last executing test programs: 4.705062112s ago: executing program 3 (id=129): r0 = socket(0x27, 0x4, 0x1) (async, rerun: 64) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) (rerun: 64) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) (async) r3 = userfaultfd(0x0) capset(&(0x7f0000000040)={0x20080522}, &(0x7f0000000080)) (async) prctl$PR_SET_SECUREBITS(0x1c, 0x0) (async) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000ff9000/0x4000)=nil, 0x4000}, 0x1}) (async) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x9) ioctl$KVM_REGISTER_COALESCED_MMIO(r2, 0x4010ae67, &(0x7f0000000000)={0x77774002, 0x12000, 0x2}) (async, rerun: 32) r4 = socket$nl_audit(0x10, 0x3, 0x9) (rerun: 32) getsockopt$netlink(r4, 0x10e, 0x3, 0x0, &(0x7f0000000080)) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000080)={0x2, &(0x7f0000000440)=[{0x6c, 0x0, 0x1, 0xfffffffc}, {0x6, 0xfc, 0x0, 0x7fff0000}]}) ioctl$KVM_UNREGISTER_COALESCED_MMIO(r2, 0x4010ae68, &(0x7f00000003c0)={0xb000, 0x0, 0xfffffffe}) ioctl$sock_SIOCSIFVLAN_DEL_VLAN_CMD(r0, 0x8983, &(0x7f0000000000)={0x1, 'vlan0\x00', {}, 0xc2c}) 4.64101024s ago: executing program 3 (id=130): unshare(0x64000400) r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000002c0)='/sys/power/resume', 0x149a82, 0x0) write$cgroup_int(r0, &(0x7f00000000c0)=0x40004, 0x12) prctl$PR_SET_VMA(0x48, 0x0, &(0x7f0000332000/0x4000)=nil, 0x4000, 0x0) r1 = syz_usb_connect(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000001018610f4205ae06d6c011703010902240001010000000904690202ff5aa30009050402100000fa000905820240"], 0x0) syz_usb_control_io$printer(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r1, 0x0, &(0x7f0000000300)={0x1c, &(0x7f0000000140)={0x0, 0xc, 0x6, "f82970c636f5"}, 0x0, 0x0}) syz_usb_control_io$hid(r1, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000200)={0x40, 0xa, 0x4, "921a352e"}, 0x0, 0x0, 0x0, 0x0}) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) socket$inet_udp(0x2, 0x2, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cpuacct.usage_sys\x00', 0x275a, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x2800, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetlb.2MB.rsvd.usage_in_bytes\x00', 0x275a, 0x0) socket$nl_sock_diag(0x10, 0x3, 0x4) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000001c0)='cgroup.stat\x00', 0x275a, 0x0) ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='freezer.self_freezing\x00', 0x275a, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f00000af000/0x18000)=nil, &(0x7f00000000c0)=[@textreal={0x8, &(0x7f0000000000)="8ee8c9b8ee088ed8660f3801b2d6352ed9ff660f3882040f01cf0fc72d2626652e0f01ca0fc7386635002000000f22e0", 0x30}], 0x1, 0x50, 0x0, 0x0) write$binfmt_script(r3, &(0x7f0000000000), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r3, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x48241, 0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) dup(r5) write$tun(r4, 0x0, 0x3e) preadv(r3, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x1, 0x0, 0x0) socket$netlink(0x10, 0x3, 0x15) 3.081730987s ago: executing program 1 (id=135): r0 = syz_open_dev$rtc(&(0x7f0000000080), 0x0, 0x1000) ioctl$RTC_PIE_OFF(r0, 0x7006) ioctl$KVM_GET_VCPU_MMAP_SIZE(0xffffffffffffffff, 0xae04) r1 = epoll_create(0x3) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCGARP(r2, 0x8954, &(0x7f0000000240)={{0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x306, @broadcast}, 0xa, {0x2, 0x4e20, @rand_addr=0x64010100}, 'veth1_macvtap\x00'}) ioctl$BTRFS_IOC_QGROUP_CREATE(r1, 0x4010942a, 0x0) r3 = socket$netlink(0x10, 0x3, 0x4) writev(r3, &(0x7f00000000c0)=[{&(0x7f0000000180)="580000001500add427323b470c45b4560a067fffffff81004e22030d00ff0028925aa8002000eaa57b00090080020efffeffe809020000ff0004f03a09000000ffffffffffffffffffffffe7ee0000000000000000020000", 0x58}], 0x1) r4 = syz_open_dev$evdev(&(0x7f0000000000), 0x8000000000000001, 0x200) ioctl$EVIOCSABS20(r4, 0x401845e0, &(0x7f0000000040)={0x5, 0x4, 0xf68c, 0x2, 0x1, 0x100}) r5 = userfaultfd(0x801) ioctl$UFFDIO_API(r5, 0xc018aa3f, &(0x7f0000000000)={0xaa, 0x280}) mremap(&(0x7f00003ff000/0xc00000)=nil, 0xc00000, 0x2000, 0x3, &(0x7f0000000000/0x2000)=nil) ioctl$UFFDIO_WRITEPROTECT(r5, 0xc018aa06, &(0x7f00000000c0)={{&(0x7f000040a000/0x800000)=nil, 0x800000}}) syz_usb_connect$uac2(0x5, 0x7b, &(0x7f0000000700)=ANY=[@ANYBLOB="1201010200000020820509004000010203010902690003010b6080080b010001ff200209040000000101200009240100040b0900000904ffff000102200009040101"], &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0}) 2.724725553s ago: executing program 0 (id=141): pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$IOC_WATCH_QUEUE_SET_FILTER(r1, 0x5761, &(0x7f0000000040)={0x4, 0x0, [{0x7, 0x8, 0x7, [0x2, 0x5, 0x1, 0xfffffffa, 0x7, 0x3, 0x7, 0x2e]}, {0x7, 0x81, 0x9, [0x6, 0x1d5, 0xc5ad, 0x100, 0x40, 0x5de1, 0x44, 0xb]}, {0x2, 0x3, 0xb3, [0x80000000, 0x1e9, 0x2, 0xffffebc3, 0x401, 0x7, 0x0, 0xffff]}, {0x0, 0x9, 0x6, [0x1, 0x56d, 0x939, 0x7fff, 0x2, 0x51f22d39, 0x86f, 0xffff]}]}) ioctl$FS_IOC_READ_VERITY_METADATA(r0, 0xc0286687, &(0x7f0000000140)={0x1, 0xeee, 0x1a, &(0x7f0000000100)=""/26}) (async) r2 = epoll_create(0x2) (async) ioctl$GIO_FONTX(r1, 0x4b6b, &(0x7f0000000580)={0x122, 0x2, &(0x7f0000000180)}) (async) fcntl$notify(r0, 0x402, 0x80000002) (async) ioctl$TCSETSW(r1, 0x5403, &(0x7f00000005c0)={0x2, 0x7fffffff, 0x6, 0x6, 0x10, "2efb4c7891876cf55b58d5bce41a8364ae48d3"}) (async) r3 = socket$packet(0x11, 0x3, 0x300) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCSIFVLAN_GET_VLAN_REALDEV_NAME_CMD(r4, 0x8983, &(0x7f0000000600)={0x8, 'veth1_macvtap\x00', {'bridge_slave_1\x00'}, 0x2}) getsockopt$SO_COOKIE(r1, 0x1, 0x39, &(0x7f0000000640), &(0x7f0000000680)=0x8) (async) r5 = epoll_create1(0x0) (async) r6 = fcntl$getown(r2, 0x9) fcntl$setownex(r5, 0xf, &(0x7f00000006c0)={0x2, r6}) (async) fcntl$addseals(r5, 0x409, 0xc) r7 = openat$ttynull(0xffffffffffffff9c, &(0x7f0000000700), 0x101000, 0x0) ioctl$TCSETSF(r7, 0x5404, &(0x7f0000000740)={0x6, 0x7fffffff, 0x0, 0x7, 0x5, "91c8b4c13cdd1f0b0595fb86e08206555f3101"}) (async) ioctl$F2FS_IOC_DEFRAGMENT(r5, 0xc010f508, &(0x7f0000000780)={0x7, 0x80000001}) ioctl$KVM_CLEAR_DIRTY_LOG(r1, 0xc018aec0, &(0x7f0000000bc0)={0x10002, 0x200, 0x280, &(0x7f00000007c0)=[0x5, 0x1, 0x400, 0x5, 0x3, 0x1, 0x2, 0x0, 0xfffffffffffffbff, 0xd82c, 0x3, 0x8000000000000000, 0x3, 0xfffffffffffffffd, 0x72, 0x8, 0x2, 0x8ea8, 0x2, 0xd9, 0xb, 0x3, 0x10001, 0x8, 0x100, 0xffffffffffffffff, 0x3ff, 0x3ff, 0x5, 0xfffffffffffffff7, 0x7, 0x2, 0x1, 0xfffffffffffffff9, 0x7, 0xabad, 0x3a, 0xfff, 0x4, 0xfff, 0x2, 0x4, 0x8, 0xfffffffffffffff8, 0x7ff, 0x63, 0x0, 0x2, 0x0, 0x4, 0x5beb7daf, 0x2, 0x3, 0x4, 0x3, 0x0, 0xfffffffffffffffe, 0x6, 0x3, 0x9, 0x4, 0x4, 0x2, 0x8, 0x6, 0xffffffffffffffff, 0x100000001, 0x8, 0x3, 0x2, 0x7, 0x6, 0x3, 0x2, 0x4c, 0x1, 0x3, 0x6, 0x2165, 0x0, 0x1, 0x8, 0x4a57, 0x8, 0x5, 0xb, 0x7d6a, 0x4, 0x5, 0x1000, 0xd614, 0xa1a, 0x8000000000000000, 0x3, 0x4, 0x5, 0x6, 0x7, 0x1f1000000000000, 0xd92f, 0x6, 0x8, 0xb, 0x1, 0x4, 0x3, 0x7fffffffffffffff, 0x9c, 0xc9, 0x8001, 0x1, 0x7, 0x3, 0x80, 0x1, 0x3, 0x1, 0x2614334c, 0x3ff, 0x6, 0x8, 0xfffffffffffffffe, 0xffff, 0x6, 0x8, 0x8000000080, 0x18000000, 0x6]}) (async) ioctl$MON_IOCX_GETX(r1, 0x4018920a, &(0x7f0000000c80)={&(0x7f0000000c00), &(0x7f0000000c40)=""/56, 0x38}) r8 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000cc0), 0xc0000, 0x0) (async) setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f0000000d40)={0x3, &(0x7f0000000d00)=[{0x60d3, 0x2, 0xf3, 0x2}, {0x5, 0x6, 0x9, 0x7f}, {0x3, 0x5, 0x4, 0x7643}]}, 0x10) (async) r9 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000d80), 0x40000, 0x0) fsync(r9) ioctl$SNDRV_TIMER_IOCTL_CREATE(r1, 0xc02054a5, &(0x7f0000000dc0)={0x7, r9, 'id1\x00'}) setsockopt$bt_l2cap_L2CAP_OPTIONS(r10, 0x6, 0x1, &(0x7f0000000e40)={0x4, 0x0, 0x2, 0x86, 0x9, 0x3, 0x2}, 0xc) (async) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r8, 0x81f8943c, &(0x7f0000000e80)={0x0, ""/256, 0x0, 0x0}) ioctl$BTRFS_IOC_TREE_SEARCH(r8, 0xd0009411, &(0x7f0000001080)={{0x0, 0x3, 0xfffffffffffffff7, 0xfffffffffffffffe, 0x0, 0x3, 0xc, 0xfcd3, 0x40, 0x6, 0x9, 0x26a6b4f1, 0x5, 0xfffffffffffffffd, 0xf21c}}) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, &(0x7f0000002080)={r11, r12, "320a1f3d4aff48b05700edaf2a42471133431d5c185c1c66d717ed19f56b27bf1296c09060b9e08733b415f823a25cfebc0a4fa89d7b5c4841bbe5b69835d592e27200831f7e0837faf8f86283f3b783bf3f4a4d0a9f935b677f113e36cded641916d697a62ba76c9c9e05f06bda8d4c892fa3638907c8982301ed1fdf6ed08216a350b50b7b321c09cb7bb01d30ab963e90fd32ed1a9214bdd358d5a37a3c4d3f189b03a7572b6aa7322c400c5d7b8b697f13c5c969e5ae7982d9b78f33535a01e4ced129aa5d633a7ce96eaf901c8039febd73f2a3860fa2319e0660b25ee0c53000997d1b4b17f3691d2fc0ce08d5dea18c65419163469b4cf3ec3d343a2e", "1d562a88851281829c22843fc8e23e73641e4542b0d0cdfbaae7f974cc7fa6c5b7bd1014543551a4f5c219dc0500dbbb827929f497791bb133940257908918f93e589d4928c47432bcbe43845adc54b1299de1cff289abd396fed6f61dbf894e871ecdde5fb7a57ebcba2e6375cb88e17db50b3cf18dcf598a8004524b6f3c5a2d5ff996cecaeb78a215c331e117578357f13f4c0c920dc4418672fc00a9831645fcab816a3372a44b8f0057cfae0191bb8f8df245af1e76763a9df1adcf7f33ff20a5d85bb92b566b13e1ddd2881eea17cffa1560200448cbe569477679da8d7a9daffadf6eb07a15fd868e7018a451f84607d88b72e638d95e991c9ef13b8b5dc0c951036f369beddc9bc3ad5b0f2d7d1c204b2076cbb6a7de6fdc5f9ce3fa944213df48fd05253168f87e2ab3e127ae824a214599dc58f62c77562e546811698af7ec57de0d09de939a907adef82fa454169a33df72609ba11271b764fc91fb29e59226f2775afed945e72a61dde566e43a33b677a4be7328e2ee760b8c19413696936fa5a2c87c2cdd030f55bee5f7a9bb42d889afa111d7eb56135318dba3d6fa7646048b6f48343ef5bb40f4d021e58f06e9e945b0db197c6570e5859938e736fa8ee4b50ee151c8ea7add72e2bc06e93dfb5ca64b36d9e463f376d8d4f69302161e2c9cb566fc91ff8606760c7a9530c3b8b3c7861d903ad3cd89b4a7f950717180bd9e264437d924851d040054c6a677ca8549ee2a2130f6c49229e157287a84869c5f3a6538faef155e5a57ec38c92281799c0c86e4c7d8435bb37aa5c9cd6115afb70b18c4344c35cfe0ce52fbee3d87a4d2f94613cdc94fe83b1685cfdd9bacb4610e8220e1db54f5d860af406b9663f4ee2241f74d1266d12794a277f98f69081b99818c04e8ee51c70e936a2b2d0c8b57d55c7f846d8d274efd3e95f2e4064dbc6b5f545c45336804427985a5ecfff2d8216d1e2b5cb5448e7ceeeec4eebe8e68026b0a7df231f9c7024e442428875d3d3f8fe6a31359b737a042b69db708e6d54860f90ac57b4bfa30c635df0ea92bf0dd3cd9f891a9091dbc0826169af72a5712151de70982ce1b70368642b7219e341561e12887f305510320fa9e0130f6dcb4020bfe037ee37c41b0513ddaa58be52b1fcf7f7068efebd5f49b32a99132f3b1090c7238f1e7adabc0aca259d3fbe79169b2e0d33d715a3d8e1b4cf1acbe3fc0d6e1d67b245e16b932a61bfd12786a09ecf1fc407738f06da3c320b39368191f8a397577c548f8d517ec983e28456012c6f8e3323c576230998a56830c1a953569f610ff4c8557f352542f25c379ad570d72c614aa2ff9ff6b5f17ccdf774cd6fab30655bd9229f56028227a66624cdb2a4ef8f3fdbd130839e4d793cd2926ba6c6ceab268189c2f49fef87541b788e61f4c501e1993269d07c0ab2613349a38127acfb4d19dd93ea1982dff843dda332c918258ef086854576d80d09cd7ad166629cca36466e70e0a0a37995ed741128de66ef27a57b872d4b2675c0641414b27b0ce0577dffc666a245feb5c58b8104244e03fc1a58fa6fb321e221772222cc843d666f14271af0334931777f5ac69e107d79b0d4e3f6de2ac2ba19971b2cf41e7e1129ed28fdda56de6a22d3074a0035112b9d278c29e9ee44daeeee05079d7fa4519011c26b42b88c7de27de13db4937bf5fe8879bddc32ff0dcda25873078ee4d1b098290a940d7f57ac0cd998dce48c56d27e526cc6d59b88b8382fcce682e36e744c4cca6736512e41f25ff8239f0da77dab716dac53ce2ffc2fd23e83b7c9183861dd6a022acacab18ec5608573dd684f96019c82d6587eb8eec40463da983b352b60bb6987b95072ed9163cfd093c255a9c072ac4a8c14080331fa20c97ace93d74887ea8b3c11088f71e7d242042770f959c048c81be5716b46bcd2e294e630edd15c62c3eea40c14b87830ef0cbca6b424592a9a236c40e53a9af74e00a567f8a8fefbe2087d02d7e9dd19ec0584a0289a78479d81677d420e17eac768904a17f24834b403d21aad571ba2bb8ce838a5c5ab4d07879749c669eeabd20b2e4bdfe41cd83de2c0254442e7322752ec553faf0336c618a89e3daec23c743bf8ab61fba3eb80598e0d1e494c2c64c61723fa6f56630cae81efeb45a687949f026fc31aa682ff462a6787055315a02903cb3801d41003a798c2264c351bc5e93941623567af14fe0ed4ddbc76b94369c817165bf449b700f6330549383a9e7bca53ef7cc5028bd1e02f809193fee5cb6c57d64128f3e53d9d545233030f7f3d51415e9d33e9db9814395f1e7985fb0823d6b76316d33ac0e86176e62edacda9330315350509ce13c949b50663795e2d285ae37fd63a2267d8e116ecac5826dc6cf2afef012a8d8c373d08c3124c28db54ba9302520b669635494cc023afe021ebfc5fc0b5de96390f16949cf80f195bcc032fd6c237aaf80c67406146f5b0387cd98e3d795a05203b8b9577af074dafc920378be582206b486c1215d6bbd0b66638f655b21eef8a80ffc1190a49f39a9d8ae980e6e981fd03ccb00a0cd1fa81d9abf43295e18f5b43959bbf2919981ccba793defc3d3a9db646f4aa9309aca1ee1463d0c32a9ad542f8830d6cd74835e975c54d1928d0abde1ff1cf154bc80e03ce35304353cebfff2c29b2c886ece77cf742eb100a424a50f2fd5372541e364d4f3762dc9e9c8b43d602eaa5ff7e9ffeecd387d15f95e21bcc7bbf272cf42cc0ff936b5a5176437058530ebefe6c4e5d565c7037c936730da283c5a5f4e10f0c428bff6525ea0aa24a01b50102bcacc8a020b8fb5ff20279e4513f84460fceb3b4bc1ed2b44017fad4511d8b330b34e8a573f67506eb7cad8d99bd62766fede9e1227fc099960285e5c33dc89238b8ef0bfe91a2b9a686c44759bfc4dc4521d67d7f065924dc4222480f974c2434e6e7194af7696bfa37f981446dfbad5590c82da337ba8c96c8aac48040c707cfb3d5e873ba43dfc92cc52e3e398501764aa5bc807bc0186f0b13651554d4c564cbd93bc0195046fb577215685ece8e602638ef2cba9a2508511f2eaf741cb5cde64d53ab2bbc839f92ce591f3b25446b48e3de59a89a6d3176119c6e1fbe1cf85084a730cc6f3f9f0397d29b660e3e2bbd8fabf3805a03615aac5cb10d4ba10d04e5c3b592d2aff6d27c2930209fceabffbfdde525b2b963bb4c3efab4a8e2733819a7248258f52c190901b0fd65a20f783798847520f29322b9b650abf98b51c4988ce3848b272fdb5bc2a5e6ddb8c424b53edcb47048f2a59d68e451bede280134f644414e041cd8b962a9569cfc6ca1c06546b4517e8c25b38ef8e365495d2ec0ffb988c9daf7df34bcda670c97be35fccc3e35d9236a5a1c96474873889c03d58f3d7755420572c7c36f1236df574e67cd7e65faefa24efd1dd4917866ab3bcdccbe28f7d4c2be9813c9427db967abfab1347e565768e28b41568c126d7a54beb92b72c16b190f86135b735b762afc1eb9d784102dff8e3fb18553ecfb25a8b4d297039aac5db25d99b0235159d74a542d2682316f3b3aa87f03e6201e6eaadc8355c68548ab8f87c7ee11d19d0f3437bd027ee3cf489c716c007febd1f06cde8408cc4e677590c53d7bf6a0da9a5e17148c58aa6531d2255d87a6e99a558cc4d5e7c804725b7c99fe9868a7ceacebc5e11516f58e2c07bd0a803489a8214547446bbbcb3cfb39a35d3c6b69d527370fe37f7a126fed7dc4f7faa2f93550ad31fb5de0ef7faa2e9176460c14c8aa6271548596ac219437bad76aab366bc63e57b2b4e7c1e5179bc0317bd04eddf76359710468a58e9d6d731864904a4d7d3d846e7b784e1f742e00c97aeb8d88b810014f24eb9b30762c64ab683048c031f437eec337db1b8571a3a81053e25d115e87d18d213892fd7ce10d1dccd91f30249dff58d315d0f1f983c7ba292a9b675289363be023b6cebd2bf5d7ac3ed9ed93db787971be72c2d06f0cc21eae178f8008c21452cfbfb211ed763ab7a7adef7011ccb75ef89147adfb558e1775958a056aaa0baa81783d97ab84a3414b1b06b682ea736e1c119725197e07e5d6991058dddbb98cbe5e6fa4eff3f935f6bba9cfc3f3680a91424b39307aeed85bbd6a05ec1eafce39e215478785d804da3cd9df58c595d39ac90a5d9a643e07a7a30d96a39e7716565e1adb2ac924e1199c0cc86302f9de33ad6dd22a5d8f6128087369f9c2a444aba86990c44801fe64298c8daf4ec68a3d90a33dffd3cd9f0f900ea9b1a644be178d6a728f783988ba8d98ef1b360a7505fb518580ba4f8b7630cb3ad5d27daf3a7eb38d3aea53cc96a4e0160ba4b90d5b3cb654c08779331269c60c4db2fc89afbdf10291f460bf19c3b03452afc5aeff2d620fbbad999c118ee8339d485ef8ce23cbe02cff3bbe35e4305698c06080f32cf7b56f99a684ee5a4f3e739569572d64be088129fde3b7d6f5eeece69807e423ef24d25bfa9a008109c0e4405c026fc3246096b821d862a14a2edbd3d6b430855ebf362fee7fd387189fc06dec9b51b6c0c7581a98b7afd8e854db0f5a32535187ce3857348ec630c30cabe27d1c3e211b22ca24f0889678a5b55557b383b455d70b071a4416c71e8c0de234d562bbd1d85e155a8ef3fad5de665c768e16a33f192ab40b487866b1e0e2501f9eb0039368c4ade54a89d8f37e4f99515abbceaeacb446b5c5e1554ec4f1653090443dc1592af028b7b203545e0dfb10ead7a5252fa4aaa248431c2b124815efd10e41fc9a430cc96a72bb51a38632e62b64c9c01d5fb7e72856499d36b99cc4b09437c1ea23bb3745d55edbee2ab6ed0727c9f0352d1553389bfb47570eb0f13967b7a645dc9b1d139237f0012b9d9baf44a3b7711fb624dfa76decb6b4d8e78e583c6e2d0a33e971398ada3d9b8a33cc08bce8ebea4550007f40c031c620949c0890b2f667c2219d2b3a6ff0870013ed1e6e795a5b9db8fd4c46008e91c40525ed75d99d6e80ef1f2e5390ede4c37808602bc62f62c2436226a7086c7204c39ce464be1a43f3d8ec6204637a53f559fdd25d716593122d5672825c5d78123d95f664383f610c58b42a0ae1dc64302bcacde4d10f590ecdc7c75211fe1fa44fdf02550fa7bf1cd43b02c0a51a3d8e1064d70993822b0d5c54e0b3768c8958a09555e38d4d583a0bb3cf0b29b3426e45c21bc0fe16aaab247a583f24e83beda376a6d5caf2c7217602426fbb8bb9ae86a0388529a6017a34a925112023ae73ec946d786fa79e1ef1d3158bae434f854968718534238ca3da6e5f93da18a120e38ae96d7af17d043343c84646af1eacc89c702c8fd7d8c3bccbadac4430e4d75c164cd18"}) (async) ioctl$UI_END_FF_ERASE(r1, 0x400c55cb, &(0x7f0000003080)={0xf, 0xfff, 0x8001}) 2.70836203s ago: executing program 0 (id=142): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000000c0)=0x6a, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r2, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) recvmsg$unix(r1, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f00000014c0), 0xe8}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r4, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r3, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x100}, 0x0) newfstatat(0xffffffff0000005d, 0x0, 0x0, 0x1000) bind$inet(r0, &(0x7f0000001c00)={0x2, 0x4e23, @multicast2}, 0x10) connect$inet(r0, &(0x7f0000001bc0)={0x2, 0x4e23, @loopback}, 0x10) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, 0x0) r5 = syz_open_dev$evdev(0x0, 0x0, 0x822b01) r6 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x42902, 0x0) sendmmsg(r0, &(0x7f0000001680)=[{{&(0x7f00000001c0)=@pppoe={0x18, 0x0, {0x2, @remote, 'ipvlan0\x00'}}, 0x80, &(0x7f0000001600)=[{0x0}, {&(0x7f0000001340)="427a2d57a504821636d51bfdf41f093b7b17b8cbc8225044095893cee81f565042c5bf94d7a31c2f0ba8fe93e5b965ea251ebddf5f88ba60fadc286205e36d62cf2621073c830296b1d53c4340c9f300e38089bed5981d2b91947a13976a68c682e689360460d8111fc6406ab945542d487d5b54ab12aec622c31582d8c97522fc9670560fb8dff780b508cc06c4083ab98357cddef0846d111f45a0e15e2086edf74bf6d1bd2d95e0dda56424e68fbfe825692075e0818d6470668d62148b818e11fca29a157eb6f894ecebdd853d8278bd110e9d0d9ec302f06f0aa2b58c271a01817d21c0cb30cb", 0xe9}, {&(0x7f0000001440)="3f0c254aa1febfc3add6cfaa9996ca9268e6235c37ae09b5ef55ca168cf5d286775d5c6ddf94a53f539281ab3932a2e4352f0b7fd3b78301e64db864bace65bd846f9443", 0x44}, {&(0x7f00000014c0)="1a9018e8fc4ac60c6697e86251f63f8742537413b5b46fbad642d6a686119b642b6b279fd5537be2beb1e58faa520cad82", 0x31}, {&(0x7f0000000100)="acba405626758716becb80995f", 0xd}, {&(0x7f0000000240)="38ed8081c45dcf164eccdf783738e7941f49aa1ba4a3ee858bb41706c00cd05a870a058359f0a592f4193f4ee175007ff04b51b03d", 0x35}, {&(0x7f0000001580)="85f7628a8dbc1965ef92de54b3da1af1d9035b2aee68b38b00462cd51d17cd5eeb59fd516f2e4c8b93b29a01862494f45db75dd669b057cd", 0x38}], 0x7}}], 0x1, 0x2048001) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x6, 0x13, r6, 0x5a85d000) syz_usb_connect$cdc_ncm(0x0, 0xdf, &(0x7f0000001c40)={{0x12, 0x1, 0x250, 0x2, 0x0, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xcd, 0x2, 0x1, 0xfb, 0x40, 0xc, "", {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x9, 0x24, 0x6, 0x0, 0x1, "1fae391e"}, {0x5, 0x24, 0x0, 0x81b5}, {0xd, 0x24, 0xf, 0x1, 0xfffff426, 0x4, 0x80, 0xb}, {0x6, 0x24, 0x1a, 0x2}, [@dmm={0x0, 0x24, 0x14, 0xa, 0x401}, @dmm={0x7, 0x24, 0x14, 0x5, 0x220}, @call_mgmt={0x5, 0x24, 0x1, 0x442dab492de7c1fa, 0x2}, @mdlm_detail={0x5a, 0x24, 0x13, 0x7, "86dd440cf7ad4036f269de0c269ffd468df30709519f4a2b14dcba9bf4195973c19654f9a830c5e11efe84749d1d4239193840761856485d8c67076ac7283b8f9ec9a164677bc41424ac8a56fd8630fb732d3023582e"}]}, {{0x9, 0x5, 0x81, 0x3, 0x400, 0x4, 0xf9, 0x6}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x3ff, 0x8, 0x0, 0x5}}, {{0x9, 0x5, 0x3, 0x2, 0x200, 0x1, 0x3, 0x1}}}}}}}]}}, &(0x7f00000016c0)={0xa, &(0x7f0000000080)={0xa, 0x6, 0x310, 0x2, 0x4, 0x7, 0x20, 0xa1}, 0x5, &(0x7f0000000180)={0x5, 0xf, 0x5}, 0x7, [{0x4, &(0x7f0000001500)=@lang_id={0x4, 0x3, 0x180c}}, {0x4, &(0x7f0000001540)=@lang_id={0x4, 0x3, 0x1001}}, {0x93, &(0x7f00000017c0)=@string={0x93, 0x3, "5f5b42bb04517a9e8780b2293ee249e52fda016f2fd4cdf7185fbfd54095f97ed1c190bd0ac6bafa0f6a04ae2b022fab7f1d671daccfe987be28e52d80279c3c5f32ad0a1bad845a42cf705ad34b1b29704dcfcd35dd97e773ab2597dfeb50192cda65987c1c963aea5c42404410224954746311275279df16d2ea260d3ceecd322df4f01b62ea661252f3333b3e27b780"}}, {0xd1, &(0x7f0000001880)=@string={0xd1, 0x3, "3e8aa918e02299e1f8c7a356d8767c6255e786944a111179d4dda4c9121b68d5eeb519998ff3ecb39f4d1c3fa85dd5d826219c906e94e6b6a50fb72db6b07495cb26f2e4d1376438af1db7973b1c469d75a32c89bf4c479c85fcf2b036fe3f1857bdbb9f3f33fa8f7e327f5956e311822af3d69e3286c6438dd8bf92feb2e5377143430ead0606946ab89939cf6b476fe45b83479724517e9bf241ea2e4c350e02736bf479d8584bb069c9678fc0e53e79a358c767106d96173081bdd9a624b7d52338969b780c1e5352ed248f65c7"}}, {0x4, &(0x7f00000015c0)=@lang_id={0x4, 0x3, 0x2009}}, {0xc9, &(0x7f0000001980)=@string={0xf, 0x3, "55c3e0280c8533b86e0507b3ef3f22c415c4ab7c4f24dfdc6afab84daceb81fbc5e06e2be28541f78db2503ac12f45310820262eaf8ac2d97ec27153e42f35f26fd41cba957be7c984a4d7842a49b94bf6fa1270a7cfdd587c41d41e91b55503b49704bd8182627c1f22c06a0713e6c968e5461cb65bb5c7b62344125fc104b162713d5b0f5f2c57afa84e5cfb0beed2cc3c724e9218f442a12a6cad3d0778972edede7a1ecf00dc328bb5be6a020d926cbd579a3a20d96553dd22d8c32cf295409a78a4ed3bc5"}}, {0x45, &(0x7f0000001a80)=@string={0x45, 0x3, "937d9f21a666fa3c2f1e343ba2e3bc8a91c6c528e6d687d433cd7c700afe65502c4a17768bc378def79e565ca4eabfda5a5604832cee94bf39944f590a7553416483a4"}}]}) write$char_usb(r5, 0x0, 0x0) ioctl$EVIOCGSND(r5, 0x8040451a, &(0x7f0000000340)=""/4096) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(r0, 0x8982, &(0x7f0000000040)) ioctl$BTRFS_IOC_LOGICAL_INO(r2, 0xc0389424, &(0x7f0000001d40)={0x6, 0x38, '\x00', 0x0, &(0x7f0000001780)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000140)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0xe4}]}, 0x10) write$binfmt_misc(r0, &(0x7f0000000000)='}', 0x1) newfstatat(0xffffffffffffff9c, &(0x7f0000001740)='./file0\x00', &(0x7f0000001b40), 0x100) r7 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$ARPT_SO_SET_REPLACE(r7, 0x0, 0x60, &(0x7f0000000040)={'filter\x00', 0x10, 0x4, 0x3c8, 0x110, 0x0, 0x0, 0x2e0, 0x2e0, 0x2e0, 0x4, 0x0, {[{{@arp={@private, @rand_addr, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_virt_wifi\x00', 'veth1_to_bridge\x00'}, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x4, {@empty, @mac=@dev, @dev, @broadcast}}}, {{@uncond, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffb}}, {{@arp={@empty, @empty, 0x0, 0x0, 0x0, 0x0, {@mac}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'dvmrp0\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@MARK={0x28}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x418) sendto$inet(r0, &(0x7f00000002c0)="01a4acc7cf28ab9f6c7fc745c30bfc165466072a660bbf56352083db9d40454a67f8010000004bd29585885c89773ca3ba28a1e85ffe2a9220e0ecd440e345b745bf2146835ad015c801f95be5b890e44fb3dfbe8e88a1e5176e584c970207f23b0073ca5375abddf56331be396eaa2398ea66b93a74fd4147e826abed1b5d1de578682288c19ac23c1ccc1cdd936d2571c3510b0000000000000000000000000000000000f32bb3874c926a8944caa4677d2eae3bc831e748000000", 0xfffffffffffffe88, 0x0, 0x0, 0x0) 2.252817906s ago: executing program 3 (id=143): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f0000000000)=[{0x20, 0x0, 0x0, 0xfffff010}, {0x6}]}, 0x10) r2 = eventfd2(0x0, 0x0) ioprio_set$uid(0x3, 0x0, 0x0) io_setup(0x81, &(0x7f0000000400)=0x0) io_submit(r3, 0x1, &(0x7f0000000440)=[&(0x7f0000000180)={0x0, 0x0, 0x3f, 0x0, 0x1fd, r2, 0x0, 0x0, 0x0, 0x0, 0x1, r2}]) sendmmsg$inet(r0, &(0x7f0000002c40)=[{{0x0, 0x0, &(0x7f0000000e80)=[{&(0x7f0000000a80)="2a73ed35", 0x4}], 0x1}}], 0x1, 0x800) r4 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r4, 0x6, 0x0, 0x0, 0x0) r5 = fsmount(r4, 0x1, 0x0) fchdir(r5) r6 = open(&(0x7f0000000040)='./file1\x00', 0x80242, 0x0) write$FUSE_CREATE_OPEN(r6, &(0x7f0000000180)={0xa0, 0xfffffffffffffff5, 0x0, {{0x4, 0x1, 0x5, 0x6, 0x3, 0x1, {0x1, 0x180, 0xff, 0x7, 0x100, 0x7cf4, 0x9, 0x7ffffffd, 0xfffffffe, 0xa000, 0x0, 0xee00, 0x0, 0xbe87, 0x1}}, {0x0, 0x11}}}, 0xa0) sendfile(r6, r6, &(0x7f0000000080)=0x2, 0x7f03) 2.246124644s ago: executing program 2 (id=146): r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x483) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000000100)={{0x1, 0x0, 0x0, 0x3}}) (async) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r0, 0x40505412, &(0x7f0000000440)={0x0, 0xf4242, 0x0, 0x0, 0x6}) (async) ioctl$SNDRV_TIMER_IOCTL_START(r0, 0x54a0) (async) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) (async) sendmsg$unix(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="14"], 0x18}, 0x0) (async) r2 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000000580)='./binderfs/binder-control\x00', 0xc00, 0x0) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) (async) ioctl$BINDER_CTL_ADD(r2, 0xc1086201, &(0x7f0000000000)={'custom1\x00'}) (async) r3 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x2) syz_kvm_setup_cpu$x86(r3, r4, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000200)=[@textreal={0x8, 0x0}], 0x1, 0x1, 0x0, 0x0) (async) pipe2$9p(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80800) setresuid(0xee00, 0xee00, 0x0) (async) setpriority(0x0, 0x0, 0x5) write$P9_RXATTRCREATE(r5, &(0x7f0000000240)={0x7, 0x21, 0x1}, 0x7) (async) socket(0xa, 0x3, 0x3a) (async) r6 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) mkdir(&(0x7f0000000340)='./file0/file0\x00', 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) sendmmsg$unix(r7, &(0x7f00000001c0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4008050}}, {{&(0x7f00000000c0)=@file={0x1, './file0\x00'}, 0x6e, 0x0, 0x0, 0x0, 0x0, 0x40080}}], 0x2, 0x0) (async) r8 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000280), 0x602040, 0x0) ioctl$KDSKBMODE(r8, 0x4b45, &(0x7f00000002c0)=0x4) (async) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r9 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCETHTOOL(r9, 0x89f0, &(0x7f0000000400)={'bridge0\x00', &(0x7f0000000300)=@ethtool_cmd={0x13, 0x5, 0x49cb353f, 0x0, 0x8, 0x6, 0x4, 0x4, 0x1, 0xef, 0x6, 0x0, 0x1110, 0x9, 0x0, 0xb80, [0x2, 0x800]}}) r10 = socket$inet6_tcp(0xa, 0x1, 0x0) r11 = dup(r10) ioctl$SIOCSIFHWADDR(r11, 0x8914, &(0x7f0000000080)={'syzkaller1\x00', @broadcast}) (async) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000108d0e03000000000000010902240001000010000904"], 0x0) 2.115716057s ago: executing program 3 (id=147): r0 = socket(0x1e, 0x4, 0x0) r1 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r1, 0x10f, 0x87, &(0x7f0000000440)=@req={0x3fc}, 0x10) setsockopt$packet_tx_ring(r0, 0x10f, 0x87, &(0x7f0000000440)=@req={0x3fc}, 0x10) sendmmsg(r0, &(0x7f00000030c0)=[{{0x0, 0xa9cc7003, &(0x7f0000000400)=[{&(0x7f00000000c0)="ee", 0x101d0}], 0x1}}], 0x400000000000181, 0x9200000000000000) r2 = dup3(r1, r0, 0x0) recvmmsg$unix(r2, &(0x7f0000000e00)=[{{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000005140)=""/4111, 0x100f}], 0x1}}, {{0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000300)=""/227, 0xe3}], 0x1}}, {{0x0, 0x0, &(0x7f0000000b00)=[{&(0x7f0000000740)=""/37, 0x25}], 0x1}}, {{0x0, 0x0, &(0x7f0000000d40)=[{&(0x7f0000000c80)=""/151, 0x97}], 0x1}}], 0x4, 0x58ca2280, 0x0) r3 = socket(0xa, 0x3, 0x3a) r4 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) capset(&(0x7f0000000c00)={0x20071026}, &(0x7f0000000140)) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$unix(r5, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f00000001c0)='\x00', 0x1}], 0x1, &(0x7f00000000c0)=ANY=[@ANYBLOB="14000000000000000100000001"], 0x18, 0x20004881}, 0x0) getsockopt$TIPC_GROUP_JOIN(r3, 0x10f, 0x87, &(0x7f0000000040), &(0x7f0000000180)=0x4) prlimit64(0x0, 0x7, &(0x7f0000000300), 0x0) sendmmsg$unix(r5, &(0x7f0000005400)=[{{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000100)='+', 0x1}], 0x1, &(0x7f0000000880)=ANY=[@ANYBLOB="14000000000000000100000001"], 0x18}}], 0x1, 0x11) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = dup(r6) ioctl$SIOCSIFHWADDR(r7, 0x8914, &(0x7f0000000080)={'syzkaller1\x00', @broadcast}) write$tun(r4, &(0x7f0000000440)=ANY=[@ANYBLOB="0a00885dffffffffffffaaaaaaaaaabb86dd694f920600143aff200100000000000000ff0200000000000000000000000000018700907800000000000000000000000000000001"], 0x4e) syz_usb_connect$uac1(0x2, 0xa5, &(0x7f00000002c0)=ANY=[@ANYBLOB="12010000000000106b1d01014000010203010902930003010000000904000000010100000a240100000002010213240600000600000000000000dfff000000000924030000000000000924050000f8431cfd09240300000300040206240504"], 0x0) 1.981009619s ago: executing program 0 (id=148): r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000340)={0x400000100002f}) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f0000002440)={'syz1\x00', {0x4, 0x7, 0x6, 0x7}, 0x18, [0x108, 0x1, 0xa11, 0x200, 0x7, 0x0, 0xc3a, 0x3, 0xba, 0x4, 0x1, 0x10, 0x2, 0x5, 0x8000, 0x63, 0x8, 0x8, 0xfffffffb, 0x0, 0xfff, 0x400, 0x2, 0x9, 0x245, 0x0, 0x7fffffff, 0x9, 0x7, 0x3ff, 0xfffffffc, 0x0, 0xfffffbff, 0x5, 0xaca4, 0x7ff, 0x8, 0xa9c34bc, 0xc, 0x367d, 0x7, 0x5cce, 0x2020000, 0x5, 0x40000000, 0xb943, 0x0, 0x10001, 0x8, 0xdb, 0x80000001, 0x4, 0xfffffff8, 0x2, 0x9, 0x4, 0xf986, 0x36, 0x9, 0x5, 0x6, 0x6, 0x7], [0x1800, 0x3, 0x2, 0x3, 0x5, 0x8, 0x2, 0x3, 0x4, 0x3, 0x800, 0xfffffffe, 0x2, 0x28, 0x660, 0x8, 0x7, 0x3, 0xfffffffd, 0xfffffffe, 0x96, 0x8, 0x1, 0x0, 0xffff8001, 0x9, 0x3, 0x5, 0x4, 0x7f, 0x80000001, 0x85a89417, 0x2, 0xfffffff6, 0x8, 0x4, 0xbe, 0x10000, 0x4, 0x9, 0x6, 0x8, 0x3, 0xbed, 0x3, 0xc, 0x6, 0x1, 0x1, 0x3d, 0x824, 0x0, 0xc4d, 0x2, 0x3, 0x7fff, 0x3, 0x4, 0x2, 0x8, 0x8, 0x3e3, 0x4b0, 0xf], [0x8, 0xb, 0x287, 0xb, 0x2, 0x5, 0x7, 0x2, 0x196, 0xffff, 0x5, 0x700, 0x4, 0x80000001, 0x8000, 0x4, 0x9, 0x45f, 0x6, 0x7b07, 0x3, 0x6771, 0x9, 0x5, 0x6, 0x8, 0x851, 0xfd6, 0xfffffffd, 0x7, 0x8f4c, 0xba6f, 0x40, 0x0, 0x7fff, 0xffff, 0x9, 0x0, 0x1, 0x200, 0x7, 0xfffffff9, 0x4, 0x5, 0x3, 0x3, 0x6, 0x2, 0x3, 0x7, 0x6, 0x6, 0x10, 0x7, 0x5, 0x200, 0x9, 0x1, 0x7, 0x3, 0x300, 0x8, 0x2009, 0x1ff], [0xe, 0x4, 0x7, 0xff, 0xfffffffb, 0x200, 0x0, 0x10, 0xed, 0x7, 0x10, 0x5, 0x7, 0x5, 0x6, 0x4, 0x6, 0x6, 0x7, 0x1, 0xa, 0x7, 0x3, 0x200, 0x254, 0x2, 0xffff, 0xf5c6, 0xa69, 0xe1b, 0x1ff, 0xe, 0x7, 0x6, 0x1000, 0xfffffff9, 0xff, 0x80000001, 0x8, 0xfff, 0xb, 0x10001, 0x80, 0x7, 0xffffffff, 0xfffffff7, 0x3, 0x10, 0xef, 0x53, 0x7, 0x6, 0x8, 0x3, 0x6, 0x4, 0x7fffffff, 0x200, 0x80, 0x1, 0xbe, 0x9, 0x6, 0x6]}, 0x45c) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000000000205804115000000000000109022400010000000009040000050300000009210400000122940309058103"], 0x0) r3 = fsopen(&(0x7f0000000180)='proc\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) r4 = fsmount(r3, 0x1, 0x0) fsconfig$FSCONFIG_SET_PATH(r3, 0x3, &(0x7f00000000c0)='source', &(0x7f0000000240)='./file0\x00', r4) write$P9_RLOPEN(r4, &(0x7f0000000100)={0x18, 0xd, 0x2, {{0x8, 0x2, 0x8}, 0xf8}}, 0x18) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000280)={0x34, r6, 0x1, 0x70bd2d, 0x25dfdbff, {}, [@ETHTOOL_A_LINKINFO_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syz_tun\x00'}]}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0xb2}]}, 0x34}, 0x1, 0x0, 0x0, 0x20009005}, 0x40040c0) syz_usb_control_io$hid(r2, 0x0, 0x0) syz_usb_connect$uac1(0x1, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x54, &(0x7f0000000380)={0x5, 0xf, 0x54, 0x1, [@generic={0x4f, 0x10, 0xa, "0185e50ec6e542779297444adc681b37d111fc1f8abf00ce84b35f6a9b4948e11514615ce3221e5a4dcb329d1b9e122c85a15071c5a6932b94990d57401ff722c37803b5022f54058aad460c"}]}, 0x1, [{0x18, &(0x7f0000000280)=@string={0x18, 0x3, "0251b1454218d19aebaab82388a9bdb115e14c35aac4"}}]}) syz_usb_control_io$hid(r2, &(0x7f0000000340)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="00220508"], 0x0}, 0x0) sendmsg$nl_generic(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)={0x20, 0x18, 0x1, 0x0, 0x10, {0xa}, [@typed={0x8, 0x0, 0x0, 0x0, @ipv4=@local}, @nested={0x4, 0x16}]}, 0x20}, 0x1, 0x0, 0x0, 0x14}, 0x0) 1.832155529s ago: executing program 1 (id=149): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) sendmmsg$inet(0xffffffffffffffff, &(0x7f00000011c0)=[{{0x0, 0x0, &(0x7f0000000340)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000b80)}], 0x4}}], 0x1, 0x2090) r3 = syz_clone(0x20002000, &(0x7f00000006c0), 0x0, 0x0, 0x0, 0x0) r4 = syz_pidfd_open(r3, 0x0) setns(r4, 0x24020000) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000440)=[@text64={0x40, &(0x7f0000000200)="f7790066baa00066b86b4266ef66ba420066b8e20066ef0f29902cbb0000f36d666666440f38826b410f786b42d1d107b8010000000f01d98fe9d89afd", 0x3d}], 0x1, 0x21, 0x0, 0x0) ioctl$KVM_SET_VAPIC_ADDR(r2, 0x4008ae93, &(0x7f0000000040)=0x1000) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4400ae8f, &(0x7f0000000140)=@arm64={0x1, 0x45, 0x80, '\x00', 0x2}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 1.735014248s ago: executing program 1 (id=150): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$bt_BT_SECURITY(r0, 0x112, 0x4, &(0x7f0000000100)={0x80, 0x7}, 0x2) socket$netlink(0x10, 0x3, 0x4) socket$inet6_tcp(0xa, 0x1, 0x0) (async) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x2040400) (async) unshare(0x2040400) r2 = socket$netlink(0x10, 0x3, 0x0) writev(r2, &(0x7f00000000c0)=[{&(0x7f0000000080)="390000001300090468fe0700200000000000ff3f08000000480100100000000019002b000a0001000500000000000072080003000500000000", 0x39}], 0x1) (async) writev(r2, &(0x7f00000000c0)=[{&(0x7f0000000080)="390000001300090468fe0700200000000000ff3f08000000480100100000000019002b000a0001000500000000000072080003000500000000", 0x39}], 0x1) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x4801}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180), 0x284402, 0x0) close(r4) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r5) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) ioctl$SIOCSIFHWADDR(r5, 0x8943, &(0x7f0000002280)={'syzkaller0\x00', @random}) (async) ioctl$SIOCSIFHWADDR(r5, 0x8943, &(0x7f0000002280)={'syzkaller0\x00', @random}) r6 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) close(r6) (async) close(r6) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)) (async) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)) ioctl$SIOCSIFHWADDR(r6, 0x8943, &(0x7f0000002280)={'syzkaller0\x00', @random="200000000102"}) ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000000)={[{0x4, 0xfcd1, 0x7c, 0x1, 0xf, 0x0, 0x4, 0x1, 0xf1, 0x0, 0xc, 0x9, 0xffffffff}, {0x3ff, 0x200, 0x7, 0x2, 0x34, 0x8f, 0x1, 0x9, 0xc, 0x6, 0x2, 0x4, 0x100000000001d}, {0x4, 0x1, 0x6, 0x2, 0x0, 0x1, 0x8, 0x10, 0x81, 0x7f, 0x7, 0x7, 0x9a87}], 0xb7000000}) (async) ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000000)={[{0x4, 0xfcd1, 0x7c, 0x1, 0xf, 0x0, 0x4, 0x1, 0xf1, 0x0, 0xc, 0x9, 0xffffffff}, {0x3ff, 0x200, 0x7, 0x2, 0x34, 0x8f, 0x1, 0x9, 0xc, 0x6, 0x2, 0x4, 0x100000000001d}, {0x4, 0x1, 0x6, 0x2, 0x0, 0x1, 0x8, 0x10, 0x81, 0x7f, 0x7, 0x7, 0x9a87}], 0xb7000000}) 1.602989711s ago: executing program 2 (id=151): r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='task\x00') fchdir(r0) mount(0x0, &(0x7f0000000080)='.\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r1 = gettid() r2 = syz_open_procfs(r1, &(0x7f0000000280)='timerslack_ns\x00') write$binfmt_format(r2, &(0x7f0000000180)='1\x00', 0x2) 1.602687011s ago: executing program 1 (id=152): r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = socket$inet6(0xa, 0x800000000000002, 0x0) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x41, &(0x7f0000000340)=0x63ba, 0x4) (async) setsockopt$inet6_int(r1, 0x29, 0x2, &(0x7f0000000100)=0x4, 0x4) (async) sendmmsg$inet6(r1, &(0x7f0000000880)=[{{&(0x7f0000000000)={0xa, 0x4e22, 0x3, @empty, 0x9}, 0x1c, 0x0}}], 0x1, 0x44040044) (async) recvmmsg(r1, &(0x7f00000003c0)=[{{0x0, 0x0, 0x0}, 0x8}], 0x1, 0x40002142, 0x0) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000100), r0) sendmsg$TIPC_CMD_ENABLE_BEARER(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a"], 0x38}}, 0x0) (async) r3 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) getsockopt$WPAN_WANTLQI(r3, 0x0, 0x3, 0x0, &(0x7f0000000040)) (async) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r0) sendmsg$NL80211_CMD_DEL_STATION(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000080)={&(0x7f0000000140)={0xa4, r4, 0x100, 0x70bd25, 0x25dfdbfc, {{}, {@void, @val={0xc, 0x99, {0x0, 0x2d}}}}, [@NL80211_ATTR_OPMODE_NOTIF={0x5, 0xc2, 0x8}, @NL80211_ATTR_STA_CAPABILITY={0x6, 0xab, 0x7}, @NL80211_ATTR_MESH_PEER_AID={0x6, 0xed, 0x732}, @NL80211_ATTR_STA_TX_POWER={0x6, 0x114, 0x7f}, @NL80211_ATTR_STA_TX_POWER_SETTING={0x5, 0x113, 0x2}, @NL80211_ATTR_MESH_PEER_AID={0x6, 0xed, 0x5e9}, @NL80211_ATTR_STA_SUPPORTED_CHANNELS={0x16, 0xbd, [0xa94, 0x800, 0x6, 0xc, 0xfff9, 0x3ff, 0x7, 0xa54a, 0xf2]}, @NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES={0x29, 0xbe, "cd2dc32d3467db52040521a96e20997847c74ccc16573494c471e9078627f12cb2c30174d0"}, @NL80211_ATTR_VLAN_ID={0x6, 0x11a, 0x4}, @NL80211_ATTR_STA_AID={0x6, 0x10, 0x93}]}, 0xa4}, 0x1, 0x0, 0x0, 0xc000}, 0x4000010) 1.601778041s ago: executing program 2 (id=153): sendmsg$netlink(0xffffffffffffffff, &(0x7f0000001080)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000300)=ANY=[@ANYBLOB="240000002800010023bd700000000000050000000c000000000000f7ff"], 0x24}], 0x1}, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x2840, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x64, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_SET_SREGS(r2, 0x4138ae84, &(0x7f00000001c0)={{0x2000, 0x30000, 0x8, 0x6f, 0x3, 0x8, 0x40, 0x29, 0x0, 0x2f, 0x19}, {0xd000, 0x1, 0xc, 0x0, 0x6, 0x42, 0x7d, 0x8, 0x58, 0x3, 0x3, 0xc0}, {0xdddd1000, 0x10000, 0xe, 0xc, 0x3, 0x0, 0xfe, 0x9, 0x5, 0xab, 0x5}, {0xf000, 0x26000, 0xf, 0x5b, 0x4, 0x42, 0x9, 0xff, 0x6, 0x7, 0xe}, {0x0, 0x58000, 0x9, 0x3, 0x6, 0x7, 0xab, 0x7f, 0x9e, 0x9, 0x80, 0x83}, {0x1000, 0x80a0000, 0x8, 0xa0, 0xb1, 0x8, 0x1, 0xfc, 0x80, 0x11, 0x40, 0xfd}, {0xeeed4004, 0x6000, 0x0, 0x7, 0x7, 0x2, 0xb, 0x0, 0x5, 0x81, 0xff, 0x70}, {0x5000, 0x1000, 0xf, 0x5, 0xf, 0x7, 0xff, 0x18, 0x2, 0x3, 0x7, 0x9}, {0x4000, 0x30}, {0x10000, 0x86}, 0x80000031, 0x0, 0x70000, 0x242101, 0x1400000000b, 0x0, 0xa000, [0x6840000000000000, 0xdb6b, 0x5a, 0xced7]}) r3 = socket$netlink(0x10, 0x3, 0x0) write(0xffffffffffffffff, &(0x7f0000000300)="8adc63441021396b23ad2487ac9e37d116546fca1589b50ecba8ed4143c3858c8a9b6dd5d109b2489a4fcbc5bdf8c3ce88ed768c229dd7ca97d5f9d39ab735eea8bbe01ad4e408d9", 0x48) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) nanosleep(&(0x7f0000000340)={0x0, 0x2faf080}, 0x0) sendmsg$netlink(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000300)=ANY=[@ANYBLOB='0\x00\x00\x00%'], 0x30}], 0x1}, 0x0) sendmsg$netlink(0xffffffffffffffff, &(0x7f0000001080)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000300)=ANY=[@ANYBLOB="240000002800010023bd700000000000050000000c000000000000f7ff"], 0x24}], 0x1}, 0x0) (async) openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x2840, 0x0) (async) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) (async) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) (async) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x64, 0x0, 0x0) (async) ioctl$KVM_RUN(r2, 0xae80, 0x0) (async) ioctl$KVM_SET_SREGS(r2, 0x4138ae84, &(0x7f00000001c0)={{0x2000, 0x30000, 0x8, 0x6f, 0x3, 0x8, 0x40, 0x29, 0x0, 0x2f, 0x19}, {0xd000, 0x1, 0xc, 0x0, 0x6, 0x42, 0x7d, 0x8, 0x58, 0x3, 0x3, 0xc0}, {0xdddd1000, 0x10000, 0xe, 0xc, 0x3, 0x0, 0xfe, 0x9, 0x5, 0xab, 0x5}, {0xf000, 0x26000, 0xf, 0x5b, 0x4, 0x42, 0x9, 0xff, 0x6, 0x7, 0xe}, {0x0, 0x58000, 0x9, 0x3, 0x6, 0x7, 0xab, 0x7f, 0x9e, 0x9, 0x80, 0x83}, {0x1000, 0x80a0000, 0x8, 0xa0, 0xb1, 0x8, 0x1, 0xfc, 0x80, 0x11, 0x40, 0xfd}, {0xeeed4004, 0x6000, 0x0, 0x7, 0x7, 0x2, 0xb, 0x0, 0x5, 0x81, 0xff, 0x70}, {0x5000, 0x1000, 0xf, 0x5, 0xf, 0x7, 0xff, 0x18, 0x2, 0x3, 0x7, 0x9}, {0x4000, 0x30}, {0x10000, 0x86}, 0x80000031, 0x0, 0x70000, 0x242101, 0x1400000000b, 0x0, 0xa000, [0x6840000000000000, 0xdb6b, 0x5a, 0xced7]}) (async) socket$netlink(0x10, 0x3, 0x0) (async) write(0xffffffffffffffff, &(0x7f0000000300)="8adc63441021396b23ad2487ac9e37d116546fca1589b50ecba8ed4143c3858c8a9b6dd5d109b2489a4fcbc5bdf8c3ce88ed768c229dd7ca97d5f9d39ab735eea8bbe01ad4e408d9", 0x48) (async) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) (async) nanosleep(&(0x7f0000000340)={0x0, 0x2faf080}, 0x0) (async) sendmsg$netlink(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000300)=ANY=[@ANYBLOB='0\x00\x00\x00%'], 0x30}], 0x1}, 0x0) (async) 1.532148866s ago: executing program 1 (id=154): r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000c00)=[{&(0x7f0000000200)=ANY=[@ANYBLOB="2c0000002e00fdffffffffffffff7d83a8000200", @ANYRES32], 0x2c}], 0x1}, 0xcc000) r1 = socket$packet(0x11, 0x1, 0x300) r2 = syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000000)={0x0, &(0x7f0000000440)=[@nested_load_syzos={0x136, 0x90, {0x1, 0x7, [@nested_amd_invlpga={0x17d, 0x20, {0xfec00000, 0x9953}}, @rdmsr={0x66, 0x18, {0xb95}}, @nested_vmresume={0x130, 0x18, 0x2}, @wr_drn={0x68, 0x20, {0x1, 0xff}}]}}, @nested_amd_invlpga={0x17d, 0x20, {0x200000, 0xf62a}}, @nested_amd_set_intercept={0x181, 0x30, {0x2, 0xd48, 0x1}}, @nested_load_syzos={0x136, 0x88, {0x0, 0x8, [@nested_amd_vmsave={0x183, 0x18, 0x3}, @nested_vmresume={0x130, 0x18}, @nested_intel_vmwrite_mask={0x154, 0x38, {0x0, @ro_nat=0x6404, 0x100000000, 0x4, 0x8}}]}}, @uexit={0x0, 0x18, 0x2}, @set_irq_handler={0xc8, 0x20, {0xaf, 0x2}}, @code={0xa, 0x70, {"66ba4200ec66baf80cb85470d18eef66bafc0cb800000000ef0f48bdfe4f0000c74424008b000000c744240200000000ff2c24400fc72a66b872000f00d00fc79a000000006636440f009457903f1f4466364783800000000001f3460faee9"}}, @nested_amd_stgi={0x17e, 0x10}, @nested_vmresume={0x130, 0x18}, @nested_amd_vmsave={0x183, 0x18, 0x3}], 0x250}) ioctl$KVM_SET_SREGS2(r2, 0x4140aecd, &(0x7f0000000280)={{0xfec00000, 0x1000, 0x8, 0x9, 0x80, 0xb, 0x0, 0xff, 0x0, 0x86, 0x0, 0xb}, {0x25000, 0xd000, 0x10, 0x3, 0x83, 0x7, 0x6, 0x7f, 0x1, 0x4, 0x8, 0x12}, {0xf000, 0x60000, 0xf, 0x4, 0x10, 0xa1, 0x4, 0x13, 0x5, 0x4, 0x92, 0x80}, {0x100000, 0x5000, 0xf, 0x7, 0x1, 0x3e, 0x1, 0x0, 0xfd, 0x29, 0x0, 0x9}, {0x80a0000, 0x0, 0xc, 0x9, 0x80, 0x2, 0xfd, 0xf1, 0x2, 0x6e, 0x2, 0x8}, {0x59004, 0xdddd1000, 0x4, 0x5, 0xaa, 0x2, 0x5, 0x5, 0x1, 0xe, 0x6, 0x3}, {0xa000, 0x41000, 0xb, 0x0, 0xcd, 0xe4, 0x5, 0x26, 0x2, 0xcd, 0xfc, 0x2}, {0x1, 0xf000, 0xd, 0xe, 0x13, 0x40, 0xff, 0x0, 0x7f, 0x1, 0xf, 0x8}, {0x100000, 0x5}, {0x80a0000, 0xff81}, 0x80000003, 0x0, 0x6000, 0x1005a1, 0x5, 0xe801, 0x2, 0x1, [0xb, 0x2, 0x3, 0x3]}) r3 = socket$packet(0x11, 0x3, 0x300) r4 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_RX_RING(r4, 0x11b, 0x2, &(0x7f0000000040)=0x1000000, 0x4) bind$xdp(r4, &(0x7f0000000100)={0x2c, 0x4}, 0x10) r5 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCSIFVLAN_DEL_VLAN_CMD(0xffffffffffffffff, 0x8983, &(0x7f0000000000)={0x1, 'vlan1\x00', {}, 0x7ff}) r6 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='smaps\x00') ptrace(0x10, r6) r7 = openat$zero(0xffffffffffffff9c, &(0x7f00000001c0), 0x200, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000006c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_MCAST_RATE(r7, &(0x7f0000000780)={&(0x7f0000000240), 0xc, &(0x7f0000000740)={&(0x7f0000000700)={0x2c, 0x0, 0x400, 0x70bd28, 0x25dfdbff, {{}, {@val={0x8, 0x3, r8}, @void}}, [@NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0xa}, @NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0x168}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4}, 0xc050) ptrace$setregs(0xd, r6, 0x0, &(0x7f00000003c0)="18607651149d7b10b4024fbbdc08899b8f589df2dbb5d7a8d1b36cfab675cb3976ee8100e2878c9cfa178cac130eb046eda93df39ed4b41924dc225ad4028dd63defb87d698be5c749450b350a789dcfc6b2d6a696b5026d1e52f19274566d1da0f353dd65e330ebf71c5e823f2753c5fd76724828ef31b353e71805205c3dceb44cc4c7b3664e29fb") ptrace$getregset(0x4205, r6, 0x1, &(0x7f0000000080)={&(0x7f0000000000)=""/120, 0x78}) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r5, 0x89f0, &(0x7f0000000400)={'ip6gre0\x00', 0x0}) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r4, 0x0) setsockopt$packet_int(r3, 0x107, 0xf, &(0x7f0000000100)=0x9, 0x4) ioctl$F2FS_IOC_GET_FEATURES(0xffffffffffffffff, 0x8004f50c, &(0x7f0000000080)) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000000c0)={'batadv_slave_1\x00', 0x0}) sendto$packet(r3, &(0x7f0000000180)="0b036800e0ff64000200475400f6a13bb1000000080086dd4803", 0x100a6, 0x0, &(0x7f0000000140)={0x11, 0x0, r9}, 0x14) 1.487144277s ago: executing program 3 (id=155): r0 = memfd_secret(0x80000) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x13, r0, 0x0) ftruncate(r0, 0x3) ioctl$XFS_IOC_FREE_EOFBLOCKS(0xffffffffffffffff, 0x8080583a, &(0x7f00000000c0)={0x5, 0x4, 0x65a4, 0x4, 0x82f, 0x0, 0x3}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_int(r1, 0x0, 0x2, &(0x7f00000000c0)=0x6, 0x4) getsockopt$inet_opts(r1, 0x0, 0x2, 0x0, &(0x7f0000000000)) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) 1.469597454s ago: executing program 3 (id=156): r0 = openat$loop_ctrl(0xffffffffffffff9c, 0x0, 0x200cc2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0xd00b7000) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000fc0)) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_DELETE(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB="34000000020103000000ddffffff00000100000408001540000000020800084000000de3"], 0x34}, 0x1, 0x0, 0x0, 0xd7b463f9eab17a7e}, 0x4800) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r2, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x200407f9, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) sendmmsg$inet(r2, &(0x7f0000000640)=[{{0x0, 0x0, &(0x7f0000001dc0)=[{&(0x7f0000000e80)="44900000000056ee66c372f3105eb186dd8062fad2d5b5bfb0ba06f274a8d026bd209da8ffa6826e3b3f8075704a9d0ef9aff7f1e7db24609f02d34e76992c9df9fe6888c6c9a4825c6223be6ac54536025affdea54e527c68b0ff250261953f2da79a78104c2d9e7b16ed86b124945aa9ab7581ebd385fb61d442035db81e18c2d2462d0bb25fff9d3b1ce90b597992b2a4d541611ce77f58dce7c9500118229e7cdf4ca7f6adca92c73d97ce54164c1942b2568635bec8e020b41fb2f8000000000000000000000000000000001c8a9f7956583e26f6f0edc415851d0b8305fe66c2b7c114e3712d87744938848f24a13cb604000000000000000000000000000000c7aa5035897b20a6c23f1fc4af2990c07f784b985a3d", 0x119}, {&(0x7f00000002c0)="641a6a2b863c0dd89801925ab48c844221841a87729aca4f2dd9194838b58523947f720c0ecddddb8e618e16ea418060862fdb55f8799bf9c3ecf3812b886138dc5e474541dc531f94fb9c624173cee8b8e3c30aee406b06e859075700000000bdd2bd8853ecedf6056e713bfa99afecaa4a5228f090006692a76749a831a000"/138, 0x8a}, {&(0x7f00000001c0)="985e44efeabe001cabcf3d8673c3a254a9a2d3197970cb347b70a243bf77139a94bc3ae91684aaf7b7dff691deb8f8aef2d915fb3a0794a9a9b431a819bca6122c35", 0x42}], 0x3}}, {{0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f0000000b80)="f77d2b5dd5f7d74f07", 0x9}], 0x1}}, {{&(0x7f00000000c0)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x34}}, 0x10, &(0x7f0000000180), 0x0, &(0x7f0000000380)}}, {{&(0x7f0000000240)={0x2, 0x4e21, @private=0x40000}, 0x10, &(0x7f0000000400)=[{&(0x7f0000001e00)="f09ddb6485339325fb02595173f2c42133e0e10250a49c51a35b4542a8a05415b0d36a0395ef4d52d0de3c85666a112b86708d1b6d477df88c370c3381e3e41f269df7c31ebbbb67434b0439cad2de13f62fefa59ee8b401343657197c8ef1c08b7710d5eb31988dc2a73dafb1ce03bcdb0dc865da0e3d4c95cc4814c989b75cdb9cb5bbbd87421c42ae6280754b109772246b2f504c6bd01f76810318ac1aca986126e1496135264d5b7794ae0f23edb8975ad7e338b9d043b7ead265e978a7f65f3de211368f44fdf2b150283889b466e59a08d7559039060a3d7816cfe0a856179a94614e77c143f35166a0e0587e9330b920257775511f4a01a54e20637c3bd8b13a5e311c48b14dbb6dc56a1232378e363a59c89e058636d9f65192cb98c0115bfcb08e684d58d02a68a9340d13d4af792bf1aefed1a5b1c4389875a84e02b50a54ae016e6b79c9a60041cdf963973de92119fed139ecf46e307c6ec7072d5f3d405b6685e5ac960be2045596db7b600c9d58394cd709d8f1cbb51e7577a678bce6de1e6fdeffbd42151ed3e1c2c87580c13dcaadddb0035cbcb29207166e91deaca63bd53f15a843a63806e035bce5a5a99a24d762617319d74f8326435ba6fcd3af5867efa4b1dd2f2e1be95d9803d6f26b467a4511f691c18ce50309c45e9ac5ae4473300c45506bee8090b6406102d9a6b65479ab434c2d5aaf5cb95fc7b7685ea4d073ad24f53ef670c91ea59042e5f09f9cfad79d2591daf44e6bb205463e2719007f97fe476777c1294d07b1d8b5abb74346d9fbaff2436acbd734cce9d9d067b11d1fe4ad42953d7d81a18bc9962a20b98c99e990d5200817e90072a26f55ac24cc3b4545e122408ffae80f628ee5f8b82941f1d9b383586a47aee563a18ca58b1db5455d5736c649fce734932a2d5c16fc150cf0c4f902f30860bf389e7cf831f128b43d278f90a5fe455d377d955a3d09766dc1bf3529c76caccdbb91db32b29a099f23caa552400251240cd7e2eca5fcbbecc6a6b8e677c5f94ebf937aae63bdf47377070d9d7c762e308eeb11191492a78d496918084b281766434c3bdbdda1d422d7fb3c7e9c1451b99f9aa11874142b97f65b286f17c07ee272531c7fe499ec88ed4dc963a8b5504c0d1d94b752078ad4765d3758698064a2463a04237986392a614fd39be95e07eeed0e5045b8d0672189fc63f8b9b85a52c527c747696ad955565640323b4f7837adfb37f4b2aa03143b9674eed9500c430b121c4d4610f96b5a82e8906c3ef7281055508a7630ce797df6ccdf154cb1f188422b9cc790c5bc0c3291f2668a4549e1529d4d311de596e5b9955797d35d839d92e41a40e9a08150c615cc0542ccb96a14ca2709bb72fa6bd9e81bcae77a0d0aebf551caa4bafe02e4799aa93f3a7a0ffc5e278b13c15030299914b4ea080cdd3426e659293aea34826ff93d070ebc0fdd70133d3f15edfa267f63c1f8bb4d8d4ef3080719c608c6257611cdb0c454d4de9a97c5f5907e4a7a33cd6c6d14eb12bb6107e75f4ddb4064dec70eaae2677cecf0589c24c98658bbfe2f554826bf574cb221b866f55d5f806d2c175f489c38b5c764414008ffe7304b8f9eed54be76d414377449a84a7cb3579d3be001e4f9b7c95f941f0ba85e9decb368a10be001e0bd01a796147cbb12334961b6d77a88b262e429617956922d3aa9dc67fde8b837ffc11a6c632b7807fa245280e2bf11828a9c4381da7934d31f7f13b327305af6b95545bf00d052a1a03217b11b0e3737470c4ee0b0aac2fce66da209ff73188bf49019b4c8fe77bfba3e12f9483f8a728f63f0cf96fcaa69ac3665ead5c94eea1023ad47de39b7a079c065131cc7256f3a9805c2068caf7f0beed7c6fe83e84e8cfd54b96908855818b0449b9da2d623d575998eed9744586c29f0251025b3b7c8cdfa7147a182953a9b44a602c55af8642736e4fdebb987ef84ec9541bbf05435abfe2ec9f54db094f444ee3a62db0a8c673ffe1e1ea7b30bc11ea083481efdda43e6ce4a6cf83139d611708ff8ee522576d20fb89e791e0bed02bb099ca250facc4e03b6d0add25f76f8549eabe3f02bb16b1d819ec2ecf6d3745ec3edd22ed0d0ad3dec34fc1d648bbe0adc3785aa81308614397ec61f80b57ec9a3a45063d40e9d139cbddc53ef4df7e853e1c5b5d826aefe4aadb70d165211707de6d26e8ccf4c9051e6c2bf36b17831a33fdd18121ade20424912a0bb43a7df2026b31bc1053dbfc108702819b42e11400e8047761711160999311e6dcc9a4ca77ad7fd0a2f9fd4792119b351aa31fee21f0324cb060d105f41c701f8fc9300f490134d016b40fcecc4102f99bc35b1ea15998aebfaa08fac1470807e016159da4c1e3d1173c68dd95f83867b196c0008ff350e567767b054a228f7618f1e382fe744a173dedcc76c181ee64b224c4a58", 0x6d1}], 0x1}}], 0x4, 0x2090) sendto$inet(r2, &(0x7f0000000580)="17", 0x59a, 0x10008095, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x41, 0x0) ioctl$TCSETAF(r3, 0x5408, &(0x7f00000000c0)={0x0, 0x4ce, 0x3, 0x9dff, 0xf, "000300eb00cbe600"}) write$binfmt_aout(r3, &(0x7f00000000c0)=ANY=[], 0xff2e) ioctl$TCSETS(r3, 0x40045431, &(0x7f0000000dc0)={0x0, 0x0, 0x0, 0x5, 0x0, "0062ba7d82000000000000000000f7ffffff00"}) r4 = syz_open_pts(r3, 0x0) r5 = dup3(r4, r3, 0x0) ioctl$TIOCSTI(r5, 0x5412, &(0x7f0000000000)=0x17) ioctl$TIOCSTI(r5, 0x5412, &(0x7f0000000140)=0x3) r6 = syz_usb_connect(0x0, 0x36, &(0x7f0000000480)=ANY=[@ANYBLOB="12010000b510f210950b2a7773820102030109022400010000000009042200028953950009050a02"], 0x0) r7 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) close_range(r7, 0xffffffffffffffff, 0x0) syz_usb_control_io$lan78xx(r6, 0x0, 0x0) fcntl$F_GET_FILE_RW_HINT(r0, 0x40d, &(0x7f0000000040)) r8 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000001c0)=ANY=[@ANYBLOB="1201000000000040bd28050900000000000109022400010000000009040200010300000009210000000122050009058103"], 0x0) syz_usb_control_io$hid(r8, 0x0, 0x0) syz_usb_control_io(r8, &(0x7f0000000040)={0x2c, &(0x7f0000000180)=ANY=[@ANYBLOB="00017c"], 0x0, 0x0, 0x0, 0x0}, 0x0) 1.377126654s ago: executing program 2 (id=157): ioctl$XFS_IOC_FD_TO_HANDLE(0xffffffffffffffff, 0xc038586a, &(0x7f00000001c0)={0xffffffffffffffff, &(0x7f00000000c0)='[\'\x00', 0x101000, &(0x7f0000000100)={@_ha_fsid={[0x6, 0x9cc]}, {0x6, 0x9, 0x200, 0x7fffffffffffffff}}, 0x9, &(0x7f0000000140)={@_ha_fsid}, &(0x7f0000000180)=0x7}) ioctl$FS_IOC_GET_ENCRYPTION_NONCE(r0, 0x8010661b, &(0x7f0000000200)) (async) prctl$PR_GET_SPECULATION_CTRL(0x35, 0x0, 0x10) (async, rerun: 64) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) (async, rerun: 64) r1 = open(&(0x7f00000000c0)='.\x00', 0x0, 0x100) signalfd4(r1, &(0x7f0000000000), 0x8, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='net/raw6\x00') r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r2, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_udp_int(r3, 0x11, 0x67, &(0x7f0000000000)=0x507, 0x4) (async) clock_gettime(0xfffffffffffffffd, 0x0) (async) openat$cgroup_ro(r1, &(0x7f0000000280)='cpuacct.usage_user\x00', 0x0, 0x0) (async, rerun: 64) r4 = open(&(0x7f0000000080)='./file0\x00', 0x501002, 0x50) (rerun: 64) read$FUSE(r4, &(0x7f00000020c0)={0x2020}, 0x2020) 1.376937044s ago: executing program 2 (id=158): r0 = creat(&(0x7f0000000080)='./file0\x00', 0xe9) write$binfmt_elf64(r0, &(0x7f00000000c0)=ANY=[], 0x120) (async) close(r0) execve(&(0x7f00000000c0)='./file0\x00', 0x0, 0x0) (async) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) (async) socket$nl_xfrm(0x10, 0x3, 0x6) syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="002222000000962313f3e43f170c0000002a9000070900be0083000000000b09007a150b9d000000", @ANYBLOB="1fb82035776c32d58ffb9fbf7a583648d74930a4896c2089fbc4de19a27408ec7a403244fbaeeddadbc855cfafae4b326470982112241f4004330e970082472ba99bed7738b94d12e722afe61d2bf5d78d70ae146b490eeb898df22cd246fd2d0537cf01fc217b2dee892ac414550b0bc24f8bb62297530f3c5b23833937c9cea3486a27706447d04ba76f31d2de957c5f34a043d38c4f97887c768c22c0d3851d72fc8d5c8ef02f5380bc3ca19f01fc49e8148ca7729a192e450c8ee238bc67e5c11bd51a2659a0425e8de0d525300747638532072243b35b9dac0d6f77dc0f02d5f97273219f21e81b7be6b20a15c7b8fce589f95df2a76a467855c4c8", @ANYRES8=r0, @ANYRESOCT=0x0], 0x0}, 0x0) 1.001855417s ago: executing program 1 (id=159): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) ioctl$int_in(r0, 0x5452, &(0x7f0000000000)=0xf4e) readv(r0, &(0x7f0000000080)=[{&(0x7f00000004c0)=""/233, 0xe9}], 0x1) (async) readv(r0, &(0x7f0000000080)=[{&(0x7f00000004c0)=""/233, 0xe9}], 0x1) writev(r0, &(0x7f0000000480)=[{&(0x7f0000000380)="ad", 0x1}], 0x1) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000027c0)=ANY=[@ANYRES32=r0], 0x0) syz_usb_control_io(r1, 0x0, 0x0) (async) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io(r1, &(0x7f0000000040)={0x2c, &(0x7f0000000200)=ANY=[@ANYBLOB="200b4000000028b1"], 0x0, 0x0, 0x0, 0x0}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1381, 0x1}) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000300)='debugfs\x00', 0x0, 0x0) ppoll(0x0, 0x0, 0x0, 0x0, 0x0) r3 = inotify_init1(0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000002300), 0x80802, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_SET_TSC_KHZ_vm(r5, 0xaea2, 0x8000000000000000) (async) ioctl$KVM_SET_TSC_KHZ_vm(r5, 0xaea2, 0x8000000000000000) inotify_add_watch(r3, &(0x7f0000000000)='./file0\x00', 0x2000001) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) (async) ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) syz_open_dev$evdev(0x0, 0x40, 0x0) (async) syz_open_dev$evdev(0x0, 0x40, 0x0) 818.916439ms ago: executing program 2 (id=160): syz_usb_connect(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000001018610f4205ae06d6c011703010902240001010000000904690202ff5aa30009050402100000fa000905820240"], 0x0) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x42082, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x102, 0x0) close(r1) ioctl$TUNSETTXFILTER(r0, 0x400454d1, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, 0x0) socket$nl_route(0x10, 0x3, 0x0) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) bind$bt_l2cap(r2, &(0x7f0000002080)={0x1f, 0x0, @any, 0x0, 0x1}, 0xe) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) bind$bt_l2cap(r3, &(0x7f0000002080)={0x1f, 0x0, @none, 0x0, 0x1}, 0xe) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x80202, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x5) r7 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000840), r7) ioctl$SNDRV_TIMER_IOCTL_SELECT(r7, 0x40345410, &(0x7f0000000100)={{0xfffffffffffffffc, 0x1, 0x3, 0x2, 0x7}}) syz_kvm_setup_cpu$x86(r5, r6, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000000c0)=[@text64={0x40, &(0x7f0000000040)="f30f1ef7470f09410f6b2640d8c2460f00dc8f29d8925e0066ba2000ed670f01cfc4c18df6c3b805000000b9000000000f01d9", 0x33}], 0x1, 0x52, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) symlink(&(0x7f0000000080)='.\x00', &(0x7f0000000200)='./file0\x00') chmod(&(0x7f0000000180)='./file0\x00', 0x234) fstat(r3, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) creat(&(0x7f00000002c0)='./file0/file0\x00', 0x115) ioctl$NS_GET_OWNER_UID(r7, 0xb704, &(0x7f00000001c0)=0x0) lchown(&(0x7f0000000140)='./file0\x00', r9, r8) open(&(0x7f00009e1000)='./file0\x00', 0x60840, 0x0) mknod(&(0x7f0000000000)='./file0/file0\x00', 0x8000, 0x0) 301.009552ms ago: executing program 0 (id=161): r0 = syz_clone(0x1022000, 0x0, 0xfffffffffffffc76, 0x0, 0x0, 0x0) setpgid(r0, 0x0) (async) socket$netlink(0x10, 0x3, 0x0) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cpuacct.usage_percpu_user\x00', 0x275a, 0x0) (async) syz_clone3(&(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f0000000040), 0x2}, 0xa0) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x0) (async) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89101) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x262) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000180)='w', 0x1}], 0x1, 0x1) (async) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) (async) syz_open_dev$usbfs(&(0x7f0000000100), 0x77, 0x101301) r2 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) mount$fuse(0x0, 0x0, 0x0, 0x8, &(0x7f0000000040)=ANY=[@ANYRESDEC=0x0]) (async, rerun: 32) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)={0xfffff34, 0x0, [{0xf88e470f, 0xed}]}) (async, rerun: 32) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) (async) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000200)={[0x2, 0x9, 0xfffffffffffffffd, 0x2, 0x2, 0x0, 0x4002004c4, 0x1004, 0x8000000000000000, 0xc595, 0x0, 0x1, 0xffffffffffffffff, 0x2400000000000002, 0xb3, 0x8d], 0xeeee8000, 0x2010d3}) (async) ioctl$KVM_RUN(r4, 0xae80, 0x0) (async) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x202, 0x0) (async) ioctl$KVM_RUN(r4, 0xae80, 0x0) (async, rerun: 32) ioctl$KVM_RUN(r4, 0xae80, 0x0) (rerun: 32) move_mount(r1, &(0x7f0000000300)='./file0\x00', r1, &(0x7f0000000340)='./file0/../file0\x00', 0x10) prctl$PR_SET_MM_MAP(0x21, 0xe, 0x0, 0x0) futex_waitv(&(0x7f0000000ec0), 0x0, 0x0, 0x0, 0x0) (async) sendmsg$tipc(0xffffffffffffffff, &(0x7f0000000040)={&(0x7f0000000140)=@id={0x1e, 0x3, 0x0, {0x4e21, 0x3}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x4000884}, 0x20000004) (async) r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000), 0x1c0102, 0x0) write$vga_arbiter(r5, &(0x7f0000000280)=ANY=[@ANYBLOB='lock io'], 0xc) (async) write$vga_arbiter(r5, &(0x7f0000000380)=@other={'unlock', ' ', 'mem'}, 0xb) 198.336541ms ago: executing program 0 (id=162): r0 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$TIPC_CONN_TIMEOUT(0xffffffffffffffff, 0x10f, 0x82, &(0x7f0000000000), &(0x7f0000000040)=0x4) io_setup(0x3ff, &(0x7f0000000500)=0x0) r2 = socket$igmp(0x2, 0x3, 0x2) setsockopt$inet_mreqn(r2, 0x0, 0x23, &(0x7f0000000140)={@multicast1, @private=0xa010101}, 0xc) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) r4 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000080), 0x1c0002, 0x0) write$vga_arbiter(r4, &(0x7f0000000000)=ANY=[@ANYBLOB='lock m'], 0xc) r5 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r5, &(0x7f0000000180), 0x10) io_submit(r1, 0x1, &(0x7f0000000100)=[&(0x7f00000002c0)={0x400000, 0x0, 0x0, 0x1, 0x0, r5, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f00000000000029ffffff000000", 0x38}]) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f00000000c0)=ANY=[@ANYBLOB="e0000002000000100000000000000000"], 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000080)={'batadv0\x00', 0x0}) arch_prctl$ARCH_REQ_XCOMP_PERM(0x1023, 0x12) socket(0xa, 0x801, 0x0) getsockopt(r2, 0x0, 0x4, &(0x7f0000000240)=""/82, &(0x7f00000000c0)=0x52) syz_open_dev$usbfs(&(0x7f0000000000), 0x76, 0x183281) setsockopt$inet_mreqn(r0, 0x0, 0x24, &(0x7f0000000100)={@dev={0xac, 0x14, 0x14, 0xc}, @remote, r6}, 0xc) write$tun(r3, &(0x7f0000000300)={@val={0x0, 0x88a2}, @void, @x25={0x1, 0x0, 0xf5, "75cb00bd85fcad384ad1c960422d4e40a06ab713358052067fa8843fbf5de5d9360a9823656a54f14079340736bcd12d0ac1b979e3c14b6665c4241a8020fe7c76bad3845fe72d7168a5dba7f78169ec5a1efc104827053c490168410a69617248975820d865de93a3234cc7b8e106b17a8ea0f2598772b9d22ba4d587661ebbd16c64cfab89a0547d4468688ea9d43d5e3bfb9e09575d8e3b2f22b1bfe2518c2d6c37d2a39e0854ce125e5976465a55dd7b63a033011531cb2ef1ad82daaccdbd341a655907ad183bfcfce87c199217dc69a3b4ad1aabf4accf91f7e1"}}, 0xe4) 44.369779ms ago: executing program 0 (id=163): r0 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r0, 0x10e, 0xc, &(0x7f0000000080)=0x4, 0x4) 0s ago: executing program 32 (id=163): r0 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r0, 0x10e, 0xc, &(0x7f0000000080)=0x4, 0x4) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.112' (ED25519) to the list of known hosts. [ 24.616848][ T36] audit: type=1400 audit(1772372456.820:64): avc: denied { mounton } for pid=283 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2022 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 24.620452][ T283] cgroup: Unknown subsys name 'net' [ 24.639578][ T36] audit: type=1400 audit(1772372456.820:65): avc: denied { mount } for pid=283 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 24.666901][ T36] audit: type=1400 audit(1772372456.840:66): avc: denied { unmount } for pid=283 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 24.667336][ T283] cgroup: Unknown subsys name 'devices' [ 24.808834][ T283] cgroup: Unknown subsys name 'hugetlb' [ 24.814475][ T283] cgroup: Unknown subsys name 'rlimit' [ 24.970964][ T36] audit: type=1400 audit(1772372457.170:67): avc: denied { setattr } for pid=283 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 24.994196][ T36] audit: type=1400 audit(1772372457.170:68): avc: denied { mounton } for pid=283 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 25.018970][ T36] audit: type=1400 audit(1772372457.170:69): avc: denied { mount } for pid=283 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 25.045797][ T285] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 25.054642][ T36] audit: type=1400 audit(1772372457.250:70): avc: denied { relabelto } for pid=285 comm="mkswap" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 25.080114][ T36] audit: type=1400 audit(1772372457.250:71): avc: denied { write } for pid=285 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 25.107789][ T36] audit: type=1400 audit(1772372457.310:72): avc: denied { read } for pid=283 comm="syz-executor" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 25.133419][ T36] audit: type=1400 audit(1772372457.310:73): avc: denied { open } for pid=283 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 25.134106][ T283] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 26.074775][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.081928][ T293] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.089168][ T293] bridge_slave_0: entered allmulticast mode [ 26.095504][ T293] bridge_slave_0: entered promiscuous mode [ 26.104950][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.112042][ T293] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.119141][ T293] bridge_slave_1: entered allmulticast mode [ 26.125478][ T293] bridge_slave_1: entered promiscuous mode [ 26.131626][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.138730][ T290] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.145804][ T290] bridge_slave_0: entered allmulticast mode [ 26.152158][ T290] bridge_slave_0: entered promiscuous mode [ 26.160624][ T291] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.167729][ T291] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.174798][ T291] bridge_slave_0: entered allmulticast mode [ 26.181150][ T291] bridge_slave_0: entered promiscuous mode [ 26.190341][ T291] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.197573][ T291] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.204661][ T291] bridge_slave_1: entered allmulticast mode [ 26.211111][ T291] bridge_slave_1: entered promiscuous mode [ 26.217122][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.224173][ T290] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.231326][ T290] bridge_slave_1: entered allmulticast mode [ 26.237711][ T290] bridge_slave_1: entered promiscuous mode [ 26.256202][ T292] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.263297][ T292] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.270455][ T292] bridge_slave_0: entered allmulticast mode [ 26.276816][ T292] bridge_slave_0: entered promiscuous mode [ 26.286287][ T292] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.293403][ T292] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.300557][ T292] bridge_slave_1: entered allmulticast mode [ 26.306881][ T292] bridge_slave_1: entered promiscuous mode [ 26.484633][ T292] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.491733][ T292] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.499095][ T292] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.506134][ T292] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.514703][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.521809][ T290] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.529159][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.536215][ T290] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.552680][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.559854][ T293] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.567158][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.574195][ T293] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.591486][ T291] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.598575][ T291] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.605867][ T291] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.612934][ T291] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.658625][ T45] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.666031][ T45] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.674131][ T45] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.681444][ T45] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.689190][ T45] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.696503][ T45] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.703681][ T45] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.711074][ T45] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.729665][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.736877][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.744421][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.751516][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.762353][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.769474][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.782219][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.789305][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.815013][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.822073][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.829823][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.836892][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.844405][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.851492][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.867921][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.874966][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.899813][ T290] veth0_vlan: entered promiscuous mode [ 26.922478][ T290] veth1_macvtap: entered promiscuous mode [ 26.942425][ T292] veth0_vlan: entered promiscuous mode [ 26.952045][ T293] veth0_vlan: entered promiscuous mode [ 26.976276][ T292] veth1_macvtap: entered promiscuous mode [ 26.984541][ T291] veth0_vlan: entered promiscuous mode [ 27.000667][ T293] veth1_macvtap: entered promiscuous mode [ 27.011480][ T290] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 27.039856][ T291] veth1_macvtap: entered promiscuous mode [ 27.102317][ T336] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 27.336456][ T10] usb 4-1: new full-speed USB device number 2 using dummy_hcd [ 27.376512][ T9] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 27.489395][ T10] usb 4-1: config 17 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 27.495824][ T358] process 'syz.2.9' launched './file0' with NULL argv: empty string added [ 27.501260][ T10] usb 4-1: config 17 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 27.521631][ T10] usb 4-1: config 17 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 64 [ 27.533537][ T10] usb 4-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.00 [ 27.542862][ T9] usb 2-1: Using ep0 maxpacket: 16 [ 27.548311][ T10] usb 4-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 27.556759][ T10] usb 4-1: Manufacturer: syz [ 27.561943][ T9] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 27.576264][ T334] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 27.576635][ T340] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 27.592371][ T9] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 27.602447][ T9] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 27.615740][ T9] usb 2-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 27.626768][ T9] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 27.635646][ T9] usb 2-1: config 0 descriptor?? [ 27.777601][ T340] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 27.788821][ T340] usb 1-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 1024 [ 27.803856][ T10] aiptek 4-1:17.0: Aiptek using 400 ms programming speed [ 27.812603][ T340] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 27.822944][ T10] input: Aiptek as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:17.0/input/input4 [ 27.832896][ T340] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 27.844126][ T340] usb 1-1: Product: syz [ 27.848938][ T340] usb 1-1: Manufacturer: syz [ 27.856006][ T10] usb 4-1: USB disconnect, device number 2 [ 27.856004][ C1] aiptek 4-1:17.0: aiptek_irq - usb_submit_urb failed with result -19 [ 27.870326][ T340] usb 1-1: SerialNumber: syz [ 27.882642][ T340] cdc_mbim 1-1:1.0: skipping garbage [ 27.899325][ T338] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 27.910933][ T338] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 28.082761][ T353] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22 [ 28.125370][ T338] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 28.134032][ T338] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 28.144968][ T338] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 28.155982][ T338] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 28.168385][ T9] microsoft 0003:045E:07DA.0001: unknown main item tag 0x0 [ 28.175733][ T9] microsoft 0003:045E:07DA.0001: unknown main item tag 0x0 [ 28.183252][ T9] microsoft 0003:045E:07DA.0001: unknown main item tag 0x0 [ 28.191515][ T9] microsoft 0003:045E:07DA.0001: unknown main item tag 0x0 [ 28.199359][ T9] microsoft 0003:045E:07DA.0001: unknown main item tag 0x0 [ 28.207082][ T9] microsoft 0003:045E:07DA.0001: unknown main item tag 0x0 [ 28.214345][ T9] microsoft 0003:045E:07DA.0001: unknown main item tag 0x0 [ 28.221859][ T9] microsoft 0003:045E:07DA.0001: unknown main item tag 0x0 [ 28.229597][ T9] microsoft 0003:045E:07DA.0001: unknown main item tag 0x0 [ 28.237187][ T9] microsoft 0003:045E:07DA.0001: unknown main item tag 0x0 [ 28.244486][ T9] microsoft 0003:045E:07DA.0001: unknown main item tag 0x0 [ 28.252219][ T9] microsoft 0003:045E:07DA.0001: unknown main item tag 0x0 [ 28.260519][ T9] microsoft 0003:045E:07DA.0001: unknown main item tag 0x0 [ 28.268407][ T9] microsoft 0003:045E:07DA.0001: unknown main item tag 0x0 [ 28.275718][ T9] microsoft 0003:045E:07DA.0001: unknown main item tag 0x0 [ 28.284594][ T379] random: crng reseeded on system resumption [ 28.291538][ T340] cdc_mbim 1-1:1.0: bind() failure [ 28.298075][ T9] input: HID 045e:07da as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/0003:045E:07DA.0001/input/input5 [ 28.310650][ T340] cdc_ncm 1-1:1.1: CDC Union missing and no IAD found [ 28.318068][ T340] cdc_ncm 1-1:1.1: bind() failure [ 28.325964][ T340] usb 1-1: USB disconnect, device number 2 [ 28.394077][ T9] microsoft 0003:045E:07DA.0001: input,hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.1-1/input0 [ 28.442626][ T9] usb 2-1: USB disconnect, device number 2 [ 28.462151][ T394] capability: warning: `syz.2.17' uses 32-bit capabilities (legacy support in use) [ 28.502712][ T391] fido_id[391]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.1/usb2/report_descriptor': No such file or directory [ 28.726453][ T67] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 28.831426][ T410] FAULT_INJECTION: forcing a failure. [ 28.831426][ T410] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 28.845075][ T410] CPU: 1 UID: 0 PID: 410 Comm: syz.0.21 Not tainted syzkaller #0 c4f231820317ff22bb61fe038e0df9024df7047c [ 28.845113][ T410] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 28.845133][ T410] Call Trace: [ 28.845141][ T410] [ 28.845150][ T410] __dump_stack+0x21/0x30 [ 28.845189][ T410] dump_stack_lvl+0x140/0x1c0 [ 28.845226][ T410] ? __cfi_dump_stack_lvl+0x10/0x10 [ 28.845257][ T410] dump_stack+0x19/0x20 [ 28.845284][ T410] should_fail_ex+0x3d7/0x530 [ 28.845309][ T410] should_fail+0xf/0x20 [ 28.845330][ T410] should_fail_usercopy+0x1e/0x30 [ 28.845356][ T410] strncpy_from_user+0x29/0x270 [ 28.845380][ T410] getname_flags+0x101/0x700 [ 28.845455][ T410] __x64_sys_rename+0x61/0xa0 [ 28.845481][ T410] x64_sys_call+0x150b/0x2ee0 [ 28.845523][ T410] do_syscall_64+0x57/0xf0 [ 28.845545][ T410] ? clear_bhb_loop+0x50/0xa0 [ 28.845568][ T410] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 28.845603][ T410] RIP: 0033:0x7f8a4499c799 [ 28.845632][ T410] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 28.845651][ T410] RSP: 002b:00007f8a4578a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000052 [ 28.845686][ T410] RAX: ffffffffffffffda RBX: 00007f8a44c15fa0 RCX: 00007f8a4499c799 [ 28.845708][ T410] RDX: 0000000000000000 RSI: 0000200000000800 RDI: 00002000000001c0 [ 28.845723][ T410] RBP: 00007f8a4578a090 R08: 0000000000000000 R09: 0000000000000000 [ 28.845744][ T410] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 28.845757][ T410] R13: 00007f8a44c16038 R14: 00007f8a44c15fa0 R15: 00007ffefeb30ac8 [ 28.845778][ T410] [ 28.856551][ T354] usb 3-1: new full-speed USB device number 2 using dummy_hcd [ 28.886635][ T67] usb 4-1: Using ep0 maxpacket: 16 [ 29.037823][ T67] usb 4-1: too many endpoints for config 1 interface 0 altsetting 0: 255, using maximum allowed: 30 [ 29.038926][ T354] usb 3-1: config index 0 descriptor too short (expected 1307, got 27) [ 29.060098][ T414] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=4096 sclass=netlink_audit_socket pid=414 comm=syz.0.22 [ 29.065087][ T67] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 32 [ 29.073483][ T354] usb 3-1: config 0 has an invalid interface number: 0 but max is -1 [ 29.083116][ T67] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 29.101365][ T354] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 0 [ 29.106847][ T67] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 29.111284][ T354] usb 3-1: too many endpoints for config 0 interface 0 altsetting 0: 246, using maximum allowed: 30 [ 29.122220][ T67] usb 4-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 255 [ 29.146757][ T354] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 29.156893][ T354] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 246 [ 29.170655][ T67] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 29.180054][ T67] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 29.188568][ T67] usb 4-1: SerialNumber: syz [ 29.193328][ T354] usb 3-1: New USB device found, idVendor=0460, idProduct=0008, bcdDevice=e2.de [ 29.203796][ T397] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 29.213778][ T397] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 29.225331][ T354] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 29.233545][ T354] usb 3-1: Product: syz [ 29.237963][ T354] usb 3-1: Manufacturer: syz [ 29.242628][ T354] usb 3-1: SerialNumber: syz [ 29.250120][ T354] usb 3-1: config 0 descriptor?? [ 29.256047][ T354] hub 3-1:0.0: bad descriptor, ignoring hub [ 29.262071][ T9] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 29.271627][ T354] hub 3-1:0.0: probe with driver hub failed with error -5 [ 29.303198][ T422] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 29.317310][ T422] x_tables: duplicate underflow at hook 1 [ 29.324259][ T422] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 29.406435][ T9] usb 2-1: device descriptor read/64, error -71 [ 29.438604][ T397] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 29.451515][ T397] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 29.465075][ T435] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 29.474572][ T435] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 29.481113][ T397] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 29.492072][ T397] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 29.504925][ T439] FAULT_INJECTION: forcing a failure. [ 29.504925][ T439] name failslab, interval 1, probability 0, space 0, times 1 [ 29.518052][ T439] CPU: 0 UID: 0 PID: 439 Comm: syz.0.31 Not tainted syzkaller #0 c4f231820317ff22bb61fe038e0df9024df7047c [ 29.518087][ T439] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 29.518101][ T439] Call Trace: [ 29.518108][ T439] [ 29.518117][ T439] __dump_stack+0x21/0x30 [ 29.518153][ T439] dump_stack_lvl+0x140/0x1c0 [ 29.518181][ T439] ? __cfi_dump_stack_lvl+0x10/0x10 [ 29.518209][ T439] ? check_stack_object+0x81/0x150 [ 29.518245][ T439] ? __virt_addr_valid+0x2a6/0x380 [ 29.518268][ T439] dump_stack+0x19/0x20 [ 29.518294][ T439] should_fail_ex+0x3d7/0x530 [ 29.518317][ T439] should_failslab+0xac/0x100 [ 29.518349][ T439] kmem_cache_alloc_noprof+0x42/0x410 [ 29.518377][ T439] ? getname_flags+0xc5/0x700 [ 29.518405][ T439] ? strncpy_from_user+0x14d/0x270 [ 29.518429][ T439] getname_flags+0xc5/0x700 [ 29.518458][ T439] __x64_sys_rename+0x6e/0xa0 [ 29.518482][ T439] x64_sys_call+0x150b/0x2ee0 [ 29.518512][ T439] do_syscall_64+0x57/0xf0 [ 29.518533][ T439] ? clear_bhb_loop+0x50/0xa0 [ 29.518555][ T439] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 29.518589][ T439] RIP: 0033:0x7f8a4499c799 [ 29.518607][ T439] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 29.518626][ T439] RSP: 002b:00007f8a4578a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000052 [ 29.518649][ T439] RAX: ffffffffffffffda RBX: 00007f8a44c15fa0 RCX: 00007f8a4499c799 [ 29.518666][ T439] RDX: 0000000000000000 RSI: 0000200000000800 RDI: 00002000000001c0 [ 29.518681][ T439] RBP: 00007f8a4578a090 R08: 0000000000000000 R09: 0000000000000000 [ 29.518696][ T439] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 29.518709][ T439] R13: 00007f8a44c16038 R14: 00007f8a44c15fa0 R15: 00007ffefeb30ac8 [ 29.518728][ T439] [ 29.522804][ T67] usb 4-1: USB disconnect, device number 3 [ 29.557499][ T441] netlink: 'syz.3.33': attribute type 12 has an invalid length. [ 29.722883][ T441] netlink: 17 bytes leftover after parsing attributes in process `syz.3.33'. [ 29.724045][ T369] usb 3-1: USB disconnect, device number 2 [ 29.775770][ T36] kauditd_printk_skb: 239 callbacks suppressed [ 29.775790][ T36] audit: type=1400 audit(1772372461.970:313): avc: denied { read } for pid=449 comm="syz.3.35" dev="nsfs" ino=4026532403 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 29.796466][ T9] usb 2-1: device descriptor read/64, error -71 [ 29.804854][ T36] audit: type=1400 audit(1772372461.970:314): avc: denied { open } for pid=449 comm="syz.3.35" path="net:[4026532403]" dev="nsfs" ino=4026532403 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 29.832100][ T36] audit: type=1400 audit(1772372461.980:315): avc: denied { create } for pid=449 comm="syz.3.35" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 29.851853][ T36] audit: type=1400 audit(1772372461.980:316): avc: denied { setopt } for pid=449 comm="syz.3.35" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 29.871573][ T36] audit: type=1400 audit(1772372461.980:317): avc: denied { read } for pid=449 comm="syz.3.35" name=".pending_reads" dev="incremental-fs" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 29.894850][ T36] audit: type=1400 audit(1772372461.980:318): avc: denied { open } for pid=449 comm="syz.3.35" path="/7/file0/.pending_reads" dev="incremental-fs" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 29.919016][ T36] audit: type=1400 audit(1772372462.030:319): avc: denied { unmount } for pid=290 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 30.006424][ T369] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 30.036406][ T36] audit: type=1400 audit(1772372462.230:320): avc: denied { read } for pid=453 comm="syz.2.37" name="uinput" dev="devtmpfs" ino=194 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 30.059307][ T36] audit: type=1400 audit(1772372462.230:321): avc: denied { open } for pid=453 comm="syz.2.37" path="/dev/uinput" dev="devtmpfs" ino=194 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 30.076556][ T9] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 30.083801][ T36] audit: type=1400 audit(1772372462.230:322): avc: denied { setopt } for pid=453 comm="syz.2.37" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 30.091361][ T354] usb 4-1: new full-speed USB device number 4 using dummy_hcd [ 30.166442][ T369] usb 1-1: Using ep0 maxpacket: 16 [ 30.172787][ T369] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 30.183754][ T369] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 30.193788][ T369] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 30.206625][ T369] usb 1-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 30.215724][ T369] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 30.224547][ T369] usb 1-1: config 0 descriptor?? [ 30.247354][ T9] usb 2-1: device descriptor read/64, error -71 [ 30.267408][ T354] usb 4-1: config 0 has an invalid interface number: 251 but max is 0 [ 30.275637][ T354] usb 4-1: config 0 has no interface number 0 [ 30.283364][ T354] usb 4-1: New USB device found, idVendor=0b95, idProduct=172a, bcdDevice=f7.f4 [ 30.292498][ T354] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 30.300580][ T354] usb 4-1: Product: syz [ 30.304766][ T354] usb 4-1: Manufacturer: syz [ 30.309565][ T354] usb 4-1: SerialNumber: syz [ 30.315165][ T354] usb 4-1: config 0 descriptor?? [ 30.376403][ T340] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 30.437844][ T369] usbhid 1-1:0.0: can't add hid device: -71 [ 30.443889][ T369] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 30.452985][ T369] usb 1-1: USB disconnect, device number 3 [ 30.496435][ T9] usb 2-1: device descriptor read/64, error -71 [ 30.527599][ T340] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 30.538686][ T340] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 30.548640][ T340] usb 3-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 30.557789][ T340] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 30.566882][ T340] usb 3-1: config 0 descriptor?? [ 30.606581][ T9] usb usb2-port1: attempt power cycle [ 30.946897][ T9] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 30.978590][ T9] usb 2-1: device descriptor read/8, error -71 [ 30.991090][ T340] usb 3-1: string descriptor 0 read error: -71 [ 31.006668][ T354] asix 4-1:0.251 (unnamed net_device) (uninitialized): Interface mode not supported by driver [ 31.017325][ T340] uclogic 0003:256C:006D.0002: failed retrieving string descriptor #200: -71 [ 31.026144][ T340] uclogic 0003:256C:006D.0002: failed retrieving pen parameters: -71 [ 31.036436][ T354] asix 4-1:0.251: probe with driver asix failed with error -524 [ 31.051750][ T340] uclogic 0003:256C:006D.0002: failed probing pen v2 parameters: -71 [ 31.060162][ T340] uclogic 0003:256C:006D.0002: failed probing parameters: -71 [ 31.067848][ T340] uclogic 0003:256C:006D.0002: probe with driver uclogic failed with error -71 [ 31.078145][ T340] usb 3-1: USB disconnect, device number 3 [ 31.085283][ T468] FAULT_INJECTION: forcing a failure. [ 31.085283][ T468] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 31.101076][ T468] CPU: 1 UID: 0 PID: 468 Comm: syz.2.40 Not tainted syzkaller #0 c4f231820317ff22bb61fe038e0df9024df7047c [ 31.101111][ T468] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 31.101125][ T468] Call Trace: [ 31.101132][ T468] [ 31.101140][ T468] __dump_stack+0x21/0x30 [ 31.101173][ T468] dump_stack_lvl+0x140/0x1c0 [ 31.101199][ T468] ? __cfi_dump_stack_lvl+0x10/0x10 [ 31.101228][ T468] dump_stack+0x19/0x20 [ 31.101252][ T468] should_fail_ex+0x3d7/0x530 [ 31.101284][ T468] should_fail+0xf/0x20 [ 31.101305][ T468] should_fail_usercopy+0x1e/0x30 [ 31.101327][ T468] strncpy_from_user+0x29/0x270 [ 31.101350][ T468] getname_flags+0x101/0x700 [ 31.101379][ T468] __x64_sys_rename+0x6e/0xa0 [ 31.101403][ T468] x64_sys_call+0x150b/0x2ee0 [ 31.101433][ T468] do_syscall_64+0x57/0xf0 [ 31.101453][ T468] ? clear_bhb_loop+0x50/0xa0 [ 31.101474][ T468] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 31.101508][ T468] RIP: 0033:0x7f457ef9c799 [ 31.101526][ T468] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 31.101545][ T468] RSP: 002b:00007f457fe14028 EFLAGS: 00000246 ORIG_RAX: 0000000000000052 [ 31.101567][ T468] RAX: ffffffffffffffda RBX: 00007f457f215fa0 RCX: 00007f457ef9c799 [ 31.101583][ T468] RDX: 0000000000000000 RSI: 0000200000000800 RDI: 00002000000001c0 [ 31.101598][ T468] RBP: 00007f457fe14090 R08: 0000000000000000 R09: 0000000000000000 [ 31.101612][ T468] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 31.101624][ T468] R13: 00007f457f216038 R14: 00007f457f215fa0 R15: 00007ffeb81d1178 [ 31.101643][ T468] [ 31.137811][ T9] usb 2-1: device descriptor read/8, error -71 [ 31.248601][ T31] usb 4-1: USB disconnect, device number 4 [ 31.486442][ T9] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 31.507584][ T9] usb 2-1: device descriptor read/8, error -71 [ 31.586450][ T10] usb 1-1: new low-speed USB device number 4 using dummy_hcd [ 31.637653][ T9] usb 2-1: device descriptor read/8, error -71 [ 31.736417][ T10] usb 1-1: Invalid ep0 maxpacket: 64 [ 31.747095][ T9] usb usb2-port1: unable to enumerate USB device [ 31.866518][ T10] usb 1-1: new low-speed USB device number 5 using dummy_hcd [ 32.016414][ T10] usb 1-1: Invalid ep0 maxpacket: 64 [ 32.023246][ T10] usb usb1-port1: attempt power cycle [ 32.078665][ T493] FAULT_INJECTION: forcing a failure. [ 32.078665][ T493] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 32.092745][ T493] CPU: 1 UID: 0 PID: 493 Comm: syz.1.49 Not tainted syzkaller #0 c4f231820317ff22bb61fe038e0df9024df7047c [ 32.092782][ T493] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 32.092796][ T493] Call Trace: [ 32.092804][ T493] [ 32.092812][ T493] __dump_stack+0x21/0x30 [ 32.092859][ T493] dump_stack_lvl+0x140/0x1c0 [ 32.092886][ T493] ? __cfi_dump_stack_lvl+0x10/0x10 [ 32.092916][ T493] dump_stack+0x19/0x20 [ 32.092952][ T493] should_fail_ex+0x3d7/0x530 [ 32.092976][ T493] should_fail+0xf/0x20 [ 32.092997][ T493] should_fail_usercopy+0x1e/0x30 [ 32.093022][ T493] strncpy_from_user+0x29/0x270 [ 32.093045][ T493] getname_flags+0x101/0x700 [ 32.093076][ T493] __x64_sys_rename+0x6e/0xa0 [ 32.093101][ T493] x64_sys_call+0x150b/0x2ee0 [ 32.093132][ T493] do_syscall_64+0x57/0xf0 [ 32.093153][ T493] ? clear_bhb_loop+0x50/0xa0 [ 32.093174][ T493] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 32.093208][ T493] RIP: 0033:0x7fda4b59c799 [ 32.093227][ T493] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 32.093246][ T493] RSP: 002b:00007fda4c3d1028 EFLAGS: 00000246 ORIG_RAX: 0000000000000052 [ 32.093270][ T493] RAX: ffffffffffffffda RBX: 00007fda4b815fa0 RCX: 00007fda4b59c799 [ 32.093287][ T493] RDX: 0000000000000000 RSI: 0000200000000800 RDI: 00002000000001c0 [ 32.093302][ T493] RBP: 00007fda4c3d1090 R08: 0000000000000000 R09: 0000000000000000 [ 32.093317][ T493] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 32.093330][ T493] R13: 00007fda4b816038 R14: 00007fda4b815fa0 R15: 00007fffebbac3a8 [ 32.093349][ T493] [ 32.292621][ T498] vlan1: entered promiscuous mode [ 32.297956][ T498] vlan1: entered allmulticast mode [ 32.303115][ T498] veth0_vlan: entered allmulticast mode [ 32.386722][ T10] usb 1-1: new low-speed USB device number 6 using dummy_hcd [ 32.416752][ T10] usb 1-1: Invalid ep0 maxpacket: 64 [ 32.531330][ T512] cgroup: Invalid name [ 32.556434][ T10] usb 1-1: new low-speed USB device number 7 using dummy_hcd [ 32.566038][ T514] +$<: renamed from bridge0 (while UP) [ 32.576876][ T10] usb 1-1: Invalid ep0 maxpacket: 64 [ 32.582325][ T10] usb usb1-port1: unable to enumerate USB device [ 32.636504][ T495] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 32.659203][ T519] FAULT_INJECTION: forcing a failure. [ 32.659203][ T519] name failslab, interval 1, probability 0, space 0, times 0 [ 32.671918][ T519] CPU: 0 UID: 0 PID: 519 Comm: syz.1.58 Not tainted syzkaller #0 c4f231820317ff22bb61fe038e0df9024df7047c [ 32.671948][ T519] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 32.671961][ T519] Call Trace: [ 32.671966][ T519] [ 32.671974][ T519] __dump_stack+0x21/0x30 [ 32.672002][ T519] dump_stack_lvl+0x140/0x1c0 [ 32.672025][ T519] ? __cfi_dump_stack_lvl+0x10/0x10 [ 32.672050][ T519] dump_stack+0x19/0x20 [ 32.672072][ T519] should_fail_ex+0x3d7/0x530 [ 32.672092][ T519] should_failslab+0xac/0x100 [ 32.672118][ T519] kmem_cache_alloc_lru_noprof+0x44/0x410 [ 32.672148][ T519] ? __d_alloc+0x42/0x8e0 [ 32.672171][ T519] __d_alloc+0x42/0x8e0 [ 32.672192][ T519] d_alloc+0x4c/0x1c0 [ 32.672211][ T519] ? lookup_one_qstr_excl+0xba/0x280 [ 32.672237][ T519] lookup_one_qstr_excl+0xcf/0x280 [ 32.672264][ T519] do_renameat2+0x447/0xc40 [ 32.672283][ T519] ? __virt_addr_valid+0x2a6/0x380 [ 32.672305][ T519] ? __cfi_do_renameat2+0x10/0x10 [ 32.672326][ T519] ? __kasan_check_write+0x18/0x20 [ 32.672349][ T519] ? getname_flags+0x208/0x700 [ 32.672373][ T519] __x64_sys_rename+0x86/0xa0 [ 32.672394][ T519] x64_sys_call+0x150b/0x2ee0 [ 32.672419][ T519] do_syscall_64+0x57/0xf0 [ 32.672436][ T519] ? clear_bhb_loop+0x50/0xa0 [ 32.672455][ T519] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 32.672483][ T519] RIP: 0033:0x7fda4b59c799 [ 32.672499][ T519] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 32.672515][ T519] RSP: 002b:00007fda4c3d1028 EFLAGS: 00000246 ORIG_RAX: 0000000000000052 [ 32.672535][ T519] RAX: ffffffffffffffda RBX: 00007fda4b815fa0 RCX: 00007fda4b59c799 [ 32.672549][ T519] RDX: 0000000000000000 RSI: 0000200000000800 RDI: 00002000000001c0 [ 32.672562][ T519] RBP: 00007fda4c3d1090 R08: 0000000000000000 R09: 0000000000000000 [ 32.672573][ T519] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 32.672584][ T519] R13: 00007fda4b816038 R14: 00007fda4b815fa0 R15: 00007fffebbac3a8 [ 32.672600][ T519] [ 32.886644][ T495] usb 3-1: Using ep0 maxpacket: 16 [ 32.893889][ T495] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 32.904147][ T495] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 32.920799][ T495] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 32.930163][ T495] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 32.938377][ T495] usb 3-1: Product: syz [ 32.942669][ T495] usb 3-1: Manufacturer: syz [ 32.944409][ T521] SELinux: policydb version 1521979019 does not match my version range 15-33 [ 32.948494][ T495] usb 3-1: SerialNumber: syz [ 32.956623][ T354] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 32.969074][ T521] SELinux: failed to load policy [ 33.096454][ T354] usb 4-1: device descriptor read/64, error -71 [ 33.169831][ T508] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 33.178465][ T508] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 33.266494][ T10] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 33.336477][ T354] usb 4-1: device descriptor read/64, error -71 [ 33.395682][ T13] Bluetooth: hci0: Frame reassembly failed (-84) [ 33.402249][ T508] Bluetooth: hci0: received HCILL_GO_TO_SLEEP_ACK in state 2 [ 33.410032][ T13] Bluetooth: hci0: Frame reassembly failed (-84) [ 33.417688][ T10] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 33.428718][ T10] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 33.438527][ T10] usb 2-1: New USB device found, idVendor=046d, idProduct=c71f, bcdDevice= 0.00 [ 33.447797][ T10] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 33.456812][ T10] usb 2-1: config 0 descriptor?? [ 33.586443][ T354] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 33.716427][ T354] usb 4-1: device descriptor read/64, error -71 [ 33.865151][ T10] logitech-djreceiver 0003:046D:C71F.0003: unknown main item tag 0x7 [ 33.874482][ T10] logitech-djreceiver 0003:046D:C71F.0003: hidraw0: USB HID v0.00 Device [HID 046d:c71f] on usb-dummy_hcd.1-1/input0 [ 33.956494][ T354] usb 4-1: device descriptor read/64, error -71 [ 34.066576][ T354] usb usb4-port1: attempt power cycle [ 34.406432][ T354] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 34.427693][ T354] usb 4-1: device descriptor read/8, error -71 [ 34.562829][ T354] usb 4-1: device descriptor read/8, error -71 [ 34.573156][ T549] FAULT_INJECTION: forcing a failure. [ 34.573156][ T549] name failslab, interval 1, probability 0, space 0, times 0 [ 34.586062][ T549] CPU: 0 UID: 0 PID: 549 Comm: syz.0.67 Not tainted syzkaller #0 c4f231820317ff22bb61fe038e0df9024df7047c [ 34.586094][ T549] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 34.586107][ T549] Call Trace: [ 34.586114][ T549] [ 34.586122][ T549] __dump_stack+0x21/0x30 [ 34.586157][ T549] dump_stack_lvl+0x140/0x1c0 [ 34.586185][ T549] ? __cfi_dump_stack_lvl+0x10/0x10 [ 34.586214][ T549] ? avc_has_perm_noaudit+0x28a/0x360 [ 34.586246][ T549] dump_stack+0x19/0x20 [ 34.586273][ T549] should_fail_ex+0x3d7/0x530 [ 34.586297][ T549] should_failslab+0xac/0x100 [ 34.586331][ T549] __kmalloc_cache_noprof+0x41/0x470 [ 34.586365][ T549] ? ovl_encode_real_fh+0xe4/0x440 [ 34.586394][ T549] ovl_encode_real_fh+0xe4/0x440 [ 34.586421][ T549] ? __cfi_ovl_encode_real_fh+0x10/0x10 [ 34.586449][ T549] ? capable+0x8e/0xf0 [ 34.586480][ T549] ovl_get_origin_fh+0x83/0xa0 [ 34.586506][ T549] ovl_lookup+0xd81/0x1d60 [ 34.586543][ T549] ? __cfi_ovl_lookup+0x10/0x10 [ 34.586576][ T549] ? _raw_spin_lock+0x92/0x120 [ 34.586598][ T549] ? __cfi__raw_spin_lock+0x10/0x10 [ 34.586619][ T549] ? __d_alloc+0x510/0x8e0 [ 34.586646][ T549] ? d_alloc+0x174/0x1c0 [ 34.586670][ T549] lookup_one_qstr_excl+0x129/0x280 [ 34.586704][ T549] do_renameat2+0x447/0xc40 [ 34.586729][ T549] ? __virt_addr_valid+0x2a6/0x380 [ 34.586794][ T549] ? __cfi_do_renameat2+0x10/0x10 [ 34.586822][ T549] ? __kasan_check_write+0x18/0x20 [ 34.586850][ T549] ? getname_flags+0x208/0x700 [ 34.586880][ T549] __x64_sys_rename+0x86/0xa0 [ 34.586906][ T549] x64_sys_call+0x150b/0x2ee0 [ 34.586938][ T549] do_syscall_64+0x57/0xf0 [ 34.586959][ T549] ? clear_bhb_loop+0x50/0xa0 [ 34.586983][ T549] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 34.587017][ T549] RIP: 0033:0x7f8a4499c799 [ 34.587036][ T549] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 34.587055][ T549] RSP: 002b:00007f8a4578a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000052 [ 34.587079][ T549] RAX: ffffffffffffffda RBX: 00007f8a44c15fa0 RCX: 00007f8a4499c799 [ 34.587096][ T549] RDX: 0000000000000000 RSI: 0000200000000800 RDI: 00002000000001c0 [ 34.587112][ T549] RBP: 00007f8a4578a090 R08: 0000000000000000 R09: 0000000000000000 [ 34.587127][ T549] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 34.587141][ T549] R13: 00007f8a44c16038 R14: 00007f8a44c15fa0 R15: 00007ffefeb30ac8 [ 34.587161][ T549] [ 34.857437][ T36] kauditd_printk_skb: 23 callbacks suppressed [ 34.857609][ T36] audit: type=1400 audit(1772372467.060:346): avc: denied { sqpoll } for pid=550 comm="syz.0.68" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 34.956462][ T354] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 34.971461][ T36] audit: type=1400 audit(1772372467.170:347): avc: denied { setopt } for pid=591 comm="syz.0.70" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 34.991776][ T36] audit: type=1400 audit(1772372467.180:348): avc: denied { write } for pid=591 comm="syz.0.70" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 34.994557][ T354] usb 4-1: device descriptor read/8, error -71 [ 35.128352][ T36] audit: type=1400 audit(1772372467.330:349): avc: denied { map } for pid=596 comm="syz.0.72" path="socket:[4819]" dev="sockfs" ino=4819 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tcp_socket permissive=1 [ 35.148178][ T354] usb 4-1: device descriptor read/8, error -71 [ 35.151589][ T36] audit: type=1400 audit(1772372467.340:350): avc: granted { setsecparam } for pid=596 comm="syz.0.72" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=security [ 35.266568][ T354] usb usb4-port1: unable to enumerate USB device [ 35.408206][ T495] usb 3-1: cannot find UAC_HEADER [ 35.415660][ T495] snd-usb-audio 3-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 35.425589][ T495] usb 3-1: USB disconnect, device number 4 [ 35.431565][ T529] Bluetooth: hci0: command 0x1003 tx timeout [ 35.436478][ T528] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 35.439381][ T31] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 35.456117][ T399] udevd[399]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 35.515071][ T36] audit: type=1400 audit(1772372467.710:351): avc: denied { write } for pid=602 comm="syz.1.75" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 35.554348][ T605] FAULT_INJECTION: forcing a failure. [ 35.554348][ T605] name failslab, interval 1, probability 0, space 0, times 0 [ 35.567085][ T605] CPU: 1 UID: 0 PID: 605 Comm: syz.1.76 Not tainted syzkaller #0 c4f231820317ff22bb61fe038e0df9024df7047c [ 35.567119][ T605] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 35.567132][ T605] Call Trace: [ 35.567139][ T605] [ 35.567148][ T605] __dump_stack+0x21/0x30 [ 35.567182][ T605] dump_stack_lvl+0x140/0x1c0 [ 35.567210][ T605] ? __cfi_dump_stack_lvl+0x10/0x10 [ 35.567241][ T605] dump_stack+0x19/0x20 [ 35.567268][ T605] should_fail_ex+0x3d7/0x530 [ 35.567292][ T605] should_failslab+0xac/0x100 [ 35.567325][ T605] __kmalloc_node_noprof+0x6c/0x4f0 [ 35.567366][ T605] ? __kvmalloc_node_noprof+0x128/0x300 [ 35.567393][ T605] __kvmalloc_node_noprof+0x128/0x300 [ 35.567420][ T605] ? __cfi___kvmalloc_node_noprof+0x10/0x10 [ 35.567445][ T605] ? avc_has_perm_noaudit+0x28a/0x360 [ 35.567473][ T605] simple_xattr_alloc+0x68/0x140 [ 35.567501][ T605] ? _raw_spin_lock+0x92/0x120 [ 35.567522][ T605] simple_xattr_set+0x45/0x300 [ 35.567551][ T605] shmem_xattr_handler_set+0x192/0x2d0 [ 35.567574][ T605] ? __cfi_shmem_xattr_handler_set+0x10/0x10 [ 35.567596][ T605] __vfs_setxattr+0x49f/0x4e0 [ 35.567620][ T605] __vfs_setxattr_noperm+0x12e/0x670 [ 35.567646][ T605] __vfs_setxattr_locked+0x216/0x240 [ 35.567670][ T605] ? __insert_inode_hash+0x19c/0x1d0 [ 35.567703][ T605] vfs_setxattr+0x16b/0x2f0 [ 35.567727][ T605] ? __cfi_vfs_setxattr+0x10/0x10 [ 35.567751][ T605] ? ovl_encode_real_fh+0x26e/0x440 [ 35.567785][ T605] ovl_check_setxattr+0x12f/0x270 [ 35.567815][ T605] ovl_set_origin_fh+0x70/0xb0 [ 35.567840][ T605] ovl_lookup+0xdd8/0x1d60 [ 35.567877][ T605] ? __cfi_ovl_lookup+0x10/0x10 [ 35.567909][ T605] ? _raw_spin_lock+0x92/0x120 [ 35.567928][ T605] ? __cfi__raw_spin_lock+0x10/0x10 [ 35.567948][ T605] ? __d_alloc+0x510/0x8e0 [ 35.567974][ T605] ? d_alloc+0x174/0x1c0 [ 35.567998][ T605] lookup_one_qstr_excl+0x129/0x280 [ 35.568031][ T605] do_renameat2+0x447/0xc40 [ 35.568054][ T605] ? __virt_addr_valid+0x2a6/0x380 [ 35.568079][ T605] ? __cfi_do_renameat2+0x10/0x10 [ 35.568104][ T605] ? __kasan_check_write+0x18/0x20 [ 35.568130][ T605] ? getname_flags+0x208/0x700 [ 35.568159][ T605] __x64_sys_rename+0x86/0xa0 [ 35.568184][ T605] x64_sys_call+0x150b/0x2ee0 [ 35.568215][ T605] do_syscall_64+0x57/0xf0 [ 35.568235][ T605] ? clear_bhb_loop+0x50/0xa0 [ 35.568257][ T605] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 35.568291][ T605] RIP: 0033:0x7fda4b59c799 [ 35.568309][ T605] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 35.568328][ T605] RSP: 002b:00007fda4c3d1028 EFLAGS: 00000246 ORIG_RAX: 0000000000000052 [ 35.568351][ T605] RAX: ffffffffffffffda RBX: 00007fda4b815fa0 RCX: 00007fda4b59c799 [ 35.568368][ T605] RDX: 0000000000000000 RSI: 0000200000000800 RDI: 00002000000001c0 [ 35.568383][ T605] RBP: 00007fda4c3d1090 R08: 0000000000000000 R09: 0000000000000000 [ 35.568398][ T605] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 35.568411][ T605] R13: 00007fda4b816038 R14: 00007fda4b815fa0 R15: 00007fffebbac3a8 [ 35.568430][ T605] [ 35.889326][ T31] usb 1-1: device descriptor read/64, error -71 [ 35.898159][ T10] usb 2-1: USB disconnect, device number 7 [ 35.952559][ T612] No source specified [ 35.965951][ T612] kvm: kvm [611]: vcpu0, guest rIP: 0x9136 Unhandled WRMSR(0xc1) = 0x6000003d [ 35.976295][ T612] kvm: kvm [611]: vcpu0, guest rIP: 0x9136 Unhandled WRMSR(0xc2) = 0x6000003c [ 35.988272][ T612] kvm: kvm [611]: vcpu0, guest rIP: 0x9136 Unhandled WRMSR(0x11e) = 0x600000e0 [ 36.001516][ T612] kvm: kvm [611]: vcpu0, guest rIP: 0x9136 Unhandled WRMSR(0x186) = 0x60000078 [ 36.013103][ T612] kvm: kvm [611]: vcpu0, guest rIP: 0x9136 Unhandled WRMSR(0x187) = 0x60000077 [ 36.024718][ T612] kvm_intel: kvm [611]: vcpu0, guest rIP: 0x9136 Unhandled WRMSR(0x1d9) = 0x60000025 [ 36.033774][ T36] audit: type=1400 audit(1772372468.230:352): avc: denied { map } for pid=616 comm="syz.3.80" path="socket:[5000]" dev="sockfs" ino=5000 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 36.126414][ T31] usb 1-1: device descriptor read/64, error -71 [ 36.149994][ T626] netlink: 'syz.2.82': attribute type 29 has an invalid length. [ 36.170466][ T36] audit: type=1400 audit(1772372468.370:353): avc: denied { read } for pid=628 comm="syz.2.83" name="binder1" dev="binder" ino=14 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 36.193233][ T36] audit: type=1400 audit(1772372468.370:354): avc: denied { map } for pid=628 comm="syz.2.83" path="/dev/binderfs/binder1" dev="binder" ino=14 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 36.217114][ T36] audit: type=1400 audit(1772372468.370:355): avc: denied { execute } for pid=628 comm="syz.2.83" path="/dev/binderfs/binder1" dev="binder" ino=14 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 36.268969][ T638] overlay: Unknown parameter './file0' [ 36.366444][ T31] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 36.428194][ T658] binder: Bad value for 'max' [ 36.506446][ T31] usb 1-1: device descriptor read/64, error -71 [ 36.526414][ T10] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 36.676407][ T10] usb 3-1: Using ep0 maxpacket: 32 [ 36.682775][ T10] usb 3-1: config 2 has an invalid interface number: 194 but max is 0 [ 36.691662][ T10] usb 3-1: config 2 has an invalid descriptor of length 0, skipping remainder of the config [ 36.701871][ T10] usb 3-1: config 2 has no interface number 0 [ 36.708037][ T10] usb 3-1: New USB device found, idVendor=0499, idProduct=1025, bcdDevice=9c.f6 [ 36.717155][ T10] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 36.746474][ T31] usb 1-1: device descriptor read/64, error -71 [ 36.856461][ T369] usb 2-1: new full-speed USB device number 8 using dummy_hcd [ 36.856784][ T31] usb usb1-port1: attempt power cycle [ 36.928500][ T10] usb 3-1: string descriptor 0 read error: -71 [ 36.938402][ T10] snd-usb-audio 3-1:2.194: probe with driver snd-usb-audio failed with error -2 [ 36.945764][ T399] udevd[399]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:2.194/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 36.949496][ T10] usb 3-1: USB disconnect, device number 5 [ 37.007475][ T369] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 37.018444][ T369] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 37.031049][ T369] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 37.041395][ T369] usb 2-1: New USB device found, idVendor=7de0, idProduct=676e, bcdDevice=77.db [ 37.050991][ T369] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 37.060377][ T369] usb 2-1: config 0 descriptor?? [ 37.206489][ T31] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 37.227571][ T31] usb 1-1: device descriptor read/8, error -71 [ 37.268224][ T369] usb 2-1: string descriptor 0 read error: -71 [ 37.275901][ T369] usb 2-1: USB disconnect, device number 8 [ 37.326530][ T340] usb 4-1: new high-speed USB device number 9 using dummy_hcd [ 37.357687][ T31] usb 1-1: device descriptor read/8, error -71 [ 37.477716][ T340] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 37.488795][ T340] usb 4-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 1024 [ 37.500611][ T340] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 37.514942][ T340] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 37.523256][ T340] usb 4-1: Product: syz [ 37.527657][ T340] usb 4-1: Manufacturer: syz [ 37.532298][ T340] usb 4-1: SerialNumber: syz [ 37.539154][ T340] cdc_mbim 4-1:1.0: skipping garbage [ 37.545185][ T495] kernel write not supported for file /uhid (pid: 495 comm: kworker/1:3) [ 37.591735][ T679] ======================================================= [ 37.591735][ T679] WARNING: The mand mount option has been deprecated and [ 37.591735][ T679] and is ignored by this kernel. Remove the mand [ 37.591735][ T679] option from the mount to silence this warning. [ 37.591735][ T679] ======================================================= [ 37.626724][ T31] usb 1-1: new high-speed USB device number 11 using dummy_hcd [ 37.626970][ T679] 9pnet_fd: Insufficient options for proto=fd [ 37.647586][ T31] usb 1-1: device descriptor read/8, error -71 [ 37.739123][ T670] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 37.777828][ T31] usb 1-1: device descriptor read/8, error -71 [ 37.886557][ T31] usb usb1-port1: unable to enumerate USB device [ 37.966432][ T369] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 38.049424][ T690] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 38.125617][ T693] netlink: 104 bytes leftover after parsing attributes in process `syz.1.104'. [ 38.134801][ T369] usb 3-1: Using ep0 maxpacket: 16 [ 38.141380][ T369] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 38.151682][ T369] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 38.162016][ T369] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 38.171375][ T369] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 38.179723][ T369] usb 3-1: Product: syz [ 38.183982][ T369] usb 3-1: Manufacturer: syz [ 38.188644][ T369] usb 3-1: SerialNumber: syz [ 38.230098][ T702] FAULT_INJECTION: forcing a failure. [ 38.230098][ T702] name failslab, interval 1, probability 0, space 0, times 0 [ 38.242957][ T702] CPU: 1 UID: 0 PID: 702 Comm: syz.1.107 Not tainted syzkaller #0 c4f231820317ff22bb61fe038e0df9024df7047c [ 38.242994][ T702] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 38.243008][ T702] Call Trace: [ 38.243015][ T702] [ 38.243024][ T702] __dump_stack+0x21/0x30 [ 38.243059][ T702] dump_stack_lvl+0x140/0x1c0 [ 38.243086][ T702] ? __cfi_dump_stack_lvl+0x10/0x10 [ 38.243114][ T702] ? __kasan_kmalloc+0x96/0xb0 [ 38.243149][ T702] dump_stack+0x19/0x20 [ 38.243176][ T702] should_fail_ex+0x3d7/0x530 [ 38.243201][ T702] should_failslab+0xac/0x100 [ 38.243234][ T702] __kmalloc_node_track_caller_noprof+0x68/0x4f0 [ 38.243266][ T702] ? simple_xattr_set+0x5e/0x300 [ 38.243295][ T702] ? __asan_memcpy+0x5a/0x80 [ 38.243323][ T702] kstrdup+0x4d/0x130 [ 38.243348][ T702] simple_xattr_set+0x5e/0x300 [ 38.243378][ T702] shmem_xattr_handler_set+0x192/0x2d0 [ 38.243402][ T702] ? __cfi_shmem_xattr_handler_set+0x10/0x10 [ 38.243426][ T702] __vfs_setxattr+0x49f/0x4e0 [ 38.243453][ T702] __vfs_setxattr_noperm+0x12e/0x670 [ 38.243489][ T702] __vfs_setxattr_locked+0x216/0x240 [ 38.243515][ T702] vfs_setxattr+0x16b/0x2f0 [ 38.243541][ T702] ? __cfi_vfs_setxattr+0x10/0x10 [ 38.243567][ T702] ? ovl_check_setxattr+0x149/0x270 [ 38.243597][ T702] ovl_set_impure+0x1d6/0x350 [ 38.243626][ T702] ovl_lookup+0xe4c/0x1d60 [ 38.243665][ T702] ? __cfi_ovl_lookup+0x10/0x10 [ 38.243696][ T702] ? _raw_spin_lock+0x92/0x120 [ 38.243717][ T702] ? __cfi__raw_spin_lock+0x10/0x10 [ 38.243735][ T702] ? __d_alloc+0x510/0x8e0 [ 38.243760][ T702] ? d_alloc+0x174/0x1c0 [ 38.243786][ T702] lookup_one_qstr_excl+0x129/0x280 [ 38.243819][ T702] do_renameat2+0x447/0xc40 [ 38.243851][ T702] ? __virt_addr_valid+0x2a6/0x380 [ 38.243878][ T702] ? __cfi_do_renameat2+0x10/0x10 [ 38.243905][ T702] ? __kasan_check_write+0x18/0x20 [ 38.243932][ T702] ? getname_flags+0x208/0x700 [ 38.243962][ T702] __x64_sys_rename+0x86/0xa0 [ 38.243988][ T702] x64_sys_call+0x150b/0x2ee0 [ 38.244026][ T702] do_syscall_64+0x57/0xf0 [ 38.244048][ T702] ? clear_bhb_loop+0x50/0xa0 [ 38.244071][ T702] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 38.244106][ T702] RIP: 0033:0x7fda4b59c799 [ 38.244125][ T702] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 38.244145][ T702] RSP: 002b:00007fda4c3d1028 EFLAGS: 00000246 ORIG_RAX: 0000000000000052 [ 38.244174][ T702] RAX: ffffffffffffffda RBX: 00007fda4b815fa0 RCX: 00007fda4b59c799 [ 38.244192][ T702] RDX: 0000000000000000 RSI: 0000200000000800 RDI: 00002000000001c0 [ 38.244209][ T702] RBP: 00007fda4c3d1090 R08: 0000000000000000 R09: 0000000000000000 [ 38.244223][ T702] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 38.244237][ T702] R13: 00007fda4b816038 R14: 00007fda4b815fa0 R15: 00007fffebbac3a8 [ 38.244258][ T702] [ 38.460733][ T369] usb 3-1: cannot find UAC_HEADER [ 38.491690][ T670] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 38.515871][ T369] snd-usb-audio 3-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 38.560293][ T340] cdc_mbim 4-1:1.0: dwNtbInMaxSize=2 is too small. Using 2048 [ 38.576458][ T340] cdc_mbim 4-1:1.0: setting rx_max = 2048 [ 38.623099][ T369] usb 3-1: USB disconnect, device number 6 [ 38.632514][ T399] udevd[399]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 38.640311][ T707] netlink: 4 bytes leftover after parsing attributes in process `syz.0.109'. [ 38.657150][ T707] bridge_slave_1: left allmulticast mode [ 38.662899][ T707] bridge_slave_1: left promiscuous mode [ 38.668816][ T707] bridge0: port 2(bridge_slave_1) entered disabled state [ 38.676916][ T707] bridge_slave_0: left allmulticast mode [ 38.682594][ T707] bridge_slave_0: left promiscuous mode [ 38.689626][ T707] bridge0: port 1(bridge_slave_0) entered disabled state [ 38.741031][ T340] cdc_mbim 4-1:1.0: cdc-wdm0: USB WDM device [ 38.748076][ T340] wwan wwan0: port wwan0mbim0 attached [ 38.755178][ T340] cdc_mbim 4-1:1.0 wwan0: register 'cdc_mbim' at usb-dummy_hcd.3-1, CDC MBIM, e6:f3:0b:63:0b:4b [ 38.767783][ T340] usb 4-1: USB disconnect, device number 9 [ 38.774994][ T340] cdc_mbim 4-1:1.0 wwan0: unregister 'cdc_mbim' usb-dummy_hcd.3-1, CDC MBIM [ 38.817183][ T31] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 38.828152][ T340] wwan wwan0: port wwan0mbim0 disconnected [ 38.966531][ T31] usb 2-1: Using ep0 maxpacket: 16 [ 38.972827][ T31] usb 2-1: too many endpoints for config 1 interface 0 altsetting 0: 255, using maximum allowed: 30 [ 38.983697][ T31] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 32 [ 38.993591][ T31] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 39.003484][ T31] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 39.013168][ T31] usb 2-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 255 [ 39.027075][ T31] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 39.036133][ T31] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 39.044172][ T31] usb 2-1: SerialNumber: syz [ 39.049987][ T705] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 39.057276][ T705] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 39.086500][ T495] usb 1-1: new full-speed USB device number 12 using dummy_hcd [ 39.237671][ T495] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 39.248711][ T495] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 39.258211][ T495] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 39.271105][ T49] usb 2-1: USB disconnect, device number 9 [ 39.278505][ T495] usb 1-1: SerialNumber: syz [ 39.285935][ T495] usb 1-1: bad CDC descriptors [ 39.386521][ T31] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 39.408594][ T727] netlink: 'syz.3.116': attribute type 4 has an invalid length. [ 39.416317][ T727] netlink: 'syz.3.116': attribute type 5 has an invalid length. [ 39.424093][ T727] netlink: 'syz.3.116': attribute type 1 has an invalid length. [ 39.487064][ T714] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 39.496693][ T714] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 39.516454][ T31] usb 3-1: device descriptor read/64, error -71 [ 39.547623][ T340] usb 1-1: USB disconnect, device number 12 [ 39.724568][ T736] Zero length message leads to an empty skb [ 39.756426][ T31] usb 3-1: device descriptor read/64, error -71 [ 39.966453][ T36] kauditd_printk_skb: 565 callbacks suppressed [ 39.966472][ T36] audit: type=1400 audit(1772372472.170:921): avc: denied { bind } for pid=751 comm="syz.3.123" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 40.006452][ T31] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 40.056438][ T495] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 40.100809][ T760] FAULT_INJECTION: forcing a failure. [ 40.100809][ T760] name failslab, interval 1, probability 0, space 0, times 0 [ 40.113667][ T760] CPU: 1 UID: 0 PID: 760 Comm: syz.3.126 Not tainted syzkaller #0 c4f231820317ff22bb61fe038e0df9024df7047c [ 40.113701][ T760] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 40.113712][ T760] Call Trace: [ 40.113718][ T760] [ 40.113724][ T760] __dump_stack+0x21/0x30 [ 40.113748][ T760] dump_stack_lvl+0x140/0x1c0 [ 40.113768][ T760] ? __cfi_dump_stack_lvl+0x10/0x10 [ 40.113800][ T760] ? __vfs_getxattr+0x41e/0x450 [ 40.113818][ T760] dump_stack+0x19/0x20 [ 40.113836][ T760] should_fail_ex+0x3d7/0x530 [ 40.113851][ T760] ? ovl_get_fh+0x190/0x600 [ 40.113873][ T760] should_failslab+0xac/0x100 [ 40.113895][ T760] __kmalloc_noprof+0x69/0x500 [ 40.113914][ T760] ? ovl_get_fh+0x190/0x600 [ 40.113935][ T760] ? __asan_memcpy+0x5a/0x80 [ 40.113954][ T760] ovl_get_fh+0x190/0x600 [ 40.113976][ T760] ovl_verify_fh+0x2a/0x150 [ 40.113998][ T760] ovl_verify_origin_xattr+0x98/0x300 [ 40.114021][ T760] ovl_lookup+0xb70/0x1d60 [ 40.114047][ T760] ? __cfi_ovl_lookup+0x10/0x10 [ 40.114069][ T760] ? _raw_spin_lock+0x92/0x120 [ 40.114083][ T760] ? __cfi__raw_spin_lock+0x10/0x10 [ 40.114097][ T760] ? __d_alloc+0x510/0x8e0 [ 40.114115][ T760] ? d_alloc+0x174/0x1c0 [ 40.114131][ T760] lookup_one_qstr_excl+0x129/0x280 [ 40.114153][ T760] do_renameat2+0x447/0xc40 [ 40.114170][ T760] ? __virt_addr_valid+0x2a6/0x380 [ 40.114187][ T760] ? __cfi_do_renameat2+0x10/0x10 [ 40.114205][ T760] ? __kasan_check_write+0x18/0x20 [ 40.114223][ T760] ? getname_flags+0x208/0x700 [ 40.114243][ T760] __x64_sys_rename+0x86/0xa0 [ 40.114260][ T760] x64_sys_call+0x150b/0x2ee0 [ 40.114283][ T760] do_syscall_64+0x57/0xf0 [ 40.114297][ T760] ? clear_bhb_loop+0x50/0xa0 [ 40.114313][ T760] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 40.114336][ T760] RIP: 0033:0x7fde1e19c799 [ 40.114349][ T760] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 40.114362][ T760] RSP: 002b:00007fde1f088028 EFLAGS: 00000246 ORIG_RAX: 0000000000000052 [ 40.114379][ T760] RAX: ffffffffffffffda RBX: 00007fde1e415fa0 RCX: 00007fde1e19c799 [ 40.114390][ T760] RDX: 0000000000000000 RSI: 0000200000000800 RDI: 00002000000001c0 [ 40.114401][ T760] RBP: 00007fde1f088090 R08: 0000000000000000 R09: 0000000000000000 [ 40.114411][ T760] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 40.114420][ T760] R13: 00007fde1e416038 R14: 00007fde1e415fa0 R15: 00007fff43db2008 [ 40.114433][ T760] [ 40.114441][ T760] overlayfs: failed to verify origin (32/file0, ino=215, err=-12) [ 40.374061][ T31] usb 3-1: device descriptor read/64, error -71 [ 40.394129][ T765] SELinux: failed to load policy [ 40.411597][ T36] audit: type=1400 audit(1772372472.610:922): avc: denied { create } for pid=770 comm="syz.3.129" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 40.446478][ T340] usb 1-1: new full-speed USB device number 13 using dummy_hcd [ 40.456463][ T495] usb 2-1: Using ep0 maxpacket: 16 [ 40.464537][ T495] usb 2-1: New USB device found, idVendor=0d49, idProduct=7010, bcdDevice= c.90 [ 40.473693][ T495] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 40.481777][ T495] usb 2-1: Product: syz [ 40.485991][ T495] usb 2-1: Manufacturer: syz [ 40.490697][ T495] usb 2-1: SerialNumber: syz [ 40.496563][ T495] usb 2-1: config 0 descriptor?? [ 40.502883][ T495] ums-onetouch 2-1:0.0: USB Mass Storage device detected [ 40.607790][ T340] usb 1-1: not running at top speed; connect to a high speed hub [ 40.616411][ T340] usb 1-1: config 1 interface 0 altsetting 3 endpoint 0x2 has invalid wMaxPacketSize 0 [ 40.626407][ T340] usb 1-1: config 1 interface 0 has no altsetting 0 [ 40.627118][ T31] usb 3-1: device descriptor read/64, error -71 [ 40.638626][ T340] usb 1-1: New USB device found, idVendor=18d1, idProduct=503d, bcdDevice= 0.40 [ 40.648438][ T340] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 40.656511][ T340] usb 1-1: Product: 앖綒簰㛘许櫢џ䷚ꨞ䱪膱誗ୱ쬍횗ﾸ杂캟৵嶁ᛐ錘瑊萂䪧櫚䱤왵婼礦ⅿ㟂ꚦ쿙昵᳠몓 [ 40.671128][ T340] usb 1-1: Manufacturer: 烷㹎쒳㫍⵪迹ڹ词啹냯掩儢뢙涘昂粙䆐씱쥔議㓾貪老䍭ⵦ롕뜖ꁨ博鑍錨㸷䬾뻋뵹怯齝윏誂⑜焾ᷪ䍙郊雷Ⲓ‭齐땼渧챕ࣜ㛊對칗ꤙ⦂쐖費ݸ缻࿖ਥ粶㟭貟茯汚 [ 40.693865][ T340] usb 1-1: SerialNumber: ࡃ [ 40.703382][ T67] usb 2-1: USB disconnect, device number 10 [ 40.746615][ T31] usb usb3-port1: attempt power cycle [ 40.766509][ T495] usb 4-1: new high-speed USB device number 10 using dummy_hcd [ 40.915423][ T340] usbhid 1-1:1.0: can't add hid device: -71 [ 40.921463][ T340] usbhid 1-1:1.0: probe with driver usbhid failed with error -71 [ 40.926650][ T495] usb 4-1: Using ep0 maxpacket: 16 [ 40.935379][ T340] usb 1-1: USB disconnect, device number 13 [ 40.936092][ T495] usb 4-1: config 1 has an invalid interface number: 105 but max is 0 [ 40.950977][ T495] usb 4-1: config 1 has no interface number 0 [ 40.957198][ T495] usb 4-1: config 1 interface 105 altsetting 2 bulk endpoint 0x4 has invalid maxpacket 16 [ 40.973766][ T495] usb 4-1: config 1 interface 105 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 64 [ 40.983935][ T495] usb 4-1: config 1 interface 105 has no altsetting 0 [ 40.992148][ T495] usb 4-1: New USB device found, idVendor=20f4, idProduct=e05a, bcdDevice=6c.6d [ 41.001433][ T495] usb 4-1: New USB device strings: Mfr=1, Product=23, SerialNumber=3 [ 41.009595][ T495] usb 4-1: Product: syz [ 41.013850][ T495] usb 4-1: Manufacturer: syz [ 41.018563][ T495] usb 4-1: SerialNumber: syz [ 41.027435][ T778] raw-gadget.3 gadget.3: fail, usb_ep_enable returned -22 [ 41.034686][ T778] raw-gadget.3 gadget.3: fail, usb_ep_enable returned -22 [ 41.073503][ T36] audit: type=1400 audit(1772372473.270:923): avc: denied { write } for pid=783 comm="syz.0.132" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=key permissive=1 [ 41.092626][ T31] usb 3-1: new high-speed USB device number 9 using dummy_hcd [ 41.110217][ T786] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 41.119361][ T786] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 41.128264][ T31] usb 3-1: device descriptor read/8, error -71 [ 41.224942][ T36] audit: type=1326 audit(1772372473.420:924): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=788 comm="syz.1.134" exe="/root/syz-executor" sig=9 arch=c000003e syscall=157 compat=0 ip=0x7fda4b59c799 code=0x0 [ 41.267476][ T31] usb 3-1: device descriptor read/8, error -71 [ 41.346521][ T340] usb 1-1: new high-speed USB device number 14 using dummy_hcd [ 41.448600][ T778] raw-gadget.3 gadget.3: fail, usb_ep_enable returned -22 [ 41.455866][ T778] raw-gadget.3 gadget.3: fail, usb_ep_enable returned -22 [ 41.496424][ T340] usb 1-1: Using ep0 maxpacket: 32 [ 41.502812][ T340] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 41.506601][ T31] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 41.513909][ T340] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 41.531312][ T340] usb 1-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 41.538276][ T31] usb 3-1: device descriptor read/8, error -71 [ 41.540453][ T340] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 41.555670][ T340] usb 1-1: config 0 descriptor?? [ 41.563718][ T340] hub 1-1:0.0: USB hub found [ 41.677473][ T31] usb 3-1: device descriptor read/8, error -71 [ 41.761589][ T340] hub 1-1:0.0: 6 ports detected [ 41.766840][ T340] hub 1-1:0.0: insufficient power available to use all downstream ports [ 41.786545][ T31] usb usb3-port1: unable to enumerate USB device [ 41.963610][ T36] audit: type=1400 audit(1772372474.160:925): avc: denied { read } for pid=785 comm="syz.0.133" name="loop-control" dev="devtmpfs" ino=48 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:loop_control_device_t tclass=chr_file permissive=1 [ 41.987870][ T36] audit: type=1400 audit(1772372474.160:926): avc: denied { open } for pid=785 comm="syz.0.133" path="/dev/loop-control" dev="devtmpfs" ino=48 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:loop_control_device_t tclass=chr_file permissive=1 [ 42.012430][ T36] audit: type=1400 audit(1772372474.160:927): avc: denied { ioctl } for pid=785 comm="syz.0.133" path="/dev/loop-control" dev="devtmpfs" ino=48 ioctlcmd=0x4c81 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:loop_control_device_t tclass=chr_file permissive=1 [ 42.093846][ T340] hub 1-1:0.0: hub_hub_status failed (err = -71) [ 42.100974][ T340] hub 1-1:0.0: config failed, can't get hub status (err -71) [ 42.111313][ T340] usbhid 1-1:0.0: can't add hid device: -71 [ 42.126409][ T36] audit: type=1400 audit(1772372474.320:928): avc: denied { mounton } for pid=796 comm="syz.0.136" path="/proc/112/task" dev="proc" ino=6829 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=dir permissive=1 [ 42.134268][ T340] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 42.163078][ T36] audit: type=1400 audit(1772372474.360:929): avc: denied { create } for pid=777 comm="syz.3.130" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_crypto_socket permissive=1 [ 42.184812][ T340] usb 1-1: USB disconnect, device number 14 [ 42.309626][ T36] audit: type=1400 audit(1772372474.510:930): avc: denied { accept } for pid=805 comm="syz.2.140" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=unix_dgram_socket permissive=1 [ 42.336543][ T369] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 42.486437][ T369] usb 2-1: Using ep0 maxpacket: 32 [ 42.493200][ T369] usb 2-1: unable to get BOS descriptor or descriptor too short [ 42.501857][ T369] usb 2-1: config 1 has an invalid interface number: 255 but max is 2 [ 42.510956][ T369] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 42.521452][ T369] usb 2-1: config 1 has no interface number 2 [ 42.527839][ T369] usb 2-1: config 1 interface 255 has no altsetting 0 [ 42.534787][ T369] usb 2-1: config 1 interface 1 has no altsetting 0 [ 42.543387][ T369] usb 2-1: New USB device found, idVendor=0582, idProduct=0009, bcdDevice= 0.40 [ 42.552850][ T369] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 42.561065][ T369] usb 2-1: Product: syz [ 42.565484][ T369] usb 2-1: Manufacturer: syz [ 42.570386][ T369] usb 2-1: SerialNumber: syz [ 42.784392][ T369] usb 2-1: USB disconnect, device number 11 [ 42.838925][ T495] aqc111 4-1:1.105 (unnamed net_device) (uninitialized): Failed to read(0x1) reg index 0x0001: -71 [ 42.866420][ T495] aqc111 4-1:1.105 (unnamed net_device) (uninitialized): Failed to read(0x1) reg index 0x0001: -71 [ 42.888496][ T495] aqc111 4-1:1.105 eth1: register 'aqc111' at usb-dummy_hcd.3-1, USB-C 3.1 to 5GBASE-T Ethernet Adapter, f8:29:70:c6:36:f5 [ 42.918970][ T495] usb 4-1: USB disconnect, device number 10 [ 42.925497][ T495] aqc111 4-1:1.105 eth1: unregister 'aqc111' usb-dummy_hcd.3-1, USB-C 3.1 to 5GBASE-T Ethernet Adapter [ 42.988050][ T495] aqc111 4-1:1.105 eth1 (unregistered): Failed to write(0x1) reg index 0x0002: -19 [ 42.997606][ T495] aqc111 4-1:1.105 eth1 (unregistered): Failed to write(0x1) reg index 0x0002: -19 [ 43.013151][ T495] aqc111 4-1:1.105 eth1 (unregistered): Failed to write(0x61) reg index 0x0000: -19 [ 43.096573][ T846] capability: warning: `syz.3.147' uses deprecated v2 capabilities in a way that may be insecure [ 43.376424][ T67] usb 1-1: new high-speed USB device number 15 using dummy_hcd [ 43.422775][ T866] sit0: entered promiscuous mode [ 43.428945][ T866] netlink: 'syz.1.150': attribute type 1 has an invalid length. [ 43.436711][ T866] netlink: 1 bytes leftover after parsing attributes in process `syz.1.150'. [ 43.447528][ T866] syzkaller0: entered promiscuous mode [ 43.453009][ T866] syzkaller0: entered allmulticast mode [ 43.526489][ T67] usb 1-1: Using ep0 maxpacket: 32 [ 43.536607][ T67] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 43.554083][ T67] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 43.564067][ T67] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 43.577119][ T67] usb 1-1: New USB device found, idVendor=0458, idProduct=5011, bcdDevice= 0.00 [ 43.586194][ T67] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 43.598457][ T67] usb 1-1: config 0 descriptor?? [ 43.609812][ T877] netlink: 8 bytes leftover after parsing attributes in process `syz.1.154'. [ 43.787676][ T886] netlink: 16 bytes leftover after parsing attributes in process `syz.3.156'. [ 44.096419][ T31] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 44.246396][ T31] usb 4-1: Using ep0 maxpacket: 16 [ 44.252701][ T31] usb 4-1: config 0 has an invalid interface number: 34 but max is 0 [ 44.261244][ T852] IPv6: NLM_F_CREATE should be specified when creating new route [ 44.261623][ T31] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 44.279276][ T31] usb 4-1: config 0 has no interface number 0 [ 44.285538][ T31] usb 4-1: config 0 interface 34 altsetting 0 endpoint 0xA has invalid wMaxPacketSize 0 [ 44.295522][ T31] usb 4-1: config 0 interface 34 altsetting 0 bulk endpoint 0xA has invalid maxpacket 0 [ 44.305445][ T67] usbhid 1-1:0.0: can't add hid device: -71 [ 44.311438][ T31] usb 4-1: config 0 interface 34 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 44.324422][ T67] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 44.333314][ T67] usb 1-1: USB disconnect, device number 15 [ 44.343539][ T31] usb 4-1: New USB device found, idVendor=0b95, idProduct=772a, bcdDevice=82.73 [ 44.352893][ T31] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 44.361159][ T31] usb 4-1: Product: syz [ 44.365368][ T31] usb 4-1: Manufacturer: syz [ 44.370023][ T31] usb 4-1: SerialNumber: syz [ 44.375502][ T31] usb 4-1: config 0 descriptor?? [ 44.381351][ T31] asix 4-1:0.34: probe with driver asix failed with error -22 [ 44.456435][ T354] usb 2-1: new high-speed USB device number 12 using dummy_hcd [ 44.576480][ T369] usb 3-1: new high-speed USB device number 11 using dummy_hcd [ 44.586523][ T354] usb 2-1: device descriptor read/64, error -71 [ 44.726440][ T369] usb 3-1: Using ep0 maxpacket: 16 [ 44.732867][ T369] usb 3-1: config 1 has an invalid interface number: 105 but max is 0 [ 44.741314][ T369] usb 3-1: config 1 has no interface number 0 [ 44.747481][ T369] usb 3-1: config 1 interface 105 altsetting 2 bulk endpoint 0x4 has invalid maxpacket 16 [ 44.757421][ T369] usb 3-1: config 1 interface 105 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 64 [ 44.767586][ T369] usb 3-1: config 1 interface 105 has no altsetting 0 [ 44.776125][ T369] usb 3-1: New USB device found, idVendor=20f4, idProduct=e05a, bcdDevice=6c.6d [ 44.785341][ T369] usb 3-1: New USB device strings: Mfr=1, Product=23, SerialNumber=3 [ 44.793492][ T369] usb 3-1: Product: syz [ 44.797793][ T369] usb 3-1: Manufacturer: syz [ 44.802478][ T369] usb 3-1: SerialNumber: syz [ 44.812118][ T905] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 44.819640][ T905] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 44.826526][ T354] usb 2-1: device descriptor read/64, error -71 [ 44.942723][ T912] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 44.962396][ T912] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 45.086432][ T354] usb 2-1: new high-speed USB device number 13 using dummy_hcd [ 45.164093][ T369] aqc111 3-1:1.105: probe with driver aqc111 failed with error -71 [ 45.176860][ T369] usb 3-1: USB disconnect, device number 11 [ 45.199017][ T579] veth1_macvtap: left promiscuous mode [ 45.204675][ T579] veth0_vlan: left promiscuous mode [ 45.216393][ T354] usb 2-1: device descriptor read/64, error -71 [ 45.259697][ T36] kauditd_printk_skb: 27 callbacks suppressed [ 45.259715][ T36] audit: type=1400 audit(1772372477.460:958): avc: denied { mounton } for pid=915 comm="syz-executor" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 45.335618][ T915] bridge0: port 1(bridge_slave_0) entered blocking state [ 45.342792][ T915] bridge0: port 1(bridge_slave_0) entered disabled state [ 45.350321][ T915] bridge_slave_0: entered allmulticast mode [ 45.356949][ T915] bridge_slave_0: entered promiscuous mode [ 45.363420][ T915] bridge0: port 2(bridge_slave_1) entered blocking state [ 45.370741][ T915] bridge0: port 2(bridge_slave_1) entered disabled state [ 45.377946][ T915] bridge_slave_1: entered allmulticast mode [ 45.384297][ T915] bridge_slave_1: entered promiscuous mode [ 45.434977][ T915] bridge0: port 2(bridge_slave_1) entered blocking state [ 45.442069][ T915] bridge0: port 2(bridge_slave_1) entered forwarding state [ 45.449921][ T915] bridge0: port 1(bridge_slave_0) entered blocking state [ 45.457027][ T915] bridge0: port 1(bridge_slave_0) entered forwarding state [ 45.480333][ T577] bridge0: port 1(bridge_slave_0) entered disabled state [ 45.488485][ T577] bridge0: port 2(bridge_slave_1) entered disabled state [ 45.496422][ T354] usb 2-1: device descriptor read/64, error -71 [ 45.503855][ T579] ------------[ cut here ]------------ [ 45.508097][ T578] bridge0: port 1(bridge_slave_0) entered blocking state [ 45.509608][ T579] WARNING: CPU: 0 PID: 579 at net/ipv6/xfrm6_tunnel.c:341 xfrm6_tunnel_net_exit+0xc4/0x140 [ 45.516417][ T578] bridge0: port 1(bridge_slave_0) entered forwarding state SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 45.533766][ T579] Modules linked in: [ 45.537752][ T579] CPU: 0 UID: 0 PID: 579 Comm: kworker/u8:32 Not tainted syzkaller #0 c4f231820317ff22bb61fe038e0df9024df7047c [ 45.549651][ T579] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 45.556454][ T36] audit: type=1400 audit(1772372477.750:959): avc: denied { write } for pid=283 comm="syz-executor" path="pipe:[608]" dev="pipefs" ino=608 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 45.559866][ T579] Workqueue: netns cleanup_net [ 45.587474][ T579] RIP: 0010:xfrm6_tunnel_net_exit+0xc4/0x140 [ 45.593502][ T579] Code: e8 e1 99 db fc 4b 83 3c 3e 00 75 19 e8 b5 b7 83 fc 49 81 ff f8 07 00 00 74 1b e8 a7 b7 83 fc 49 83 c7 08 eb c9 e8 9c b7 83 fc <0f> 0b 49 81 ff f8 07 00 00 75 e5 49 8d 9e 00 08 00 00 45 31 ff 4a [ 45.613821][ T579] RSP: 0018:ffffc9000e697b90 EFLAGS: 00010293 [ 45.620005][ T579] RAX: ffffffff8503e7c4 RBX: ffff88812d3111c0 RCX: ffff88811abe0000 [ 45.628073][ T579] RDX: 0000000000000000 RSI: 0000000000400000 RDI: ffff8881043246a0 [ 45.636085][ T579] RBP: ffffc9000e697bb0 R08: ffffffff87d35907 R09: 1ffffffff0fa6b20 [ 45.644148][ T579] R10: dffffc0000000000 R11: fffffbfff0fa6b21 R12: dffffc0000000000 [ 45.652187][ T579] R13: dffffc0000000000 R14: ffff888104324000 R15: 00000000000006a0 [ 45.660296][ T579] FS: 0000000000000000(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 45.669319][ T579] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 45.675956][ T579] CR2: 00007fcf871e5300 CR3: 0000000102b56000 CR4: 00000000003526b0 [ 45.683987][ T579] Call Trace: [ 45.687311][ T579] [ 45.690270][ T579] cleanup_net+0x6bd/0xc90 [ 45.694732][ T579] ? __cfi_cleanup_net+0x10/0x10 [ 45.699805][ T579] ? __schedule+0x1357/0x1ea0 [ 45.704555][ T579] ? kick_pool+0xb9/0x550 [ 45.708954][ T579] process_scheduled_works+0x7d4/0x1020 [ 45.714545][ T579] worker_thread+0xc70/0x10b0 [ 45.719300][ T579] kthread+0x2c9/0x370 [ 45.723430][ T579] ? __cfi_worker_thread+0x10/0x10 [ 45.728650][ T579] ? __cfi_kthread+0x10/0x10 [ 45.733363][ T579] ret_from_fork+0x64/0xa0 [ 45.737844][ T579] ? __cfi_kthread+0x10/0x10 [ 45.742470][ T579] ret_from_fork_asm+0x1a/0x30 [ 45.747415][ T579] [ 45.750467][ T579] ---[ end trace 0000000000000000 ]--- [ 45.759450][ T578] bridge0: port 2(bridge_slave_1) entered blocking state [ 45.766550][ T578] bridge0: port 2(bridge_slave_1) entered forwarding state [ 45.768356][ T354] usb usb2-port1: attempt power cycle [ 45.828166][ T579] ------------[ cut here ]------------ [ 45.833678][ T579] WARNING: CPU: 0 PID: 579 at net/ipv6/xfrm6_tunnel.c:344 xfrm6_tunnel_net_exit+0x119/0x140 [ 45.843838][ T579] Modules linked in: [ 45.847808][ T579] CPU: 0 UID: 0 PID: 579 Comm: kworker/u8:32 Tainted: G W syzkaller #0 c4f231820317ff22bb61fe038e0df9024df7047c [ 45.861117][ T579] Tainted: [W]=WARN [ 45.864963][ T579] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 45.875086][ T579] Workqueue: netns cleanup_net [ 45.879926][ T579] RIP: 0010:xfrm6_tunnel_net_exit+0x119/0x140 [ 45.886044][ T579] Code: fc 4b 83 bc 3e 00 08 00 00 00 75 19 e8 60 b7 83 fc 49 81 ff f8 07 00 00 74 1b e8 52 b7 83 fc 49 83 c7 08 eb c5 e8 47 b7 83 fc <0f> 0b 49 81 ff f8 07 00 00 75 e5 e8 37 b7 83 fc 5b 41 5c 41 5e 41 [ 45.905705][ T579] RSP: 0018:ffffc9000e697b90 EFLAGS: 00010293 [ 45.911921][ T579] RAX: ffffffff8503e819 RBX: ffff888104324800 RCX: ffff88811abe0000 [ 45.919962][ T579] RDX: 0000000000000000 RSI: 0000000000400000 RDI: ffff888104324810 [ 45.927987][ T579] RBP: ffffc9000e697bb0 R08: ffffffff87d35907 R09: 1ffffffff0fa6b20 [ 45.935989][ T579] R10: dffffc0000000000 R11: fffffbfff0fa6b21 R12: dffffc0000000000 [ 45.944069][ T579] R13: dffffc0000000000 R14: ffff888104324000 R15: 0000000000000010 [ 45.952105][ T579] FS: 0000000000000000(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 45.961098][ T579] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 45.967757][ T579] CR2: 00007fcf871e5300 CR3: 000000011452c000 CR4: 00000000003526b0 [ 45.975775][ T579] Call Trace: [ 45.979108][ T579] [ 45.982068][ T579] cleanup_net+0x6bd/0xc90 [ 45.986585][ T579] ? __cfi_cleanup_net+0x10/0x10 [ 45.991557][ T579] ? __schedule+0x1357/0x1ea0 [ 45.996270][ T579] ? kick_pool+0xb9/0x550 [ 46.000650][ T579] process_scheduled_works+0x7d4/0x1020 [ 46.006244][ T579] worker_thread+0xc70/0x10b0 [ 46.011005][ T579] kthread+0x2c9/0x370 [ 46.015104][ T579] ? __cfi_worker_thread+0x10/0x10 [ 46.020292][ T579] ? __cfi_kthread+0x10/0x10 [ 46.024915][ T579] ret_from_fork+0x64/0xa0 [ 46.029401][ T579] ? __cfi_kthread+0x10/0x10 [ 46.034024][ T579] ret_from_fork_asm+0x1a/0x30 [ 46.038873][ T579] [ 46.041913][ T579] ---[ end trace 0000000000000000 ]--- [ 46.096413][ T579] ------------[ cut here ]------------ [ 46.101920][ T579] WARNING: CPU: 0 PID: 579 at net/xfrm/xfrm_state.c:3216 xfrm_state_fini+0x2be/0x310 [ 46.111482][ T579] Modules linked in: [ 46.115422][ T579] CPU: 0 UID: 0 PID: 579 Comm: kworker/u8:32 Tainted: G W syzkaller #0 c4f231820317ff22bb61fe038e0df9024df7047c [ 46.128754][ T579] Tainted: [W]=WARN [ 46.132577][ T579] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 46.142708][ T579] Workqueue: netns cleanup_net [ 46.147606][ T579] RIP: 0010:xfrm_state_fini+0x2be/0x310 [ 46.153159][ T579] Code: 3c 20 00 74 08 48 89 df e8 8f 63 f6 fc 48 8b 3b e8 27 9e e1 fc 5b 41 5c 41 5d 41 5e 41 5f 5d e9 18 c3 b7 00 cc e8 52 81 9e fc <0f> 0b e9 b0 fd ff ff e8 46 81 9e fc 0f 0b e9 18 fe ff ff e8 3a 81 [ 46.172864][ T579] RSP: 0018:ffffc9000e697b70 EFLAGS: 00010293 [ 46.179044][ T579] RAX: ffffffff84e91e0e RBX: ffff88812d3111c0 RCX: ffff88811abe0000 [ 46.187088][ T579] RDX: 0000000000000000 RSI: 0000000000400000 RDI: ffff88811abe0000 [ 46.195086][ T579] RBP: ffffc9000e697b98 R08: ffffffff87d35907 R09: 1ffffffff0fa6b20 [ 46.203142][ T579] R10: dffffc0000000000 R11: fffffbfff0fa6b21 R12: 1ffffffff0fa6870 [ 46.211195][ T579] R13: dffffc0000000000 R14: ffff88812d311dc0 R15: dffffc0000000000 [ 46.219242][ T579] FS: 0000000000000000(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 46.228255][ T579] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 46.234858][ T579] CR2: 00007fcf871e5300 CR3: 000000011452c000 CR4: 00000000003526b0 [ 46.242893][ T579] Call Trace: [ 46.246192][ T579] [ 46.249173][ T579] xfrm_net_exit+0x31/0x80 [ 46.253635][ T579] cleanup_net+0x6bd/0xc90 [ 46.258127][ T579] ? __cfi_cleanup_net+0x10/0x10 [ 46.263134][ T579] ? __schedule+0x1357/0x1ea0 [ 46.267891][ T579] ? kick_pool+0xb9/0x550 [ 46.272246][ T579] process_scheduled_works+0x7d4/0x1020 [ 46.277863][ T579] worker_thread+0xc70/0x10b0 [ 46.282611][ T579] kthread+0x2c9/0x370 [ 46.286734][ T579] ? __cfi_worker_thread+0x10/0x10 [ 46.291890][ T579] ? __cfi_kthread+0x10/0x10 [ 46.296547][ T579] ret_from_fork+0x64/0xa0 [ 46.300998][ T579] ? __cfi_kthread+0x10/0x10 [ 46.305591][ T579] ret_from_fork_asm+0x1a/0x30 [ 46.310439][ T579] [ 46.313505][ T579] ---[ end trace 0000000000000000 ]--- [ 46.347527][ T31] usb 4-1: USB disconnect, device number 11 [ 46.431572][ T579] bridge_slave_1: left allmulticast mode [ 46.437366][ T579] bridge_slave_1: left promiscuous mode [ 46.443107][ T579] bridge0: port 2(bridge_slave_1) entered disabled state [ 46.456670][ T579] bridge_slave_0: left allmulticast mode [ 46.462354][ T579] bridge_slave_0: left promiscuous mode [ 46.476445][ T579] bridge0: port 1(bridge_slave_0) entered disabled state [ 46.698982][ T579] veth1_macvtap: left promiscuous mode [ 46.704505][ T579] veth0_vlan: left promiscuous mode [ 47.019306][ T579] bridge_slave_1: left allmulticast mode [ 47.024972][ T579] bridge_slave_1: left promiscuous mode [ 47.030768][ T579] +$<: port 2(bridge_slave_1) entered disabled state [ 47.038270][ T579] bridge_slave_0: left allmulticast mode [ 47.043904][ T579] bridge_slave_0: left promiscuous mode [ 47.049674][ T579] +$<: port 1(bridge_slave_0) entered disabled state [ 47.057399][ T579] bridge_slave_1: left allmulticast mode [ 47.063051][ T579] bridge_slave_1: left promiscuous mode [ 47.068769][ T579] bridge0: port 2(bridge_slave_1) entered disabled state [ 47.076304][ T579] bridge_slave_0: left allmulticast mode [ 47.082157][ T579] bridge_slave_0: left promiscuous mode [ 47.087868][ T579] bridge0: port 1(bridge_slave_0) entered disabled state [ 47.095501][ T579] bridge_slave_1: left allmulticast mode [ 47.101278][ T579] bridge_slave_1: left promiscuous mode [ 47.107092][ T579] bridge0: port 2(bridge_slave_1) entered disabled state [ 47.114561][ T579] bridge_slave_0: left allmulticast mode [ 47.120340][ T579] bridge_slave_0: left promiscuous mode [ 47.125963][ T579] bridge0: port 1(bridge_slave_0) entered disabled state [ 47.391980][ T579] veth1_macvtap: left promiscuous mode [ 47.397643][ T579] veth0_vlan: left promiscuous mode [ 47.403214][ T579] veth1_macvtap: left promiscuous mode [ 47.888510][ T579] ------------[ cut here ]------------ [ 47.894000][ T579] WARNING: CPU: 1 PID: 579 at net/xfrm/xfrm_state.c:3216 xfrm_state_fini+0x2be/0x310 [ 47.903563][ T579] Modules linked in: [ 47.907540][ T579] CPU: 1 UID: 0 PID: 579 Comm: kworker/u8:32 Tainted: G W syzkaller #0 c4f231820317ff22bb61fe038e0df9024df7047c [ 47.920825][ T579] Tainted: [W]=WARN [ 47.924815][ T579] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 47.934939][ T579] Workqueue: netns cleanup_net [ 47.939778][ T579] RIP: 0010:xfrm_state_fini+0x2be/0x310 [ 47.945341][ T579] Code: 3c 20 00 74 08 48 89 df e8 8f 63 f6 fc 48 8b 3b e8 27 9e e1 fc 5b 41 5c 41 5d 41 5e 41 5f 5d e9 18 c3 b7 00 cc e8 52 81 9e fc <0f> 0b e9 b0 fd ff ff e8 46 81 9e fc 0f 0b e9 18 fe ff ff e8 3a 81 [ 47.965133][ T579] RSP: 0018:ffffc9000e697b70 EFLAGS: 00010293 [ 47.971303][ T579] RAX: ffffffff84e91e0e RBX: ffff8881213e2380 RCX: ffff88811abe0000 [ 47.979340][ T579] RDX: 0000000000000000 RSI: 0000000000c00000 RDI: ffff88811abe0000 [ 47.987378][ T579] RBP: ffffc9000e697b98 R08: ffffffff87d35907 R09: 1ffffffff0fa6b20 [ 47.995378][ T579] R10: dffffc0000000000 R11: fffffbfff0fa6b21 R12: 1ffffffff0fa6870 [ 48.003428][ T579] R13: dffffc0000000000 R14: ffff8881213e2f80 R15: dffffc0000000000 [ 48.011672][ T579] FS: 0000000000000000(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 48.020800][ T579] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 48.027467][ T579] CR2: 000056053ece5af8 CR3: 000000010c74c000 CR4: 00000000003526b0 [ 48.035458][ T579] Call Trace: [ 48.038804][ T579] [ 48.041752][ T579] xfrm_net_exit+0x31/0x80 [ 48.046180][ T579] cleanup_net+0x6bd/0xc90 [ 48.050696][ T579] ? __cfi_cleanup_net+0x10/0x10 [ 48.055686][ T579] ? kick_pool+0xb9/0x550 [ 48.060097][ T579] process_scheduled_works+0x7d4/0x1020 [ 48.065699][ T579] worker_thread+0xc70/0x10b0 [ 48.070486][ T579] kthread+0x2c9/0x370 [ 48.074590][ T579] ? __cfi_worker_thread+0x10/0x10 [ 48.079830][ T579] ? __cfi_kthread+0x10/0x10 [ 48.084449][ T579] ret_from_fork+0x64/0xa0 [ 48.088991][ T579] ? __cfi_kthread+0x10/0x10 [ 48.093616][ T579] ret_from_fork_asm+0x1a/0x30 [ 48.098463][ T579] [ 48.101505][ T579] ---[ end trace 0000000000000000 ]---