async) syz_ublk_setup_queues(0xffffffffffffffff, 0x0, &(0x7f0000001c40)={0x0, 0x8ff4, 0x4000, 0x3, 0xe2}, &(0x7f0000001cc0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x96df, 0x80, 0x1, 0x3ae}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x41b9, 0x8, 0x0, 0x341, 0x0, r3}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xa886, 0x10000, 0x3, 0x178}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7b49, 0x1000, 0x0, 0x184}}], 0x4, &(0x7f0000001900)={0x2e, 0x52, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0xff6c}, 0x0, 0x0, '\x00', {0x0, 0x625, 0x0, &(0x7f0000000900)=@buf_512="f3fb7dc842e37e9a539f80b257f160ff919ea51c4d2a9dda62aacfe4ad40348af7779265c4b21482f38e2f1274a6814d001cbbfb4f8c93a62c1b1d4fc299d4adcb14de7413c96cded7f53c2bcc509ff69af87e18a8174e6e01c311246895618cf4170c6babd747f452ba3d3acb6ca139bbf2f7737c6db4be6a37b21740705d695f174065caed98f0b90ff6c9ef5eef0c2f3046b3680d989ac8d2ab04fc44b5abb198f6dbaac589ced60ff59ab94cccfba27929705a68b1fa8a91afa1745c12037a4b1944437cfbd3dc0c8f6888e686fcf173a1d9eabf7e741f7982a96b773921609a47c8ffed5bf3e50e7b59256264a6cc871b7575da151454d661fc886fdccdd77c9aadcfd71b3095bc0157aae453d5dc4622eeaf33608deaf2dd85221736cee4c182318bb5130e1d55c89e9086bdf5313dfdb4f86867daddd7a95676106daadb750ffa5439f22e29bc6ad5fc0aab09b5aabb321890ee32a931af9518e3d3f1d314ce14e9fee8e26654e214fd32f52eaa428ee7ea5f2df4dfbd9c84cd31b7d6670e75b4ba70751fb26c7aacf20c28e441ec662466a4a772395826277a4a3637a446502710db973d9c48209d9d014b63298db3f1836fb1bf54f8eeffd228a03f6e52528c73fd2193577b203401a93b1b58b6a74d7a49664cead53d0d1d2ee6fa1f3b66f861cb93ace3f1762922d6c20fc28ce4aa6df56c86bcb2e3bf0dd8be91"}}, &(0x7f0000001980)) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) setns(0xc9, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$devlink(&(0x7f0000000340), r6) (async) r7 = syz_genetlink_get_family_id$devlink(&(0x7f0000000340), r6) sendmsg$DEVLINK_CMD_RATE_SET(r6, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000400)=ANY=[@ANYBLOB="14fdffa2", @ANYRES16=r7, @ANYBLOB="1b0b2abd7000000000002a000000"], 0x14}, 0x1, 0x0, 0x0, 0xd4209235c937efa7}, 0x0) r8 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r9 = ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r8, 0x4020ae46, &(0x7f0000000040)={0x3, 0x2, 0x3000, 0x1000, &(0x7f0000feb000/0x1000)=nil}) syz_kvm_setup_cpu$x86(r8, r9, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000000c0)=[@text64={0x40, &(0x7f0000000280)="48b801b89734000000004d9823c80f23f835080050000f23e2c744240004000000c744240200000000c74424060000000066baf80cb8580acb8def66bafc0cb800980000ef670f2107c74424002a010000ff2c24b8010000000f01c10f23c00f21f835020002000f23f8260f01d1f341f4c4017d10e548b8c0770c90f03a5f344b0fc76f000f20e035004000000f22e035080000000f23f8", 0x98}], 0x1, 0x21, 0x0, 0x0) ioctl$KVM_RUN(r9, 0xae80, 0x0) ioctl$TIOCSTI(r1, 0x5412, &(0x7f0000000240)=0x1a) (async) ioctl$TIOCSTI(r1, 0x5412, &(0x7f0000000240)=0x1a) 993.96211ms ago: executing program 4 (id=588): syz_usb_connect(0x0, 0x5d, &(0x7f00000002c0)=ANY=[@ANYBLOB="12010000551b8920b822276080c20102030109024b0001000000000904000000020a"], 0x0) syz_usb_connect(0x0, 0x24, &(0x7f0000000380)=ANY=[@ANYBLOB="120100009e173610ef171e7206de90f6007009021200010000000009040000000202"], 0x0) syz_usb_connect$uac1(0x0, 0x88, &(0x7f00000003c0)={{0x12, 0x1, 0x300, 0x0, 0x0, 0x0, 0x10, 0x763, 0x1033, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x76, 0x3, 0x1, 0x6, 0x10, 0xc, "", {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0x4, 0xa}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_ii_discrete={0xf, 0x24, 0x2, 0x2, 0x0, 0x92f7, 0x2, "0719e5c03057"}, @as_header={0x7, 0x24, 0x1, 0xb8, 0x7, 0x2}]}, {{0x9, 0x5, 0x1, 0x9, 0x400, 0x4, 0x1, 0xbf, {0x7, 0x25, 0x1, 0xc, 0x45, 0xffe2}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x50, 0xc1, 0xc, 0xb, {0x7, 0x25, 0x1, 0x0, 0x40, 0x2}}}}}}}}]}}, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0}) mkdirat(0xffffffffffffff9c, &(0x7f0000000880)='./sys\x00', 0x1ff) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setuid(0xee00) bind$bt_hci(r0, &(0x7f0000000300)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000340)="4a00ffff11003ee0b4fdddd685986a49e00588f1ba6f01", 0x17) r1 = openat$kvm(0x0, &(0x7f0000000000), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = syz_kvm_setup_syzos_vm$x86(r2, &(0x7f0000c00000/0x400000)=nil) syz_kvm_add_vcpu$x86(r3, &(0x7f0000000040)={0x0, &(0x7f0000000080)=[@enable_nested={0x12c, 0x18}, @nested_create_vm={0x12d, 0x18}, @nested_vmlaunch={0x12f, 0x18}], 0x48}) syz_kvm_add_vcpu$x86(r3, &(0x7f0000000280)={0x0, &(0x7f0000000100)=[@nested_amd_clgi={0x17f, 0x10}, @set_irq_handler={0xc8, 0x20, {0x19}}, @wr_drn={0x68, 0x20, {0x4, 0x5}}, @nested_vmresume={0x130, 0x18, 0x2}, @in_dx={0x69, 0x20, {0x1269, 0x2}}, @in_dx={0x69, 0x20, {0x21b3, 0x3}}, @nested_amd_inject_event={0x180, 0x38, {0x1, 0x66, 0x2, 0xa, 0x3}}, @nested_vmresume={0x130, 0x18}, @code={0xa, 0x63, {"643665450f01c2b9570300000f32c7442400bd2b0000c7442402ef000000c7442406000000000f01142447f69c8c00980000480fc79d00000000420f01c80fc7b2dfffffff0f01f866460f71d400450f2203"}}], 0x15b}) mount(0x0, &(0x7f00000008c0)='./sys\x00', &(0x7f0000000900)='sysfs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000940)='./sys/bus/serio/devices/serio0/drvctl\x00', 0x1, 0x0) write(r4, &(0x7f0000000980)='r', 0x1) 953.900374ms ago: executing program 3 (id=591): r0 = socket$inet6(0xa, 0x3, 0x7) sendmmsg$inet6(r0, &(0x7f0000000440)=[{{&(0x7f0000000480)={0xa, 0x0, 0x0, @mcast2}, 0x1c, 0x0, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="24000000000005dc2900000032"], 0x28}}], 0x1, 0x0) 701.501169ms ago: executing program 3 (id=592): ioctl$KVM_X86_SET_MSR_FILTER(0xffffffffffffffff, 0x4188aec6, &(0x7f0000000080)={0x0, [{0x0, 0x4d88, 0x6, &(0x7f0000000880)="7a650e526bd0998268bb5847d9beacc47a22df873eab4b8b91133675482eaa56ace8db59bed9aa07d4e390c7c9f98c462b55612196911e3c4e510ede3efde35eec990f22a76cf752e507c1e2de2920a9fc0790cc176bd2b901e4127b09835ae6d0d196048bb19a64d26f20a05b95c69f371882ef2e20c5606ed1b2ebcf09a4a333f6e1c3c4fb64d8182df4ab09d0a381d966977fc041cea9bdf0aa31fe51efe9211b9b8e6e4551b6438f8efcc41265574ff6504435eb22a678a99768f0327ded8fdcb41f27c2024d2b923f7dc5df5bf62af447b121dd9f94d766d6cebdeb02f611ab10e57af4b3268fb3f9777373bd5fd6b82f730e67c4eab113d8e65d7405be3e5d92dc5e7e85d34bb8b7c894cbed629ecc25c288b3d4556a85a1e2150cac5b686a8de29ab7c35040b77875bfa0e451dc0869cfe105bd115e7cf48f44dfdf26be65f3b727fd88d6395d051e49c060998e84b19377fcb20fe2eb392335e5a9d84555ef037aab37169ce761aa8a8ec08ea87e3a3b896f3d1b2380bc8256e0f7ea7dc488382e6112b53a7bb269d6261f87e0e0e0cef9152f8a67f412148f34880c970101fbd7b0e8fc49d6a5c87e487b7b175b15be26b6b8e1ed8527614dcefcfd80f8392560c8b706418b7de8fbb7a666a7e7f322dc70373606bf39efa04616cb99d662dfc591061bde5ed27a66aa7edbfec1eb0b1e843c372b84c3ed514a0aadf523b8669e526765d429824aeaa0a6f4c185754d437d977a1f586431dc256ce5aa7c25be259de3a0ae6e5bcdf56b4c7e8199fe6b461e78467cfac19de6956056ef57e93d3a7df8f646f4a9002b100edb0a6caa72b3f6eb29dc54de58120d27daff9cd61c64107e1bcb3b3212e1e2aa24fb24dc2dafc636c82ad25da9d934e46c7783d8f915337612feb348857ce2262240dfe51ec94d9d61074959f167b9840b20f003883bf167149228d7f03eafde851427cd1966a96aeae05b51ae4cd82f4b4dad60a070c01a8b500e2683f7136e331602e76845262825d7f3764cf1a05ad95d88aab71d41484f63fa6a43c044c7f03130552321933bc40b888fd0cc55939ff79a5059516f3b80c7ba8188ffb6a259a34567ee52c1f9df0f6c91737d688e36d076a49d1045cac30d5ed52a10381c96d9f22e469cc531bb06853d18b8f8625d2a917e795ffa4407fa75713510a3f5370e1ecbf7a5ff68a90a1eda077531cf4d399d4908f138c936e1931c72240070c6a6255f5fd03966e9a06c1d481e8e3d128e880776e572177780a3481c49bd86c174e152bafed245d58ef3428c645b08e48833960d1b5223d7be0c67a2b2c7531390d1837a84ed004a00cb4b0cd6e78824da032b48c49ec006d14206dc3d0c67d7ca87e9ea0faddc3e0b0c917c64eefeebf79e3a16c958db63a08a5d4d7210273aba3e56a4cd4cccb044750ff97749505ff1332b2dd30990849ab1500e1947d0abfb0c59760f0a502806ee1bce56fbb42251dd6ac8b709c73a6b8c548c2b23cf351dc498810e477bd082464e76702703b56d3cd2f3d8a2e00f19d8ffa3c236d3601f169c9dfe9c316f8cbe63c3801a51ea5ac785694a0c653cd28d68c5a81c2590d2aeea8c8688b2e88f46c4f99890e51b42cce485fcb4d91557fb3912b36b0dbeac8df44e945eb9937141402fb2aa1476185e1f8c37f6c98bc937f36d9c7237135132a54a03067b002b9c657ab0daa253af66eee78b0309cb8532dd2dee800c8349b731da0efa66ead82eebe0102279df5aa281fe1d86c0dbf154910d5e8a113ecbddbd046367b9e2acfa7cc406f61b472bbec6919534615ed81b664da956ce6586bf4c92d63ef371dfec5f9ce748931d585cadc9372a95a1372c7213e2c52fca253945afeee02e9f2de2d9452c85fd2dbdc87cb6c25697dfcbed8a0eba381835e6c360f3861367ec98a9a9ccf956d6cbfb706fee0d391cf82a0d4662792274f52fc2b5d72a43ec74a86400e62d3652f607774cfad1504bc0476570d532b527bf0d7012804b2e6fdf9a9414f10b16c9374f2b065348d865b309e37750d3a7e12394e356c48c9fa0d4a9a43f689f6cbf70b09a3b9782cc3d5d93480f8a7a21a049780fc6bf21f1eca938a37afcbb2b929a0c502e164d2571e78d214b359d97e3edc0ad5c7fd1625b4ece33e1f569676e9a7262ead857873f77ef149d2f8c5a09ab19ae384a7f957f612a24283c35327aa969b20711309644c5b3e6c89da94e1f5da54246bd771468a1adc8a8d601e0b12769604f0f07ca43ce2a8a2f4b5654c0b76b146c49038e07db54dae702580b97096911f034fc1797029de8b7c213c902d1d754e77ff85e6222e745db9d5d2d45c5d29a8b6de0f27e5701fdf12b09fd6c70baa0f85a424c21ce0796dbe1fd366b94fcdf64ea232b3e88b89a38d728de77e84decc804f07a48f2716ca6f76b24923cea1a4da0d1f1dc73611269e784c4fd921f9b26c11f35b5cda45842a81b603ce2155d95c273fa0743a571b52e68c9ea3f28009fc37406b9e329ce50fedfb20dfb4cdf3a94769aee2586c2a17e68a07abfcd18aceddfd3876b14558e4d092eadb9120796c44e89610494085117bc41b5c4619a8c160b97811df49fc7d9bf222d7a002640644337ef5af53ed50661131f7c042665b276c0adf0c9a74f3542729beb7632a6027e65eddff7bb27915826701ec9b6a4c672f08877eefd859e0aa6e75a2e841e1ea98dff994e5a58be628df86bff17497a4d0f92ab39db421eb1062a2a393656bbb1d92becbb91a59619156b51585cd2eafd8a18d6326166312efeaa7258bddad63e0c7372ffb7ce1f1adf1ac2ffa0f278e4be6684d762f8971ed7bb04096b96f8126bf5fd32142e745d421f495327dde0f1e2d9a1d8ba63c1453101396a2e54e89cdabac2c6a01f23a5c1d5a2dfa2a3c634176e97c9c62b41ea28102b5a08af2fba1d311bb323df086ea97726c9d8c7b7b53a3399a80f040d434fdcc2148fb1da3b7d7f0f3e3fd56471a310ee275da611c79f86be8ed6343f6ed0ad91dfeffebc3ab6389d0566d6db904c1db499ae7d2698fdc7170320f85cc3d3d0d9d0d0c7d45db7b53c5eb79a2fed2a048d9d74419532122fac62f6315a9e13b461cb4e26514491debd366927987271be963ea5805a49b8b480c6a393fda1b11fd5634890cf02948cb5bfea237afb30d081c7403cd334a02e5bb8db542c4d5fa5ec5c8a0dd36b62156881c98e01948b4775a502c5d8453439fd930df52caac9d71c28b712000b306b913c10918ca0bc194f2533334462e5cd2b2e6c978a4838febfbc2d4375b8108bd0aa32aeaf05e7ba30c781cace6470ead574f5cbfa68aa8c8d835e9b3ab2bd7dd90b5e3e6cd62d8e04c3b45326e1f560a8dd8f3db4177e9e5ccd61f21dacb5c40c8030559cdfe88f7aa98bdcde90c1214cf293b3df093d0630bc3073cbaffa025b1f5537b49d799731745de7d36cded4a9db25915a511ba505b4ddd885cd226c24ea37fd926dbd90b887"}, {0x0, 0x0, 0x1ff, 0x0}, {0x3, 0x0, 0x100f5b6, 0x0}, {0x2, 0xffffffffffffff46, 0x31b7, 0x0}, {0x0, 0x0, 0x9, 0x0}, {0x1, 0x0, 0x3, 0x0}, {0x2, 0x0, 0x1ff, 0x0}, {0x0, 0x0, 0xe0, 0x0}, {0x1, 0x0, 0xf3f, 0x0}, {0x0, 0x0, 0x1000, 0x0}, {0x3, 0x0, 0x6, 0x0}, {0x3, 0x0, 0x1000, 0x0}, {0x0, 0x0, 0x9, 0x0}, {0x0, 0x0, 0x1545, 0x0}, {0x2, 0x0, 0x9, 0x0}, {0x2, 0x0, 0x86a, 0x0}]}) openat$kvm(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000001280)={0x0, 0x0, 0xfffff000, 0x2000, &(0x7f0000000000/0x2000)=nil}) r0 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KVM_RUN(r0, 0xae80, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f00000012c0)={0x4, 0x1, 0x0, 0x2000, &(0x7f0000002000/0x2000)=nil}) ioctl$KVM_RUN(r0, 0xae80, 0x0) 701.09862ms ago: executing program 3 (id=593): r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = socket$vsock_stream(0x28, 0x1, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f00000003c0), r2) prlimit64(0x0, 0xe, &(0x7f0000000400)={0x8, 0x80000000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000440)=0x7) r4 = getpid() sched_setscheduler(r4, 0x2, &(0x7f0000000480)=0x6) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r5 = syz_open_dev$MSR(&(0x7f00000004c0), 0x0, 0x0) read$msr(r5, &(0x7f0000000500)=""/102392, 0x18ff8) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000019500)={0x0, 0x0, &(0x7f0000019540)={&(0x7f00000198c0)=ANY=[@ANYBLOB="f000000010000100feffffff00010000fe880000000000000000000000000001fc0100000000000000000000000000004e2407144e070005000020003a58eb64ece7336c8b0000004b868ccdbeb4b2e2a9b07bf089cf609c8954ec7dae92b52edfc2b6fc043ee3fb7dc70e8423e20b8019272d8cc692d069e605127dbba9df2df6f4", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="e0000002000000000000000000000000000004d46c00000000000000000000000000000000000001000000000000000092010000000000000600000000000000ffff0000000000001c250800000000000200000000000000f8ffffffffffffff0000000000000000ffffffffffffffff000000000000000026ae000000000000000000000000000002000000fcffffff000000002abd700005350000020001002000000000000000"], 0xf0}, 0x1, 0x0, 0x0, 0x8801}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000019680)={0x0, 0x0, &(0x7f00000196c0)={&(0x7f0000019700)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01040000000000000000010000030900010073797a30000000002c000000030a01010000000000000000010000000900010073797a30000000000900030073797a320000000090000000060a010400000000000000000100000308000b4000003ce013ad000068000480340001800b000100657874686472000024000280080001400000000b080003400000004d0500020007000000080004400000002f3000018008000100636d7000240002801000038009000100910d000000000000080001400000000208000240000000000900010073797a3000000000"], 0x104}, 0x1, 0x0, 0x0, 0x180}, 0x0) sendmsg$ETHTOOL_MSG_PAUSE_SET(r2, &(0x7f0000019800)={0x0, 0x0, &(0x7f0000019840)={&(0x7f0000019880)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="01fffc00000000000000200100000c000280080002006c6f000018000380040001000800020005000000080004"], 0x38}}, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x1000008, 0x20812, r1, 0x830c5000) prctl$PR_SET_SECUREBITS(0x1c, 0x2c) setuid(0xee00) r6 = syz_clone(0x800000, 0x0, 0x0, 0x0, 0x0, 0x0) r7 = syz_open_procfs(0x0, &(0x7f0000000080)='task\x00') fchdir(r7) mount(0x0, &(0x7f0000000200)='.\x00', &(0x7f0000000240)='proc\x00', 0x80, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f00000199c0), 0x0, 0x0) setsockopt$inet_IP_IPSEC_POLICY(r7, 0x0, 0x10, &(0x7f0000019c40)={{{@in6=@rand_addr=' \x01\x00', @in6=@remote, 0x4e24, 0x9, 0x4e20, 0x0, 0x2, 0x80, 0x60, 0x2f}, {0xffffffff7fffffff, 0x5, 0x2, 0xda, 0x2, 0x80000000, 0xeb, 0x1}, {0x3, 0xc, 0x2, 0x80000001}, 0x1, 0x6e6bc0, 0x2, 0x1, 0x2, 0x3}, {{@in6=@loopback, 0x4d3, 0x32}, 0xa, @in=@rand_addr=0x64010100, 0x3506, 0x0, 0x2, 0x5, 0x5, 0x3, 0x80}}, 0xe8) r8 = syz_open_procfs(r6, &(0x7f0000000280)='ns\x00') readlinkat(r8, &(0x7f00000002c0)='./mnt\x00', &(0x7f0000000300)=""/163, 0xa3) write$UHID_CREATE(r0, &(0x7f00000000c0)={0x0, {'syz0\x00', 'syz1\x00', 'syz0\x00', 0x0, 0x0, 0xdde, 0xffffffff, 0x4, 0x3, 0x10000000}}, 0x120) 674.484702ms ago: executing program 3 (id=594): write$tun(0xffffffffffffffff, 0x0, 0x0) r0 = syz_usb_connect$cdc_ncm(0x5, 0x6e, &(0x7f0000000100)=ANY=[@ANYBLOB="12010000060000402505a1a440000102030109025c0002010000000901000100020d0000052406000105240000000d240f0100000000000000000006241a0000000905810300020000000904010000020d00000904010120ee0e"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f0000000300)={0x40, 0x1b, 0x73, "6e54a0bf2cbae9d2c9b28b84da550e617bf382c61a50afa3a38f2d1059f48f33974841a7b5a200b4af44605dc01f5ab475ffee23047c0c7f7955bf1ad2fa590711fa0b7a1aa0318404f44d02f0dcdc8af80be320af2f7e5e5a96d75fadccc6b2bd413020e3b9ed98580162952adc2df98ff8c5"}, &(0x7f0000000380)={0x0, 0xa, 0x1}, &(0x7f00000003c0)={0x0, 0x8, 0x1, 0x9}, &(0x7f0000000400)={0x20, 0x80, 0x1c, {0x94b0, 0x4, 0x1, 0xff7f, 0x3, 0x989, 0x0, 0x6, 0x1, 0x81, 0x39, 0xe}}, &(0x7f0000000440)={0x20, 0x85, 0x4, 0x1}, &(0x7f0000000480)={0x20, 0x83, 0x2}, &(0x7f00000004c0)={0x20, 0x87, 0x2, 0xdb6}, &(0x7f0000000500)={0x20, 0x89, 0x2, 0x1}}) 540.346286ms ago: executing program 1 (id=595): fchmod(0xffffffffffffffff, 0x42) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x100, 0x0) ioctl$TCXONC(r0, 0x540a, 0x1) r1 = openat$binderfs_feature(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/features/oneway_spam_detection\x00', 0x0, 0x0) ioctl$BTRFS_IOC_ENCODED_WRITE(r1, 0x40809440, &(0x7f0000000400)={&(0x7f0000000380)=[{&(0x7f0000000080)="ed3770fe52ac70663e6944ee9c5d2cdb012b9e04946b3813f0c0d58307a01071a912a6298af37fd2bdf12aa358ece791cac98ef46f8b73df397d6b41e7c753a6656f468a06895721b564c7dc8783ffc43a4c68dacf77fb9248ba293c524075e1ef102eef505263c976bc9f8e25e4b2169ec71a9ec4b0fd299d4b77d44077022b39c212b73e3b37e80f24e240ecd336a57b31c0a574ddaddc240df76688317e7d96841949339e03867b1fd7cb27081fa60dda3d8d26d6892f9a2635059b3acd65e5883f1172469082404e1c48fff85d4986e035e56d818aab38fc", 0xda}, {&(0x7f0000000180)="4c30d4affd9d5519ec97b70e53ef8e900e64bce2846015bd54a914dd2cf8ba6d18ddc6b82d87eabd1113f2ab72879ed65826f3bbb5b4db695b2d4c74cd1c9da180aa663f7e4bf642390d7e93627977e85d243ea56e213f569621fd597843fc19689219825d116eff07652a7eaa216915856355892f4486afa54e3b0d4082f0f31cfa477b667ba2a7093364023647d733ebecc9510b55ec5d67042cc916383304974f321b00170b4cf2320cee05ff699328e86e83ebf789a85cd07eeb9a79621e63c50a7bdded8781ad470869238c169b98478d812d9e5c154c68a8a9e8657cd44d16aac993", 0xe5}, {&(0x7f0000000280)="ae7709069637e59c51734c4a8a77e3460aa79192ef13c5fab1dd", 0x1a}, {&(0x7f00000002c0)="a6d4f0a763fb649661dbabaa317e5f530c020ae8f7ccc37598635153bfb6918428527d138a0f5bb05c3ed8d5dd45", 0x2e}, {&(0x7f0000000300)="115ed6b8e9543c05e0d14d6b23a8b92104c1c46512e905ab808ab2eb03684c37cc3a3fc14e611519a9", 0x29}, {&(0x7f0000000340)="24142caedc2cec62a4d164234fcd1bb3bda1ebd8b5dcefac7e7bd49a67edc260518dfa2e9632200c8da5512f1e", 0x2d}], 0x6, 0x0, 0x0, 0x4, 0x3, 0x1, 0x4, 0x6}) ioctl$KVM_SET_SIGNAL_MASK(r1, 0x4004ae8b, &(0x7f0000000480)={0x19, "fcaaf48696bfd16b8a5947e731e7ce4edeca76fe12007e86e3"}) ioctl$TIOCSTI(r1, 0x5412, &(0x7f00000004c0)=0x3) ioctl$EVIOCGUNIQ(r1, 0x80404508, &(0x7f0000000500)) ioctl(r1, 0x9, &(0x7f0000000540)) writev(r1, &(0x7f0000000a80)=[{&(0x7f0000000580)="319eb418d714547e6b775d9e7dad0e5c42b51f7df3b6b675300098315659cf55d41ab29e8487085bfcea0d2a28c703789c40a00d6e73eb9a41bf6c70f9cc90ce114e280742243691b6f779a63bc3ce71149c57ee58f937718404d82f97f203dd9e8f854c709e0e9ce890ccbb879b0006a151b8d2f7d0a250a3a9b71e7010a875426c30d5003fd1c91e9168abe26bea28d696c7efe158f0027370bf13b61c0642d598f25f6c805ac1efd09ff886387abe10ac491a5eb0859e4fa3ad9b810203fd388b7602d9933a60f0d3fab204aa760d18f38efce95016abc35c6d953c577d225025a4", 0xe3}, {&(0x7f0000000680)="c665a26a1ee065a366d2865fc632e142c60a6a92ca43dbca42f39c7955b3a5dff59d7c7b22afba80b489ef7d90e624c61a54e8fe9f450d009906e5eb11effcde5130d84e645e3bd236bcdc56c8f9a7edab9572988354b7a9f4a1d5b28c09b6185b5117160d821ac35f6ad22cfc9f1049bb6d765248ecf3854d45545aa7ff80ebe84b367eb5b6cd2c20a9b2", 0x8b}, {&(0x7f0000000740)="48d4347078933bfe3ae6ee0d08ac39b09eba453bb4f4fd77d40294d0c8bf80bbe55cef2d08f76745f1136f1439346c7fd83694f6e245be2b375fd52746975d57725686054179838bfbef84b18a4aec0b69c0c59f470856dac0962eb2d96477d8a6abf75eafbeeead70a5964fc3f5e33b7a6525b013b01fcde6ca52acb98346b0eee0dcf684f18a16dcd7bdd0e2943fe35506198059e1d627d8b7c376d37c568e74c3d4ae2e9c664ac9b62aa810853d6252af20613b1ae56d93ebca0f04f8eb9075df91c831be6c8c5e93b6ee79dbd2088969810b74c9a9fc8a5559118f832ca2e81a62d2dc789d7236", 0xe9}, {&(0x7f0000000840)="088645d4b465c826e4d4f1c59a02e290fb73d89ab63761184bcfb00b0f9d81f5c4642dbb715130305b85bd63c53d5f8b4da8baa8238a5587fa2065f74465d1a61ff1c6c2e01beea524819ea209bf8583b09123c5790fa719fabb75551d3b3c73b6cce4cdf680f26e960e350a26fcf52603431de3db0b106948ff26c6ea680c711e0a3a7817777516ef1769d0195ace6ce5", 0x91}, {&(0x7f0000000900)="936b689921d2c4d6eaec0c2844ace3b33148a2cbc723e9114e5795cd7d2baf9e93daa56923067d5829dcb4fb024a7e2f22af23c482294f6bf43fc3439c9e8127b2685ae3bda8af22c5110e1b35a85a271b3c453333509fd230c4653d4d3f0db44a5074eb9e3e0c84c7cc49f58ae537d282deb8de4dff2858f2eb16960f996d699aceb9b1248319fec63308c87b0d63d57908673967b02decdd46595e4b8c5ed4a91ce6a3c8ded9740dbadf343edab270c07edc6d9d08a27fbaa3cfa3d31c90d70c9b8865", 0xc4}, {&(0x7f0000000a00)="91285704d9de5791a3b1615bde97af7142813ee4ee02eeb62ca22af16a01d10c6ff1150afdd23cf3bc9e2147c55e4577fbc97f39d4309fc520d507a47d0d565d5ae3896e08a1520abcfb28614bdee0fdfb35c01453bfa2045509b74de4454bafe500d30920186936185e5979ed72", 0x6e}], 0x6) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000b00)='batadv0\x00', 0x10) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r1, 0xc0502100, &(0x7f0000000b40)={0x0, 0x0}) getpgrp(r2) ioctl$sock_SIOCSIFVLAN_DEL_VLAN_CMD(0xffffffffffffffff, 0x8983, &(0x7f0000000bc0)={0x1, 'ipvlan1\x00', {}, 0x8}) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000000c00)={{{@in=@initdev, @in6=@private2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in=@remote}}, &(0x7f0000000d00)=0xe8) quotactl_fd$Q_QUOTAON(0xffffffffffffffff, 0xffffffff80000201, r3, &(0x7f0000000d40)='./file0\x00') sendmsg$IPVS_CMD_FLUSH(r1, &(0x7f0000000e80)={&(0x7f0000000d80)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000e40)={&(0x7f0000000dc0)={0x54, 0x0, 0x100, 0x70bd2b, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x4}, @IPVS_CMD_ATTR_DAEMON={0x28, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x1}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'veth0_to_team\x00'}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @local}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x6}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x7}]}, 0x54}, 0x1, 0x0, 0x0, 0xc000}, 0x20000091) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) readv(r4, &(0x7f00000020c0)=[{&(0x7f0000000ec0)=""/60, 0x3c}, {&(0x7f0000000f00)=""/154, 0x9a}, {&(0x7f0000000fc0)=""/197, 0xc5}, {&(0x7f00000010c0)=""/4096, 0x1000}], 0x4) timer_create(0x6, &(0x7f0000002240)={0x0, 0x2e, 0x1, @thr={&(0x7f0000002100)="cb20a46ffad5fc25e4f37b55d5e2f6fa0c63354d12246fc2c2ed9941cca6fbc9ae989af23a9d4f30fcebec40f11ae0f774111c44", &(0x7f0000002140)="713b4058b26182f8400373812f8a91aac3faed0ecfb5d33fbb1173802bb53e60cdf4d44acd90c1f0864667f010965bb81b0f10ca203e31d26030c49d74ae28739eed9d7a2cb7bef8ac78b51b8eb814f93e04e998a66d4fe4d1811248d2df37b316c69978f7a231135b5654ef3cff7843019eb80e936dc423f9447197828b14f686e7f053e7f93c9dd2630cb08c6b4f424ce257da3499c739617f35b10553446476232bc934428c8c84df3359fda5942361454a8842f75e303ef97556cf6e41c429a4376e3e20bd1e42eb762a68c9e52781d90c7797b7591b6136b9d6d11224c66627b5ffea47ebedf4cd4857f1eb336b3420086494"}}, &(0x7f0000002280)=0x0) ioctl$DM_TABLE_LOAD(r1, 0xc138fd09, &(0x7f00000022c0)={0x4, 0x0, 0x0, 0x198, 0x138, 0x1, 0x0, 0x800, 0x0, 0x0, @by_name={0x0, {'syz', 0x0, '1\x00'}}, [@integrity={0x0, 0x0, 0x0, 0x60, 'integrity\x00', {{@ram={'/dev/ram', 0x0}, 0x20, '1'}, 0x20, '8', 0x20, 'R', ' 2 internal_hash:crc32c recalculate'}}]}) timer_getoverrun(r5) ioctl$FS_IOC_FSSETXATTR(r1, 0x401c5820, &(0x7f0000002480)={0x3, 0x400, 0x1, 0x2, 0x7fff}) execve(&(0x7f00000024c0)='./file0/../file0\x00', &(0x7f0000002700)={[&(0x7f0000002500)=':\\\x00', &(0x7f0000002540)='./binderfs/features/oneway_spam_detection\x00', &(0x7f0000002580)='\'.+$\x00', &(0x7f00000025c0)=']-^((*-%-(/^@,-+\x00', &(0x7f0000002600)='(,\x00', &(0x7f0000002640)='1\x00', &(0x7f0000002680)='\x00', &(0x7f00000026c0)='\x00']}, &(0x7f0000002800)={[&(0x7f0000002780)='$\x00', &(0x7f00000027c0)='{*\x00']}) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000002840), 0x10881, 0x0) ioctl$KVM_GET_MSR_FEATURE_INDEX_LIST(r7, 0xc004ae0a, &(0x7f0000002880)={0x3, [0x0, 0x0, 0x0]}) getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f00000028c0)={0x0}, &(0x7f0000002900)=0xc) syz_open_procfs(r8, &(0x7f0000002940)='net/snmp\x00') ioctl$AUTOFS_IOC_FAIL(r4, 0x9361, 0x6) 150.058525ms ago: executing program 2 (id=596): r0 = creat(&(0x7f0000000040)='./file0\x00', 0xc9a9c042ad77c5e5) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000540)='./file0\x00', &(0x7f0000000580), 0x88, &(0x7f00000005c0)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}}) mount$fuse(0x0, &(0x7f0000000640)='./file0\x00', &(0x7f0000000680), 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0]) write$P9_RSTAT(r0, &(0x7f0000000080)={0x58, 0x7d, 0x1, {0x0, 0x51, 0x4, 0xfffffff8, {0x80, 0x2}, 0x10050000, 0x5, 0x0, 0x4, 0x9, '-$\\^\xba.//&', 0x8, 'rootmode', 0xb, '}(.\\-^^{),]', 0x2, 'fd'}}, 0x58) 149.248655ms ago: executing program 2 (id=597): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_open_procfs$namespace(0x0, &(0x7f0000000400)='ns/pid_for_children\x00') (async) syz_open_procfs$namespace(0x0, &(0x7f0000000400)='ns/pid_for_children\x00') mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) (async) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000440)='net/vlan/vlan1\x00') unshare(0x22020600) readlinkat(r2, &(0x7f0000000480)='./mnt\x00', &(0x7f00000004c0)=""/66, 0x42) r3 = socket(0x10, 0x3, 0x0) sendto$inet6(r3, &(0x7f0000000300)="c10e000018001f06b9409b0dffff110d0207be040205060506100a044300040018000000fac8388827a685a168d9a44604094565360c648dcaaf6c26c291214549932fde4a460c89b6ec0cff3959547f509058ba86c902fc3a10004a320c0400160015000a00000000000000000000080756ede4ccbe5880", 0xec1, 0x0, 0x0, 0x9e5e111c47e3504f) r4 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r5 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r0, 0xae04) mmap$KVM_VCPU(&(0x7f0000000000/0xa000)=nil, r5, 0x300000b, 0x11, r4, 0x0) sendmsg$NL80211_CMD_GET_STATION(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={0x0}, 0x1, 0x0, 0x0, 0x4004000}, 0x4c094) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f00000000c0)={[0xffffffffff48ec43, 0x0, 0x23400000000, 0x4, 0x8000000, 0x3, 0x9, 0x9, 0x4, 0xffffffff00000000, 0x9, 0x1002, 0x5, 0x6, 0x8, 0x80000001], 0x4, 0x100201}) ioctl$KVM_RUN(r4, 0xae80, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) socket(0x1e, 0x4, 0x0) (async) socket(0x1e, 0x4, 0x0) pselect6(0x40, &(0x7f0000000180)={0x0, 0xfffffffffffffffd, 0x1, 0x0, 0x800, 0x0, 0x100001, 0x5}, 0x0, &(0x7f00000001c0)={0x1f, 0x2, 0xffff, 0x3, 0x2, 0x220, 0x6a9, 0xfffffffffffffffc}, &(0x7f0000000240)={0x0, 0x3938700}, 0x0) (async) pselect6(0x40, &(0x7f0000000180)={0x0, 0xfffffffffffffffd, 0x1, 0x0, 0x800, 0x0, 0x100001, 0x5}, 0x0, &(0x7f00000001c0)={0x1f, 0x2, 0xffff, 0x3, 0x2, 0x220, 0x6a9, 0xfffffffffffffffc}, &(0x7f0000000240)={0x0, 0x3938700}, 0x0) r6 = openat$binderfs_proc_dir(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) faccessat2(r6, &(0x7f00000003c0)='./file0\x00', 0x90, 0x100) (async) faccessat2(r6, &(0x7f00000003c0)='./file0\x00', 0x90, 0x100) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f0000000000)={'\x00', 0x8, 0x1000, 0x5, 0x1, 0xded}) (async) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f0000000000)={'\x00', 0x8, 0x1000, 0x5, 0x1, 0xded, 0x0}) ptrace(0x4208, r7) 102.70252ms ago: executing program 3 (id=598): preadv(0xffffffffffffffff, 0x0, 0x0, 0x8000000000000000, 0x0) syz_open_procfs(0x0, &(0x7f0000000400)='ns\x00') 95.258891ms ago: executing program 3 (id=599): capset(&(0x7f0000000000)={0x20080522}, &(0x7f0000000080)={0x200002, 0x200003, 0x801, 0x4, 0x7}) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x76dc) r1 = socket$can_raw(0x1d, 0x3, 0x1) r2 = getpgid(0x0) r3 = syz_pidfd_open(r2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000480)='./sys\x00', 0x19f) mount(0x0, &(0x7f00000004c0)='./sys\x00', 0x0, 0x0, 0x0) r4 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$cgroup_int(r4, &(0x7f0000000500)=0x3, 0x12) r5 = pidfd_getfd(r3, r3, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000540), 0x2, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) mremap(&(0x7f0000064000/0x3000)=nil, 0x3000, 0x600000, 0x3, &(0x7f0000a00000/0x600000)=nil) setns(r5, 0x66020000) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0) sendmsg$can_raw(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000600)=@can={{}, 0xc5, 0x88d4c35330bd1557, 0x4, 0x2, "0000004000001400"}, 0x10}, 0x1, 0x0, 0x0, 0x2000c840}, 0x20000040) creat(&(0x7f0000000640)='./file0\x00', 0x0) connect$inet6(r0, &(0x7f0000000140)={0xa, 0x0, 0xfffffffe, @loopback, 0x4}, 0x1c) setsockopt$inet6_opts(r0, 0x29, 0x3b, 0x0, 0x10) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000180), 0x4) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f00000001c0)=@gcm_128={{0x304}, "121685e61d09b74b", "d5e234f8e6373754dbe765dc05905a84", "41e82f2f", "ede8872ad4899908"}, 0x28) r6 = getpid() r7 = syz_pidfd_open(r6, 0x0) setns(r7, 0x24020000) r8 = socket$inet6(0xa, 0x3, 0x0) setsockopt$inet6_group_source_req(r8, 0x29, 0x2f, &(0x7f0000000200)={0x8, {{0xa, 0x4e21, 0xa3f, @mcast1, 0xbfd}}, {{0xa, 0x4e20, 0x5, @private1={0xfc, 0x1, '\x00', 0x1}, 0x40}}}, 0x108) getsockopt$inet6_buf(r8, 0x29, 0x30, &(0x7f0000000340)=""/214, &(0x7f0000000440)=0xd6) socket$nl_route(0x10, 0x3, 0x0) syz_usb_connect(0x1, 0x24, &(0x7f0000000040)={{0x12, 0x1, 0x200, 0xc3, 0xd7, 0x9a, 0x8, 0x9fb, 0x6026, 0xaedc, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x3, 0x4, 0xb0, 0x1, "", [{{0x9, 0x4, 0x3, 0x4, 0x0, 0x99, 0xd8, 0x22, 0x3}}]}}]}}, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) 2.00151ms ago: executing program 2 (id=600): r0 = socket$inet6(0xa, 0x3, 0x7) sendmmsg$inet6(r0, &(0x7f0000000440)=[{{&(0x7f0000000480)={0xa, 0x0, 0x0, @mcast2}, 0x1c, 0x0, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="240000000000fff52900000032"], 0x28}}], 0x1, 0x0) 575.27µs ago: executing program 2 (id=601): ioctl$KVM_X86_SET_MSR_FILTER(0xffffffffffffffff, 0x4188aec6, &(0x7f0000000080)={0x0, [{0x0, 0x4d88, 0x6, &(0x7f0000000880)="7a650e526bd0998268bb5847d9beacc47a22df873eab4b8b91133675482eaa56ace8db59bed9aa07d4e390c7c9f98c462b55612196911e3c4e510ede3efde35eec990f22a76cf752e507c1e2de2920a9fc0790cc176bd2b901e4127b09835ae6d0d196048bb19a64d26f20a05b95c69f371882ef2e20c5606ed1b2ebcf09a4a333f6e1c3c4fb64d8182df4ab09d0a381d966977fc041cea9bdf0aa31fe51efe9211b9b8e6e4551b6438f8efcc41265574ff6504435eb22a678a99768f0327ded8fdcb41f27c2024d2b923f7dc5df5bf62af447b121dd9f94d766d6cebdeb02f611ab10e57af4b3268fb3f9777373bd5fd6b82f730e67c4eab113d8e65d7405be3e5d92dc5e7e85d34bb8b7c894cbed629ecc25c288b3d4556a85a1e2150cac5b686a8de29ab7c35040b77875bfa0e451dc0869cfe105bd115e7cf48f44dfdf26be65f3b727fd88d6395d051e49c060998e84b19377fcb20fe2eb392335e5a9d84555ef037aab37169ce761aa8a8ec08ea87e3a3b896f3d1b2380bc8256e0f7ea7dc488382e6112b53a7bb269d6261f87e0e0e0cef9152f8a67f412148f34880c970101fbd7b0e8fc49d6a5c87e487b7b175b15be26b6b8e1ed8527614dcefcfd80f8392560c8b706418b7de8fbb7a666a7e7f322dc70373606bf39efa04616cb99d662dfc591061bde5ed27a66aa7edbfec1eb0b1e843c372b84c3ed514a0aadf523b8669e526765d429824aeaa0a6f4c185754d437d977a1f586431dc256ce5aa7c25be259de3a0ae6e5bcdf56b4c7e8199fe6b461e78467cfac19de6956056ef57e93d3a7df8f646f4a9002b100edb0a6caa72b3f6eb29dc54de58120d27daff9cd61c64107e1bcb3b3212e1e2aa24fb24dc2dafc636c82ad25da9d934e46c7783d8f915337612feb348857ce2262240dfe51ec94d9d61074959f167b9840b20f003883bf167149228d7f03eafde851427cd1966a96aeae05b51ae4cd82f4b4dad60a070c01a8b500e2683f7136e331602e76845262825d7f3764cf1a05ad95d88aab71d41484f63fa6a43c044c7f03130552321933bc40b888fd0cc55939ff79a5059516f3b80c7ba8188ffb6a259a34567ee52c1f9df0f6c91737d688e36d076a49d1045cac30d5ed52a10381c96d9f22e469cc531bb06853d18b8f8625d2a917e795ffa4407fa75713510a3f5370e1ecbf7a5ff68a90a1eda077531cf4d399d4908f138c936e1931c72240070c6a6255f5fd03966e9a06c1d481e8e3d128e880776e572177780a3481c49bd86c174e152bafed245d58ef3428c645b08e48833960d1b5223d7be0c67a2b2c7531390d1837a84ed004a00cb4b0cd6e78824da032b48c49ec006d14206dc3d0c67d7ca87e9ea0faddc3e0b0c917c64eefeebf79e3a16c958db63a08a5d4d7210273aba3e56a4cd4cccb044750ff97749505ff1332b2dd30990849ab1500e1947d0abfb0c59760f0a502806ee1bce56fbb42251dd6ac8b709c73a6b8c548c2b23cf351dc498810e477bd082464e76702703b56d3cd2f3d8a2e00f19d8ffa3c236d3601f169c9dfe9c316f8cbe63c3801a51ea5ac785694a0c653cd28d68c5a81c2590d2aeea8c8688b2e88f46c4f99890e51b42cce485fcb4d91557fb3912b36b0dbeac8df44e945eb9937141402fb2aa1476185e1f8c37f6c98bc937f36d9c7237135132a54a03067b002b9c657ab0daa253af66eee78b0309cb8532dd2dee800c8349b731da0efa66ead82eebe0102279df5aa281fe1d86c0dbf154910d5e8a113ecbddbd046367b9e2acfa7cc406f61b472bbec6919534615ed81b664da956ce6586bf4c92d63ef371dfec5f9ce748931d585cadc9372a95a1372c7213e2c52fca253945afeee02e9f2de2d9452c85fd2dbdc87cb6c25697dfcbed8a0eba381835e6c360f3861367ec98a9a9ccf956d6cbfb706fee0d391cf82a0d4662792274f52fc2b5d72a43ec74a86400e62d3652f607774cfad1504bc0476570d532b527bf0d7012804b2e6fdf9a9414f10b16c9374f2b065348d865b309e37750d3a7e12394e356c48c9fa0d4a9a43f689f6cbf70b09a3b9782cc3d5d93480f8a7a21a049780fc6bf21f1eca938a37afcbb2b929a0c502e164d2571e78d214b359d97e3edc0ad5c7fd1625b4ece33e1f569676e9a7262ead857873f77ef149d2f8c5a09ab19ae384a7f957f612a24283c35327aa969b20711309644c5b3e6c89da94e1f5da54246bd771468a1adc8a8d601e0b12769604f0f07ca43ce2a8a2f4b5654c0b76b146c49038e07db54dae702580b97096911f034fc1797029de8b7c213c902d1d754e77ff85e6222e745db9d5d2d45c5d29a8b6de0f27e5701fdf12b09fd6c70baa0f85a424c21ce0796dbe1fd366b94fcdf64ea232b3e88b89a38d728de77e84decc804f07a48f2716ca6f76b24923cea1a4da0d1f1dc73611269e784c4fd921f9b26c11f35b5cda45842a81b603ce2155d95c273fa0743a571b52e68c9ea3f28009fc37406b9e329ce50fedfb20dfb4cdf3a94769aee2586c2a17e68a07abfcd18aceddfd3876b14558e4d092eadb9120796c44e89610494085117bc41b5c4619a8c160b97811df49fc7d9bf222d7a002640644337ef5af53ed50661131f7c042665b276c0adf0c9a74f3542729beb7632a6027e65eddff7bb27915826701ec9b6a4c672f08877eefd859e0aa6e75a2e841e1ea98dff994e5a58be628df86bff17497a4d0f92ab39db421eb1062a2a393656bbb1d92becbb91a59619156b51585cd2eafd8a18d6326166312efeaa7258bddad63e0c7372ffb7ce1f1adf1ac2ffa0f278e4be6684d762f8971ed7bb04096b96f8126bf5fd32142e745d421f495327dde0f1e2d9a1d8ba63c1453101396a2e54e89cdabac2c6a01f23a5c1d5a2dfa2a3c634176e97c9c62b41ea28102b5a08af2fba1d311bb323df086ea97726c9d8c7b7b53a3399a80f040d434fdcc2148fb1da3b7d7f0f3e3fd56471a310ee275da611c79f86be8ed6343f6ed0ad91dfeffebc3ab6389d0566d6db904c1db499ae7d2698fdc7170320f85cc3d3d0d9d0d0c7d45db7b53c5eb79a2fed2a048d9d74419532122fac62f6315a9e13b461cb4e26514491debd366927987271be963ea5805a49b8b480c6a393fda1b11fd5634890cf02948cb5bfea237afb30d081c7403cd334a02e5bb8db542c4d5fa5ec5c8a0dd36b62156881c98e01948b4775a502c5d8453439fd930df52caac9d71c28b712000b306b913c10918ca0bc194f2533334462e5cd2b2e6c978a4838febfbc2d4375b8108bd0aa32aeaf05e7ba30c781cace6470ead574f5cbfa68aa8c8d835e9b3ab2bd7dd90b5e3e6cd62d8e04c3b45326e1f560a8dd8f3db4177e9e5ccd61f21dacb5c40c8030559cdfe88f7aa98bdcde90c1214cf293b3df093d0630bc3073cbaffa025b1f5537b49d799731745de7d36cded4a9db25915a511ba505b4ddd885cd226c24ea37fd926dbd90b887"}, {0x0, 0x0, 0x1ff, 0x0}, {0x3, 0x0, 0x100f5b6, 0x0}, {0x2, 0xffffffffffffff46, 0x31b7, 0x0}, {0x0, 0x0, 0x9, 0x0}, {0x1, 0x0, 0x3, 0x0}, {0x2, 0x0, 0x1ff, 0x0}, {0x0, 0x0, 0xe0, 0x0}, {0x1, 0x0, 0xf3f, 0x0}, {0x0, 0x0, 0x1000, 0x0}, {0x3, 0x0, 0x6, 0x0}, {0x3, 0x0, 0x1000, 0x0}, {0x0, 0x0, 0x9, 0x0}, {0x0, 0x0, 0x1545, 0x0}, {0x2, 0x0, 0x9, 0x0}, {0x2, 0x0, 0x86a, 0x0}]}) openat$kvm(0xffffffffffffff9c, &(0x7f0000001240), 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000001280)={0x0, 0x0, 0xfffff000, 0x2000, &(0x7f0000000000/0x2000)=nil}) r0 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KVM_RUN(r0, 0xae80, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f00000012c0)={0x4, 0x1, 0x0, 0x2000, &(0x7f0000002000/0x2000)=nil}) ioctl$KVM_RUN(r0, 0xae80, 0x0) 0s ago: executing program 2 (id=602): r0 = openat$dm_control(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) readv(r0, &(0x7f00000000c0)=[{&(0x7f0000000000)=""/74, 0x4a}], 0x1) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x8080, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000140)={'syzkaller0\x00', 0x2}) ioctl$TUNSETTXFILTER(r1, 0x400454d1, &(0x7f0000000180)={0x1, 0x1, [@broadcast]}) (async) ioctl$TUNSETTXFILTER(r1, 0x400454d1, &(0x7f0000000180)={0x1, 0x1, [@broadcast]}) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f00000001c0)={'syzkaller0\x00', 0x1}) r3 = socket$inet(0x2, 0x2, 0x0) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000200)='syzkaller0\x00', 0xb) (async) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000200)='syzkaller0\x00', 0xb) sendto$inet(r3, 0x0, 0x0, 0x0, &(0x7f0000000240)={0x2, 0x4e20, @loopback}, 0x10) ioctl$DM_DEV_CREATE(r0, 0xc138fd03, &(0x7f0000000640)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x20000, 0x0, 0x0, {0x0, {'syz', 0x0, '2\x00'}}}) (async) ioctl$DM_DEV_CREATE(r0, 0xc138fd03, &(0x7f0000000640)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x20000, 0x0, 0x0, {0x0, {'syz', 0x0, '2\x00'}}}) ioctl$DM_TABLE_LOAD(r0, 0xc138fd09, &(0x7f0000000940)={0x4, 0x0, 0x0, 0x1b8, 0x138, 0x1, 0x0, 0xc010, 0x0, 0x0, @by_dev={r4}, [@snapshot={0x0, 0x8, 0x0, 0x4f, 'snapshot\x00', {@ram_num={'1:', 0x0}, 0x20, @ram={'/dev/ram', 0x0}, 0x20, 'p', 0x20, '7', ' 2 discard_zeroes_cow discard_passdown_origin'}}]}) fadvise64(r0, 0x5, 0x6, 0x5) (async) fadvise64(r0, 0x5, 0x6, 0x5) kernel console output (not intermixed with test programs): sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tun_socket permissive=1 [ 28.518328][ T9] usb 2-1: new full-speed USB device number 3 using dummy_hcd [ 28.656593][ T36] audit: type=1400 audit(2000000002.470:297): avc: denied { create } for pid=447 comm="syz.0.39" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 28.677280][ T36] audit: type=1400 audit(2000000002.480:298): avc: denied { connect } for pid=447 comm="syz.0.39" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 28.699283][ T36] audit: type=1400 audit(2000000002.520:299): avc: denied { read write } for pid=449 comm="syz.0.40" name="vhost-vsock" dev="devtmpfs" ino=200 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 28.705200][ T9] usb 2-1: config 1 interface 0 has no altsetting 0 [ 28.723309][ T36] audit: type=1400 audit(2000000002.520:300): avc: denied { open } for pid=449 comm="syz.0.40" path="/dev/vhost-vsock" dev="devtmpfs" ino=200 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 28.731810][ T66] usb 3-1: USB disconnect, device number 2 [ 28.754041][ T36] audit: type=1400 audit(2000000002.520:301): avc: denied { ioctl } for pid=449 comm="syz.0.40" path="/dev/vhost-vsock" dev="devtmpfs" ino=200 ioctlcmd=0xaf11 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 28.770150][ T9] usb 2-1: string descriptor 0 read error: -22 [ 28.784421][ T36] audit: type=1400 audit(2000000002.520:302): avc: denied { read } for pid=449 comm="syz.0.40" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 28.796006][ T9] usb 2-1: New USB device found, idVendor=04b4, idProduct=0001, bcdDevice= 0.40 [ 28.810623][ T36] audit: type=1400 audit(2000000002.580:303): avc: denied { write } for pid=449 comm="syz.0.40" name="rtc0" dev="devtmpfs" ino=195 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 28.820047][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 28.853621][ T36] audit: type=1400 audit(2000000002.580:304): avc: denied { ioctl } for pid=449 comm="syz.0.40" path="/dev/rtc0" dev="devtmpfs" ino=195 ioctlcmd=0x7003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 28.878802][ T36] audit: type=1400 audit(2000000002.580:305): avc: denied { create } for pid=449 comm="syz.0.40" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 29.080553][ T9] usbhid 2-1:1.0: can't add hid device: -71 [ 29.086727][ T9] usbhid 2-1:1.0: probe with driver usbhid failed with error -71 [ 29.097476][ T9] usb 2-1: USB disconnect, device number 3 [ 29.249108][ T461] input: AT Translated Set 2 keyboard as /devices/platform/i8042/serio0/input/input7 [ 29.798534][ T311] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 29.938308][ T311] usb 1-1: device descriptor read/64, error -71 [ 30.048289][ T66] usb 2-1: new full-speed USB device number 4 using dummy_hcd [ 30.178286][ T311] usb 1-1: device descriptor read/64, error -71 [ 30.219029][ T66] usb 2-1: not running at top speed; connect to a high speed hub [ 30.227645][ T66] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 30.237897][ T66] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 30.257434][ T66] usb 2-1: New USB device found, idVendor=225a, idProduct=e1d4, bcdDevice=a7.ad [ 30.266629][ T66] usb 2-1: New USB device strings: Mfr=245, Product=194, SerialNumber=0 [ 30.275398][ T66] usb 2-1: Product: syz [ 30.279688][ T66] usb 2-1: Manufacturer: syz [ 30.301613][ T66] usb 2-1: Found UVC 1.00 device syz (225a:e1d4) [ 30.308040][ T66] usb 2-1: Failed to create links for entity 1 [ 30.328261][ T66] usb 2-1: Failed to register entities (-22). [ 30.418305][ T311] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 30.501538][ T490] 9pnet_fd: Insufficient options for proto=fd [ 30.508031][ T490] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 30.522206][ T423] usb 2-1: USB disconnect, device number 4 [ 30.558303][ T311] usb 1-1: device descriptor read/64, error -71 [ 30.798295][ T311] usb 1-1: device descriptor read/64, error -71 [ 30.830572][ T66] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 30.908431][ T311] usb usb1-port1: attempt power cycle [ 30.989096][ T66] usb 3-1: Using ep0 maxpacket: 32 [ 30.995287][ T66] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 31.006202][ T66] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 31.015970][ T66] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 31.028835][ T66] usb 3-1: New USB device found, idVendor=0458, idProduct=5011, bcdDevice= 0.00 [ 31.037861][ T66] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 31.046672][ T66] usb 3-1: config 0 descriptor?? [ 31.223317][ T516] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 31.268310][ T311] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 31.289568][ T311] usb 1-1: device descriptor read/8, error -71 [ 31.311509][ T66] input: HID 0458:5011 as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/0003:0458:5011.0002/input/input8 [ 31.322873][ T9] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 31.331276][ T66] input: HID 0458:5011 as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/0003:0458:5011.0002/input/input9 [ 31.348966][ T66] kye 0003:0458:5011.0002: input,hiddev96,hidraw0: USB HID v0.00 Mouse [HID 0458:5011] on usb-dummy_hcd.2-1/input0 [ 31.419249][ T311] usb 1-1: device descriptor read/8, error -71 [ 31.488287][ T9] usb 2-1: Using ep0 maxpacket: 32 [ 31.494409][ T9] usb 2-1: config 0 has an invalid interface number: 67 but max is 0 [ 31.502686][ T9] usb 2-1: config 0 has no interface number 0 [ 31.510620][ T9] usb 2-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 31.519761][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 31.527738][ T9] usb 2-1: Product: syz [ 31.531896][ T9] usb 2-1: Manufacturer: syz [ 31.536485][ T9] usb 2-1: SerialNumber: syz [ 31.541604][ T9] usb 2-1: config 0 descriptor?? [ 31.547640][ T9] smsc95xx v2.0.0 [ 31.549918][ T423] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 31.658298][ T311] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 31.679267][ T311] usb 1-1: device descriptor read/8, error -71 [ 31.708272][ T423] usb 4-1: Using ep0 maxpacket: 32 [ 31.714407][ T423] usb 4-1: config 0 has an invalid interface number: 184 but max is 0 [ 31.722596][ T423] usb 4-1: config 0 has no interface number 0 [ 31.728691][ T423] usb 4-1: config 0 interface 184 has no altsetting 0 [ 31.736787][ T423] usb 4-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 31.745846][ T423] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 31.753845][ T423] usb 4-1: Product: syz [ 31.757979][ T423] usb 4-1: Manufacturer: syz [ 31.762576][ T423] usb 4-1: SerialNumber: syz [ 31.767794][ T423] usb 4-1: config 0 descriptor?? [ 31.773459][ T423] smsc75xx v1.0.0 [ 31.809273][ T311] usb 1-1: device descriptor read/8, error -71 [ 31.918363][ T311] usb usb1-port1: unable to enumerate USB device [ 31.949286][ T9] smsc95xx 2-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -32 [ 31.960035][ T9] smsc95xx 2-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 32.948292][ T66] usb 1-1: new full-speed USB device number 7 using dummy_hcd [ 32.975390][ T521] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 32.983926][ T521] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 33.099252][ T66] usb 1-1: too many endpoints for config 1 interface 0 altsetting 0: 255, using maximum allowed: 30 [ 33.110090][ T66] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 33.121159][ T66] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 517, setting to 64 [ 33.131971][ T66] usb 1-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 255 [ 33.145768][ T66] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 33.155039][ T66] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 33.163053][ T66] usb 1-1: SerialNumber: syz [ 33.168825][ T530] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 33.572542][ T9] smsc95xx 2-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000038: -61 [ 33.583353][ T9] smsc95xx 2-1:0.67: probe with driver smsc95xx failed with error -61 [ 33.601336][ T312] usb 3-1: USB disconnect, device number 3 [ 33.634613][ T36] kauditd_printk_skb: 27 callbacks suppressed [ 33.634642][ T36] audit: type=1400 audit(2000000007.450:333): avc: denied { read } for pid=535 comm="syz.2.64" name="usbmon0" dev="devtmpfs" ino=87 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 33.665579][ T36] audit: type=1400 audit(2000000007.450:334): avc: denied { open } for pid=535 comm="syz.2.64" path="/dev/usbmon0" dev="devtmpfs" ino=87 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 33.688904][ T36] audit: type=1400 audit(2000000007.460:335): avc: denied { ioctl } for pid=535 comm="syz.2.64" path="/dev/usbmon0" dev="devtmpfs" ino=87 ioctlcmd=0x9207 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 33.758602][ T539] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 33.767150][ T539] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 33.775813][ T539] netlink: 104 bytes leftover after parsing attributes in process `syz.3.65'. [ 33.797453][ T9] usb 2-1: USB disconnect, device number 5 [ 33.869145][ T536] input: AT Translated Set 2 keyboard as /devices/platform/i8042/serio0/input/input10 [ 34.310844][ T36] audit: type=1400 audit(2000000008.130:336): avc: denied { setopt } for pid=547 comm="syz.3.69" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 34.330893][ T36] audit: type=1400 audit(2000000008.130:337): avc: denied { append } for pid=548 comm="syz.1.68" name="loop2" dev="devtmpfs" ino=51 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 34.354851][ T36] audit: type=1400 audit(2000000008.130:338): avc: denied { map } for pid=548 comm="syz.1.68" path="/dev/loop2" dev="devtmpfs" ino=51 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 34.382337][ T36] audit: type=1400 audit(2000000008.130:339): avc: denied { execute } for pid=548 comm="syz.1.68" path="/dev/loop2" dev="devtmpfs" ino=51 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 34.406399][ T36] audit: type=1400 audit(2000000008.150:340): avc: denied { accept } for pid=547 comm="syz.3.69" lport=255 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 34.426710][ T36] audit: type=1400 audit(2000000008.170:341): avc: denied { bind } for pid=547 comm="syz.3.69" lport=255 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 34.451683][ T565] Zero length message leads to an empty skb [ 34.729063][ T574] input: AT Translated Set 2 keyboard as /devices/platform/i8042/serio0/input/input11 [ 34.744765][ T36] audit: type=1400 audit(2000000008.560:342): avc: denied { unmount } for pid=297 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=filesystem permissive=1 [ 34.793205][ T582] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 34.801897][ T582] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 34.822812][ T581] tc_dump_action: action bad kind [ 35.209205][ T599] FAULT_INJECTION: forcing a failure. [ 35.209205][ T599] name failslab, interval 1, probability 0, space 0, times 1 [ 35.221887][ T599] CPU: 0 UID: 0 PID: 599 Comm: syz.1.82 Not tainted syzkaller #0 1c9c13191c392e8d374fa2f59d394ca06c0f036a [ 35.221914][ T599] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 35.221932][ T599] Call Trace: [ 35.221938][ T599] [ 35.221944][ T599] __dump_stack+0x21/0x30 [ 35.221968][ T599] dump_stack_lvl+0x140/0x1c0 [ 35.221984][ T599] ? __cfi_dump_stack_lvl+0x10/0x10 [ 35.222000][ T599] ? selinux_kernfs_init_security+0x14b/0x4b0 [ 35.222024][ T599] dump_stack+0x19/0x20 [ 35.222039][ T599] should_fail_ex+0x3c2/0x510 [ 35.222056][ T599] should_failslab+0xac/0x100 [ 35.222074][ T599] kmem_cache_alloc_noprof+0x42/0x410 [ 35.222097][ T599] ? __kernfs_new_node+0xf1/0x740 [ 35.222117][ T599] __kernfs_new_node+0xf1/0x740 [ 35.222135][ T599] ? kernfs_new_node+0x280/0x280 [ 35.222152][ T599] ? down_write+0xee/0x2b0 [ 35.222173][ T599] ? __cfi_down_write+0x10/0x10 [ 35.222195][ T599] ? __kasan_check_write+0x18/0x20 [ 35.222218][ T599] ? up_write+0x66/0x280 [ 35.222238][ T599] kernfs_new_node+0x154/0x280 [ 35.222257][ T599] kernfs_create_link+0xa8/0x200 [ 35.222278][ T599] sysfs_do_create_link_sd+0x8a/0x120 [ 35.222295][ T599] sysfs_create_link+0x6c/0x90 [ 35.222310][ T599] device_add_class_symlinks+0x1dd/0x260 [ 35.222332][ T599] device_add+0x4b8/0xbf0 [ 35.222350][ T599] netdev_register_kobject+0x196/0x330 [ 35.222382][ T599] register_netdevice+0x1042/0x1a80 [ 35.222399][ T599] ? kasan_save_alloc_info+0x3a/0x50 [ 35.222422][ T599] ? __cfi_register_netdevice+0x10/0x10 [ 35.222440][ T599] ipip6_tunnel_create+0x160/0x2e0 [ 35.222462][ T599] ipip6_tunnel_locate+0x51c/0x7a0 [ 35.222482][ T599] ? skb_clone_writable+0x1e0/0x1e0 [ 35.222503][ T599] ? ns_capable+0x90/0xf0 [ 35.222520][ T599] ipip6_tunnel_ctl+0xc68/0x15b0 [ 35.222541][ T599] ip_tunnel_siocdevprivate+0x131/0x1e0 [ 35.222561][ T599] ? __cfi_ip_tunnel_siocdevprivate+0x10/0x10 [ 35.222583][ T599] ipip6_tunnel_siocdevprivate+0x24f/0xe20 [ 35.222604][ T599] ? __cfi_ipip6_tunnel_siocdevprivate+0x10/0x10 [ 35.222626][ T599] ? full_name_hash+0xa1/0xf0 [ 35.222651][ T599] dev_ifsioc+0x94e/0xc10 [ 35.222669][ T599] dev_ioctl+0xa62/0x1000 [ 35.222689][ T599] sock_ioctl+0x74e/0x7e0 [ 35.222705][ T599] ? __cfi_sock_ioctl+0x10/0x10 [ 35.222721][ T599] ? __fget_files+0x2bc/0x330 [ 35.222739][ T599] ? bpf_lsm_file_ioctl+0xd/0x20 [ 35.222757][ T599] ? security_file_ioctl+0x3e/0x110 [ 35.222780][ T599] ? __cfi_sock_ioctl+0x10/0x10 [ 35.222795][ T599] __se_sys_ioctl+0x123/0x1b0 [ 35.222813][ T599] __x64_sys_ioctl+0x7f/0xa0 [ 35.222830][ T599] x64_sys_call+0x1878/0x2ee0 [ 35.222847][ T599] do_syscall_64+0x57/0xf0 [ 35.222864][ T599] ? clear_bhb_loop+0x50/0xa0 [ 35.222886][ T599] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 35.222907][ T599] RIP: 0033:0x7f129679fb19 [ 35.222928][ T599] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 35.222941][ T599] RSP: 002b:00007f1297673028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 35.222965][ T599] RAX: ffffffffffffffda RBX: 00007f1296a25fa0 RCX: 00007f129679fb19 [ 35.222978][ T599] RDX: 0000200000000140 RSI: 00000000000089f1 RDI: 0000000000000006 [ 35.222990][ T599] RBP: 00007f1296837b70 R08: 0000000000000000 R09: 0000000000000000 [ 35.223001][ T599] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 35.223012][ T599] R13: 00007f1296a26038 R14: 00007f1296a25fa0 R15: 00007fffdbb082e8 [ 35.223026][ T599] [ 35.629888][ T66] cdc_acm 1-1:1.0: ttyACM0: USB ACM device [ 35.638923][ T66] usb 1-1: USB disconnect, device number 7 [ 35.667207][ T619] ./dev: Can't lookup blockdev [ 35.789299][ T603] input: AT Translated Set 2 keyboard as /devices/platform/i8042/serio0/input/input12 [ 35.849741][ T631] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 35.859050][ T631] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 35.948355][ T311] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 36.099260][ T311] usb 2-1: config 0 interface 0 altsetting 8 endpoint 0x81 has an invalid bInterval 253, changing to 11 [ 36.110490][ T311] usb 2-1: config 0 interface 0 altsetting 8 endpoint 0x81 has invalid maxpacket 1544, setting to 1024 [ 36.121567][ T311] usb 2-1: config 0 interface 0 altsetting 8 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 36.134377][ T311] usb 2-1: config 0 interface 0 has no altsetting 0 [ 36.141012][ T311] usb 2-1: New USB device found, idVendor=1e7d, idProduct=2dbe, bcdDevice= 0.00 [ 36.150064][ T311] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 36.158617][ T311] usb 2-1: config 0 descriptor?? [ 36.163847][ T621] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 36.381301][ T638] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 36.389833][ T638] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 36.398693][ T638] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 36.407117][ T638] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 36.518278][ T31] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 36.574394][ T311] usbhid 2-1:0.0: can't add hid device: -71 [ 36.580371][ T311] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 36.590295][ T311] usb 2-1: USB disconnect, device number 6 [ 36.678275][ T31] usb 1-1: Using ep0 maxpacket: 32 [ 36.684377][ T31] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 36.695275][ T31] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 36.705032][ T31] usb 1-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 36.714079][ T31] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 36.722584][ T31] usb 1-1: config 0 descriptor?? [ 36.728466][ T31] hub 1-1:0.0: USB hub found [ 36.984721][ T634] fuse: Unknown parameter '000000000000000000080000000000000000001000000000000000000000' [ 36.996150][ T634] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 37.005412][ T634] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 37.089320][ T31] hub 1-1:0.0: config failed, can't read hub descriptor (err -22) [ 37.090546][ T660] netlink: 68 bytes leftover after parsing attributes in process `syz.1.101'. [ 37.098770][ T31] usbhid 1-1:0.0: can't add hid device: -71 [ 37.106469][ T661] netlink: 68 bytes leftover after parsing attributes in process `syz.1.101'. [ 37.112157][ T31] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 37.121219][ T660] netlink: 'syz.1.101': attribute type 12 has an invalid length. [ 37.149595][ T31] usb 1-1: USB disconnect, device number 8 [ 37.224783][ T665] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 37.233799][ T665] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 37.378280][ T311] usb 2-1: new full-speed USB device number 7 using dummy_hcd [ 37.529312][ T311] usb 2-1: config 0 has an invalid interface number: 1 but max is 0 [ 37.537344][ T311] usb 2-1: config 0 has no interface number 0 [ 37.543460][ T311] usb 2-1: config 0 interface 1 altsetting 128 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 37.554609][ T311] usb 2-1: config 0 interface 1 altsetting 128 endpoint 0x81 has invalid wMaxPacketSize 0 [ 37.564520][ T311] usb 2-1: config 0 interface 1 altsetting 128 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 37.577470][ T311] usb 2-1: config 0 interface 1 has no altsetting 0 [ 37.584074][ T311] usb 2-1: New USB device found, idVendor=145f, idProduct=0212, bcdDevice= 0.00 [ 37.593107][ T311] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 37.602447][ T311] usb 2-1: config 0 descriptor?? [ 37.768434][ T673] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 37.776975][ T673] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 37.801742][ T673] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 37.810686][ T673] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 38.028456][ T423] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): Failed to write reg index 0x00000040: -110 [ 38.039490][ T423] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): Error writing E2P_CMD [ 38.048864][ T423] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -32 [ 38.059719][ T423] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -32 [ 38.068284][ T9] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 38.069398][ T423] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_reset [ 38.087112][ T423] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -32 [ 38.096548][ T423] smsc75xx 4-1:0.184: probe with driver smsc75xx failed with error -32 [ 38.198283][ T9] usb 3-1: device descriptor read/64, error -71 [ 38.212674][ T311] uclogic 0003:145F:0212.0003: failed retrieving string descriptor #100: -71 [ 38.221514][ T311] uclogic 0003:145F:0212.0003: failed retrieving pen parameters: -71 [ 38.229628][ T311] uclogic 0003:145F:0212.0003: pen probing failed: -71 [ 38.236498][ T311] uclogic 0003:145F:0212.0003: failed probing parameters: -71 [ 38.243997][ T311] uclogic 0003:145F:0212.0003: probe with driver uclogic failed with error -71 [ 38.254101][ T311] usb 2-1: USB disconnect, device number 7 [ 38.438283][ T9] usb 3-1: device descriptor read/64, error -71 [ 38.468311][ T687] netlink: 4 bytes leftover after parsing attributes in process `syz.0.109'. [ 38.501223][ T687] netlink: 12 bytes leftover after parsing attributes in process `syz.0.109'. [ 38.517659][ T687] netlink: 20 bytes leftover after parsing attributes in process `syz.0.109'. [ 38.688295][ T9] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 38.799047][ T694] input: AT Translated Set 2 keyboard as /devices/platform/i8042/serio0/input/input13 [ 38.818395][ T9] usb 3-1: device descriptor read/64, error -71 [ 38.823118][ T701] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 38.833117][ T701] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 38.878319][ T311] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 38.968294][ T423] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 39.038292][ T311] usb 1-1: Using ep0 maxpacket: 8 [ 39.044376][ T311] usb 1-1: config 179 has an invalid interface number: 65 but max is 0 [ 39.052657][ T311] usb 1-1: config 179 has no interface number 0 [ 39.058277][ T9] usb 3-1: device descriptor read/64, error -71 [ 39.058918][ T311] usb 1-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 39.076157][ T311] usb 1-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 39.087515][ T311] usb 1-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 39.098705][ T311] usb 1-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 39.110141][ T311] usb 1-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 39.123370][ T311] usb 1-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 39.132415][ T423] usb 2-1: Using ep0 maxpacket: 32 [ 39.137552][ T311] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 39.147128][ T696] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 39.157346][ T423] usb 2-1: config 0 has an invalid interface number: 67 but max is 0 [ 39.165504][ T423] usb 2-1: config 0 has no interface number 0 [ 39.173014][ T423] usb 2-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 39.178376][ T9] usb usb3-port1: attempt power cycle [ 39.182141][ T423] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 39.195497][ T423] usb 2-1: Product: syz [ 39.199693][ T423] usb 2-1: Manufacturer: syz [ 39.204291][ T423] usb 2-1: SerialNumber: syz [ 39.209527][ T423] usb 2-1: config 0 descriptor?? [ 39.215161][ T423] smsc95xx v2.0.0 [ 39.353663][ T703] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 39.362456][ T703] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 39.518278][ T9] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 39.539266][ T9] usb 3-1: device descriptor read/8, error -71 [ 39.571263][ T696] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 39.579841][ T696] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 39.588144][ T350] usb 1-1: USB disconnect, device number 9 [ 39.588144][ C1] xpad 1-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 39.588286][ C1] xpad 1-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 39.616042][ T423] smsc95xx 2-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -32 [ 39.626742][ T423] smsc95xx 2-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 39.669279][ T9] usb 3-1: device descriptor read/8, error -71 [ 39.908292][ T9] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 39.929371][ T9] usb 3-1: device descriptor read/8, error -71 [ 40.037164][ T36] kauditd_printk_skb: 24 callbacks suppressed [ 40.037188][ T36] audit: type=1326 audit(2000000013.850:367): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=707 comm="syz.3.117" exe="/root/ci2-android-6-12-rust/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fa8a0d9fb19 code=0x0 [ 40.068260][ T36] audit: type=1400 audit(2000000013.850:368): avc: denied { create } for pid=707 comm="syz.3.117" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_nflog_socket permissive=1 [ 40.089821][ T9] usb 3-1: device descriptor read/8, error -71 [ 40.115954][ T36] audit: type=1400 audit(2000000013.930:369): avc: denied { unlink } for pid=714 comm="syz.0.119" name="#1" dev="tmpfs" ino=124 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 40.116983][ T715] overlayfs: workdir is in-use as upperdir/workdir of another mount, accessing files from both mounts will result in undefined behavior. [ 40.152904][ T715] overlayfs: conflicting lowerdir path [ 40.198368][ T9] usb usb3-port1: unable to enumerate USB device [ 40.408281][ T311] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 40.559624][ T311] usb 1-1: unable to get BOS descriptor or descriptor too short [ 40.568018][ T311] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 40.578183][ T311] usb 1-1: config 1 has 0 interfaces, different from the descriptor's value: 3 [ 40.588464][ T311] usb 1-1: New USB device found, idVendor=200c, idProduct=100b, bcdDevice= 0.40 [ 40.597527][ T311] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 40.605558][ T311] usb 1-1: Product: syz [ 40.609738][ T311] usb 1-1: Manufacturer: syz [ 40.614323][ T311] usb 1-1: SerialNumber: syz [ 40.822085][ T717] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 40.831014][ T717] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 40.881276][ T36] audit: type=1400 audit(2000000014.700:370): avc: denied { name_bind } for pid=721 comm="syz.3.122" src=20000 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=tcp_socket permissive=1 [ 40.903627][ T36] audit: type=1400 audit(2000000014.700:371): avc: denied { node_bind } for pid=721 comm="syz.3.122" src=20000 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 40.968124][ T36] audit: type=1400 audit(2000000014.780:372): avc: denied { write } for pid=723 comm="syz.3.123" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=key permissive=1 [ 40.969096][ T724] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=14 sclass=netlink_route_socket pid=724 comm=syz.3.123 [ 41.013352][ T36] audit: type=1400 audit(2000000014.830:373): avc: denied { ioctl } for pid=725 comm="syz.3.124" path="/dev/binderfs/binder_logs/transaction_log" dev="binder" ino=1048633 ioctlcmd=0x1500 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 41.042221][ T66] usb 1-1: USB disconnect, device number 10 [ 41.058719][ T731] FAULT_INJECTION: forcing a failure. [ 41.058719][ T731] name failslab, interval 1, probability 0, space 0, times 0 [ 41.071543][ T731] CPU: 0 UID: 0 PID: 731 Comm: syz.3.125 Not tainted syzkaller #0 1c9c13191c392e8d374fa2f59d394ca06c0f036a [ 41.071569][ T731] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 41.071580][ T731] Call Trace: [ 41.071586][ T731] [ 41.071593][ T731] __dump_stack+0x21/0x30 [ 41.071614][ T731] dump_stack_lvl+0x140/0x1c0 [ 41.071630][ T731] ? __cfi_dump_stack_lvl+0x10/0x10 [ 41.071647][ T731] ? __d_add+0x636/0xac0 [ 41.071664][ T731] dump_stack+0x19/0x20 [ 41.071679][ T731] should_fail_ex+0x3c2/0x510 [ 41.071695][ T731] should_failslab+0xac/0x100 [ 41.071713][ T731] kmem_cache_alloc_lru_noprof+0x44/0x410 [ 41.071739][ T731] ? __d_alloc+0x42/0x8c0 [ 41.071761][ T731] __d_alloc+0x42/0x8c0 [ 41.071782][ T731] d_alloc_parallel+0xe4/0x1370 [ 41.071803][ T731] ? __kasan_check_write+0x18/0x20 [ 41.071824][ T731] ? security_inode_permission+0x77/0x150 [ 41.071846][ T731] ? downgrade_write+0x470/0x470 [ 41.071866][ T731] ? __d_lookup+0x4e8/0x550 [ 41.071881][ T731] ? __cfi_d_alloc_parallel+0x10/0x10 [ 41.071903][ T731] ? down_read+0x7f/0xe0 [ 41.071925][ T731] ? __cfi_down_read+0x10/0x10 [ 41.071949][ T731] path_openat+0xa09/0x35a0 [ 41.071972][ T731] ? x64_sys_call+0xe69/0x2ee0 [ 41.071993][ T731] ? do_filp_open+0x440/0x440 [ 41.072009][ T731] do_filp_open+0x1f2/0x440 [ 41.072023][ T731] ? __cfi_do_filp_open+0x10/0x10 [ 41.072042][ T731] ? __cfi_kfree_link+0x10/0x10 [ 41.072064][ T731] ? alloc_fd+0x4c1/0x570 [ 41.072082][ T731] do_sys_openat2+0x134/0x1d0 [ 41.072103][ T731] ? do_sys_open+0x100/0x100 [ 41.072116][ T731] ? is_dma_buf_file+0x11/0x50 [ 41.072128][ T731] __x64_sys_openat+0x13a/0x170 [ 41.072140][ T731] x64_sys_call+0xe69/0x2ee0 [ 41.072150][ T731] do_syscall_64+0x57/0xf0 [ 41.072160][ T731] ? clear_bhb_loop+0x50/0xa0 [ 41.072192][ T731] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 41.072216][ T731] RIP: 0033:0x7fa8a0d6034e [ 41.072232][ T731] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 41.072247][ T731] RSP: 002b:00007fa8a1c12ec8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 41.072260][ T731] RAX: ffffffffffffffda RBX: 00007fa8a1c136c0 RCX: 00007fa8a0d6034e [ 41.072267][ T731] RDX: 0000000000000002 RSI: 00007fa8a1c12f90 RDI: ffffffffffffff9c [ 41.072274][ T731] RBP: 00007fa8a0e37b70 R08: 0000000000000000 R09: 0000000000000000 [ 41.072280][ T731] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 41.072286][ T731] R13: 00007fa8a1026038 R14: 00007fa8a1025fa0 R15: 00007ffd6691e798 [ 41.072294][ T731] [ 41.240891][ T423] smsc95xx 2-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000038: -61 [ 41.348662][ T423] smsc95xx 2-1:0.67: probe with driver smsc95xx failed with error -61 [ 41.368335][ T9] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 41.447114][ T423] usb 2-1: USB disconnect, device number 8 [ 41.519425][ T9] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 41.529237][ T9] usb 3-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 41.538293][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 41.546759][ T9] usb 3-1: config 0 descriptor?? [ 41.552676][ T9] usbhid 3-1:0.0: couldn't find an input interrupt endpoint [ 41.602584][ T736] overlayfs: missing 'lowerdir' [ 41.602584][ T735] overlayfs: missing 'lowerdir' [ 41.668032][ T742] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x118010 [ 41.677260][ T742] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 41.686002][ T742] flags: 0x4000000000000040(head|zone=1) [ 41.691682][ T742] page_type: f5(slab) [ 41.695660][ T742] raw: 4000000000000040 ffff888100042140 dead000000000122 0000000000000000 [ 41.704290][ T742] raw: 0000000000000000 0000000000040004 00000001f5000000 0000000000000000 [ 41.712895][ T742] head: 4000000000000040 ffff888100042140 dead000000000122 0000000000000000 [ 41.721737][ T742] head: 0000000000000000 0000000000040004 00000001f5000000 0000000000000000 [ 41.730573][ T742] head: 4000000000000003 ffffea0004600401 ffffffffffffffff 0000000000000000 [ 41.739332][ T742] head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000 [ 41.748051][ T742] page dumped because: unmovable page [ 41.752765][ T719] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 41.753703][ T742] page_owner tracks the page as allocated [ 41.763529][ T719] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 41.768681][ T742] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 342, tgid 342 (udevd), ts 31391230165, free_ts 31339673237 [ 41.775335][ T36] audit: type=1400 audit(2000000015.580:374): avc: denied { read } for pid=93 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 41.797819][ T742] post_alloc_hook+0x37d/0x3b0 [ 41.822691][ T36] audit: type=1400 audit(2000000015.580:375): avc: denied { search } for pid=93 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 41.828896][ T742] prep_new_page+0x2d/0x180 [ 41.845794][ T36] audit: type=1400 audit(2000000015.580:376): avc: denied { write } for pid=93 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 41.853956][ T742] get_page_from_freelist+0x4aea/0x4ba0 [ 41.876149][ T742] __alloc_pages_noprof+0x35a/0x7e0 [ 41.881395][ T742] alloc_slab_page+0x6b/0x1e0 [ 41.886098][ T742] allocate_slab+0x69/0x430 [ 41.890640][ T742] ___slab_alloc+0x591/0x8c0 [ 41.895219][ T742] __kmalloc_node_noprof+0x2e7/0x500 [ 41.900513][ T742] __kvmalloc_node_noprof+0x128/0x300 [ 41.905877][ T742] seq_read_iter+0x215/0xf30 [ 41.910470][ T742] kernfs_fop_read_iter+0x149/0x570 [ 41.915656][ T742] vfs_read+0x611/0xc70 [ 41.919816][ T742] ksys_read+0x145/0x260 [ 41.924051][ T742] __x64_sys_read+0x7f/0x90 [ 41.928547][ T742] x64_sys_call+0x2638/0x2ee0 [ 41.933212][ T742] do_syscall_64+0x57/0xf0 [ 41.937627][ T742] page last free pid 341 tgid 341 stack trace: [ 41.943773][ T742] free_unref_page+0xb99/0xf50 [ 41.948556][ T742] __free_pages+0x6b/0x3b0 [ 41.952964][ T742] __free_slab+0xb2/0x110 [ 41.957298][ T742] free_slab+0x18/0xe0 [ 41.961364][ T742] __put_partials+0x115/0x150 [ 41.966023][ T742] put_cpu_partial+0x91/0xc0 [ 41.970615][ T742] __slab_free+0x1cf/0x2a0 [ 41.975019][ T742] ___cache_free+0xc9/0xe0 [ 41.979440][ T742] qlist_free_all+0xb5/0x130 [ 41.984015][ T742] kasan_quarantine_reduce+0x14f/0x180 [ 41.989478][ T742] __kasan_slab_alloc+0x28/0x90 [ 41.994312][ T742] kmem_cache_alloc_noprof+0x1bf/0x410 [ 41.999775][ T742] getname_flags+0xcc/0x6b0 [ 42.004264][ T742] do_readlinkat+0xcd/0x520 [ 42.008826][ T742] __x64_sys_readlink+0x83/0xa0 [ 42.013665][ T742] x64_sys_call+0x155b/0x2ee0 [ 42.418311][ T423] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 42.500648][ T813] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 42.509245][ T813] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 42.550600][ T423] usb 2-1: device descriptor read/64, error -71 [ 42.647263][ T838] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 42.655797][ T838] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 42.666084][ T838] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 42.674661][ T838] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 42.683306][ T838] netlink: 8 bytes leftover after parsing attributes in process `syz.2.149'. [ 42.788335][ T423] usb 2-1: device descriptor read/64, error -71 [ 43.038281][ T423] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 43.168287][ T423] usb 2-1: device descriptor read/64, error -71 [ 43.283579][ T846] FAULT_INJECTION: forcing a failure. [ 43.283579][ T846] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 43.296951][ T846] CPU: 1 UID: 0 PID: 846 Comm: syz.2.153 Not tainted syzkaller #0 1c9c13191c392e8d374fa2f59d394ca06c0f036a [ 43.296980][ T846] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 43.296992][ T846] Call Trace: [ 43.296997][ T846] [ 43.297004][ T846] __dump_stack+0x21/0x30 [ 43.297027][ T846] dump_stack_lvl+0x140/0x1c0 [ 43.297043][ T846] ? __cfi_dump_stack_lvl+0x10/0x10 [ 43.297060][ T846] ? chrdev_open+0x4e8/0x610 [ 43.297077][ T846] ? __alloc_pages_noprof+0x7e0/0x7e0 [ 43.297098][ T846] dump_stack+0x19/0x20 [ 43.297114][ T846] should_fail_ex+0x3c2/0x510 [ 43.297131][ T846] should_fail_alloc_page+0xec/0x110 [ 43.297151][ T846] __alloc_pages_noprof+0x1c0/0x7e0 [ 43.297173][ T846] ? __cfi___alloc_pages_noprof+0x10/0x10 [ 43.297196][ T846] ? __kasan_kmalloc+0x96/0xb0 [ 43.297213][ T846] get_zeroed_page_noprof+0x1f/0x50 [ 43.297234][ T846] mon_alloc_buff+0x6a/0x280 [ 43.297253][ T846] mon_bin_open+0x1fd/0x540 [ 43.297271][ T846] chrdev_open+0x4e8/0x610 [ 43.297286][ T846] ? __cfi_chrdev_open+0x10/0x10 [ 43.297303][ T846] ? bpf_lsm_file_open+0xd/0x20 [ 43.297323][ T846] ? __cfi_chrdev_open+0x10/0x10 [ 43.297339][ T846] do_dentry_open+0x97c/0x1510 [ 43.297362][ T846] vfs_open+0x86/0x240 [ 43.297380][ T846] ? __cfi_vfs_open+0x10/0x10 [ 43.297400][ T846] ? may_open+0x352/0x430 [ 43.297419][ T846] path_openat+0x2c49/0x35a0 [ 43.297441][ T846] ? kasan_save_alloc_info+0x3a/0x50 [ 43.297463][ T846] ? getname+0x1b/0x30 [ 43.297478][ T846] ? x64_sys_call+0xe69/0x2ee0 [ 43.297496][ T846] ? do_syscall_64+0x57/0xf0 [ 43.297516][ T846] ? do_filp_open+0x440/0x440 [ 43.297537][ T846] do_filp_open+0x1f2/0x440 [ 43.297556][ T846] ? __cfi_do_filp_open+0x10/0x10 [ 43.297579][ T846] ? alloc_fd+0x4c1/0x570 [ 43.297597][ T846] do_sys_openat2+0x134/0x1d0 [ 43.297618][ T846] ? do_sys_open+0x100/0x100 [ 43.297638][ T846] ? __kasan_check_write+0x18/0x20 [ 43.297660][ T846] ? do_user_addr_fault+0xbf5/0x1230 [ 43.297680][ T846] __x64_sys_openat+0x13a/0x170 [ 43.297701][ T846] x64_sys_call+0xe69/0x2ee0 [ 43.297718][ T846] do_syscall_64+0x57/0xf0 [ 43.297735][ T846] ? clear_bhb_loop+0x50/0xa0 [ 43.297757][ T846] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 43.297787][ T846] RIP: 0033:0x7fae1f16034e [ 43.297802][ T846] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 43.297818][ T846] RSP: 002b:00007fae20036b28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 43.297837][ T846] RAX: ffffffffffffffda RBX: 00007fae200376c0 RCX: 00007fae1f16034e [ 43.297852][ T846] RDX: 0000000000000000 RSI: 00007fae20036c00 RDI: ffffffffffffff9c [ 43.297864][ T846] RBP: 00007fae20036c00 R08: 0000000000000000 R09: 0000000000000000 [ 43.297876][ T846] R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd [ 43.297889][ T846] R13: 00007fae1f426038 R14: 00007fae1f425fa0 R15: 00007ffed22c09a8 [ 43.297904][ T846] [ 43.648308][ T423] usb 2-1: device descriptor read/64, error -71 [ 43.722576][ T857] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 43.743196][ T857] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 43.758343][ T423] usb usb2-port1: attempt power cycle [ 44.098316][ T423] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 44.120726][ T423] usb 2-1: device descriptor read/8, error -71 [ 44.250925][ T423] usb 2-1: device descriptor read/8, error -71 [ 44.489704][ T423] usb 2-1: new high-speed USB device number 12 using dummy_hcd [ 44.509368][ T423] usb 2-1: device descriptor read/8, error -71 [ 44.639370][ T423] usb 2-1: device descriptor read/8, error -71 [ 44.748383][ T423] usb usb2-port1: unable to enumerate USB device [ 44.847947][ T865] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 44.858971][ T865] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 44.869319][ T865] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 44.879900][ T865] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 45.439023][ T869] GUP no longer grows the stack in syz.3.162 (869): 200000001000-200000c01000 (200000000240) [ 45.478338][ T869] CPU: 0 UID: 0 PID: 869 Comm: syz.3.162 Not tainted syzkaller #0 1c9c13191c392e8d374fa2f59d394ca06c0f036a [ 45.478368][ T869] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 45.478380][ T869] Call Trace: [ 45.478387][ T869] [ 45.478394][ T869] __dump_stack+0x21/0x30 [ 45.478418][ T869] dump_stack_lvl+0x140/0x1c0 [ 45.478435][ T869] ? __cfi_dump_stack_lvl+0x10/0x10 [ 45.478453][ T869] ? find_vma+0xd3/0x120 [ 45.478480][ T869] dump_stack+0x19/0x20 [ 45.478495][ T869] fixup_user_fault+0x616/0x6a0 [ 45.478515][ T869] fault_in_user_writeable+0x75/0xe0 [ 45.478534][ T869] futex_lock_pi+0x2ed/0xa70 [ 45.478554][ T869] ? plist_check_list+0x2a8/0x2c0 [ 45.478575][ T869] ? __cfi_futex_lock_pi+0x10/0x10 [ 45.478603][ T869] ? plist_del+0x3f0/0x410 [ 45.478622][ T869] ? __kasan_check_write+0x18/0x20 [ 45.478649][ T869] ? wake_up_q+0x10a/0x1c0 [ 45.478671][ T869] ? __cfi_futex_wake_mark+0x10/0x10 [ 45.478694][ T869] ? call_rcu_hurry+0x30/0x30 [ 45.478719][ T869] do_futex+0x270/0x510 [ 45.478738][ T869] ? percpu_counter_add_batch+0x105/0x1a0 [ 45.478764][ T869] ? __cfi_do_futex+0x10/0x10 [ 45.478783][ T869] __se_sys_futex+0x13c/0x320 [ 45.478803][ T869] ? __x64_sys_futex+0x110/0x110 [ 45.478823][ T869] ? __kasan_check_write+0x18/0x20 [ 45.478846][ T869] __x64_sys_futex+0xe9/0x110 [ 45.478865][ T869] x64_sys_call+0x227f/0x2ee0 [ 45.478884][ T869] do_syscall_64+0x57/0xf0 [ 45.478902][ T869] ? clear_bhb_loop+0x50/0xa0 [ 45.478926][ T869] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 45.478948][ T869] RIP: 0033:0x7fa8a0d9fb19 [ 45.478964][ T869] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 45.478978][ T869] RSP: 002b:00007fa8a1c13028 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 45.478997][ T869] RAX: ffffffffffffffda RBX: 00007fa8a1025fa0 RCX: 00007fa8a0d9fb19 [ 45.479011][ T869] RDX: 0000000000000002 RSI: 0000000000000086 RDI: 0000200000000240 [ 45.479023][ T869] RBP: 00007fa8a0e37b70 R08: 0000200000000240 R09: 00000000fffffffc [ 45.479036][ T869] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 45.479047][ T869] R13: 00007fa8a1026038 R14: 00007fa8a1025fa0 R15: 00007ffd6691e798 [ 45.479063][ T869] [ 45.788299][ T423] usb 2-1: new high-speed USB device number 13 using dummy_hcd [ 45.795990][ T877] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 45.804711][ T877] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 45.958265][ T423] usb 2-1: Using ep0 maxpacket: 32 [ 45.965790][ T867] FAULT_INJECTION: forcing a failure. [ 45.965790][ T867] name failslab, interval 1, probability 0, space 0, times 0 [ 45.978392][ T867] CPU: 1 UID: 0 PID: 867 Comm: syz.1.161 Not tainted syzkaller #0 1c9c13191c392e8d374fa2f59d394ca06c0f036a [ 45.978420][ T867] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 45.978432][ T867] Call Trace: [ 45.978438][ T867] [ 45.978444][ T867] __dump_stack+0x21/0x30 [ 45.978468][ T867] dump_stack_lvl+0x140/0x1c0 [ 45.978485][ T867] ? __cfi_dump_stack_lvl+0x10/0x10 [ 45.978504][ T867] ? _raw_spin_unlock+0x45/0x60 [ 45.978522][ T867] dump_stack+0x19/0x20 [ 45.978538][ T867] should_fail_ex+0x3c2/0x510 [ 45.978555][ T867] ? raw_queue_event+0x94/0x3a0 [ 45.978576][ T867] should_failslab+0xac/0x100 [ 45.978595][ T867] __kmalloc_noprof+0x69/0x510 [ 45.978621][ T867] ? raw_queue_event+0x94/0x3a0 [ 45.978644][ T867] raw_queue_event+0x94/0x3a0 [ 45.978665][ T867] gadget_suspend+0x4a/0x90 [ 45.978685][ T867] ? __cfi_gadget_suspend+0x10/0x10 [ 45.978706][ T867] set_link_state+0xb7b/0x1240 [ 45.978730][ T867] dummy_pullup+0xd1/0x130 [ 45.978750][ T867] ? __cfi_dummy_pullup+0x10/0x10 [ 45.978771][ T867] usb_gadget_disconnect_locked+0x151/0x400 [ 45.978794][ T867] gadget_unbind_driver+0xaf/0x3f0 [ 45.978811][ T867] ? __cfi_gadget_unbind_driver+0x10/0x10 [ 45.978827][ T867] device_release_driver_internal+0x4ad/0x830 [ 45.978851][ T867] driver_detach+0x1f5/0x2d0 [ 45.978871][ T867] bus_remove_driver+0x254/0x2b0 [ 45.978889][ T867] driver_unregister+0x79/0xb0 [ 45.978911][ T867] usb_gadget_unregister_driver+0x52/0x80 [ 45.978935][ T867] raw_release+0xdb/0x280 [ 45.978954][ T867] ? __cfi_raw_release+0x10/0x10 [ 45.978975][ T867] __fput+0x208/0xa30 [ 45.978995][ T867] ____fput+0x20/0x30 [ 45.979014][ T867] task_work_run+0x1e8/0x260 [ 45.979038][ T867] ? __cfi_task_work_run+0x10/0x10 [ 45.979074][ T867] ? __kasan_check_write+0x18/0x20 [ 45.979100][ T867] resume_user_mode_work+0x35/0x50 [ 45.979124][ T867] syscall_exit_to_user_mode+0x63/0xb0 [ 45.979150][ T867] do_syscall_64+0x63/0xf0 [ 45.979167][ T867] ? clear_bhb_loop+0x50/0xa0 [ 45.979189][ T867] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 45.979212][ T867] RIP: 0033:0x7f129679fb19 [ 45.979228][ T867] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 45.979242][ T867] RSP: 002b:00007f1297673028 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 45.979262][ T867] RAX: 0000000000000000 RBX: 00007f1296a25fa0 RCX: 00007f129679fb19 [ 45.979275][ T867] RDX: 0000000000000000 RSI: ffffffffffffffff RDI: 0000000000000003 [ 45.979287][ T867] RBP: 00007f1296837b70 R08: 0000000000000000 R09: 0000000000000000 [ 45.979297][ T867] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 45.979307][ T867] R13: 00007f1296a26038 R14: 00007f1296a25fa0 R15: 00007fffdbb082e8 [ 45.979321][ T867] [ 45.979332][ T867] raw-gadget.1 gadget.1: failed to queue suspend event [ 46.265358][ T423] usb 2-1: unable to get BOS descriptor or descriptor too short [ 46.274394][ T423] usb 2-1: unable to read config index 0 descriptor/start: -71 [ 46.288524][ T423] usb 2-1: can't read configurations, error -71 [ 46.437007][ T36] kauditd_printk_skb: 19 callbacks suppressed [ 46.437022][ T36] audit: type=1326 audit(2000000020.250:396): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=883 comm="syz.3.168" exe="/root/ci2-android-6-12-rust/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fa8a0d9fb19 code=0x0 [ 46.589741][ T36] audit: type=1326 audit(2000000020.410:397): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=883 comm="syz.3.168" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa8a0d9fb19 code=0x7fc00000 [ 46.615615][ T886] netlink: 'syz.3.168': attribute type 16 has an invalid length. [ 46.623379][ T886] netlink: 20 bytes leftover after parsing attributes in process `syz.3.168'. [ 46.634660][ T36] audit: type=1326 audit(2000000020.450:398): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=883 comm="syz.3.168" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=32 compat=0 ip=0x7fa8a0d9fb19 code=0x7fc00000 [ 46.730882][ T888] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 46.739399][ T888] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 47.082786][ T894] input: AT Translated Set 2 keyboard as /devices/platform/i8042/serio0/input/input15 [ 47.125091][ T36] audit: type=1400 audit(2000000020.940:399): avc: denied { set_context_mgr } for pid=896 comm="syz.1.172" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 47.263735][ T899] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 47.278194][ T36] audit: type=1326 audit(2000000021.090:400): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=883 comm="syz.3.168" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa8a0d9fb19 code=0x7fc00000 [ 47.304957][ T899] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 47.335785][ T901] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 47.345774][ T901] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 47.478307][ T423] usb 2-1: new high-speed USB device number 15 using dummy_hcd [ 47.628288][ T423] usb 2-1: Using ep0 maxpacket: 32 [ 47.634548][ T423] usb 2-1: config 0 has an invalid interface number: 67 but max is 0 [ 47.642933][ T423] usb 2-1: config 0 has no interface number 0 [ 47.653412][ T423] usb 2-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 47.662643][ T423] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 47.670861][ T423] usb 2-1: Product: syz [ 47.675021][ T423] usb 2-1: Manufacturer: syz [ 47.679804][ T423] usb 2-1: SerialNumber: syz [ 47.687441][ T423] usb 2-1: config 0 descriptor?? [ 47.695008][ T423] smsc95xx v2.0.0 [ 47.903933][ T909] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 47.913634][ T36] audit: type=1400 audit(2000000021.730:401): avc: denied { name_bind } for pid=910 comm="syz.3.179" src=20002 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=rawip_socket permissive=1 [ 47.935470][ T909] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 47.943863][ T36] audit: type=1400 audit(2000000021.730:402): avc: denied { node_bind } for pid=910 comm="syz.3.179" saddr=172.20.20.170 src=20002 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=rawip_socket permissive=1 [ 48.027429][ T36] audit: type=1400 audit(2000000021.840:403): avc: denied { append } for pid=908 comm="syz.2.178" name="control" dev="devtmpfs" ino=198 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 48.095089][ T423] smsc95xx 2-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -32 [ 48.106376][ T423] smsc95xx 2-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 48.279383][ T914] input: AT Translated Set 2 keyboard as /devices/platform/i8042/serio0/input/input16 [ 48.306485][ T341] udevd[341]: setting mode of /dev/input/event2 to 020660 failed: Read-only file system [ 48.319015][ T341] udevd[341]: setting owner of /dev/input/event2 to uid=0, gid=104 failed: Read-only file system [ 48.375161][ T917] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 48.386815][ T917] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 48.657819][ T36] audit: type=1400 audit(2000000022.470:404): avc: denied { write } for pid=918 comm="syz.2.182" name="sda" dev="devtmpfs" ino=90 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 48.682966][ T919] fuse: Unknown parameter '' [ 48.688954][ T919] fuse: Unknown parameter '0x000000000000000b' [ 48.957115][ T36] audit: type=1326 audit(2000000022.770:405): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=936 comm="syz.2.189" exe="/root/ci2-android-6-12-rust/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fae1f19fb19 code=0x0 [ 49.058975][ T943] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 49.067500][ T943] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 49.099419][ T943] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 49.115016][ T943] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 49.126990][ T943] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 49.135529][ T943] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 49.275437][ T957] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 49.284826][ T957] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 49.939048][ T423] smsc95xx 2-1:0.67 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000006c: -71 [ 49.950730][ T311] rust_binder: 896: undelivered death notification, 0000000000000000 [ 49.961612][ T423] smsc95xx 2-1:0.67: probe with driver smsc95xx failed with error -71 [ 49.971060][ T423] usb 2-1: USB disconnect, device number 15 [ 50.882999][ T971] input: AT Translated Set 2 keyboard as /devices/platform/i8042/serio0/input/input17 [ 50.960064][ T980] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 50.969351][ T980] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 51.562494][ T36] kauditd_printk_skb: 1 callbacks suppressed [ 51.562509][ T36] audit: type=1400 audit(2000000025.380:407): avc: denied { ioctl } for pid=997 comm="syz.3.209" path="socket:[8621]" dev="sockfs" ino=8621 ioctlcmd=0x8916 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 51.593091][ T998] netlink: 'syz.3.209': attribute type 9 has an invalid length. [ 51.600960][ T998] netlink: 'syz.3.209': attribute type 2 has an invalid length. [ 51.619179][ T9] usb 2-1: new high-speed USB device number 16 using dummy_hcd [ 51.768280][ T9] usb 2-1: device descriptor read/64, error -71 [ 51.978630][ T1007] EXT4-fs warning (device sda1): __ext4_ioctl:1259: Setting inode version is not supported with metadata_csum enabled. [ 52.011469][ T9] usb 2-1: device descriptor read/64, error -71 [ 52.063623][ T1010] mmap: syz.3.212 (1010): VmData 29278208 exceed data ulimit 0. Update limits or use boot option ignore_rlimit_data. [ 52.142709][ T1016] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 52.164608][ T1016] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 52.248301][ T9] usb 2-1: new high-speed USB device number 17 using dummy_hcd [ 52.256877][ T1007] input: AT Translated Set 2 keyboard as /devices/platform/i8042/serio0/input/input18 [ 52.312205][ T36] audit: type=1400 audit(2000000026.130:408): avc: denied { getopt } for pid=1017 comm="syz.3.217" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 52.365286][ T36] audit: type=1400 audit(2000000026.150:409): avc: denied { connect } for pid=1021 comm="syz.3.218" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 52.376423][ T1022] netlink: 16 bytes leftover after parsing attributes in process `syz.3.218'. [ 52.385259][ T36] audit: type=1400 audit(2000000026.150:410): avc: denied { write } for pid=1021 comm="syz.3.218" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 52.408316][ T9] usb 2-1: device descriptor read/64, error -71 [ 52.516934][ T1028] netlink: 72 bytes leftover after parsing attributes in process `syz.3.220'. [ 52.517201][ T1029] netlink: 72 bytes leftover after parsing attributes in process `syz.3.220'. [ 52.535670][ T1029] netlink: 8 bytes leftover after parsing attributes in process `syz.3.220'. [ 52.546376][ T1029] netlink: 8 bytes leftover after parsing attributes in process `syz.3.220'. [ 52.556085][ T1028] netlink: 8 bytes leftover after parsing attributes in process `syz.3.220'. [ 52.588830][ T1028] netlink: 8 bytes leftover after parsing attributes in process `syz.3.220'. [ 52.668525][ T9] usb 2-1: device descriptor read/64, error -71 [ 52.778360][ T9] usb usb2-port1: attempt power cycle [ 52.873177][ T1042] syz.2.225: attempt to access beyond end of device [ 52.873177][ T1042] loop2: rw=0, sector=0, nr_sectors = 1 limit=0 [ 52.928334][ T1042] FAT-fs (loop2): unable to read boot sector [ 53.118299][ T9] usb 2-1: new high-speed USB device number 18 using dummy_hcd [ 53.139322][ T9] usb 2-1: device descriptor read/8, error -71 [ 53.180286][ T1044] input: AT Translated Set 2 keyboard as /devices/platform/i8042/serio0/input/input19 [ 53.269283][ T9] usb 2-1: device descriptor read/8, error -71 [ 53.288648][ T1049] netlink: 'syz.2.228': attribute type 46 has an invalid length. [ 53.343348][ T1051] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 53.362393][ T1051] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 53.508290][ T9] usb 2-1: new high-speed USB device number 19 using dummy_hcd [ 53.539269][ T9] usb 2-1: device descriptor read/8, error -71 [ 53.620933][ T36] audit: type=1400 audit(2000000027.440:411): avc: denied { execheap } for pid=1062 comm="syz.3.235" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 53.642730][ T1064] syzkaller1: entered allmulticast mode [ 53.679313][ T9] usb 2-1: device descriptor read/8, error -71 [ 53.784020][ T1063] input: AT Translated Set 2 keyboard as /devices/platform/i8042/serio0/input/input20 [ 53.794823][ T9] usb usb2-port1: unable to enumerate USB device [ 53.957617][ T1083] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 53.973273][ T1083] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 54.059234][ T1088] netlink: 'syz.2.244': attribute type 46 has an invalid length. [ 54.223566][ T1087] input: AT Translated Set 2 keyboard as /devices/platform/i8042/serio0/input/input21 [ 54.269282][ T36] audit: type=1400 audit(2000000028.090:412): avc: denied { map } for pid=1089 comm="syz.2.245" path="/86/tracing/per_cpu/cpu0/trace_pipe_raw" dev="tracefs" ino=73 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=file permissive=1 [ 54.309589][ T1092] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 54.321234][ T1092] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 54.403409][ T36] audit: type=1400 audit(2000000028.220:413): avc: denied { connect } for pid=1095 comm="syz.1.248" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 54.441238][ T36] audit: type=1400 audit(2000000028.260:414): avc: denied { write } for pid=1097 comm="syz.1.249" name="ppp" dev="devtmpfs" ino=86 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 54.464487][ T36] audit: type=1326 audit(2000000028.270:415): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1097 comm="syz.1.249" exe="/root/ci2-android-6-12-rust/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f129679fb19 code=0x0 [ 55.106860][ T36] audit: type=1400 audit(2000000028.920:416): avc: denied { ioctl } for pid=1115 comm="syz.2.254" path="/dev/fuse" dev="devtmpfs" ino=23 ioctlcmd=0xf50a scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 55.359134][ T1121] input: AT Translated Set 2 keyboard as /devices/platform/i8042/serio0/input/input22 [ 55.404771][ T1124] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 55.416162][ T1124] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 55.688316][ T643] usb 2-1: new high-speed USB device number 20 using dummy_hcd [ 55.839280][ T643] usb 2-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 55.854261][ T643] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 55.865564][ T643] usb 2-1: config 1 has 0 interfaces, different from the descriptor's value: 2 [ 55.876390][ T643] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 55.888365][ T643] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 55.896397][ T643] usb 2-1: Product: syz [ 55.901347][ T643] usb 2-1: Manufacturer: syz [ 55.905991][ T643] usb 2-1: SerialNumber: syz [ 55.960466][ T1130] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 55.969465][ T1130] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 56.889526][ T1139] syzkaller1: entered promiscuous mode [ 56.895076][ T1139] syzkaller1: entered allmulticast mode [ 57.172577][ T1141] input: AT Translated Set 2 keyboard as /devices/platform/i8042/serio0/input/input23 [ 57.293982][ T1146] fuse: Bad value for 'fd' [ 57.299335][ T1147] netlink: 'syz.3.265': attribute type 49 has an invalid length. [ 57.428072][ T1153] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 57.456935][ T1153] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 58.070775][ T36] kauditd_printk_skb: 1200 callbacks suppressed [ 58.070851][ T36] audit: type=1400 audit(2000000031.890:1617): avc: denied { mounton } for pid=1163 comm="syz-executor" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 58.103029][ T36] audit: type=1400 audit(2000000031.890:1618): avc: denied { create } for pid=1163 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_rdma_socket permissive=1 [ 58.160382][ T1163] bridge0: port 1(bridge_slave_0) entered blocking state [ 58.167467][ T1163] bridge0: port 1(bridge_slave_0) entered disabled state [ 58.178460][ T1163] bridge_slave_0: entered allmulticast mode [ 58.184929][ T1163] bridge_slave_0: entered promiscuous mode [ 58.191901][ T1163] bridge0: port 2(bridge_slave_1) entered blocking state [ 58.199295][ T1163] bridge0: port 2(bridge_slave_1) entered disabled state [ 58.206460][ T1163] bridge_slave_1: entered allmulticast mode [ 58.212929][ T1163] bridge_slave_1: entered promiscuous mode [ 58.219442][ T46] bridge_slave_1: left allmulticast mode [ 58.225139][ T46] bridge_slave_1: left promiscuous mode [ 58.231005][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 58.238800][ T46] bridge_slave_0: left allmulticast mode [ 58.244491][ T46] bridge_slave_0: left promiscuous mode [ 58.250279][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 58.308905][ T1179] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 58.317351][ T1179] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 58.352925][ T46] veth1_macvtap: left promiscuous mode [ 58.358520][ T46] veth0_vlan: left promiscuous mode [ 58.403069][ T1163] bridge0: port 2(bridge_slave_1) entered blocking state [ 58.410131][ T1163] bridge0: port 2(bridge_slave_1) entered forwarding state [ 58.417408][ T1163] bridge0: port 1(bridge_slave_0) entered blocking state [ 58.424469][ T1163] bridge0: port 1(bridge_slave_0) entered forwarding state [ 58.443332][ T62] bridge0: port 1(bridge_slave_0) entered disabled state [ 58.451975][ T62] bridge0: port 2(bridge_slave_1) entered disabled state [ 58.462769][ T62] bridge0: port 1(bridge_slave_0) entered blocking state [ 58.466315][ T350] usb 2-1: USB disconnect, device number 20 [ 58.469846][ T62] bridge0: port 1(bridge_slave_0) entered forwarding state [ 58.470300][ T62] bridge0: port 2(bridge_slave_1) entered blocking state [ 58.490262][ T62] bridge0: port 2(bridge_slave_1) entered forwarding state [ 58.511163][ T36] audit: type=1326 audit(2000000032.330:1619): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1182 comm="syz.1.278" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f129679fb19 code=0x50000 [ 58.536283][ T36] audit: type=1326 audit(2000000032.330:1620): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1182 comm="syz.1.278" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f129679fb19 code=0x50000 [ 58.544925][ T1163] veth0_vlan: entered promiscuous mode [ 58.570345][ T36] audit: type=1326 audit(2000000032.330:1621): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1182 comm="syz.1.278" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f129679fb19 code=0x50000 [ 58.574054][ T1163] veth1_macvtap: entered promiscuous mode [ 58.601264][ T36] audit: type=1326 audit(2000000032.330:1622): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1182 comm="syz.1.278" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f129679fb19 code=0x50000 [ 58.627444][ T36] audit: type=1326 audit(2000000032.330:1623): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1182 comm="syz.1.278" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f129679fb19 code=0x50000 [ 58.654065][ T36] audit: type=1326 audit(2000000032.330:1624): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1182 comm="syz.1.278" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f129679fb19 code=0x50000 [ 58.679244][ T36] audit: type=1326 audit(2000000032.330:1625): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1182 comm="syz.1.278" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f129679fb19 code=0x50000 [ 58.705329][ T36] audit: type=1326 audit(2000000032.330:1626): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1182 comm="syz.1.278" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f129679fb19 code=0x50000 [ 58.928323][ T1200] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 58.936859][ T1200] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 59.133181][ T643] rust_binder: 1202: undelivered transaction 4, process died [ 59.140709][ T643] rust_binder: 1202: undelivered TRANSACTION_COMPLETE [ 59.320644][ T1208] kvm: kvm [1207]: vcpu2, guest rIP: 0x9114 Unhandled WRMSR(0xc2) = 0x7 [ 59.338443][ T1208] kvm: kvm [1207]: vcpu2, guest rIP: 0x9114 Unhandled WRMSR(0xc1) = 0x7 [ 59.389123][ T1208] rust_binder: 1207:1208 error while translating object: ENOENT [ 59.396845][ T1208] rust_binder: 1207:1208 transaction async to 1207:0 failed ENOENT, code 0 size 72-24 line thread.rs:878 [ 59.450595][ T350] rust_binder: 1207: undelivered TRANSACTION_ERROR: 29201 [ 59.477315][ T1213] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 59.496935][ T1213] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 59.635402][ T1227] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 59.665745][ T1227] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 59.697821][ T1227] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 59.719105][ T1227] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 59.720312][ T1231] incfs: Options parsing error. -22 [ 59.737186][ T1231] incfs: mount failed -22 [ 60.132431][ T1248] futex_wake_op: syz.2.296 tries to shift op by 144; fix this program [ 60.141317][ T1245] futex_wake_op: syz.2.296 tries to shift op by 144; fix this program [ 60.311521][ T1264] netlink: 8 bytes leftover after parsing attributes in process `syz.2.301'. [ 60.320407][ T311] usb 5-1: new full-speed USB device number 2 using dummy_hcd [ 60.456453][ T1275] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 60.478733][ T1275] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 60.489581][ T311] usb 5-1: unable to get BOS descriptor or descriptor too short [ 60.500904][ T311] usb 5-1: not running at top speed; connect to a high speed hub [ 60.512651][ T311] usb 5-1: config 1 has an invalid interface number: 33 but max is 2 [ 60.523662][ T311] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 60.539400][ T311] usb 5-1: config 1 has 4 interfaces, different from the descriptor's value: 3 [ 60.551703][ T311] usb 5-1: config 1 has no interface number 3 [ 60.559983][ T311] usb 5-1: config 1 interface 33 has no altsetting 0 [ 60.569844][ T311] usb 5-1: New USB device found, idVendor=0582, idProduct=004c, bcdDevice= 0.40 [ 60.579022][ T311] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 60.588114][ T311] usb 5-1: Product: Ж [ 60.594445][ T311] usb 5-1: Manufacturer: 卙躳糒礟ᑺ䤃纎ᜏ촰堟鈚◢氧蒨䋛뺊᠋輟繉讈㨴絥胿䞸⃣룊ሗ礦څ틥鹧⎊뤥ꊩ칃蜅搗㔀樴漄葊ꇾ붩嗑㢾ﮡਐ㦿ꛎ靠㊿칻ˀ屑 [ 60.618521][ T311] usb 5-1: SerialNumber: 栳ꍮ錕쩲卌볠迡⠒憐闶꯮磕ꕖ卍㵝Υ媢ꀈ暾潔ꚿ頧濌젣ᗸ⊲䷯ꋷ숽窱贼噃业ꠛ昳墊␆冎薿칀ㄈ쀙열훯봨둭貓䄈㸝㫻첧㖮皘ｻ䈜渦嶯ﲲ￤쵀얥 [ 60.851541][ T311] usb 5-1: USB disconnect, device number 2 [ 60.869001][ T341] udevd[341]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 61.080797][ T1281] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 61.092034][ T1281] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 61.504646][ T1310] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 61.513789][ T1310] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 61.664250][ T1329] overlayfs: missing 'lowerdir' [ 61.673247][ T1329] overlayfs: missing 'lowerdir' [ 61.728052][ T1333] netlink: 57 bytes leftover after parsing attributes in process `syz.3.322'. [ 61.740198][ T1333] FAULT_INJECTION: forcing a failure. [ 61.740198][ T1333] name failslab, interval 1, probability 0, space 0, times 0 [ 61.759055][ T1333] CPU: 0 UID: 0 PID: 1333 Comm: syz.3.322 Not tainted syzkaller #0 1c9c13191c392e8d374fa2f59d394ca06c0f036a [ 61.759085][ T1333] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 61.759097][ T1333] Call Trace: [ 61.759103][ T1333] [ 61.759111][ T1333] __dump_stack+0x21/0x30 [ 61.759134][ T1333] dump_stack_lvl+0x140/0x1c0 [ 61.759150][ T1333] ? __cfi_dump_stack_lvl+0x10/0x10 [ 61.759168][ T1333] dump_stack+0x19/0x20 [ 61.759184][ T1333] should_fail_ex+0x3c2/0x510 [ 61.759201][ T1333] should_failslab+0xac/0x100 [ 61.759218][ T1333] __kmalloc_cache_noprof+0x41/0x470 [ 61.759242][ T1333] ? fib_insert_alias+0x4e0/0x1200 [ 61.759261][ T1333] fib_insert_alias+0x4e0/0x1200 [ 61.759278][ T1333] ? kmem_cache_alloc_noprof+0x1e2/0x410 [ 61.759299][ T1333] ? fib_trie_unmerge+0x250/0x1410 [ 61.759322][ T1333] fib_trie_unmerge+0x28b/0x1410 [ 61.759343][ T1333] fib_unmerge+0xce/0x360 [ 61.759368][ T1333] fib4_rule_configure+0x287/0xbb0 [ 61.759405][ T1333] fib_nl_newrule+0x136d/0x1e50 [ 61.759428][ T1333] ? __cfi_fib_nl_newrule+0x10/0x10 [ 61.759450][ T1333] ? mutex_lock+0x97/0x1d0 [ 61.759472][ T1333] ? __cfi_mutex_lock+0x10/0x10 [ 61.759492][ T1333] ? ns_capable+0x90/0xf0 [ 61.759510][ T1333] ? netlink_net_capable+0x129/0x160 [ 61.759531][ T1333] ? __cfi_fib_nl_newrule+0x10/0x10 [ 61.759548][ T1333] rtnetlink_rcv_msg+0x8c1/0xa40 [ 61.759566][ T1333] ? __asan_memcpy+0x5a/0x80 [ 61.759586][ T1333] ? __cfi_rtnetlink_rcv_msg+0x10/0x10 [ 61.759603][ T1333] ? avc_has_perm+0x155/0x240 [ 61.759620][ T1333] netlink_rcv_skb+0x24a/0x4e0 [ 61.759640][ T1333] ? __cfi_rtnetlink_rcv_msg+0x10/0x10 [ 61.759658][ T1333] ? __cfi_netlink_rcv_skb+0x10/0x10 [ 61.759678][ T1333] ? selinux_netlink_send+0x7df/0x8b0 [ 61.759700][ T1333] ? netlink_autobind+0x1c0/0x1c0 [ 61.759721][ T1333] ? is_vmalloc_addr+0x11/0x40 [ 61.759739][ T1333] rtnetlink_rcv+0x20/0x30 [ 61.759754][ T1333] netlink_unicast+0x8bf/0xa70 [ 61.759775][ T1333] netlink_sendmsg+0x7d1/0xad0 [ 61.759798][ T1333] ? __cfi_netlink_sendmsg+0x10/0x10 [ 61.759822][ T1333] ? bpf_lsm_socket_sendmsg+0xd/0x20 [ 61.759839][ T1333] ? security_socket_sendmsg+0x3d/0x100 [ 61.759861][ T1333] ____sys_sendmsg+0x99e/0xa00 [ 61.759883][ T1333] ? __import_iovec+0x5b9/0x7d0 [ 61.759902][ T1333] ? __sys_sendmsg_sock+0x50/0x50 [ 61.759925][ T1333] ? import_iovec+0x80/0xb0 [ 61.759945][ T1333] ___sys_sendmsg+0x2a6/0x370 [ 61.759967][ T1333] ? __sys_sendmsg+0x260/0x260 [ 61.759993][ T1333] ? __fget_files+0x2bc/0x330 [ 61.760012][ T1333] __x64_sys_sendmsg+0x1be/0x2a0 [ 61.760033][ T1333] ? __cfi___x64_sys_sendmsg+0x10/0x10 [ 61.760056][ T1333] ? __kasan_check_write+0x18/0x20 [ 61.760079][ T1333] ? fpregs_restore_userregs+0x11c/0x260 [ 61.760102][ T1333] ? switch_fpu_return+0x12/0x20 [ 61.760124][ T1333] x64_sys_call+0x2a4c/0x2ee0 [ 61.760143][ T1333] do_syscall_64+0x57/0xf0 [ 61.760160][ T1333] ? clear_bhb_loop+0x50/0xa0 [ 61.760182][ T1333] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 61.760204][ T1333] RIP: 0033:0x7fa8a0d9fb19 [ 61.760221][ T1333] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 61.760236][ T1333] RSP: 002b:00007fa8a1c13028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 61.760256][ T1333] RAX: ffffffffffffffda RBX: 00007fa8a1025fa0 RCX: 00007fa8a0d9fb19 [ 61.760270][ T1333] RDX: 0000000000000000 RSI: 0000200000000140 RDI: 000000000000000a [ 61.760282][ T1333] RBP: 00007fa8a0e37b70 R08: 0000000000000000 R09: 0000000000000000 [ 61.760294][ T1333] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 61.760305][ T1333] R13: 00007fa8a1026038 R14: 00007fa8a1025fa0 R15: 00007ffd6691e798 [ 61.760321][ T1333] [ 62.358556][ T1364] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 62.368908][ T1364] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 62.388282][ T643] usb 2-1: new high-speed USB device number 21 using dummy_hcd [ 62.548272][ T643] usb 2-1: Using ep0 maxpacket: 32 [ 62.554602][ T643] usb 2-1: config 0 has an invalid interface number: 67 but max is 0 [ 62.562790][ T643] usb 2-1: config 0 has no interface number 0 [ 62.570298][ T643] usb 2-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 62.579459][ T643] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 62.587480][ T643] usb 2-1: Product: syz [ 62.591748][ T643] usb 2-1: Manufacturer: syz [ 62.596380][ T643] usb 2-1: SerialNumber: syz [ 62.602000][ T643] usb 2-1: config 0 descriptor?? [ 62.607722][ T643] smsc95xx v2.0.0 [ 62.821579][ T1374] device-mapper: table: 252:2: verity: Data device lookup failed (-ENOENT) [ 62.830290][ T1374] device-mapper: ioctl: error adding target to table [ 62.904716][ T1381] futex_wake_op: syz.2.339 tries to shift op by 144; fix this program [ 62.918305][ T1381] futex_wake_op: syz.2.339 tries to shift op by 144; fix this program [ 62.947971][ T1387] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 62.967535][ T1387] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 63.008984][ T643] smsc95xx 2-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -32 [ 63.035743][ T643] smsc95xx 2-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 63.047743][ T1388] tmpfs: Too small a size for current use [ 63.445747][ T643] smsc95xx 2-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -32 [ 63.446645][ T1347] netlink: 'syz.1.326': attribute type 30 has an invalid length. [ 63.456602][ T643] smsc95xx 2-1:0.67: probe with driver smsc95xx failed with error -32 [ 63.519207][ T1399] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 63.527726][ T1399] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 63.762031][ T36] kauditd_printk_skb: 33683 callbacks suppressed [ 63.762067][ T36] audit: type=1400 audit(2000000037.580:35310): avc: denied { unmount } for pid=296 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 63.971308][ T1409] netlink: 60 bytes leftover after parsing attributes in process `syz.3.348'. [ 64.034468][ T1411] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 64.042971][ T1411] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 64.052623][ T1307] Bluetooth: hci0: Frame reassembly failed (-84) [ 64.059036][ T1305] Bluetooth: hci0: Frame reassembly failed (-84) [ 64.066038][ T1413] Bluetooth: hci0: Frame reassembly failed (-84) [ 64.073312][ T36] audit: type=1400 audit(2000000037.890:35311): avc: denied { name_bind } for pid=1412 comm="syz.2.349" src=20000 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=rawip_socket permissive=1 [ 64.338290][ T350] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 64.489260][ T350] usb 5-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 64.498043][ T350] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 64.509487][ T350] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 64.518564][ T350] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 64.526550][ T350] usb 5-1: Product: syz [ 64.530786][ T350] usb 5-1: Manufacturer: syz [ 64.535372][ T350] usb 5-1: SerialNumber: syz [ 64.541814][ T350] cdc_ncm 5-1:1.1: CDC Union missing and no IAD found [ 64.548636][ T350] cdc_ncm 5-1:1.1: bind() failure [ 65.184052][ T393] usb 2-1: USB disconnect, device number 21 [ 65.238996][ T1428] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=198462431 (396924862 ns) > initial count (148514 ns). Using initial count to start timer. [ 65.307176][ T36] audit: type=1400 audit(2000000039.120:35312): avc: denied { map } for pid=1430 comm="syz.1.355" path="/proc/156/syscall" dev="proc" ino=12338 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=file permissive=1 [ 65.708396][ T350] usb 2-1: new high-speed USB device number 22 using dummy_hcd [ 65.858270][ T350] usb 2-1: Using ep0 maxpacket: 32 [ 65.864442][ T350] usb 2-1: config 0 has an invalid interface number: 67 but max is 0 [ 65.872739][ T350] usb 2-1: config 0 has no interface number 0 [ 65.880213][ T350] usb 2-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 65.889355][ T350] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 65.897336][ T350] usb 2-1: Product: syz [ 65.901509][ T350] usb 2-1: Manufacturer: syz [ 65.906095][ T350] usb 2-1: SerialNumber: syz [ 65.911276][ T350] usb 2-1: config 0 descriptor?? [ 65.916895][ T350] smsc95xx v2.0.0 [ 66.108283][ T1415] Bluetooth: hci0: command 0x1003 tx timeout [ 66.108283][ T54] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 66.217293][ T1456] netlink: 140 bytes leftover after parsing attributes in process `syz.2.363'. [ 66.322393][ T350] smsc95xx 2-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -32 [ 66.337448][ T350] smsc95xx 2-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 66.360844][ T1460] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 66.369220][ T1461] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 66.369326][ T1460] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 66.378958][ T1461] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 66.911306][ T1465] usb 5-1: USB disconnect, device number 3 [ 66.920993][ T1465] overlayfs: workdir and upperdir must be separate subtrees [ 66.938901][ T1467] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 66.947385][ T1467] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 66.995005][ T1469] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 67.003844][ T1469] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 67.012766][ T1469] netlink: 16 bytes leftover after parsing attributes in process `syz.3.369'. [ 67.457177][ T1475] netlink: 40 bytes leftover after parsing attributes in process `syz.4.372'. [ 67.520443][ T36] audit: type=1400 audit(2000000041.340:35313): avc: denied { block_suspend } for pid=1476 comm="syz.2.373" capability=36 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 67.553620][ T1482] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 67.562804][ T1482] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 67.566234][ T350] smsc95xx 2-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -61 [ 67.577643][ T1486] fuse: Bad value for 'rootmode' [ 67.581272][ T350] smsc95xx 2-1:0.67: probe with driver smsc95xx failed with error -61 [ 67.740201][ T36] audit: type=1400 audit(2000000041.560:35314): avc: denied { append } for pid=1490 comm="syz.2.378" name="001" dev="devtmpfs" ino=114 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 68.079247][ T1498] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 68.087747][ T1498] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 68.614641][ T36] audit: type=1400 audit(2000000042.430:35315): avc: denied { mounton } for pid=1506 comm="syz.3.383" path="/proc/436/cgroup" dev="proc" ino=12660 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=file permissive=1 [ 68.652878][ T36] audit: type=1400 audit(2000000042.470:35316): avc: denied { create } for pid=1514 comm="syz.3.385" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 68.674392][ T1515] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 68.682923][ T1515] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 68.809839][ T350] usb 2-1: USB disconnect, device number 22 [ 79.594436][ T36] audit: type=1400 audit(2000000053.410:35317): avc: denied { write } for pid=1524 comm="syz.3.389" name="raw6" dev="proc" ino=4026532520 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_net_t tclass=file permissive=1 [ 79.623664][ T1522] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 79.633413][ T1522] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 79.633885][ T1530] FAULT_INJECTION: forcing a failure. [ 79.633885][ T1530] name failslab, interval 1, probability 0, space 0, times 0 [ 79.642722][ T36] audit: type=1400 audit(2000000053.410:35318): avc: denied { read } for pid=1524 comm="syz.3.389" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 79.680122][ T1530] CPU: 1 UID: 0 PID: 1530 Comm: syz.4.386 Not tainted syzkaller #0 1c9c13191c392e8d374fa2f59d394ca06c0f036a [ 79.680152][ T1530] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 79.680165][ T1530] Call Trace: [ 79.680171][ T1530] [ 79.680179][ T1530] __dump_stack+0x21/0x30 [ 79.680202][ T1530] dump_stack_lvl+0x140/0x1c0 [ 79.680220][ T1530] ? __cfi_dump_stack_lvl+0x10/0x10 [ 79.680238][ T1530] ? __kmalloc_node_track_caller_noprof+0x24e/0x4f0 [ 79.680265][ T1530] ? cgroup_init_fs_context+0x65/0x4d0 [ 79.680293][ T1530] dump_stack+0x19/0x20 [ 79.680310][ T1530] should_fail_ex+0x3c2/0x510 [ 79.680328][ T1530] should_failslab+0xac/0x100 [ 79.680347][ T1530] __kmalloc_cache_noprof+0x41/0x470 [ 79.680371][ T1530] ? __se_sys_fsopen+0x14d/0x390 [ 79.680393][ T1530] __se_sys_fsopen+0x14d/0x390 [ 79.680415][ T1530] __x64_sys_fsopen+0x5f/0x80 [ 79.680437][ T1530] x64_sys_call+0x2d40/0x2ee0 [ 79.680456][ T1530] do_syscall_64+0x57/0xf0 [ 79.680474][ T1530] ? clear_bhb_loop+0x50/0xa0 [ 79.680499][ T1530] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 79.680521][ T1530] RIP: 0033:0x7f0c2c19fb19 [ 79.680536][ T1530] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 79.680551][ T1530] RSP: 002b:00007f0c2d0d4028 EFLAGS: 00000246 ORIG_RAX: 00000000000001ae [ 79.680571][ T1530] RAX: ffffffffffffffda RBX: 00007f0c2c425fa0 RCX: 00007f0c2c19fb19 [ 79.680585][ T1530] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000140 [ 79.680597][ T1530] RBP: 00007f0c2c237b70 R08: 0000000000000000 R09: 0000000000000000 [ 79.680609][ T1530] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 79.680620][ T1530] R13: 00007f0c2c426038 R14: 00007f0c2c425fa0 R15: 00007ffff2ce1fe8 [ 79.680636][ T1530] [ 79.921294][ T1553] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 79.929839][ T1553] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 79.938726][ T1553] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 79.947214][ T1553] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 80.208280][ T350] usb 2-1: new high-speed USB device number 23 using dummy_hcd [ 80.230219][ T1566] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 80.238728][ T1566] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 80.358261][ T350] usb 2-1: Using ep0 maxpacket: 16 [ 80.365709][ T350] usb 2-1: New USB device found, idVendor=05d1, idProduct=2001, bcdDevice=10.00 [ 80.374807][ T350] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 80.382830][ T350] usb 2-1: Product: syz [ 80.387094][ T350] usb 2-1: Manufacturer: syz [ 80.391718][ T350] usb 2-1: SerialNumber: syz [ 80.396803][ T350] usb 2-1: config 0 descriptor?? [ 80.402794][ T350] ftdi_sio 2-1:0.0: FTDI USB Serial Device converter detected [ 80.410710][ T350] usb 2-1: Detected FT-X [ 80.477304][ T1575] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 80.485785][ T1575] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 80.495003][ T1575] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 80.503517][ T1575] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 80.512156][ T1575] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 80.520851][ T1575] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 80.604467][ T1580] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 80.612957][ T1580] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 80.621865][ T350] ftdi_sio ttyUSB0: Unable to read latency timer: -71 [ 80.628937][ T350] ftdi_sio ttyUSB0: Unable to write latency timer: -71 [ 80.636024][ T350] ftdi_sio 2-1:0.0: GPIO initialisation failed: -71 [ 80.643135][ T350] usb 2-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 80.652200][ T350] usb 2-1: USB disconnect, device number 23 [ 80.658953][ T350] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 80.668463][ T350] ftdi_sio 2-1:0.0: device disconnected [ 80.934999][ T1587] kvm: pic: level sensitive irq not supported [ 80.935072][ T1587] kvm: pic: non byte read [ 80.945624][ T1587] kvm: pic: level sensitive irq not supported [ 80.945665][ T1587] kvm: pic: non byte read [ 81.052931][ T1591] FAULT_INJECTION: forcing a failure. [ 81.052931][ T1591] name failslab, interval 1, probability 0, space 0, times 0 [ 81.065606][ T1591] CPU: 0 UID: 0 PID: 1591 Comm: syz.3.407 Not tainted syzkaller #0 1c9c13191c392e8d374fa2f59d394ca06c0f036a [ 81.065632][ T1591] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 81.065644][ T1591] Call Trace: [ 81.065650][ T1591] [ 81.065658][ T1591] __dump_stack+0x21/0x30 [ 81.065677][ T1591] dump_stack_lvl+0x140/0x1c0 [ 81.065686][ T1591] ? __cfi_dump_stack_lvl+0x10/0x10 [ 81.065697][ T1591] dump_stack+0x19/0x20 [ 81.065705][ T1591] should_fail_ex+0x3c2/0x510 [ 81.065716][ T1591] should_failslab+0xac/0x100 [ 81.065727][ T1591] kmem_cache_alloc_noprof+0x42/0x410 [ 81.065745][ T1591] ? sk_prot_alloc+0x69/0x3a0 [ 81.065757][ T1591] ? kmem_cache_alloc_noprof+0x1e2/0x410 [ 81.065772][ T1591] sk_prot_alloc+0x69/0x3a0 [ 81.065784][ T1591] ? bpf_lsm_inode_alloc_security+0xd/0x20 [ 81.065799][ T1591] sk_alloc+0x40/0x590 [ 81.065810][ T1591] ? inode_init_always_gfp+0x76e/0x9e0 [ 81.065821][ T1591] inet6_create+0x5a8/0x11c0 [ 81.065832][ T1591] __sock_create+0x3a5/0x810 [ 81.065843][ T1591] __sys_socket+0xe1/0x1c0 [ 81.065853][ T1591] __x64_sys_socket+0x7e/0x90 [ 81.065864][ T1591] x64_sys_call+0x2608/0x2ee0 [ 81.065874][ T1591] do_syscall_64+0x57/0xf0 [ 81.065884][ T1591] ? clear_bhb_loop+0x50/0xa0 [ 81.065898][ T1591] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 81.065910][ T1591] RIP: 0033:0x7fa8a0d9fb19 [ 81.065920][ T1591] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 81.065928][ T1591] RSP: 002b:00007fa8a1c13028 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 81.065940][ T1591] RAX: ffffffffffffffda RBX: 00007fa8a1025fa0 RCX: 00007fa8a0d9fb19 [ 81.065950][ T1591] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 000000000000000a [ 81.065959][ T1591] RBP: 00007fa8a0e37b70 R08: 0000000000000000 R09: 0000000000000000 [ 81.065966][ T1591] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 81.065972][ T1591] R13: 00007fa8a1026038 R14: 00007fa8a1025fa0 R15: 00007ffd6691e798 [ 81.065981][ T1591] [ 81.283338][ T36] audit: type=1400 audit(2000000055.100:35319): avc: denied { read write } for pid=1599 comm="syz.3.411" name="mtrr" dev="proc" ino=4026532004 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mtrr_device_t tclass=file permissive=1 [ 81.283642][ T1600] MTRR 1 not used [ 81.306684][ T36] audit: type=1400 audit(2000000055.100:35320): avc: denied { open } for pid=1599 comm="syz.3.411" path="/160/proc/mtrr" dev="proc" ino=4026532004 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mtrr_device_t tclass=file permissive=1 [ 81.333955][ T36] audit: type=1400 audit(2000000055.100:35321): avc: denied { ioctl } for pid=1599 comm="syz.3.411" path="/160/proc/mtrr" dev="proc" ino=4026532004 ioctlcmd=0x4d02 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mtrr_device_t tclass=file permissive=1 [ 81.366011][ T1604] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 81.374519][ T1604] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 81.385917][ T36] audit: type=1400 audit(2000000055.200:35322): avc: denied { write } for pid=1601 comm="syz.1.413" name="file0" dev="tmpfs" ino=382 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 81.408319][ T36] audit: type=1400 audit(2000000055.200:35323): avc: denied { open } for pid=1601 comm="syz.1.413" path="/63/file0" dev="tmpfs" ino=382 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 81.430960][ T36] audit: type=1400 audit(2000000055.200:35324): avc: denied { ioctl } for pid=1601 comm="syz.1.413" path="/63/file0" dev="tmpfs" ino=382 ioctlcmd=0x4c06 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 81.528173][ T1610] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=64256 sclass=netlink_route_socket pid=1610 comm=syz.1.415 [ 81.554949][ T1615] netlink: 12 bytes leftover after parsing attributes in process `syz.1.417'. [ 81.660134][ T36] audit: type=1400 audit(2000000055.480:35325): avc: denied { ioctl } for pid=1619 comm="syz.2.419" path="/142/trace/events/sched/sched_switch/trigger" dev="tracefs" ino=19680823 ioctlcmd=0xae41 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=file permissive=1 [ 81.853407][ T36] audit: type=1400 audit(2000000055.670:35326): avc: denied { mount } for pid=1641 comm="syz.1.424" name="/" dev="bpf" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bpf_t tclass=filesystem permissive=1 [ 82.038625][ T1664] netlink: 12 bytes leftover after parsing attributes in process `syz.3.429'. [ 82.553628][ T1683] rust_binder: 1682:1683 transaction call to 1682:0 failed EINVAL, code 1 size 0-22 line thread.rs:1186 [ 82.565442][ T9] rust_binder: 1682: undelivered TRANSACTION_ERROR: 29201 [ 82.637635][ T1690] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 82.647608][ T1690] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 82.744260][ T1695] netlink: 8 bytes leftover after parsing attributes in process `syz.2.436'. [ 82.777567][ T1692] kvm_intel: kvm [1691]: vcpu1, guest rIP: 0x9114 Unhandled WRMSR(0x1d9) = 0x8bad [ 82.799931][ T1692] kvm: kvm [1691]: vcpu1, guest rIP: 0x9114 Unhandled WRMSR(0x187) = 0xe6ef [ 82.818318][ T1692] kvm: kvm [1691]: vcpu1, guest rIP: 0x9114 Unhandled WRMSR(0x186) = 0xb083 [ 82.838920][ T1692] kvm: kvm [1691]: vcpu1, guest rIP: 0x9114 Unhandled WRMSR(0x11e) = 0xaa19 [ 83.094786][ T1716] FAULT_INJECTION: forcing a failure. [ 83.094786][ T1716] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 83.108055][ T1716] CPU: 0 UID: 0 PID: 1716 Comm: syz.3.440 Not tainted syzkaller #0 1c9c13191c392e8d374fa2f59d394ca06c0f036a [ 83.108085][ T1716] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 83.108101][ T1716] Call Trace: [ 83.108107][ T1716] [ 83.108114][ T1716] __dump_stack+0x21/0x30 [ 83.108140][ T1716] dump_stack_lvl+0x140/0x1c0 [ 83.108157][ T1716] ? __cfi_dump_stack_lvl+0x10/0x10 [ 83.108178][ T1716] ? __mod_memcg_lruvec_state+0x186/0x460 [ 83.108199][ T1716] dump_stack+0x19/0x20 [ 83.108221][ T1716] should_fail_ex+0x3c2/0x510 [ 83.108239][ T1716] should_fail_alloc_page+0xec/0x110 [ 83.108261][ T1716] __alloc_pages_noprof+0x1c0/0x7e0 [ 83.108286][ T1716] ? __cfi___alloc_pages_noprof+0x10/0x10 [ 83.108310][ T1716] ? filemap_get_entry+0x41b/0x490 [ 83.108332][ T1716] __folio_alloc_noprof+0x14/0x80 [ 83.108355][ T1716] __filemap_get_folio+0x798/0xe80 [ 83.108374][ T1716] ? __kasan_check_write+0x18/0x20 [ 83.108400][ T1716] ? __cfi___filemap_get_folio+0x10/0x10 [ 83.108419][ T1716] ? __cfi_folio_end_read+0x10/0x10 [ 83.108436][ T1716] ? aio_setup_ring+0x2f4/0xc60 [ 83.108458][ T1716] aio_setup_ring+0x38e/0xc60 [ 83.108478][ T1716] ? free_ioctx_reqs+0x170/0x170 [ 83.108500][ T1716] ioctx_alloc+0x337/0x840 [ 83.108518][ T1716] __se_sys_io_setup+0x6f/0x230 [ 83.108537][ T1716] __x64_sys_io_setup+0x5f/0x80 [ 83.108553][ T1716] x64_sys_call+0x26a4/0x2ee0 [ 83.108570][ T1716] do_syscall_64+0x57/0xf0 [ 83.108589][ T1716] ? clear_bhb_loop+0x50/0xa0 [ 83.108616][ T1716] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 83.108641][ T1716] RIP: 0033:0x7fa8a0d9fb19 [ 83.108657][ T1716] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 83.108674][ T1716] RSP: 002b:00007fa8a1c13028 EFLAGS: 00000246 ORIG_RAX: 00000000000000ce [ 83.108704][ T1716] RAX: ffffffffffffffda RBX: 00007fa8a1025fa0 RCX: 00007fa8a0d9fb19 [ 83.108719][ T1716] RDX: 0000000000000000 RSI: 00002000000007c0 RDI: 0000000000002080 [ 83.108732][ T1716] RBP: 00007fa8a0e37b70 R08: 0000000000000000 R09: 0000000000000000 [ 83.108747][ T1716] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 83.108759][ T1716] R13: 00007fa8a1026038 R14: 00007fa8a1025fa0 R15: 00007ffd6691e798 [ 83.108776][ T1716] [ 84.220226][ T1731] FAULT_INJECTION: forcing a failure. [ 84.220226][ T1731] name failslab, interval 1, probability 0, space 0, times 0 [ 84.232939][ T1731] CPU: 0 UID: 0 PID: 1731 Comm: syz.3.444 Not tainted syzkaller #0 1c9c13191c392e8d374fa2f59d394ca06c0f036a [ 84.232967][ T1731] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 84.232979][ T1731] Call Trace: [ 84.232985][ T1731] [ 84.232992][ T1731] __dump_stack+0x21/0x30 [ 84.233015][ T1731] dump_stack_lvl+0x140/0x1c0 [ 84.233031][ T1731] ? __cfi_dump_stack_lvl+0x10/0x10 [ 84.233048][ T1731] ? kstrtouint_from_user+0x117/0x170 [ 84.233072][ T1731] dump_stack+0x19/0x20 [ 84.233087][ T1731] should_fail_ex+0x3c2/0x510 [ 84.233103][ T1731] ? kernfs_fop_write_iter+0x15e/0x510 [ 84.233133][ T1731] should_failslab+0xac/0x100 [ 84.233151][ T1731] __kmalloc_noprof+0x69/0x510 [ 84.233174][ T1731] ? kernfs_fop_write_iter+0x15e/0x510 [ 84.233195][ T1731] ? __kasan_check_write+0x18/0x20 [ 84.233218][ T1731] ? proc_fail_nth_write+0x184/0x220 [ 84.233239][ T1731] kernfs_fop_write_iter+0x15e/0x510 [ 84.233260][ T1731] vfs_write+0x765/0xfd0 [ 84.233285][ T1731] ? __cfi_vfs_write+0x10/0x10 [ 84.233308][ T1731] ? __cfi_mutex_lock+0x10/0x10 [ 84.233331][ T1731] ksys_write+0x145/0x260 [ 84.233347][ T1731] ? __cfi_ksys_write+0x10/0x10 [ 84.233362][ T1731] ? __kasan_check_read+0x15/0x20 [ 84.233385][ T1731] __x64_sys_write+0x7f/0x90 [ 84.233400][ T1731] x64_sys_call+0x271c/0x2ee0 [ 84.233418][ T1731] do_syscall_64+0x57/0xf0 [ 84.233435][ T1731] ? clear_bhb_loop+0x50/0xa0 [ 84.233458][ T1731] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 84.233480][ T1731] RIP: 0033:0x7fa8a0d9fb19 [ 84.233494][ T1731] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 84.233510][ T1731] RSP: 002b:00007fa8a1c13028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 84.233530][ T1731] RAX: ffffffffffffffda RBX: 00007fa8a1025fa0 RCX: 00007fa8a0d9fb19 [ 84.233543][ T1731] RDX: 0000000000000001 RSI: 0000200000000980 RDI: 0000000000000003 [ 84.233555][ T1731] RBP: 00007fa8a1c13090 R08: 0000000000000000 R09: 0000000000000000 [ 84.233566][ T1731] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 84.233577][ T1731] R13: 00007fa8a1026038 R14: 00007fa8a1025fa0 R15: 00007ffd6691e798 [ 84.233592][ T1731] [ 85.248300][ T350] usb 2-1: new high-speed USB device number 24 using dummy_hcd [ 85.342419][ T1742] kvm: kvm [1741]: vcpu0, guest rIP: 0x9134 Unhandled WRMSR(0x11e) = 0xbe702111 [ 85.429336][ T350] usb 2-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 85.439284][ T350] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 85.458303][ T350] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 85.469332][ T350] usb 2-1: config 1 has no interface number 0 [ 85.475522][ T350] usb 2-1: too many endpoints for config 1 interface 1 altsetting 1: 32, using maximum allowed: 30 [ 85.486511][ T350] usb 2-1: config 1 interface 1 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 32 [ 85.501602][ T350] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 85.511019][ T350] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 85.521884][ T350] usb 2-1: Product: syz [ 85.526081][ T350] usb 2-1: Manufacturer: syz [ 85.530841][ T350] usb 2-1: SerialNumber: syz [ 85.543150][ T350] cdc_ncm 2-1:1.1: CDC Union missing and no IAD found [ 85.550173][ T350] cdc_ncm 2-1:1.1: bind() failure [ 85.608202][ T1757] netlink: 57 bytes leftover after parsing attributes in process `syz.3.450'. [ 85.725771][ T1765] FAULT_INJECTION: forcing a failure. [ 85.725771][ T1765] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 85.738883][ T1765] CPU: 0 UID: 0 PID: 1765 Comm: syz.3.453 Not tainted syzkaller #0 1c9c13191c392e8d374fa2f59d394ca06c0f036a [ 85.738921][ T1765] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 85.738932][ T1765] Call Trace: [ 85.738939][ T1765] [ 85.738946][ T1765] __dump_stack+0x21/0x30 [ 85.738966][ T1765] dump_stack_lvl+0x140/0x1c0 [ 85.738976][ T1765] ? __cfi_dump_stack_lvl+0x10/0x10 [ 85.738986][ T1765] dump_stack+0x19/0x20 [ 85.738994][ T1765] should_fail_ex+0x3c2/0x510 [ 85.739004][ T1765] should_fail+0xf/0x20 [ 85.739013][ T1765] should_fail_usercopy+0x1e/0x30 [ 85.739023][ T1765] _copy_from_iter+0x1a6/0x1520 [ 85.739035][ T1765] ? __cfi__copy_from_iter+0x10/0x10 [ 85.739045][ T1765] ? __check_object_size+0x54c/0x870 [ 85.739060][ T1765] ? __cfi___check_object_size+0x10/0x10 [ 85.739073][ T1765] ? __kmalloc_noprof+0x261/0x510 [ 85.739089][ T1765] kernfs_fop_write_iter+0x1a4/0x510 [ 85.739101][ T1765] vfs_write+0x765/0xfd0 [ 85.739116][ T1765] ? __cfi_vfs_write+0x10/0x10 [ 85.739130][ T1765] ? __cfi_mutex_lock+0x10/0x10 [ 85.739143][ T1765] ksys_write+0x145/0x260 [ 85.739151][ T1765] ? __cfi_ksys_write+0x10/0x10 [ 85.739160][ T1765] ? __kasan_check_read+0x15/0x20 [ 85.739174][ T1765] __x64_sys_write+0x7f/0x90 [ 85.739183][ T1765] x64_sys_call+0x271c/0x2ee0 [ 85.739193][ T1765] do_syscall_64+0x57/0xf0 [ 85.739203][ T1765] ? clear_bhb_loop+0x50/0xa0 [ 85.739217][ T1765] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 85.739230][ T1765] RIP: 0033:0x7fa8a0d9fb19 [ 85.739239][ T1765] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 85.739248][ T1765] RSP: 002b:00007fa8a1c13028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 85.739260][ T1765] RAX: ffffffffffffffda RBX: 00007fa8a1025fa0 RCX: 00007fa8a0d9fb19 [ 85.739267][ T1765] RDX: 0000000000000001 RSI: 0000200000000980 RDI: 0000000000000003 [ 85.739274][ T1765] RBP: 00007fa8a1c13090 R08: 0000000000000000 R09: 0000000000000000 [ 85.739281][ T1765] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 85.739287][ T1765] R13: 00007fa8a1026038 R14: 00007fa8a1025fa0 R15: 00007ffd6691e798 [ 85.739296][ T1765] [ 85.995182][ T1777] netlink: 'syz.4.455': attribute type 16 has an invalid length. [ 86.004876][ T1782] netlink: 'syz.4.455': attribute type 16 has an invalid length. [ 86.068326][ T1790] batadv_slave_0: entered promiscuous mode [ 86.074160][ T1790] batadv_slave_0: entered allmulticast mode [ 86.081063][ T1790] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 86.089562][ T1790] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 86.099410][ T1792] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 86.107874][ T1792] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 86.114152][ T1797] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 86.124217][ T1797] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 86.133529][ T1797] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=32284 sclass=netlink_route_socket pid=1797 comm=syz.3.461 [ 86.669937][ T1806] SELinux: security_context_str_to_sid (sysadm_u) failed with errno=-22 [ 86.689750][ T36] kauditd_printk_skb: 6 callbacks suppressed [ 86.689766][ T36] audit: type=1326 audit(2000000060.510:35333): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1807 comm="syz.3.465" exe="/root/ci2-android-6-12-rust/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fa8a0d9fb19 code=0x0 [ 86.720695][ T36] audit: type=1400 audit(2000000060.510:35334): avc: denied { write } for pid=1809 comm="syz.2.466" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 86.745482][ T1810] process 'syz.2.466' launched './file0' with NULL argv: empty string added [ 86.754414][ T1810] Invalid argument reading file caps for ./file0 [ 86.754411][ T36] audit: type=1400 audit(2000000060.570:35335): avc: denied { execute_no_trans } for pid=1809 comm="syz.2.466" path="/152/file0" dev="tmpfs" ino=909 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 86.785127][ T36] audit: type=1326 audit(2000000060.600:35336): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1807 comm="syz.3.465" exe="/root/ci2-android-6-12-rust/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fa8a0d9fb19 code=0x0 [ 86.814576][ T36] audit: type=1400 audit(2000000060.630:35337): avc: denied { read } for pid=1809 comm="syz.2.466" lport=7 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 87.591691][ T1832] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 87.600263][ T1832] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 87.985482][ T423] usb 2-1: USB disconnect, device number 24 [ 87.993284][ T1837] netlink: 224 bytes leftover after parsing attributes in process `syz.1.476'. [ 88.030252][ T36] audit: type=1400 audit(2000000061.850:35338): avc: denied { sqpoll } for pid=1844 comm="syz.1.479" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 88.480266][ T36] audit: type=1400 audit(2000000062.300:35339): avc: denied { remount } for pid=1858 comm="syz.2.482" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 88.480270][ T1860] SELinux: security_context_str_to_sid (sytem_uGй) failed with errno=-22 [ 89.128317][ T350] usb 2-1: new high-speed USB device number 25 using dummy_hcd [ 89.149761][ T36] audit: type=1400 audit(2000000062.970:35340): avc: denied { mount } for pid=1871 comm="syz.3.487" name="/" dev="configfs" ino=2536 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=filesystem permissive=1 [ 89.161477][ T1872] Mass Storage Function, version: 2009/09/11 [ 89.172555][ T36] audit: type=1400 audit(2000000062.970:35341): avc: denied { write } for pid=1871 comm="syz.3.487" name="usb_gadget" dev="configfs" ino=2537 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 89.178704][ T1872] LUN: removable file: (no medium) [ 89.201432][ T36] audit: type=1400 audit(2000000062.970:35342): avc: denied { add_name } for pid=1871 comm="syz.3.487" name="g1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 89.272518][ T1881] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 89.274248][ T1307] Bluetooth: hci0: Frame reassembly failed (-84) [ 89.283053][ T1881] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 89.299412][ T350] usb 2-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 89.308242][ T350] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 89.318397][ T350] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 89.327240][ T350] usb 2-1: config 1 has no interface number 0 [ 89.333399][ T350] usb 2-1: too many endpoints for config 1 interface 1 altsetting 1: 32, using maximum allowed: 30 [ 89.344156][ T350] usb 2-1: config 1 interface 1 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 32 [ 89.358498][ T350] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 89.367585][ T350] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 89.375681][ T350] usb 2-1: Product: syz [ 89.379889][ T350] usb 2-1: Manufacturer: syz [ 89.384472][ T350] usb 2-1: SerialNumber: syz [ 89.390948][ T350] cdc_ncm 2-1:1.1: CDC Union missing and no IAD found [ 89.397741][ T350] cdc_ncm 2-1:1.1: bind() failure [ 89.810623][ T1884] netlink: 12 bytes leftover after parsing attributes in process `syz.2.492'. [ 89.811913][ T1887] SELinux: Context . is not valid (left unmapped). [ 89.972634][ T1901] ./dev/sda1: Can't lookup blockdev [ 90.137024][ T1915] overlay: ./file0 is not a directory [ 90.153248][ T1917] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 90.161748][ T1917] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 90.184161][ T1917] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 90.192683][ T1917] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 90.727055][ T1922] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 90.735585][ T1922] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 90.743835][ T1922] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 90.752361][ T1922] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 90.760730][ T1923] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 90.769773][ T1923] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 91.308271][ T1415] Bluetooth: hci0: command 0x1003 tx timeout [ 91.314306][ T54] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 91.320492][ T1880] Bluetooth: hci0: Opcode 0x080f failed: -22 [ 91.381200][ T1938] ./dev/sda1: Can't lookup blockdev [ 91.551413][ T1940] netlink: 44 bytes leftover after parsing attributes in process `syz.2.506'. [ 91.560934][ T1940] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 91.569425][ T1940] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 91.885570][ T350] usb 2-1: USB disconnect, device number 25 [ 91.941413][ T36] kauditd_printk_skb: 18 callbacks suppressed [ 91.941430][ T36] audit: type=1400 audit(2000000065.760:35361): avc: denied { create } for pid=1951 comm="syz.1.510" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 92.121560][ T1973] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 92.130088][ T1973] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 92.338265][ T350] usb 2-1: new full-speed USB device number 26 using dummy_hcd [ 92.489592][ T350] usb 2-1: unable to get BOS descriptor or descriptor too short [ 92.497643][ T350] usb 2-1: not running at top speed; connect to a high speed hub [ 92.507397][ T350] usb 2-1: New USB device found, idVendor=0e41, idProduct=4650, bcdDevice= 0.40 [ 92.516480][ T350] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 92.524499][ T350] usb 2-1: Product: syz [ 92.528705][ T350] usb 2-1: Manufacturer: syz [ 92.533285][ T350] usb 2-1: SerialNumber: syz [ 92.725150][ T1986] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=1986 comm=syz.3.516 [ 92.738041][ T1979] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=65535 sclass=netlink_tcpdiag_socket pid=1979 comm=syz.3.516 [ 92.753748][ T350] usb 2-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 92.760705][ T350] usb 2-1: 2:1: invalid format type 0x1002 is detected, processed as PCM [ 92.769184][ T350] usb 2-1: 2:1 : invalid UAC_FORMAT_TYPE desc [ 92.778942][ T350] usb 2-1: USB disconnect, device number 26 [ 92.788603][ T1556] udevd[1556]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 93.498272][ T311] usb 2-1: new high-speed USB device number 27 using dummy_hcd [ 93.533393][ T1993] FAULT_INJECTION: forcing a failure. [ 93.533393][ T1993] name failslab, interval 1, probability 0, space 0, times 0 [ 93.546007][ T1993] CPU: 1 UID: 0 PID: 1993 Comm: syz.2.519 Not tainted syzkaller #0 1c9c13191c392e8d374fa2f59d394ca06c0f036a [ 93.546033][ T1993] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 93.546044][ T1993] Call Trace: [ 93.546048][ T1993] [ 93.546052][ T1993] __dump_stack+0x21/0x30 [ 93.546067][ T1993] dump_stack_lvl+0x140/0x1c0 [ 93.546076][ T1993] ? __cfi_dump_stack_lvl+0x10/0x10 [ 93.546086][ T1993] dump_stack+0x19/0x20 [ 93.546094][ T1993] should_fail_ex+0x3c2/0x510 [ 93.546104][ T1993] should_failslab+0xac/0x100 [ 93.546115][ T1993] __kmalloc_cache_noprof+0x41/0x470 [ 93.546130][ T1993] ? mirred_init_net+0xb4/0x2b0 [ 93.546143][ T1993] mirred_init_net+0xb4/0x2b0 [ 93.546155][ T1993] ops_init+0x302/0x5d0 [ 93.546167][ T1993] ? __kasan_check_write+0x18/0x20 [ 93.546182][ T1993] ? rwsem_read_trylock+0x275/0x5a0 [ 93.546195][ T1993] setup_net+0x227/0x9b0 [ 93.546209][ T1993] ? copy_net_ns+0xa20/0xa20 [ 93.546223][ T1993] ? down_read_killable+0x7f/0x100 [ 93.546237][ T1993] ? __cfi_down_read_killable+0x10/0x10 [ 93.546251][ T1993] copy_net_ns+0x4fc/0xa20 [ 93.546265][ T1993] create_new_namespaces+0x390/0x6f0 [ 93.546276][ T1993] copy_namespaces+0x257/0x2b0 [ 93.546286][ T1993] copy_process+0x1302/0x33a0 [ 93.546301][ T1993] ? __cfi_copy_process+0x10/0x10 [ 93.546315][ T1993] kernel_clone+0x233/0x810 [ 93.546328][ T1993] ? __cfi_kernel_clone+0x10/0x10 [ 93.546341][ T1993] ? do_futex+0x32a/0x510 [ 93.546353][ T1993] __x64_sys_clone+0x1b7/0x230 [ 93.546366][ T1993] ? __cfi___x64_sys_clone+0x10/0x10 [ 93.546381][ T1993] ? __kasan_check_write+0x18/0x20 [ 93.546394][ T1993] ? fpregs_restore_userregs+0x11c/0x260 [ 93.546408][ T1993] ? switch_fpu_return+0x12/0x20 [ 93.546420][ T1993] x64_sys_call+0x2b3c/0x2ee0 [ 93.546431][ T1993] do_syscall_64+0x57/0xf0 [ 93.546441][ T1993] ? clear_bhb_loop+0x50/0xa0 [ 93.546455][ T1993] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 93.546468][ T1993] RIP: 0033:0x7fae1f19fb19 [ 93.546478][ T1993] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 93.546486][ T1993] RSP: 002b:00007fae20036fd8 EFLAGS: 00000206 ORIG_RAX: 0000000000000038 [ 93.546498][ T1993] RAX: ffffffffffffffda RBX: 00007fae1f425fa0 RCX: 00007fae1f19fb19 [ 93.546506][ T1993] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000c0100000 [ 93.546513][ T1993] RBP: 00007fae1f237b70 R08: 0000000000000000 R09: 0000000000000000 [ 93.546519][ T1993] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 93.546525][ T1993] R13: 00007fae1f426038 R14: 00007fae1f425fa0 R15: 00007ffed22c09a8 [ 93.546534][ T1993] [ 93.821724][ T36] audit: type=1400 audit(2000000067.640:35362): avc: denied { ioctl } for pid=1996 comm="syz.4.520" path="socket:[16834]" dev="sockfs" ino=16834 ioctlcmd=0x6 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 93.867710][ T2005] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 93.876908][ T2005] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 93.890886][ T311] usb 2-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 93.899608][ T311] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 93.909882][ T311] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 93.918943][ T311] usb 2-1: config 1 has no interface number 0 [ 93.925053][ T311] usb 2-1: too many endpoints for config 1 interface 1 altsetting 1: 32, using maximum allowed: 30 [ 93.935915][ T311] usb 2-1: config 1 interface 1 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 32 [ 93.950832][ T311] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 93.955908][ T2009] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 93.959896][ T311] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 93.969747][ T2009] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 93.976410][ T311] usb 2-1: Product: syz [ 93.988148][ T311] usb 2-1: Manufacturer: syz [ 93.989362][ T36] audit: type=1400 audit(2000000067.800:35363): avc: denied { create } for pid=2008 comm="syz.2.524" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 93.992771][ T311] usb 2-1: SerialNumber: syz [ 94.021385][ T311] cdc_ncm 2-1:1.1: CDC Union missing and no IAD found [ 94.028165][ T311] cdc_ncm 2-1:1.1: bind() failure [ 94.467243][ T36] audit: type=1400 audit(2000000068.280:35364): avc: denied { ioctl } for pid=2016 comm="syz.3.528" path="socket:[16884]" dev="sockfs" ino=16884 ioctlcmd=0x5411 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 94.468740][ T2017] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 94.501208][ T2017] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 94.551301][ T36] audit: type=1326 audit(2000000068.370:35365): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2016 comm="syz.3.528" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa8a0d9fb19 code=0x7ffc0000 [ 94.576724][ T36] audit: type=1326 audit(2000000068.370:35366): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2016 comm="syz.3.528" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa8a0d9fb19 code=0x7ffc0000 [ 94.678299][ T36] audit: type=1326 audit(2000000068.370:35367): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2016 comm="syz.3.528" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=291 compat=0 ip=0x7fa8a0d9fb19 code=0x7ffc0000 [ 94.703883][ T36] audit: type=1326 audit(2000000068.370:35368): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2016 comm="syz.3.528" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa8a0d9fb19 code=0x7ffc0000 [ 94.736724][ T36] audit: type=1326 audit(2000000068.370:35369): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2016 comm="syz.3.528" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=232 compat=0 ip=0x7fa8a0d9fb19 code=0x7ffc0000 [ 94.762355][ T36] audit: type=1326 audit(2000000068.370:35370): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2016 comm="syz.3.528" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa8a0d9fb19 code=0x7ffc0000 [ 95.535739][ T2046] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 95.545679][ T2046] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 95.554963][ T2046] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 95.564089][ T2046] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 96.152122][ T2066] capability: warning: `syz.3.544' uses 32-bit capabilities (legacy support in use) [ 96.162809][ T2066] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 96.171611][ T2066] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 96.263297][ T350] usb 2-1: USB disconnect, device number 27 [ 96.734091][ T2091] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 96.743261][ T2091] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 97.282927][ T2109] tipc: Failed to remove unknown binding: 66,0,0/0:2285086864/2285086866 [ 97.291936][ T2109] tipc: Failed to remove unknown binding: 66,0,0/0:2285086864/2285086865 [ 97.300802][ T2109] tipc: Failed to remove unknown binding: 66,0,0/0:2285086864/2285086866 [ 97.309549][ T2109] tipc: Failed to remove unknown binding: 66,0,0/0:2285086864/2285086865 [ 97.319293][ T36] kauditd_printk_skb: 12 callbacks suppressed [ 97.319306][ T36] audit: type=1400 audit(2000000071.140:35383): avc: denied { shutdown } for pid=2108 comm="syz.3.560" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 97.357947][ T2109] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 97.366832][ T2110] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 97.376719][ T2109] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 97.385275][ T36] audit: type=1400 audit(2000000071.170:35384): avc: denied { read } for pid=2108 comm="syz.3.560" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 97.408125][ T2110] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 97.657963][ T2118] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 97.666481][ T2118] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 98.192732][ T2126] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 conventional PCI endpoint [ 98.267191][ T2134] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 98.276157][ T2134] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 98.715916][ T2136] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=0 sclass=netlink_xfrm_socket pid=2136 comm=syz.2.568 [ 98.740862][ T2140] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 98.749436][ T2140] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 98.812460][ T36] audit: type=1400 audit(2000000072.630:35385): avc: denied { nlmsg_read } for pid=2149 comm="syz.3.573" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 98.968481][ T2161] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 98.977081][ T2161] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 99.258267][ T393] usb 2-1: new full-speed USB device number 28 using dummy_hcd [ 99.274418][ T2167] 9pnet_fd: p9_fd_create_tcp (2167): problem connecting socket to 127.0.0.1 [ 99.283543][ T2166] overlayfs: missing 'workdir' [ 99.301440][ T2170] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 99.310061][ T2170] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 99.419604][ T393] usb 2-1: unable to get BOS descriptor or descriptor too short [ 99.427656][ T393] usb 2-1: not running at top speed; connect to a high speed hub [ 99.436163][ T393] usb 2-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 64, changing to 4 [ 99.448598][ T393] usb 2-1: New USB device found, idVendor=0582, idProduct=004c, bcdDevice= 0.40 [ 99.457650][ T393] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 99.465652][ T393] usb 2-1: Product: syz [ 99.469852][ T393] usb 2-1: Manufacturer: syz [ 99.474453][ T393] usb 2-1: SerialNumber: syz [ 99.681539][ T2164] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 99.690084][ T2164] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 99.701535][ T393] usb 2-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 99.712483][ T393] usb 2-1: 2:1 : unknown format tag 0x4 is detected. processed as MPEG. [ 99.720973][ T393] usb 2-1: found format II with max.bitrate = 4, frame size=7372 [ 99.812329][ T36] audit: type=1400 audit(2000000073.630:35386): avc: denied { mounton } for pid=2185 comm="syz.3.585" path="/proc/721" dev="proc" ino=18557 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=dir permissive=1 [ 99.868118][ T2194] sd 0:0:1:0: device reset [ 100.204529][ T393] usb 2-1: parse_audio_format_rates_v2v3(): unable to find clock source (clock -22) [ 100.214012][ T393] usb 2-1: 2:1 : unknown format tag 0x4 is detected. processed as MPEG. [ 100.222480][ T393] usb 2-1: found format II with max.bitrate = 4, frame size=7372 [ 100.230226][ T393] usb 2-1: parse_audio_format_rates_v2v3(): unable to find clock source (clock -22) [ 100.240362][ T393] usb 2-1: failed to enable PITCH for EP 0x82 [ 100.275211][ T393] usb 2-1: USB disconnect, device number 28 [ 100.294772][ T2221] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 100.313150][ T2198] udevd[2198]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 100.329075][ T1556] udevd[1556]: setting mode of /dev/snd/pcmC0D0c to 020660 failed: No such file or directory [ 100.341888][ T2221] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 100.363741][ T1556] udevd[1556]: setting owner of /dev/snd/pcmC0D0c to uid=0, gid=29 failed: No such file or directory [ 100.787620][ T36] audit: type=1400 audit(2000000074.600:35387): avc: denied { mounton } for pid=2226 comm="syz.2.596" path="/201/file0" dev="tmpfs" ino=1197 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 100.958959][ T2244] ================================================================== [ 100.967030][ T2244] BUG: KASAN: slab-use-after-free in snapshot_ctr+0x586/0x1350 [ 100.974564][ T2244] Read of size 8 at addr ffff888122b7f418 by task syz.2.602/2244 [ 100.982258][ T2244] [ 100.984569][ T2244] CPU: 0 UID: 0 PID: 2244 Comm: syz.2.602 Not tainted syzkaller #0 1c9c13191c392e8d374fa2f59d394ca06c0f036a [ 100.984585][ T2244] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 100.984592][ T2244] Call Trace: [ 100.984595][ T2244] [ 100.984600][ T2244] __dump_stack+0x21/0x30 [ 100.984613][ T2244] dump_stack_lvl+0x140/0x1c0 [ 100.984622][ T2244] ? __cfi_dump_stack_lvl+0x10/0x10 [ 100.984631][ T2244] ? __cfi__printk+0x10/0x10 [ 100.984646][ T2244] print_address_description+0x71/0x210 [ 100.984656][ T2244] print_report+0x4a/0x70 [ 100.984665][ T2244] kasan_report+0x162/0x1a0 [ 100.984676][ T2244] ? snapshot_ctr+0x586/0x1350 [ 100.984688][ T2244] ? snapshot_ctr+0x586/0x1350 [ 100.984699][ T2244] __asan_report_load8_noabort+0x18/0x20 [ 100.984712][ T2244] snapshot_ctr+0x586/0x1350 [ 100.984723][ T2244] ? dm_split_args+0xa1/0x740 [ 100.984733][ T2244] ? __cfi_snapshot_ctr+0x10/0x10 [ 100.984743][ T2244] ? dm_split_args+0x5d0/0x740 [ 100.984753][ T2244] dm_table_add_target+0x59f/0xcb0 [ 100.984763][ T2244] table_load+0x2eb/0x7d0 [ 100.984776][ T2244] ? __check_object_size+0x99/0x870 [ 100.984791][ T2244] ? __cfi_table_load+0x10/0x10 [ 100.984804][ T2244] ? __kasan_check_write+0x18/0x20 [ 100.984818][ T2244] ? __cfi_table_load+0x10/0x10 [ 100.984830][ T2244] dm_ctl_ioctl+0x8f3/0xde0 [ 100.984845][ T2244] ? __cfi_dm_ctl_ioctl+0x10/0x10 [ 100.984869][ T2244] ? __fget_files+0x2bc/0x330 [ 100.984886][ T2244] ? bpf_lsm_file_ioctl+0xd/0x20 [ 100.984897][ T2244] ? security_file_ioctl+0x3e/0x110 [ 100.984912][ T2244] ? __cfi_dm_ctl_ioctl+0x10/0x10 [ 100.984924][ T2244] __se_sys_ioctl+0x123/0x1b0 [ 100.984935][ T2244] __x64_sys_ioctl+0x7f/0xa0 [ 100.984945][ T2244] x64_sys_call+0x1878/0x2ee0 [ 100.984956][ T2244] do_syscall_64+0x57/0xf0 [ 100.984967][ T2244] ? clear_bhb_loop+0x50/0xa0 [ 100.984981][ T2244] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 100.984994][ T2244] RIP: 0033:0x7fae1f19fb19 [ 100.985004][ T2244] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 100.985013][ T2244] RSP: 002b:00007fae20016028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 100.985025][ T2244] RAX: ffffffffffffffda RBX: 00007fae1f426090 RCX: 00007fae1f19fb19 [ 100.985032][ T2244] RDX: 0000200000000940 RSI: 00000000c138fd09 RDI: 0000000000000003 [ 100.985040][ T2244] RBP: 00007fae1f237b70 R08: 0000000000000000 R09: 0000000000000000 [ 100.985047][ T2244] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 100.985056][ T2244] R13: 00007fae1f426128 R14: 00007fae1f426090 R15: 00007ffed22c09a8 [ 100.985065][ T2244] [ 100.985069][ T2244] [ 101.244058][ T2244] Allocated by task 2244: [ 101.248370][ T2244] kasan_save_track+0x3e/0x80 [ 101.253045][ T2244] kasan_save_alloc_info+0x3a/0x50 [ 101.258163][ T2244] __kasan_kmalloc+0x96/0xb0 [ 101.262743][ T2244] __kmalloc_cache_node_noprof+0x225/0x430 [ 101.268553][ T2244] dm_get_table_device+0x1e3/0x6c0 [ 101.273658][ T2244] dm_get_device+0x32b/0x7f0 [ 101.278237][ T2244] snapshot_ctr+0x292/0x1350 [ 101.282815][ T2244] dm_table_add_target+0x59f/0xcb0 [ 101.287911][ T2244] table_load+0x2eb/0x7d0 [ 101.292232][ T2244] dm_ctl_ioctl+0x8f3/0xde0 [ 101.296721][ T2244] __se_sys_ioctl+0x123/0x1b0 [ 101.301394][ T2244] __x64_sys_ioctl+0x7f/0xa0 [ 101.305966][ T2244] x64_sys_call+0x1878/0x2ee0 [ 101.310636][ T2244] do_syscall_64+0x57/0xf0 [ 101.315036][ T2244] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 101.320914][ T2244] [ 101.323227][ T2244] Freed by task 2244: [ 101.327197][ T2244] kasan_save_track+0x3e/0x80 [ 101.331863][ T2244] kasan_save_free_info+0x44/0x50 [ 101.336878][ T2244] __kasan_slab_free+0x5f/0x80 [ 101.341631][ T2244] kfree+0x158/0x440 [ 101.345516][ T2244] dm_put_table_device+0x298/0x2e0 [ 101.350616][ T2244] dm_get_device+0x571/0x7f0 [ 101.355192][ T2244] snapshot_ctr+0x435/0x1350 [ 101.359766][ T2244] dm_table_add_target+0x59f/0xcb0 [ 101.364860][ T2244] table_load+0x2eb/0x7d0 [ 101.369188][ T2244] dm_ctl_ioctl+0x8f3/0xde0 [ 101.373679][ T2244] __se_sys_ioctl+0x123/0x1b0 [ 101.378341][ T2244] __x64_sys_ioctl+0x7f/0xa0 [ 101.382917][ T2244] x64_sys_call+0x1878/0x2ee0 [ 101.387588][ T2244] do_syscall_64+0x57/0xf0 [ 101.392003][ T2244] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 101.397889][ T2244] [ 101.400198][ T2244] The buggy address belongs to the object at ffff888122b7f400 [ 101.400198][ T2244] which belongs to the cache kmalloc-96 of size 96 [ 101.414060][ T2244] The buggy address is located 24 bytes inside of [ 101.414060][ T2244] freed 96-byte region [ffff888122b7f400, ffff888122b7f460) [ 101.427669][ T2244] [ 101.429977][ T2244] The buggy address belongs to the physical page: [ 101.436368][ T2244] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x122b7f [ 101.445203][ T2244] flags: 0x4000000000000000(zone=1) [ 101.450392][ T2244] page_type: f5(slab) [ 101.454361][ T2244] raw: 4000000000000000 ffff888100041280 dead000000000122 0000000000000000 [ 101.462929][ T2244] raw: 0000000000000000 0000000080200020 00000001f5000000 0000000000000000 [ 101.471496][ T2244] page dumped because: kasan: bad access detected [ 101.477894][ T2244] page_owner tracks the page as allocated [ 101.483597][ T2244] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x152cc0(GFP_USER|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 297, tgid 297 (syz-executor), ts 100947148072, free_ts 100947134896 [ 101.502772][ T2244] post_alloc_hook+0x37d/0x3b0 [ 101.507537][ T2244] prep_new_page+0x2d/0x180 [ 101.512062][ T2244] get_page_from_freelist+0x4aea/0x4ba0 [ 101.517609][ T2244] __alloc_pages_noprof+0x35a/0x7e0 [ 101.522804][ T2244] alloc_slab_page+0x6b/0x1e0 [ 101.527478][ T2244] allocate_slab+0x69/0x430 [ 101.531969][ T2244] ___slab_alloc+0x591/0x8c0 [ 101.536541][ T2244] __kmalloc_cache_node_noprof+0x2ae/0x430 [ 101.542341][ T2244] __get_vm_area_node+0x150/0x390 [ 101.547354][ T2244] __vmalloc_node_range_noprof+0x340/0x1300 [ 101.553237][ T2244] vzalloc_noprof+0x103/0x1d0 [ 101.557906][ T2244] alloc_counters+0x75/0x520 [ 101.562481][ T2244] do_ipt_get_ctl+0xab5/0x1210 [ 101.567236][ T2244] nf_getsockopt+0x288/0x2b0 [ 101.571810][ T2244] ip_getsockopt+0x15b/0x200 [ 101.576388][ T2244] tcp_getsockopt+0x106/0x130 [ 101.581057][ T2244] page last free pid 297 tgid 297 stack trace: [ 101.587189][ T2244] free_unref_page+0xb99/0xf50 [ 101.591939][ T2244] __free_pages+0x6b/0x3b0 [ 101.596341][ T2244] vfree+0x3ea/0x5b0 [ 101.600218][ T2244] do_ipt_get_ctl+0xef6/0x1210 [ 101.604963][ T2244] nf_getsockopt+0x288/0x2b0 [ 101.609536][ T2244] ip_getsockopt+0x15b/0x200 [ 101.614111][ T2244] tcp_getsockopt+0x106/0x130 [ 101.618770][ T2244] sock_common_getsockopt+0xb2/0xd0 [ 101.623950][ T2244] do_sock_getsockopt+0x3a1/0x6c0 [ 101.628959][ T2244] __x64_sys_getsockopt+0x1aa/0x250 [ 101.634141][ T2244] x64_sys_call+0x10db/0x2ee0 [ 101.638803][ T2244] do_syscall_64+0x57/0xf0 [ 101.643381][ T2244] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 101.649262][ T2244] [ 101.651572][ T2244] Memory state around the buggy address: [ 101.657182][ T2244] ffff888122b7f300: 00 00 00 00 00 00 00 00 03 fc fc fc fc fc fc fc [ 101.665224][ T2244] ffff888122b7f380: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc [ 101.673269][ T2244] >ffff888122b7f400: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc [ 101.681307][ T2244] ^ [ 101.686137][ T2244] ffff888122b7f480: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc [ 101.694201][ T2244] ffff888122b7f500: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc [ 101.702240][ T2244] ================================================================== [ 101.710476][ T2244] Disabling lock debugging due to kernel taint [ 101.716992][ T2244] device-mapper: table: 252:6: device 1:4 not in table devices list [ 101.725155][ T2244] device-mapper: table: 252:6: snapshot: COW device cannot be the same as origin device (-EINVAL) [ 101.736125][ T2244] device-mapper: ioctl: error adding target to table [ 101.742988][ T2244] device-mapper: table: 252:6: dm_table_destroy: dm_put_device call missing for 1:4