last executing test programs: 58.138338852s ago: executing program 0 (id=305): ioprio_set$pid(0x2, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) ioprio_get$pid(0x2, 0x0) mount$incfs(&(0x7f0000000440)='./file0\x00', &(0x7f0000000140)='./file0\x00', &(0x7f0000000200), 0x80, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000240)="bf"}) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0xc2c02e4d8eb2a416, 0x4) r1 = openat$incfs(r0, &(0x7f0000000280)='.pending_reads\x00', 0x1, 0x130) ioctl$TIOCL_GETKMSGREDIRECT(r1, 0xc058671e, &(0x7f00000000c0)) 58.069604823s ago: executing program 0 (id=308): mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f0000000100)='ext4\x00', 0x8410, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x6612, 0x0) 58.064556233s ago: executing program 0 (id=311): mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt\x00', 0x1ff) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f0000000100)='ext4\x00', 0x8410, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x41009432, 0x0) 58.009694495s ago: executing program 0 (id=314): ioprio_set$pid(0x2, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x1c0) mount$incfs(&(0x7f0000000440)='./file0\x00', &(0x7f0000000140)='./file0\x00', &(0x7f0000000200), 0x80, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000240)="bf"}) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0xc2c02e4d8eb2a416, 0x4) r1 = openat$incfs(r0, &(0x7f0000000280)='.pending_reads\x00', 0x1, 0x130) ioctl$TIOCL_GETKMSGREDIRECT(r1, 0xc058671e, &(0x7f00000000c0)) (fail_nth: 35) 57.654265663s ago: executing program 0 (id=320): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./trace\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./trace\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) mkdir(&(0x7f0000000400)='./my_sys\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./my_sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./my_sys/bus/pci/devices/0000:00:01.0/config\x00', 0x2, 0x0) write$binfmt_script(r0, &(0x7f0000000080)={'#! ', './my_sys/bus/pci/devices/0000:00:01.0/config', [], 0xa, "e24c8a6d2d"}, 0x35) sendfile(r0, r0, 0x0, 0x6) sendmsg$TIPC_CMD_SHOW_PORTS(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x1, 0x70bd28, 0x25dfdbfc}, 0x1c}, 0x1, 0x0, 0x0, 0x2}, 0x24048800) r1 = socket(0x10, 0x3, 0x0) mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0x3, 0x20132, 0xffffffffffffffff, 0xb2993000) bind$netlink(0xffffffffffffffff, &(0x7f0000000080)={0x10, 0x0, 0x0, 0xfffffffffffffffd}, 0xc) munmap(&(0x7f0000001000/0x3000)=nil, 0x3000) r2 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r2) ptrace$poke(0x4, r2, &(0x7f00000011c0), 0xfffffffffffffffe) r3 = socket$nl_audit(0x10, 0x3, 0x9) ioctl$sock_SIOCSPGRP(r3, 0x8902, &(0x7f0000002d00)) ioctl$sock_FIOGETOWN(r3, 0x8903, &(0x7f00000037c0)) sendmsg$netlink(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000002c0)=ANY=[@ANYBLOB="1c0000001a0001002abd700000ffffff81"], 0x78}], 0x1, 0x0, 0x0, 0x20400}, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000200)='./trace/set_event\x00', 0x2, 0x1) r4 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r4, 0x10e, 0xc, &(0x7f0000000080)=0x4, 0x4) sendmsg$netlink(r4, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000240)=ANY=[@ANYBLOB="240000060000000000d0403a2d7d2d2b2900"/36], 0x24}], 0x1}, 0x0) r5 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) connect$inet6(r5, &(0x7f0000000100)={0xa, 0xfffe, 0x4, @mcast2={0xff, 0x3}}, 0x1c) setsockopt$inet6_IPV6_HOPOPTS(r5, 0x29, 0x36, &(0x7f0000000340)=ANY=[], 0x8) connect$inet6(r5, &(0x7f0000000040)={0xa, 0x4e23, 0xfffffff0, @mcast2}, 0x1c) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='pids.current\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000040), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r6, 0x0) 57.190657754s ago: executing program 0 (id=323): mmap$IORING_OFF_SQ_RING(0x0, 0x8000006, 0x3000005, 0x401d031, 0xffffffffffffffff, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt\x00', 0x1ff) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f0000000100)='ext4\x00', 0x8410, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x41009432, 0x0) 42.034079813s ago: executing program 32 (id=323): mmap$IORING_OFF_SQ_RING(0x0, 0x8000006, 0x3000005, 0x401d031, 0xffffffffffffffff, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt\x00', 0x1ff) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f0000000100)='ext4\x00', 0x8410, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x41009432, 0x0) 34.013949554s ago: executing program 4 (id=499): mmap$IORING_OFF_SQ_RING(0x0, 0x8000006, 0x3000005, 0x401d031, 0xffffffffffffffff, 0x0) r0 = openat$zero(0xffffffffffffff9c, 0x0, 0x80c42, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x40000, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000640)={0x0, 0x0, &(0x7f00000005c0)=[{}], 0x1, 0x0, 0x0, 0x11000000}, 0x0) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB='6@'], 0xfe33) r1 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r1) sendmsg$key(0xffffffffffffffff, &(0x7f00000001c0)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="0202"], 0x80}}, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) add_key$user(&(0x7f0000000080), &(0x7f0000000100)={'syz', 0x3}, 0x0, 0x0, 0x0) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000540)) ptrace$cont(0x20, r1, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @tid=r1}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000000040)={0x0, 0x0, 0x8000, 0x3ff}) r2 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x20000000, 0x0) r3 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r3) ptrace(0x4207, r3) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x77359400}}, 0x0) ioctl$VHOST_SET_OWNER(r0, 0xaf01, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x100001d, 0x200000005c831, 0xffffffffffffffff, 0x0) mkdirat(r0, &(0x7f0000001500)='./dev\x00', 0x0) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt\x00', 0x1ff) syz_usb_connect(0x2, 0xb3, &(0x7f0000000200)=ANY=[], &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0}) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f0000000100)='ext4\x00', 0x8410, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) 33.101125295s ago: executing program 4 (id=506): mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt\x00', 0x1ff) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f0000000100)='ext4\x00', 0x8410, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x6611, 0x0) (fail_nth: 1) 32.741205834s ago: executing program 4 (id=509): r0 = fsopen(&(0x7f0000000000)='debugfs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000240)='uid', &(0x7f0000000040)='0\x00#\x00\xd0\x00 \x00\x00qS\x00\x00\x00\x00\x00\x00\x00\x00$\xf6_\xbdI\x1c\xf2\xa9]\xcc\xe0*\xef\x01\x8d\x15\xd2h\x93\xc9\xb57\xc3\xea\\Eb\xf8\xe6,\xdf\xd4\xfae\x84\xcc\xd5\"d\xf0D-\x98\x9f\x81{\xfc$\xc4\xbcF\xf8\xc8\x8d\xcb\xb8\xf2\x1e\xe4\'U\xb3\xb8\xd3\xe6\xd7\x80=\x8a\xeb\n\xb8_\xe8\x96YY\xe3\xc7\xe6\xf28\x19\xa6\x87\xfa\xdb\x1ce\xc1\x03\x86J\xb2fh\x19\xee#\xcc\x0f\xed\xfea\xdc\x88\xcb%bW\xd35\xda=\xac\x1d\xae\x93\xfd\'T6\x94\n\xa4\x9cU\xc4\fA~[\xbf\x8b\x90\xfe\x04\xe7U\xf3h\x81\x14l7u\x95\x96t\\\x0f\xef;\x03\xa4C\xbc(Vc!a\xc1\xe39\xc6b\x905\x1f\x03\x00\x00\x00\x00\x00\x00\xdf9\xaf5\xc8a:z\xe4\xcbag&67\x814\xf6}\xe10v6l\xd6,\x1e\xa0\xcc\xbf\xfdkm\b?o9\x85\x01n%\x7f_\xe1.f>>\xa5\xfb\"\xab\xdb\x06\x12e\x14\x11~\x9a\bR-\x85\xc3\xa9\xe6\xf6R\x11\"\xc3\xc9\xfc\x14s X\xec\xdd\xc2qB\x85\xf0\xd7\x04\xdd<\x9ak\x00\x00\x00\x00\x00\xff\xff\xff\xff\xff\xff\xff\xff\xe7\x8f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xc1R\xda8\x7f}0\xec\xa9)a_\n\xbcf\xe6\xb3\x8b=\xbc\xdb\xb7\xe3\xc2W\xd9\fL\xf5t\xea\x15;\x8d\xad\x93\x11\xe3\x89\xb19k\x8fF\xfc\xd0\xcfz\a#zcv\xb2\x10\x02\xe4\x94:\x88L\xe8A\x88l', 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000001c0), &(0x7f0000000200)=0xc) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) 32.738031324s ago: executing program 4 (id=510): ioprio_set$pid(0x2, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x1c0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000002c0)={0x24, 0x21, 0x1, 0x0, 0x8000, "", [@typed={0xa, 0x0, 0x0, 0x0, @str='\x00\x00\x00\x01\x01b'}, @typed={0x8, 0xe, 0x0, 0x0, @binary="283bb5ad"}]}, 0x24}], 0x1}, 0x0) mount$incfs(&(0x7f0000000440)='./file0\x00', &(0x7f0000000140)='./file0\x00', &(0x7f0000000200), 0x80, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000240)="bf"}) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0xc2c02e4d8eb2a416, 0x4) r2 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r2) ptrace$setregs(0x1a, r2, 0xc, 0x0) capset(&(0x7f0000000040)={0x20080522, r2}, &(0x7f0000000080)={0x5, 0x10000000, 0x6, 0x101, 0x100, 0x10001}) r3 = openat$incfs(r1, &(0x7f0000000280)='.pending_reads\x00', 0x1, 0x130) ioctl$TIOCL_GETKMSGREDIRECT(r3, 0xc058671e, &(0x7f00000000c0)) 32.609975817s ago: executing program 4 (id=512): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x181) r0 = openat$selinux_relabel(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) readv(r0, &(0x7f0000000300)=[{&(0x7f0000000040)=""/39, 0x27}], 0x1) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_SET_SREGS(0xffffffffffffffff, 0x4138ae84, &(0x7f00000001c0)={{0x3000, 0x1, 0x8, 0x8, 0xb, 0xe6, 0x40, 0x0, 0x0, 0x81, 0x5}, {0x5000, 0x3000, 0x3, 0x0, 0x42, 0x5, 0x75, 0x6, 0x36, 0x4, 0x2, 0x87}, {0xb000, 0xeeef0000, 0xe, 0x5, 0x3, 0x7, 0x0, 0x6, 0x4, 0xa4, 0x5, 0x5}, {0x1, 0x26000, 0x9, 0x7, 0x5, 0x42, 0x2, 0xff, 0x8, 0x9, 0xe}, {0xffffffff, 0x3000, 0xf, 0x3, 0x16, 0x4, 0xa7, 0x8, 0x9, 0x9, 0xf7, 0x3}, {0xeeefa000, 0xdddd0000, 0xe, 0xa0, 0xb1, 0x8, 0x1, 0xa0, 0x82, 0x2f, 0x1, 0x7}, {0x3000, 0x3000, 0xf, 0x5, 0x2, 0x5, 0x7, 0x3, 0x9d, 0x81, 0x40, 0x70}, {0x8000000, 0x7000, 0x8, 0x5, 0xcd, 0x7, 0x1, 0x7, 0x2, 0xc, 0xb0, 0x81}, {0xeeee0000, 0x30}, {0xeeee0000, 0x9}, 0x20000019, 0x0, 0x41000, 0x2024, 0xffffffffffffffff, 0x0, 0x100c00, [0x67fffffffffffffc, 0x4, 0x3, 0x8]}) (async) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) (async) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r3, 0x4400ae8f, &(0x7f0000000140)=@x86={0xb5, 0x5, 0x6, 0x0, 0x7fffffff, 0x4, 0xf, 0xc0, 0x40, 0x4, 0x60, 0x6, 0x0, 0x6e8, 0xffffbfc3, 0xf0, 0x4, 0x0, 0x7, '\x00', 0xcb, 0xffffffffffffff59}) (async) ioctl$KVM_SET_IRQCHIP(r2, 0x8208ae63, &(0x7f0000000280)={0x2, 0x0, @ioapic={0xdddd1000, 0xe41, 0x3, 0x10020f5b, 0xc0, [{0x0, 0x9, 0x0, '\x00', 0x3a}, {}, {0x0, 0x0, 0x80}, {0x1, 0x35}, {0x3, 0x3}, {0x0, 0x0, 0x6}, {0x0, 0x5}, {0x2, 0x6}, {0x8}, {0x73, 0x6, 0x2, '\x00', 0x6}, {0x0, 0x0, 0xfe}, {0x4}, {}, {0x0, 0x2, 0x0, '\x00', 0xfe}, {0x7, 0xff, 0x0, '\x00', 0x39}, {0x0, 0x0, 0x0, '\x00', 0x8}, {0x0, 0x0, 0x91, '\x00', 0xdf}, {0x0, 0x0, 0xfa, '\x00', 0x6}, {0x0, 0xfc, 0x0, '\x00', 0xfe}, {0x0, 0x0, 0x3}, {0x6, 0x0, 0x0, '\x00', 0x1}, {0x0, 0x0, 0x7, '\x00', 0xfc}, {0x0, 0x5}, {0x0, 0x0, 0x10}]}}) (async) r4 = inotify_init() inotify_add_watch(r4, &(0x7f0000000040)='.\x00', 0x449) (async) removexattr(&(0x7f0000000080)='./file0\x00', &(0x7f0000000200)=@known='system.posix_acl_default\x00') (async) close(r4) 32.505065599s ago: executing program 4 (id=513): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0xc88765b5e0bfc577, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_usb_connect$uac2(0x2, 0x7b, &(0x7f0000000580)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x20, 0x2a39, 0x3f8c, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x69, 0x3, 0x1, 0x1, 0x70, 0x51, {0x8, 0xb, 0x0, 0x2, 0x1, 0x7, 0x20, 0x9}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0x8, 0x2, 0x9, 0x8}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x40, 0x6, 0x2, 0x8, {0x8, 0x25, 0x1, 0x0, 0x3, 0x4, 0x2}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x650, 0x4, 0x7, 0x2, {0x8, 0x25, 0x1, 0x2, 0xf, 0x6, 0x3}}}}}}}}]}}, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000540)=ANY=[@ANYBLOB="140000001000010000000000000000000700000a74000000060a030400000000000000000a00000a0900010073797a3100000000400004803c0001800a00010071756575650000002c000280060002400fea000006000140000100000600034000010000060002"], 0x9c}, 0x1, 0x0, 0x0, 0x4000850}, 0x20040040) sendmsg$netlink(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000580)=ANY=[@ANYBLOB="3400000013000100000100dffddbdf25070000f61600000008000000", @ANYRES32, @ANYBLOB="14001a8008"], 0x34}], 0x1, 0x0, 0x0, 0x4000}, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000000), r1) (async) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000000), r1) sendmsg$TIPC_NL_NET_SET(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)={0x28, r3, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ADDR={0x8, 0x2, 0x1}, @TIPC_NLA_NET_ID={0x8, 0x1, 0xba6}]}]}, 0x28}}, 0x0) (async) sendmsg$TIPC_NL_NET_SET(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)={0x28, r3, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ADDR={0x8, 0x2, 0x1}, @TIPC_NLA_NET_ID={0x8, 0x1, 0xba6}]}]}, 0x28}}, 0x0) r4 = socket(0x10, 0x3, 0x0) sendmsg$IPCTNL_MSG_EXP_GET(r4, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000540)=ANY=[@ANYBLOB="440000000102e10400000000000000000a000000300001802c00018014000300fe80000000000000fb"], 0x44}, 0x1, 0x0, 0x0, 0x20000014}, 0x4000840) sendmsg$nl_generic(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000540)=ANY=[@ANYBLOB="640000001900010000000000fbdbdf251d01"], 0x64}, 0x1, 0x0, 0x0, 0x5}, 0x0) sendmsg$TIPC_NL_KEY_SET(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)={0x68, r3, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_NODE={0x54, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ID={0x14, 0x3, '1234567890123456'}, @TIPC_NLA_NODE_KEY={0x3c, 0x4, {'gcm(aes)\x00', 0x14, "00112233445566778899aabbccddeeff00112233"}}]}]}, 0x68}}, 0x0) (async) sendmsg$TIPC_NL_KEY_SET(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)={0x68, r3, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_NODE={0x54, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ID={0x14, 0x3, '1234567890123456'}, @TIPC_NLA_NODE_KEY={0x3c, 0x4, {'gcm(aes)\x00', 0x14, "00112233445566778899aabbccddeeff00112233"}}]}]}, 0x68}}, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_STATS(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, 0x5, 0x1, 0x801, 0x0, 0x0, {0x2, 0x0, 0x5}}, 0x14}, 0x1, 0x0, 0x0, 0x20000000}, 0x8000) (async) sendmsg$IPCTNL_MSG_CT_GET_STATS(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, 0x5, 0x1, 0x801, 0x0, 0x0, {0x2, 0x0, 0x5}}, 0x14}, 0x1, 0x0, 0x0, 0x20000000}, 0x8000) write(0xffffffffffffffff, &(0x7f0000000100)="1c0000001800077bab092500090007000a07000000000006000036", 0x1b) r6 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r6, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={0x1c, 0x1e, 0x21, 0x70bd2b, 0x0, {0xa}, [@typed={0x5, 0x0, 0x0, 0x0, @str='\x00'}]}, 0x1c}}, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async) r7 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) (async) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r8, 0x4008ae89, &(0x7f0000000080)={0x1, 0x0, [{0xc001102c, 0x0, 0x9}]}) syz_usb_connect$uac1(0x2, 0xffffffffffffffef, &(0x7f0000000000)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x20, 0xb05, 0x1743, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x88, 0x3, 0x1, 0x9, 0x40, 0x3f, "", {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0xd2, 0xa}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@as_header={0x7, 0x24, 0x1, 0x8, 0x8, 0x5}, @format_type_ii_discrete={0xf, 0x24, 0x2, 0x2, 0x200, 0xfff, 0x0, "f441a4440fb2"}]}, {{0x9, 0x5, 0x1, 0x9, 0x3ff, 0x78, 0x8, 0xba, {0x7, 0x25, 0x1, 0x8, 0x4, 0x3}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_i_discrete={0xb, 0x24, 0x2, 0x1, 0xfc, 0x3, 0x8, 0x1, "371fc8"}, @as_header={0x7, 0x24, 0x1, 0x8, 0x5, 0x1002}]}, {{0x9, 0x5, 0x82, 0x9, 0x20, 0x3, 0x2, 0x1, {0x7, 0x25, 0x1, 0x0, 0xe, 0x3}}}}}}}}]}}, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0}) (async) syz_usb_connect$uac1(0x2, 0xffffffffffffffef, &(0x7f0000000000)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x20, 0xb05, 0x1743, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x88, 0x3, 0x1, 0x9, 0x40, 0x3f, "", {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0xd2, 0xa}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@as_header={0x7, 0x24, 0x1, 0x8, 0x8, 0x5}, @format_type_ii_discrete={0xf, 0x24, 0x2, 0x2, 0x200, 0xfff, 0x0, "f441a4440fb2"}]}, {{0x9, 0x5, 0x1, 0x9, 0x3ff, 0x78, 0x8, 0xba, {0x7, 0x25, 0x1, 0x8, 0x4, 0x3}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_i_discrete={0xb, 0x24, 0x2, 0x1, 0xfc, 0x3, 0x8, 0x1, "371fc8"}, @as_header={0x7, 0x24, 0x1, 0x8, 0x5, 0x1002}]}, {{0x9, 0x5, 0x82, 0x9, 0x20, 0x3, 0x2, 0x1, {0x7, 0x25, 0x1, 0x0, 0xe, 0x3}}}}}}}}]}}, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0}) 32.400202172s ago: executing program 33 (id=513): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0xc88765b5e0bfc577, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_usb_connect$uac2(0x2, 0x7b, &(0x7f0000000580)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x20, 0x2a39, 0x3f8c, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x69, 0x3, 0x1, 0x1, 0x70, 0x51, {0x8, 0xb, 0x0, 0x2, 0x1, 0x7, 0x20, 0x9}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0x8, 0x2, 0x9, 0x8}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x40, 0x6, 0x2, 0x8, {0x8, 0x25, 0x1, 0x0, 0x3, 0x4, 0x2}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x650, 0x4, 0x7, 0x2, {0x8, 0x25, 0x1, 0x2, 0xf, 0x6, 0x3}}}}}}}}]}}, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000540)=ANY=[@ANYBLOB="140000001000010000000000000000000700000a74000000060a030400000000000000000a00000a0900010073797a3100000000400004803c0001800a00010071756575650000002c000280060002400fea000006000140000100000600034000010000060002"], 0x9c}, 0x1, 0x0, 0x0, 0x4000850}, 0x20040040) sendmsg$netlink(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000580)=ANY=[@ANYBLOB="3400000013000100000100dffddbdf25070000f61600000008000000", @ANYRES32, @ANYBLOB="14001a8008"], 0x34}], 0x1, 0x0, 0x0, 0x4000}, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000000), r1) (async) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000000), r1) sendmsg$TIPC_NL_NET_SET(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)={0x28, r3, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ADDR={0x8, 0x2, 0x1}, @TIPC_NLA_NET_ID={0x8, 0x1, 0xba6}]}]}, 0x28}}, 0x0) (async) sendmsg$TIPC_NL_NET_SET(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)={0x28, r3, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ADDR={0x8, 0x2, 0x1}, @TIPC_NLA_NET_ID={0x8, 0x1, 0xba6}]}]}, 0x28}}, 0x0) r4 = socket(0x10, 0x3, 0x0) sendmsg$IPCTNL_MSG_EXP_GET(r4, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000540)=ANY=[@ANYBLOB="440000000102e10400000000000000000a000000300001802c00018014000300fe80000000000000fb"], 0x44}, 0x1, 0x0, 0x0, 0x20000014}, 0x4000840) sendmsg$nl_generic(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000540)=ANY=[@ANYBLOB="640000001900010000000000fbdbdf251d01"], 0x64}, 0x1, 0x0, 0x0, 0x5}, 0x0) sendmsg$TIPC_NL_KEY_SET(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)={0x68, r3, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_NODE={0x54, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ID={0x14, 0x3, '1234567890123456'}, @TIPC_NLA_NODE_KEY={0x3c, 0x4, {'gcm(aes)\x00', 0x14, "00112233445566778899aabbccddeeff00112233"}}]}]}, 0x68}}, 0x0) (async) sendmsg$TIPC_NL_KEY_SET(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)={0x68, r3, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_NODE={0x54, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ID={0x14, 0x3, '1234567890123456'}, @TIPC_NLA_NODE_KEY={0x3c, 0x4, {'gcm(aes)\x00', 0x14, "00112233445566778899aabbccddeeff00112233"}}]}]}, 0x68}}, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_STATS(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, 0x5, 0x1, 0x801, 0x0, 0x0, {0x2, 0x0, 0x5}}, 0x14}, 0x1, 0x0, 0x0, 0x20000000}, 0x8000) (async) sendmsg$IPCTNL_MSG_CT_GET_STATS(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, 0x5, 0x1, 0x801, 0x0, 0x0, {0x2, 0x0, 0x5}}, 0x14}, 0x1, 0x0, 0x0, 0x20000000}, 0x8000) write(0xffffffffffffffff, &(0x7f0000000100)="1c0000001800077bab092500090007000a07000000000006000036", 0x1b) r6 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r6, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={0x1c, 0x1e, 0x21, 0x70bd2b, 0x0, {0xa}, [@typed={0x5, 0x0, 0x0, 0x0, @str='\x00'}]}, 0x1c}}, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async) r7 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) (async) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r8, 0x4008ae89, &(0x7f0000000080)={0x1, 0x0, [{0xc001102c, 0x0, 0x9}]}) syz_usb_connect$uac1(0x2, 0xffffffffffffffef, &(0x7f0000000000)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x20, 0xb05, 0x1743, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x88, 0x3, 0x1, 0x9, 0x40, 0x3f, "", {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0xd2, 0xa}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@as_header={0x7, 0x24, 0x1, 0x8, 0x8, 0x5}, @format_type_ii_discrete={0xf, 0x24, 0x2, 0x2, 0x200, 0xfff, 0x0, "f441a4440fb2"}]}, {{0x9, 0x5, 0x1, 0x9, 0x3ff, 0x78, 0x8, 0xba, {0x7, 0x25, 0x1, 0x8, 0x4, 0x3}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_i_discrete={0xb, 0x24, 0x2, 0x1, 0xfc, 0x3, 0x8, 0x1, "371fc8"}, @as_header={0x7, 0x24, 0x1, 0x8, 0x5, 0x1002}]}, {{0x9, 0x5, 0x82, 0x9, 0x20, 0x3, 0x2, 0x1, {0x7, 0x25, 0x1, 0x0, 0xe, 0x3}}}}}}}}]}}, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0}) (async) syz_usb_connect$uac1(0x2, 0xffffffffffffffef, &(0x7f0000000000)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x20, 0xb05, 0x1743, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x88, 0x3, 0x1, 0x9, 0x40, 0x3f, "", {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0xd2, 0xa}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@as_header={0x7, 0x24, 0x1, 0x8, 0x8, 0x5}, @format_type_ii_discrete={0xf, 0x24, 0x2, 0x2, 0x200, 0xfff, 0x0, "f441a4440fb2"}]}, {{0x9, 0x5, 0x1, 0x9, 0x3ff, 0x78, 0x8, 0xba, {0x7, 0x25, 0x1, 0x8, 0x4, 0x3}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_i_discrete={0xb, 0x24, 0x2, 0x1, 0xfc, 0x3, 0x8, 0x1, "371fc8"}, @as_header={0x7, 0x24, 0x1, 0x8, 0x5, 0x1002}]}, {{0x9, 0x5, 0x82, 0x9, 0x20, 0x3, 0x2, 0x1, {0x7, 0x25, 0x1, 0x0, 0xe, 0x3}}}}}}}}]}}, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0}) 30.405721659s ago: executing program 1 (id=534): prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x1c0) mount$incfs(&(0x7f0000000440)='./file0\x00', &(0x7f0000000140)='./file0\x00', &(0x7f0000000200), 0x80, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000240)="bf"}) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0xc2c02e4d8eb2a416, 0x4) r1 = openat$incfs(r0, &(0x7f0000000280)='.pending_reads\x00', 0x1, 0x130) ioctl$TIOCL_GETKMSGREDIRECT(r1, 0xc058671e, &(0x7f00000000c0)) (fail_nth: 18) 30.281588372s ago: executing program 1 (id=535): unshare(0x28000) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000440)={'tunl0\x00', &(0x7f00000000c0)={'syztnl0\x00', 0x0, 0x20, 0x10, 0x4000006, 0xa, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x64, 0x0, 0x9, 0x4, 0x0, @local, @initdev={0xac, 0x1e, 0x1, 0x0}}}}}) r1 = socket(0x2b, 0x6, 0xcd) sendto(r1, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x804, 0x0, 0x0) recvmmsg(r0, &(0x7f00000008c0)=[{{0x0, 0x0, &(0x7f0000000780)=[{&(0x7f0000000100)=""/10, 0xa}, {&(0x7f0000000180)=""/98, 0x62}, {&(0x7f0000000340)=""/111, 0x6f}, {&(0x7f00000004c0)=""/136, 0x88}, {&(0x7f0000000900)=""/237, 0xed}, {&(0x7f0000000680)=""/71, 0x47}], 0x6, &(0x7f0000000800)=""/133, 0x85}, 0x2}], 0x1, 0x0, 0x0) r2 = epoll_create(0x3) readv(r2, 0x0, 0x0) socket$packet(0x11, 0x0, 0x300) openat$uinput(0xffffffffffffff9c, &(0x7f0000001180), 0x802, 0x0) pipe2(&(0x7f0000000000), 0x0) socket$tipc(0x1e, 0x2, 0x0) socket$tipc(0x1e, 0x5, 0x0) socket$tipc(0x1e, 0x2, 0x0) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)) socket$tipc(0x1e, 0x2, 0x0) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000020)) socketpair$tipc(0x1e, 0x7, 0x0, &(0x7f0000000300)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000030)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000040)) socketpair$tipc(0x1e, 0x4, 0x0, &(0x7f0000000050)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000060)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000070)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000140)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000090)) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f00000000a0)) socket$tipc(0x1e, 0x5, 0x0) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000280)) r3 = socket$nl_sock_diag(0x10, 0x3, 0x4) write(r3, &(0x7f0000000200)="580000001400010300000000000000001e000000ffffffff00"/88, 0x58) 29.250458306s ago: executing program 1 (id=536): r0 = openat$selinux_load(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) write$selinux_load(r0, &(0x7f00000004c0)=ANY=[@ANYBLOB="8cff7cf908"], 0xee) 29.194293128s ago: executing program 1 (id=537): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0x5001}) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000200)={'syzkaller1\x00', 0x1}) write$tun(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="03031b003a00320006006300000000443aff00000000000000000000ffffac141419ff020000000000000000000000003d01"], 0x76) 29.061972341s ago: executing program 1 (id=538): prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x0, &(0x7f0000000040)=0x7) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x1c0) mount$incfs(&(0x7f0000000440)='./file0\x00', &(0x7f0000000140)='./file0\x00', &(0x7f0000000200), 0x80, 0x0) r0 = creat(&(0x7f00000005c0)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000080)='sysfs\x00', 0x1214040, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000003c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) chdir(&(0x7f0000000100)='./file0\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0) close(r0) socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000600), 0xffffffffffffffff) sendmsg$WG_CMD_GET_DEVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000002c0)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="01032cbd07000000f8250000000014000200776731"], 0x28}, 0x1, 0x0, 0x0, 0xc0}, 0x20040000) socket$xdp(0x2c, 0x3, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, 0x0, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0x5001}) r4 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r4, 0x8914, &(0x7f0000000200)={'syzkaller1\x00', 0x1}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000240)="bf"}) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0xc2c02e4d8eb2a416, 0x4) r6 = openat$incfs(r5, &(0x7f0000000280)='.pending_reads\x00', 0x1, 0x130) ioctl$TIOCL_GETKMSGREDIRECT(r6, 0xc058671e, &(0x7f00000000c0)) 28.975161323s ago: executing program 1 (id=541): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x2}) mknodat$loop(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x1000, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x0) fcntl$setstatus(r1, 0x4, 0x42000) (async) r2 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x4) fcntl$setstatus(r2, 0x4, 0x42000) (async) r3 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0, 0x0) fcntl$setstatus(r3, 0x4, 0x2400) (async) mprotect(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x1) (async) mremap(&(0x7f0000880000/0x2000)=nil, 0x2000, 0x2000, 0x3, &(0x7f0000000000/0x2000)=nil) (async) r4 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r4, &(0x7f0000000080)=@pppol2tpin6={0x18, 0x1, {0x0, r4, 0x1, 0x3, 0x3, 0x1, {0xa, 0x4e21, 0x3f800000, @dev={0xfe, 0x80, '\x00', 0x12}, 0xe11b}}}, 0x32) (async) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r6, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=ANY=[@ANYBLOB="240000001e0021002bbd7000000000000a000000050000000000000008000880"], 0x24}}, 0x0) (async) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) (async) r7 = dup(r5) ioctl$SIOCSIFHWADDR(r7, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', @multicast}) (async) write$tun(r0, &(0x7f0000000200)=ANY=[@ANYBLOB="0000891402000000e3037b0ebf3a261590bbbbbbbbbbbbbbbbbbbbbbbb88a800000800461400380067000009069078e000000164010100830364000000000000000000000000000000000100004e2200004e220002000100000003"], 0x58) 26.474562372s ago: executing program 2 (id=564): r0 = openat$selinux_load(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) write$selinux_load(r0, &(0x7f00000004c0)=ANY=[@ANYBLOB="8cff7cf9"], 0xee) 26.394032364s ago: executing program 2 (id=565): mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f0000000100)='ext4\x00', 0x8410, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x40106614, 0x0) 26.329757146s ago: executing program 2 (id=567): mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt\x00', 0x1ff) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f0000000100)='ext4\x00', 0x8410, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) ioctl$ifreq_SIOCGIFINDEX_wireguard(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'wg0\x00'}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000200)={'syztnl2\x00', 0x0}) socket$inet(0x2, 0x6, 0x8) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_DELETE(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000340)={0x24, 0x2, 0x2, 0x401, 0x0, 0x0, {0x5, 0x0, 0x8}, [@CTA_EXPECT_HELP_NAME={0xe, 0x6, 'irc-20000\x00'}]}, 0x24}, 0x1, 0x0, 0x0, 0x2000c884}, 0x44800) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x40046629, 0x0) 26.287473237s ago: executing program 2 (id=568): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000000)={0x3, &(0x7f00000000c0)=[{0x50, 0x37, 0xfc, 0x1}, {0x28, 0x1, 0xb6, 0x7fff}, {0x6, 0x6, 0x0, 0x1057c}]}, 0x10) write$binfmt_aout(r0, &(0x7f0000000000)=ANY=[], 0x1057c) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000140)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_STATION(r2, &(0x7f0000000480)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000440)={&(0x7f0000000180)={0x298, r3, 0x400, 0x70bd26, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_STA_TX_POWER_SETTING={0x5, 0x113, 0x1}, @NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES={0xeb, 0xbe, "348ce57ac920c4b92d10b94dff59c8094f21440974315cb819de9fd7926c50346c08def3748ab1ac5f86db70e13cf5ee3e7016243de3b0567d47138c85ddc35be05b4f950ae607bfb7d16f4a5a6decb384600de629a3d5b9eb29dccbc3a5e8b7cf5ff154c30fee42704e7edf601cc94d7f1574f453411424ef57b655deb52ed28da86030fa88382659da9047b6026f02dd7400d0857258d041cca51206bb3ac72f73f0871a9f279aede9b73d86eb1e962307d37395129a3e0755be975777086946ae173a6d06cf8c72d7b4083eb8d625e16cced65a8f707e103486b946b7cf59109723c14d296c"}, @NL80211_ATTR_STA_TX_POWER={0x6, 0x114, 0xc}, @NL80211_ATTR_STA_SUPPORTED_RATES={0x1d, 0x13, [{0xb}, {0x48}, {0x4}, {0x6c, 0x1}, {0x16, 0x1}, {0xe}, {0x36}, {0x9, 0x1}, {0x6, 0x1}, {0x48}, {0xb}, {0x6c, 0x1}, {0x36}, {0x9}, {0xc}, {0x60}, {0x0, 0x1}, {0x32}, {0x2, 0x1}, {0x3}, {0xb, 0x1}, {0x36, 0x1}, {0x2, 0x1}, {0x36}, {0xb}]}, @NL80211_ATTR_STA_EXT_CAPABILITY={0xa6, 0xac, "952b78258f428a348feeadcc1a998263f1d9aa3cae3d22d7f8d41183d6153bc6d552913f62a393982f835929c02c8150ab5b3b3de27ccfc5b3a76dfbf4340e35108f1d71e340410f0fb8eebd46d710c98cae4427dfdc6b8ee913bbda8b2ae25f37d57053058d03b2ff297eefde02358347cf1f653066bea8f527b3dfbdfed5b71effe6369fee72793bd195aa15431cd81cd31ab09f24a89e9e697af02cca82aeaf85"}, @NL80211_ATTR_STA_EXT_CAPABILITY={0xb8, 0xac, "493e48c6cd3aed5a6eeed447d1bc239b03d8a18f4e5af673298908f4507293223261cec9da1b2839f36db4a311c34f781b7fda076f2c9b313451f0df8afbfe35b051491b2e81bbd192c9977db706b116bebe9ea60f5f5ac2894292b4e009485be35d68e2dcce67aa7608c18bbfce4ae0f2264524d484e0317a2c47b10c3baff98b0112ca59fbf7a794abad21b0e1b3c71fe9c911f81a3c18746ca865a9e2f67436638848e7a58a919e2eecf8742e27d04311b9b1"}]}, 0x298}, 0x1, 0x0, 0x0, 0x24000041}, 0x4000010) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)) (async) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000000)={0x3, &(0x7f00000000c0)=[{0x50, 0x37, 0xfc, 0x1}, {0x28, 0x1, 0xb6, 0x7fff}, {0x6, 0x6, 0x0, 0x1057c}]}, 0x10) (async) write$binfmt_aout(r0, &(0x7f0000000000)=ANY=[], 0x1057c) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000140)={'wlan0\x00'}) (async) sendmsg$NL80211_CMD_SET_STATION(r2, &(0x7f0000000480)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000440)={&(0x7f0000000180)={0x298, r3, 0x400, 0x70bd26, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_STA_TX_POWER_SETTING={0x5, 0x113, 0x1}, @NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES={0xeb, 0xbe, "348ce57ac920c4b92d10b94dff59c8094f21440974315cb819de9fd7926c50346c08def3748ab1ac5f86db70e13cf5ee3e7016243de3b0567d47138c85ddc35be05b4f950ae607bfb7d16f4a5a6decb384600de629a3d5b9eb29dccbc3a5e8b7cf5ff154c30fee42704e7edf601cc94d7f1574f453411424ef57b655deb52ed28da86030fa88382659da9047b6026f02dd7400d0857258d041cca51206bb3ac72f73f0871a9f279aede9b73d86eb1e962307d37395129a3e0755be975777086946ae173a6d06cf8c72d7b4083eb8d625e16cced65a8f707e103486b946b7cf59109723c14d296c"}, @NL80211_ATTR_STA_TX_POWER={0x6, 0x114, 0xc}, @NL80211_ATTR_STA_SUPPORTED_RATES={0x1d, 0x13, [{0xb}, {0x48}, {0x4}, {0x6c, 0x1}, {0x16, 0x1}, {0xe}, {0x36}, {0x9, 0x1}, {0x6, 0x1}, {0x48}, {0xb}, {0x6c, 0x1}, {0x36}, {0x9}, {0xc}, {0x60}, {0x0, 0x1}, {0x32}, {0x2, 0x1}, {0x3}, {0xb, 0x1}, {0x36, 0x1}, {0x2, 0x1}, {0x36}, {0xb}]}, @NL80211_ATTR_STA_EXT_CAPABILITY={0xa6, 0xac, "952b78258f428a348feeadcc1a998263f1d9aa3cae3d22d7f8d41183d6153bc6d552913f62a393982f835929c02c8150ab5b3b3de27ccfc5b3a76dfbf4340e35108f1d71e340410f0fb8eebd46d710c98cae4427dfdc6b8ee913bbda8b2ae25f37d57053058d03b2ff297eefde02358347cf1f653066bea8f527b3dfbdfed5b71effe6369fee72793bd195aa15431cd81cd31ab09f24a89e9e697af02cca82aeaf85"}, @NL80211_ATTR_STA_EXT_CAPABILITY={0xb8, 0xac, "493e48c6cd3aed5a6eeed447d1bc239b03d8a18f4e5af673298908f4507293223261cec9da1b2839f36db4a311c34f781b7fda076f2c9b313451f0df8afbfe35b051491b2e81bbd192c9977db706b116bebe9ea60f5f5ac2894292b4e009485be35d68e2dcce67aa7608c18bbfce4ae0f2264524d484e0317a2c47b10c3baff98b0112ca59fbf7a794abad21b0e1b3c71fe9c911f81a3c18746ca865a9e2f67436638848e7a58a919e2eecf8742e27d04311b9b1"}]}, 0x298}, 0x1, 0x0, 0x0, 0x24000041}, 0x4000010) (async) 25.944967215s ago: executing program 2 (id=569): prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x0, &(0x7f0000000040)=0x7) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x1c0) mount$incfs(&(0x7f0000000440)='./file0\x00', &(0x7f0000000140)='./file0\x00', &(0x7f0000000200), 0x80, 0x0) r0 = creat(&(0x7f00000005c0)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000080)='sysfs\x00', 0x1214040, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000003c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) chdir(&(0x7f0000000100)='./file0\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0) close(r0) socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000600), 0xffffffffffffffff) sendmsg$WG_CMD_GET_DEVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000002c0)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="01032cbd07000000f8250000000014000200776731"], 0x28}, 0x1, 0x0, 0x0, 0xc0}, 0x20040000) socket$xdp(0x2c, 0x3, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, 0x0, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0x5001}) r4 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r4, 0x8914, &(0x7f0000000200)={'syzkaller1\x00', 0x1}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000240)="bf"}) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0xc2c02e4d8eb2a416, 0x4) r6 = openat$incfs(r5, &(0x7f0000000280)='.pending_reads\x00', 0x1, 0x130) ioctl$TIOCL_GETKMSGREDIRECT(r6, 0xc058671e, &(0x7f00000000c0)) 25.73989483s ago: executing program 2 (id=572): r0 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./file0\x00', 0x62c40, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x42, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x500302, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x80403, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x1) unshare(0x2040400) listxattr(0x0, 0x0, 0x0) r5 = socket(0x28, 0x801, 0x0) shutdown(r5, 0x3) ioctl$KVM_SET_CPUID(r4, 0x4008ae8a, &(0x7f00000001c0)={0x1, 0x0, [{0x1, 0x4, 0x40080, 0xff, 0x2eaa}]}) ioctl$KVM_X86_SETUP_MCE(r0, 0x4008ae9c, &(0x7f00000000c0)={0x1c, 0x4, 0x80}) ioctl$KVM_SET_MSRS(r4, 0x4008ae89, &(0x7f0000000c40)={0x1, 0x0, [{0x480}]}) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r1, &(0x7f00000021c0)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r1, &(0x7f0000000040)={0x50, 0x0, r6, {0x7, 0x1f, 0x8, 0xffffffffd24b2432, 0x83, 0xffff, 0x0, 0xabe6, 0x0, 0x0, 0x80, 0x8001}}, 0x50) truncate(&(0x7f0000000180)='./file0\x00', 0x8fff5) umount2(&(0x7f00000002c0)='./file0\x00', 0xb) socket$nl_xfrm(0x10, 0x3, 0x6) socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)) socket$inet_tcp(0x2, 0x1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)) futex(0x0, 0x85, 0x0, 0x0, 0x0, 0xa0090199) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)) socket$inet6_tcp(0xa, 0x1, 0x0) socket$nl_generic(0x10, 0x3, 0x10) 13.9172785s ago: executing program 34 (id=541): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x2}) mknodat$loop(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x1000, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x0) fcntl$setstatus(r1, 0x4, 0x42000) (async) r2 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x4) fcntl$setstatus(r2, 0x4, 0x42000) (async) r3 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0, 0x0) fcntl$setstatus(r3, 0x4, 0x2400) (async) mprotect(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x1) (async) mremap(&(0x7f0000880000/0x2000)=nil, 0x2000, 0x2000, 0x3, &(0x7f0000000000/0x2000)=nil) (async) r4 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r4, &(0x7f0000000080)=@pppol2tpin6={0x18, 0x1, {0x0, r4, 0x1, 0x3, 0x3, 0x1, {0xa, 0x4e21, 0x3f800000, @dev={0xfe, 0x80, '\x00', 0x12}, 0xe11b}}}, 0x32) (async) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r6, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=ANY=[@ANYBLOB="240000001e0021002bbd7000000000000a000000050000000000000008000880"], 0x24}}, 0x0) (async) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) (async) r7 = dup(r5) ioctl$SIOCSIFHWADDR(r7, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', @multicast}) (async) write$tun(r0, &(0x7f0000000200)=ANY=[@ANYBLOB="0000891402000000e3037b0ebf3a261590bbbbbbbbbbbbbbbbbbbbbbbb88a800000800461400380067000009069078e000000164010100830364000000000000000000000000000000000100004e2200004e220002000100000003"], 0x58) 10.701847356s ago: executing program 35 (id=572): r0 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./file0\x00', 0x62c40, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x42, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x500302, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x80403, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x1) unshare(0x2040400) listxattr(0x0, 0x0, 0x0) r5 = socket(0x28, 0x801, 0x0) shutdown(r5, 0x3) ioctl$KVM_SET_CPUID(r4, 0x4008ae8a, &(0x7f00000001c0)={0x1, 0x0, [{0x1, 0x4, 0x40080, 0xff, 0x2eaa}]}) ioctl$KVM_X86_SETUP_MCE(r0, 0x4008ae9c, &(0x7f00000000c0)={0x1c, 0x4, 0x80}) ioctl$KVM_SET_MSRS(r4, 0x4008ae89, &(0x7f0000000c40)={0x1, 0x0, [{0x480}]}) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r1, &(0x7f00000021c0)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r1, &(0x7f0000000040)={0x50, 0x0, r6, {0x7, 0x1f, 0x8, 0xffffffffd24b2432, 0x83, 0xffff, 0x0, 0xabe6, 0x0, 0x0, 0x80, 0x8001}}, 0x50) truncate(&(0x7f0000000180)='./file0\x00', 0x8fff5) umount2(&(0x7f00000002c0)='./file0\x00', 0xb) socket$nl_xfrm(0x10, 0x3, 0x6) socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)) socket$inet_tcp(0x2, 0x1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)) futex(0x0, 0x85, 0x0, 0x0, 0x0, 0xa0090199) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)) socket$inet6_tcp(0xa, 0x1, 0x0) socket$nl_generic(0x10, 0x3, 0x10) 4.829657055s ago: executing program 5 (id=708): prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000080)={0x3, &(0x7f0000000000)=[{0x3, 0x81, 0x3}, {0x61, 0xf}, {0x6, 0x0, 0x0, 0x5}]}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$TUNSETOFFLOAD(r0, 0x400454ce, 0xb) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) 3.926016836s ago: executing program 5 (id=715): r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCADDRT(r0, 0x890b, &(0x7f0000000840)={0x0, {0x2, 0x0, @empty}, {0x4, 0x0, @empty}, {0x2, 0x0, @remote}, 0x4, 0x0, 0x100000000000000, 0xfdffffffffffffff, 0x0, &(0x7f00000001c0)='lo\x00', 0x6, 0x0, 0x3}) 3.925709296s ago: executing program 5 (id=716): r0 = fsopen(&(0x7f0000000000)='debugfs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f00000001c0)='\x00\x02\x00', &(0x7f0000000480)='0\x00#\x00\xd0\x00 \x00\x00qS\x00\x00\x00\x00\x00\x00\xfc\xff$\xf6_\xbdI\x1c\xf2\xa9]\xcc\xe0*\xef\x01\x8d\x15\xd2h\x93\xc9\xb57\xc3\xea\\Eb\xf8\xe6,\xdf\xd4\xfae\x84\xcc\xd5\"d\xf0D-\x98\x9f\x81{\xfc$\xc4\xbcF\xf8\xc8\x8d\xcb\xb8\xf2\x1e\xe4\'U\xb3\xb8\xd3\xe6\xd7\x80=\x8a\xeb\n\xb8_\xe8\x96YY\xe3\xc7\xe6\xf28\x19\xa6\x87\xfa\xdb\x1ce\xc1\x03\x86J\xb2fh\x19\xee#\xcc\x0f\xed\xfea\xdc\x88\xcb%bW\xd35\xda=\xac\x1d\xae\x93\xfd\'T6\x94\n\xa4\x9cU\xc4\fA~[\xbf\x8b\x90\xfe\x04\xe7U\xf3h\x81\x14l7u\x95\x96t\\\x0f\xef;\x03\xa4C\xbc(Vc!a\xc1\xe39\xc6b\x905\x1f\x03\x00\x00\x00\x00\x00\x00\xdf9\xaf5\xc8a:~\xe4\xcbag&67\x814\xf6}\xbf0v6l\xd6,\x1e\xa0\xcc\xbf\xfdkm\b?o9\x85\x01n%\x7f_\xe1.f>>\xa5\xfb\"\xab\xdb\x06\x12e\x14\x11~\x9a\bR-\x85\xc3\xa9\xe6\xf6R\x11\"\xc3\xc9\xfc\x14s X\xec\xdd\xc2qB\x85\xf0\xd7\x04\xdd<\x9ak\x00\x00\x00\x00\x00\xff\xff\xff\xff\xff\xff\xff\xff\xe7\x8f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xc1R\xda8\x7f}0\xec\xa9)a_\n\xbcf\xe6\xb3\x8b=\xbc\xdb\xb7\xe3\xc2W\xd9\fL\xf5t\xea\x15;\x8d\xad\x93\x11\xe3\x89\xb19k\x8fF\xfc\xd0\xcfz\a#zcv\xb2\x10\x02\xe4\x94:\x88L\xe8A\x88l', 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) write$cgroup_freezer_state(0xffffffffffffffff, &(0x7f0000000080)='FROZEN\x00', 0x7) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) timer_create(0x7, &(0x7f0000000080)={0x0, 0x11, 0x2}, &(0x7f0000000000)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) recvfrom(r1, 0x0, 0x0, 0x2020, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x4c6102, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000200)={'rose0\x00', 0x112}) munmap(&(0x7f0000001000/0x3000)=nil, 0x3000) ioctl$TUNSETTXFILTER(0xffffffffffffffff, 0x400454d1, &(0x7f00000003c0)=ANY=[]) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000000380)='aufs\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) r5 = dup(r4) syz_ublk_setup_queues(r5, r3, &(0x7f0000000180)={0x0, 0x1, 0x3000, 0x3, 0x255}, 0x0, 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff5, 0x4, 0x0, 0x0}}, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, &(0x7f0000000340)={{0x2, 0x3, 0xf3b, 0x0, 0x4a7}}) ioctl$UI_ABS_SETUP(0xffffffffffffffff, 0x401c5504, &(0x7f0000000340)={0x35}) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt\x00', 0x1ff) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f0000000100)='ext4\x00', 0x8410, 0x0) lseek(r1, 0x5, 0x1) bind$vsock_stream(0xffffffffffffffff, &(0x7f0000000040)={0x28, 0x0, 0x0, @local}, 0x10) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) lsetxattr$security_selinux(0x0, &(0x7f0000000300), &(0x7f0000000200)='system_u:object_r:ldconfig_cache_t:s0\x00', 0x26, 0x3) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socket$vsock_stream(0x28, 0x1, 0x0) 3.241366952s ago: executing program 6 (id=722): mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x80) socketpair$unix(0x1, 0x2, 0x0, 0x0) r2 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) ioctl$KVM_GET_MSR_FEATURE_INDEX_LIST(r2, 0xc004ae0a, 0x0) 3.240664583s ago: executing program 6 (id=723): socket$inet6(0xa, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$inet(0x2, 0x2, 0x1) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x80002, 0x0) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f0000000000)={'ip6gre0\x00', 0x0}) pipe2(0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000001c0)=@any_dev={0x4, 0x3f7, 0x0, 0x0, 0x1000, 0xe, 0x0, 0x0, 0x10}}}, &(0x7f0000000300)=0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = dup(r2) syz_ublk_setup_queues(r3, r1, &(0x7f0000000040)={0x0, 0xc1, 0x10, 0xfffffffd, 0x7f}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3, 0x42, 0x3, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc81d, 0x2, 0x1, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x93ea, 0x2000, 0x4003bfff, 0x2b9}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x626d, 0x800, 0x1, 0x26d}}], 0x1, 0x0, 0x0) r4 = openat$selinux_load(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) write$selinux_load(r4, &(0x7f00000004c0)=ANY=[@ANYBLOB="8cff7cf908"], 0xee) 2.984577089s ago: executing program 6 (id=724): r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCADDRT(r0, 0x890b, &(0x7f0000000840)={0x0, {0x2, 0x0, @empty}, {0x4, 0x0, @empty}, {0x2, 0x0, @remote}, 0x4, 0x0, 0x200000000000000, 0xfdffffffffffffff, 0x0, &(0x7f00000001c0)='lo\x00', 0x6, 0x0, 0x3}) 2.960502539s ago: executing program 6 (id=725): pipe2$9p(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) fsetxattr$security_capability(r0, &(0x7f0000000980), &(0x7f0000000a80)=@v1={0x1000000, [{0x7, 0x10000}]}, 0xc, 0x2) r1 = syz_open_dev$rtc(&(0x7f0000000080), 0x0, 0x0) ioctl$RTC_RD_TIME(r1, 0x80247009, &(0x7f00000000c0)) syz_usb_connect$uac3(0x3, 0xa0, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000408205740040000102030109028e0003017f3311080b0003010130010904000000010130000a03000000007e0700001324030200010405060500000004000a000d000d24070606"], 0x0) 2.889849751s ago: executing program 5 (id=726): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000100)={0x2, 0x4e21, @broadcast}, 0x10) shutdown(r0, 0x1) r1 = socket$tipc(0x1e, 0x5, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$inet(0x2, 0x2, 0x1) socket$nl_netfilter(0x10, 0x3, 0xc) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="280100"], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r3, 0x0, 0x0) recvmsg$unix(r2, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x80) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000001c0)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = dup(r6) syz_ublk_setup_queues(r4, r5, &(0x7f0000000140)={0x0, 0xba1d, 0x4000, 0x2, 0x3}, &(0x7f0000000540)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xcc50, 0x800, 0x1, 0xe8}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x267e, 0x200, 0x1, 0x15c}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7f69, 0x4, 0x1, 0x3d4}, 0xffffffffffffffff}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe8e3, 0x8000, 0x0, 0x148}}], 0x4, 0x0, 0x0) syz_ublk_setup_queues(r7, r5, &(0x7f00000004c0)={0x0, 0xbd, 0x10, 0x1, 0x81}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe708, 0x42, 0x3000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3b00, 0x2, 0x1, 0x3aa, 0x0, r8}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xdc67, 0x2000, 0x4003bfff, 0x802b9}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5, 0x800, 0x1, 0x26d, 0x0, r7}}], 0x1, 0x0, 0x0) bind$tipc(r1, &(0x7f0000000180)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x0, 0x4}}, 0x10) r9 = socket$tipc(0x1e, 0x5, 0x0) r10 = socket$tipc(0x1e, 0x2, 0x0) r11 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000300)=ANY=[@ANYBLOB="1201000000000040de28421100000000000109022400010000000009040000010300000009210000000122050009058103"], 0x0) syz_usb_control_io$hid(r11, 0x0, 0x0) syz_usb_control_io(r11, &(0x7f00000001c0)={0x18, &(0x7f0000000340)=ANY=[@ANYBLOB="4015050000000500b1"], 0x0, 0x0, 0x0, 0x0}, 0x0) syz_open_dev$hidraw(&(0x7f0000000280), 0x82, 0x2) bind$tipc(r10, &(0x7f0000000080)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x200, 0xfffffffd}}, 0x10) sendmsg$tipc(r9, &(0x7f0000000380)={&(0x7f0000000140)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x4, 0x4}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x4000884}, 0x4) ioctl$int_in(r0, 0x5452, &(0x7f0000000000)=0x6) connect$inet(r0, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10) 2.419779212s ago: executing program 3 (id=727): iopl(0x3) socketpair$unix(0x1, 0x2, 0x0, 0x0) add_key$keyring(&(0x7f0000000200), 0x0, 0x0, 0x0, 0xffffffffffffffff) keyctl$unlink(0x9, 0x0, 0xffffffffffffffff) r0 = socket$inet6(0xa, 0x2, 0x0) ioperm(0x1, 0xf, 0x8) bind$inet6(r0, &(0x7f0000000040)={0xa, 0xe20, 0x0, @private2}, 0x1c) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0x2, &(0x7f00000002c0)=0xffff, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0xe22, 0x0, @rand_addr=' \x01\x00'}, 0x1c) r2 = socket(0x1e, 0x4, 0x0) getsockopt$inet_int(r2, 0x0, 0xb, 0x0, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x1, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e24, 0x5, @private2, 0x9}, 0x1c) 1.753129688s ago: executing program 6 (id=728): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0x5001}) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000200)={'syzkaller1\x00', 0x1}) write$tun(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="03031b003a00320006006300000000443aff00000000000000000000ffffac141419ff020000000000000000008fffffff01"], 0x76) 1.609585901s ago: executing program 6 (id=729): r0 = syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000100)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x810, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x10, 0x24, "", [{{0x9, 0x4, 0x0, 0x5, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x3e, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x410, 0x0, 0x4}}}}}]}}]}}, 0x0) (async) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cgroup.kill\x00', 0x275a, 0x0) fcntl$lock(r1, 0x24, &(0x7f0000000000)={0x0, 0x2, 0xfffffffffffffff9, 0x7fffffff}) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x40, 0x56a, 0x10e, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x3, 0x0, 0x5, "", [{{0x9, 0x4, 0x0, 0x9, 0x1, 0x3, 0x1, 0x1, 0x6, {0x9, 0x21, 0xc3d, 0x6, 0x1, {0x22, 0x38d}}, {{{0x9, 0x5, 0x81, 0x3, 0x7df, 0x9, 0x9, 0xf3}}}}}]}}]}}, &(0x7f0000000600)={0xa, &(0x7f0000000140)={0xa, 0x6, 0x300, 0x9, 0x4, 0x6, 0x8, 0x7}, 0x51, &(0x7f0000000180)={0x5, 0xf, 0x51, 0x5, [@wireless={0xb, 0x10, 0x1, 0x8, 0x21, 0x5, 0x7, 0x4, 0x4d}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0x5, 0x6, 0xff}, @ext_cap={0x7, 0x10, 0x2, 0x0, 0x5, 0x3, 0x5}, @ssp_cap={0xc, 0x10, 0xa, 0xf8, 0x0, 0x2, 0xff00, 0x4}, @ssp_cap={0x24, 0x10, 0xa, 0x1, 0x6, 0x3, 0xf000, 0x4, [0x41cf, 0x0, 0xf, 0xff00, 0xff0030, 0xc0ff]}]}, 0x5, [{0xe0, &(0x7f0000000340)=@string={0xe0, 0x3, "b47152eb3f5e8ac521fe354d0dfca5634a12130c6b0818ba87317fb29924dcae0dd8eb3cf838a5fefbb8d4e78fbadddc349a663e796ad3b5b4f9798264d46f6d528ae96ec887dce6484ac93d10a7372e98ca64ec2d1b222e5e7e4d76b650ea315047219b8d2ae8785597a97d22beba6291354cc80419b7c4eb2c0a032dfee86e39ea3fe016b545d729261f57e07686bfc8685fcaf082408e938f9d462ffdfd67323d83130a75e38cd05ca7a15ff5bbb7a936d929eb83b0f664eb0e3b998f5413c85a500f79519ea849f1b57fd9c68ed56b521da3deee5e911448505a23a9"}}, {0x4, &(0x7f0000000440)=@lang_id={0x4, 0x3, 0x80c}}, {0x4, &(0x7f0000000480)=@lang_id={0x4}}, {0xd1, &(0x7f00000004c0)=@string={0xd1, 0x3, "f470b56e92de20eaf89b926dbfd52fac247db909ff0df0eda5e7921d0b28efcbd92d09e1875b29b084f61df26f728cbb6689d41d77c1caba8bf892317cca81469a98acd80cacf06f6980c6954d37dfa47923d8abb383e43ea6811bf53c9b1abcffcc9305bd7d43f60f06c98d7ee654db1554d12a3ccbda33fa52ebc1c58b6c8f4fbef8003c9ddb929b2f8235a32203a5a506a0c96159302559ffd51d4e2bcf7cffc569d0cecbc504eb07ff5fc8e95dc9bfe87910131f1efb24872e7ec1c814196276eb890c74c7af48796d4d0a79c6"}}, {0x4, &(0x7f00000005c0)=@lang_id={0x4, 0x3, 0x40b}}]}) (async) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150825ff0904a1010901a1007508950109308102c0c0"], 0x0}, 0x0) r2 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f00000002c0), 0x1, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)=[{&(0x7f0000000140)={0x18, 0x56, 0x1, 0x0, 0x800000, "", [@typed={0x7, 0x0, 0x0, 0x0, @str='\x00\x00\x00'}]}, 0x18}], 0x1, 0x0, 0x0, 0x4000001}, 0x0) (async) ppoll(&(0x7f0000000300)=[{r2, 0x40}], 0x1, 0x0, 0x0, 0x0) (async) syz_usb_connect$cdc_ecm(0x3, 0x62, &(0x7f00000000c0)={{0x12, 0x1, 0x0, 0x2, 0x0, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x0, 0x0, 0xffffffffffff8001, 0x1, [{{0x9, 0x2, 0x50, 0x1, 0x1, 0x0, 0x0, 0x80, "", [{{0x9, 0x4, 0x0, 0x0, 0x12, 0x2, 0x6, 0x0, 0x0, {{0x5}, {0x5, 0x24, 0x0, 0x7}, {0xd, 0x24, 0xf, 0x1, 0x0, 0x3}, [@mdlm={0x15, 0x24, 0x12, 0x3}]}, {[], {{0x9, 0x5, 0x82, 0x2, 0x200, 0x0, 0x3}}, {{0x9, 0x5, 0x3, 0x2, 0x8, 0x0, 0x0, 0xff}}}}}]}}]}}, 0x0) 1.566384632s ago: executing program 3 (id=730): r0 = syz_io_uring_setup(0x2f8d, &(0x7f0000000340)={0x0, 0xc382, 0x1000, 0x2, 0x200001}, &(0x7f0000000240)=0x0, &(0x7f0000000000)=0x0, &(0x7f00000002c0)=0x0) r4 = epoll_create(0xaf2) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r0, &(0x7f0000000080)={0xe000200f}) socket$nl_generic(0x10, 0x3, 0x10) socket$inet(0x2, 0x2, 0x1) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_xfrm(0x10, 0x3, 0x6) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r6, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r5, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[@rights={{0x10}}, @rights={{0x10}}, @rights={{0x10}}, @rights={{0x10}}], 0x40}, 0x80) syz_clone3(&(0x7f00000006c0)={0x42000000, 0x0, 0x0, 0x0, {0x3c}, 0x0, 0x0, 0x0, &(0x7f0000000680)=[0x0], 0x1}, 0x58) pipe2(0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000001c0)=@any_dev={0x4, 0x3f7, 0x0, 0x0, 0x1000, 0xe, 0x0, 0x0, 0x10}}}, &(0x7f0000000300)=0x0) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) r9 = dup(r8) syz_ublk_setup_queues(r9, r7, &(0x7f0000000040)={0x0, 0xc1, 0x10, 0xfffffffd, 0x7f, 0x0, r0}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3, 0x42, 0x3, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc81d, 0x2, 0x1, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x93ea, 0x2000, 0x4003bfff, 0x2b9}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x626d, 0x800, 0x1, 0x26d}}], 0x1, 0x0, 0x0) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000400)={0x2e, 0x54, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0xffffffffffffff91, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000003c0)=@new_dev={0x1, 0x5ef, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x88}}}, &(0x7f0000000180)) 1.427842106s ago: executing program 3 (id=731): r0 = socket(0x10, 0x3, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) clock_settime(0x0, 0x0) setsockopt$packet_tx_ring(r1, 0x107, 0xd, &(0x7f0000000380)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0x1c) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'veth0_macvtap\x00', 0x0}) bind$packet(r1, &(0x7f0000000140)={0x11, 0x0, r2, 0x1, 0x81, 0x6, @remote}, 0x14) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f0000000300)={'ip6tnl0\x00', &(0x7f00000000c0)={'ip6_vti0\x00', r2, 0x2, 0x8, 0x2, 0x80000001, 0x6, @dev={0xfe, 0x80, '\x00', 0x44}, @rand_addr=' \x01\x00', 0x7800, 0x40, 0x1, 0x7699}}) sendmsg$inet(r0, &(0x7f0000000240)={&(0x7f0000000040)={0x2, 0x4e22, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x43, &(0x7f00000001c0)=[{&(0x7f0000000280)="cea9edb9caddd5ac6522b7a9b83f8e1630c1ee3fb12a0b75441ce4b2e9d462164c860ca3fc6feec84a7803449cb5054fbd8a4ed38c365c92972883a6f0dec724546c4e43e195c6fa", 0x48}, {&(0x7f0000000140)="2b4a217fdb9e3c15253fa32ac49a2faeb80113eb54cf2bd1d09f", 0x1a}], 0x2, &(0x7f0000000200)=[@ip_tos_u8={{0x0, 0x0, 0x1, 0xff}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {r3, @local, @broadcast}}}], 0x38}, 0x8) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000000)={0xfff}, 0x10) write(r0, &(0x7f0000000180)="2000000012005f0214f9f4070000fbe40a0000000000", 0x41d) syz_usb_connect(0x0, 0x5a, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000ec13b2106d04f308280b0102030109024800010000000009046900000e0100002b4101", @ANYRES16=r0, @ANYRESDEC=r2], 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x4000002, 0x14032, 0xffffffffffffffff, 0x0) futex(0x0, 0x85, 0x8, 0x0, 0x0, 0x0) ioctl$RFKILL_IOCTL_NOINPUT(0xffffffffffffffff, 0x5202) sendmsg$inet(r0, &(0x7f00000005c0)={&(0x7f0000000340)={0x2, 0x4e22, @broadcast}, 0x10, &(0x7f00000003c0)=[{&(0x7f00000003c0)}, {&(0x7f0000000400)="186bba86c2093f0b43b56de23bf83b44af2647f8acbca7e2ff2b352f2c33d8e081ef8b1aed869ab11ffb7289df86b019bd99a3d2146d824fae2da3ea187bc779a2e48c38d5f731f444b7d2b0c227436c4261bd60973afa83f85ce57b02917b0583d38cccebf6ea93dab4ee52e96a9e16b124ef60b40c77f32373a72f2949118c09a31d76f69d899dfe6b2c894d50b2998cbf6d260570185c1d9d3ab4c9", 0x9d}, {&(0x7f00000004c0)="496098917a014af83e5552fcaa737ea67ff2c1875a09e9e962b59441ffc61535190a9a6c3f92cd63985f2fc70e6fce02a2a9aeb7cbe9a8d43ab0dcf18419af8c82e3358bee01a090b054b64ef29ac34945a225614451750c758dd0165dc6052fc2d40d116494c7a1e6f44b9e12d7a66f679c84b3e4901471977a12060f0f482b12763b29ad7405ab2d105f57406296b014a941", 0x93}], 0x3}, 0x80) r4 = socket$pppl2tp(0x18, 0x1, 0x1) r5 = socket$inet6_udp(0xa, 0x2, 0x0) r6 = syz_clone(0x80000200, 0x0, 0x2d, 0x0, 0x0, 0x0) ptrace(0x10, r6) ptrace$setsig(0x4203, r6, 0x3, &(0x7f0000000280)={0x1f, 0x6, 0x5}) connect$pppl2tp(r4, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r5, {0x2, 0x4e23, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e) r7 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r7, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x4e21, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x2, 0x1, 0x0, 0xfffffffc}}, 0x2e) r8 = inotify_init1(0x800) sendmsg$NFULNL_MSG_CONFIG(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB="400000000104010200000000000900000a0000050a000200000000ff050000000500010001000000080003"], 0x40}, 0x1, 0x0, 0x0, 0x4}, 0x4044844) r9 = socket$netlink(0x10, 0x3, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f00000000c0)={0x2710, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) sendmsg$netlink(r9, &(0x7f0000000740)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f00000000c0)=ANY=[@ANYBLOB="30000000110001"], 0x30}], 0x1}, 0x0) r10 = fcntl$dupfd(r7, 0x406, r8) setsockopt$inet_mtu(r10, 0x111, 0xa, &(0x7f0000000000), 0x4) 1.178003012s ago: executing program 5 (id=732): mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x80) socketpair$unix(0x1, 0x2, 0x0, 0x0) r2 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) ioctl$KVM_GET_MSR_FEATURE_INDEX_LIST(r2, 0xc004ae0a, 0x0) 1.177695721s ago: executing program 5 (id=733): r0 = openat2$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)={0x40000, 0x3, 0x10}, 0x18) r1 = add_key$fscrypt_provisioning(&(0x7f0000000080), &(0x7f00000001c0)={'syz', 0x3}, &(0x7f0000000200)=ANY=[@ANYBLOB="0100000000000069e1fa5e24242c"], 0xe, 0xfffffffffffffffb) ioctl$FS_IOC_ADD_ENCRYPTION_KEY(r0, 0xc0506617, &(0x7f0000000240)={@desc={0x1, 0x0, @desc2}, 0x21, r1, '\x00', @c}) syz_usb_connect$hid(0x2, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="1201010000000020f3044d07000000000001090224000100dd002009040000ff03000100092100000001220600090581035800fc0ff3aabece6909dc917f83c386fa324139ea6a68493450b34c24585f3144549dd931b1178a1c68df4843a8bc380f659b0912d34a18ac23c120e529c85a3735eed03957fae9ac5758cd968eeda6ce673e5b5fe3f27e838dd36ce79493f8939c39db1c61b326ca017bedf8b2a5fc4062d58db9ceb2a5776403fff7863fbbe07f842867d2a794ac4dc79004a99b699b35b03770d7c2a7313328e7c6c4e66a1ed957725c2fb99dbcc6e324c513d7e5b2d85c075b0a9a033c1c33a3b6c155e253a56fc05a785e94b4"], 0x0) 525.815797ms ago: executing program 7 (id=740): r0 = memfd_secret(0x0) fchmod(r0, 0x53) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x14, 0x1a, 0x1, 0x0, 0x0, {0xa}}, 0x14}}, 0x0) write$cgroup_subtree(r0, &(0x7f0000000000)={[{0x2b, 'net_prio'}]}, 0xa) 480.187368ms ago: executing program 7 (id=741): r0 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r0, &(0x7f0000000100)=@name={0x1e, 0x2, 0x0, {{0x42}}}, 0x10) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000040)={0x42, 0x0, 0x3}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000000)={0x42, 0x0, 0x1}, 0x10) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r2, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)=[{&(0x7f0000000080)=ANY=[@ANYBLOB="240000002e001f0700001a00000000000c00d60001"], 0x24}], 0x1, 0x0, 0x0, 0x4004000}, 0x0) sendmsg$tipc(r1, &(0x7f00000008c0)={&(0x7f0000000600)=@name, 0x10, 0x0, 0x0, 0x0, 0x0, 0x81}, 0x80) r3 = dup3(r0, r1, 0x0) r4 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(0xffffffffffffffff, 0x0, 0x0) setsockopt$TIPC_GROUP_JOIN(r4, 0x10f, 0x87, &(0x7f0000000180)={0x42}, 0x10) setsockopt$TIPC_GROUP_LEAVE(r3, 0x10f, 0x88) 389.095911ms ago: executing program 7 (id=742): mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x80) socketpair$unix(0x1, 0x2, 0x0, 0x0) r2 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) ioctl$KVM_GET_MSR_FEATURE_INDEX_LIST(r2, 0xc004ae0a, 0x0) 274.033463ms ago: executing program 7 (id=743): r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCADDRT(r0, 0x890b, &(0x7f0000000840)={0x0, {0x2, 0x0, @empty}, {0x4, 0x0, @empty}, {0x2, 0x0, @remote}, 0x4, 0x0, 0xa00000000000000, 0xfdffffffffffffff, 0x0, &(0x7f00000001c0)='lo\x00', 0x6, 0x0, 0x3}) 273.886803ms ago: executing program 7 (id=744): sendmsg$inet(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x4000000) r0 = socket$inet(0x2, 0x2, 0x1) sendmsg$inet(r0, &(0x7f0000000600)={&(0x7f0000000040)={0x2, 0xffff, @multicast2}, 0x10, &(0x7f0000000000)=[{&(0x7f00000002c0)="2a00a0df167e6d22", 0xffdf}], 0x1, &(0x7f0000000100)=ANY=[@ANYBLOB="1c000000000002000000000007000000830b040a0101027f000001010e0000001c000000000000000000000008"], 0x40}, 0xee00) 247.442914ms ago: executing program 7 (id=745): socket$nl_generic(0x10, 0x3, 0x10) (async) socket$nl_generic(0x10, 0x3, 0x10) socket$inet(0x2, 0x2, 0x1) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) (async) socket$nl_netfilter(0x10, 0x3, 0xc) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) (async) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) fsopen(&(0x7f00000001c0)='binfmt_misc\x00', 0x1) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='.\x00', 0x0, 0x0) getdents64(r0, 0x0, 0x20) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r2, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) (async) sendmsg$inet(r2, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r1, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000340)=[@cred={{0x1c}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x3c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x90}, 0x80) (async) recvmsg$unix(r1, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000340)=[@cred={{0x1c}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x3c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x90}, 0x80) socketpair$unix(0x1, 0x2, 0x0, 0x0) setuid(0xee01) syz_open_procfs(0x0, 0x0) syz_clone3(&(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) (async) r5 = syz_clone3(&(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) r6 = syz_pidfd_open(r5, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r6, 0xff03) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000001c0)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) ioctl$XFS_IOC_GET_RESBLKS(r6, 0x80105873, &(0x7f0000000000)) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0xc, 0x0, 0x0) syz_usb_connect(0x0, 0x5d, &(0x7f0000000200)=ANY=[@ANYBLOB="12010000551b8920b822276080c20102030109024b0001000000000904000000020a000005241301"], 0x0) (async) syz_usb_connect(0x0, 0x5d, &(0x7f0000000200)=ANY=[@ANYBLOB="12010000551b8920b822276080c20102030109024b0001000000000904000000020a000005241301"], 0x0) dup(r8) (async) r9 = dup(r8) syz_ublk_setup_queues(r9, r7, &(0x7f00000004c0)={0x0, 0x42cc, 0x10, 0x1, 0x7f}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe706, 0x1000, 0x1000002, 0x91, 0x0, r3}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3b00, 0x2, 0x4, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x93e9, 0x2000, 0x4003bfff, 0x2b9, 0x0, r4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5, 0x800, 0x1, 0x230, 0x0, r4}}], 0x1, 0x0, 0x0) 138.603136ms ago: executing program 3 (id=746): r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000040)={0x803}, 0x10) setsockopt$inet_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000100), 0x3) pipe2$9p(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) r3 = dup(r2) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000001040), 0x4, &(0x7f0000000000)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r3}, 0x2c, {[{@debug}]}}) sendmsg$nl_generic(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)={0x18, 0x52, 0x1, 0x0, 0x0, {0x2}, [@nested={0x4, 0x2}]}, 0x18}}, 0x0) preadv(r1, &(0x7f0000000600)=[{&(0x7f0000000200)=""/203, 0xcb}, {&(0x7f0000000300)=""/253, 0xfd}, {&(0x7f0000000400)=""/194, 0xc2}, {&(0x7f0000000500)=""/180, 0xb4}], 0x4, 0x0, 0x7fff) 57.972118ms ago: executing program 3 (id=747): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0x5001}) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000200)={'syzkaller1\x00', 0x1}) write$tun(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="03031b003a00320006006300000000443aff00000000000000000000ffffac141419ff0200000000000000000093ffffff01"], 0x76) 0s ago: executing program 3 (id=748): capset(&(0x7f0000000040)={0x20080522}, &(0x7f0000000000)={0x0, 0x8, 0x0, 0x3}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1\x00', 0x1ff) openat2(0xffffffffffffff9c, &(0x7f0000000040)='./config/usb_gadget/g1\x00', &(0x7f0000000080)={0x0, 0x0, 0x20}, 0x18) rmdir(&(0x7f0000000600)='./config/usb_gadget/g1\x00') setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000040)=[{0x6}]}, 0x10) capset(&(0x7f0000000040)={0x20080522}, &(0x7f0000000000)={0x0, 0x8, 0x0, 0x3}) (async) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) (async) mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1\x00', 0x1ff) (async) openat2(0xffffffffffffff9c, &(0x7f0000000040)='./config/usb_gadget/g1\x00', &(0x7f0000000080)={0x0, 0x0, 0x20}, 0x18) (async) rmdir(&(0x7f0000000600)='./config/usb_gadget/g1\x00') (async) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000040)=[{0x6}]}, 0x10) (async) kernel console output (not intermixed with test programs): 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 75.262890][ T1449] RSP: 002b:00007f69965d0028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 75.262922][ T1449] RAX: ffffffffffffffda RBX: 00007f6995a25fa0 RCX: 00007f699579e159 [ 75.262945][ T1449] RDX: 000000000000ee00 RSI: 0000200000000600 RDI: 0000000000000003 [ 75.262965][ T1449] RBP: 00007f69965d0090 R08: 0000000000000000 R09: 0000000000000000 [ 75.262985][ T1449] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 75.263003][ T1449] R13: 00007f6995a26038 R14: 00007f6995a25fa0 R15: 00007ffeee1e8d68 [ 75.263029][ T1449] [ 75.270401][ T10] usb 2-1: device descriptor read/8, error -71 [ 75.398256][ T66] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 75.459058][ T1452] ./dev/sda1: Can't lookup blockdev [ 75.465612][ T66] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 75.507997][ T10] usb usb2-port1: unable to enumerate USB device [ 75.513646][ T66] usb 4-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 75.637099][ T1454] netlink: 4096 bytes leftover after parsing attributes in process `syz.4.469'. [ 75.655011][ T66] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 75.663335][ T66] usb 4-1: SerialNumber: syz [ 75.695105][ T1458] FAULT_INJECTION: forcing a failure. [ 75.695105][ T1458] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 75.715886][ T1458] CPU: 0 UID: 0 PID: 1458 Comm: syz.4.471 Not tainted syzkaller #0 998a4fffdb5e6e31f7f8340a226dd9d0893c7622 [ 75.715921][ T1458] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 75.715935][ T1458] Call Trace: [ 75.715941][ T1458] [ 75.715951][ T1458] __dump_stack+0x21/0x30 [ 75.715986][ T1458] dump_stack_lvl+0x140/0x1c0 [ 75.716016][ T1458] ? __cfi_dump_stack_lvl+0x10/0x10 [ 75.716046][ T1458] dump_stack+0x19/0x20 [ 75.716073][ T1458] should_fail_ex+0x3c2/0x510 [ 75.716098][ T1458] should_fail+0xf/0x20 [ 75.716119][ T1458] should_fail_usercopy+0x1e/0x30 [ 75.716147][ T1458] _copy_to_user+0x24/0xa0 [ 75.716176][ T1458] ext4_ioctl_get_encryption_pwsalt+0x57f/0x9b0 [ 75.716202][ T1458] ext4_ioctl+0xb0d/0x3b50 [ 75.716229][ T1458] ? __cfi_ext4_ioctl+0x10/0x10 [ 75.716262][ T1458] ? __ia32_compat_sys_ioctl+0x980/0x980 [ 75.716295][ T1458] ? _parse_integer+0x2e/0x40 [ 75.716319][ T1458] ? ioctl_has_perm+0x39a/0x500 [ 75.716341][ T1458] ? has_cap_mac_admin+0xd0/0xd0 [ 75.716362][ T1458] ? proc_fail_nth_write+0x184/0x220 [ 75.716392][ T1458] ? __cfi_proc_fail_nth_write+0x10/0x10 [ 75.716427][ T1458] ? selinux_file_ioctl+0x732/0x1480 [ 75.716447][ T1458] ? vfs_write+0xbcf/0xfd0 [ 75.716468][ T1458] ? __cfi_selinux_file_ioctl+0x10/0x10 [ 75.716489][ T1458] ? __cfi_vfs_write+0x10/0x10 [ 75.716510][ T1458] ? __kasan_check_write+0x18/0x20 [ 75.716532][ T1458] ? mutex_unlock+0x90/0x240 [ 75.716559][ T1458] ? __cfi_mutex_unlock+0x10/0x10 [ 75.716582][ T1458] ? __fget_files+0x2bc/0x330 [ 75.716607][ T1458] ? bpf_lsm_file_ioctl+0xd/0x20 [ 75.716634][ T1458] ? security_file_ioctl+0x3e/0x110 [ 75.716653][ T1458] ? __cfi_ext4_ioctl+0x10/0x10 [ 75.716682][ T1458] __se_sys_ioctl+0x123/0x1b0 [ 75.716707][ T1458] __x64_sys_ioctl+0x7f/0xa0 [ 75.716731][ T1458] x64_sys_call+0x1878/0x2ee0 [ 75.716751][ T1458] do_syscall_64+0x57/0xf0 [ 75.716781][ T1458] ? clear_bhb_loop+0x50/0xa0 [ 75.716807][ T1458] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 75.716831][ T1458] RIP: 0033:0x7f699579e159 [ 75.716848][ T1458] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 75.716866][ T1458] RSP: 002b:00007f69965d0028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 75.716887][ T1458] RAX: ffffffffffffffda RBX: 00007f6995a25fa0 RCX: 00007f699579e159 [ 75.716903][ T1458] RDX: 0000000000000000 RSI: 0000000040106614 RDI: 0000000000000003 [ 75.716916][ T1458] RBP: 00007f69965d0090 R08: 0000000000000000 R09: 0000000000000000 [ 75.716930][ T1458] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 75.716944][ T1458] R13: 00007f6995a26038 R14: 00007f6995a25fa0 R15: 00007ffeee1e8d68 [ 75.716963][ T1458] [ 75.877060][ T66] usb 4-1: 0:2 : does not exist [ 76.047595][ T1464] SELinux: policydb magic number 0x0 does not match expected magic number 0xf97cff8c [ 76.063480][ T66] usb 4-1: USB disconnect, device number 22 [ 76.071134][ T1464] SELinux: failed to load policy [ 76.119760][ T1466] ./dev/sda1: Can't lookup blockdev [ 76.146696][ T36] kauditd_printk_skb: 6 callbacks suppressed [ 76.146715][ T36] audit: type=1400 audit(1788273954.179:290): avc: denied { mounton } for pid=1467 comm="syz.4.475" path="/15/dev" dev="devtmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=dir permissive=1 [ 76.245887][ T36] audit: type=1400 audit(1788273954.269:291): avc: denied { read write } for pid=1469 comm="syz.4.476" name="usbmon9" dev="devtmpfs" ino=118 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 76.269803][ T36] audit: type=1400 audit(1788273954.269:292): avc: denied { open } for pid=1469 comm="syz.4.476" path="/dev/usbmon9" dev="devtmpfs" ino=118 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 76.532855][ T1474] netlink: 'syz.3.477': attribute type 7 has an invalid length. [ 76.540894][ T1474] netlink: 232 bytes leftover after parsing attributes in process `syz.3.477'. [ 76.570447][ T1476] ./dev/sda1: Can't lookup blockdev [ 76.619948][ T36] audit: type=1400 audit(1788273954.649:293): avc: denied { setattr } for pid=1477 comm="syz.2.479" name="uinput" dev="devtmpfs" ino=194 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 76.705257][ T1485] FAULT_INJECTION: forcing a failure. [ 76.705257][ T1485] name failslab, interval 1, probability 0, space 0, times 0 [ 76.718392][ T1485] CPU: 1 UID: 0 PID: 1485 Comm: syz.2.481 Not tainted syzkaller #0 998a4fffdb5e6e31f7f8340a226dd9d0893c7622 [ 76.718435][ T1485] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 76.718453][ T1485] Call Trace: [ 76.718462][ T1485] [ 76.718473][ T1485] __dump_stack+0x21/0x30 [ 76.718516][ T1485] dump_stack_lvl+0x140/0x1c0 [ 76.718551][ T1485] ? __cfi_dump_stack_lvl+0x10/0x10 [ 76.718597][ T1485] ? __kasan_kmalloc+0x96/0xb0 [ 76.718630][ T1485] dump_stack+0x19/0x20 [ 76.718664][ T1485] should_fail_ex+0x3c2/0x510 [ 76.718696][ T1485] should_failslab+0xac/0x100 [ 76.718728][ T1485] __kmalloc_node_noprof+0x69/0x500 [ 76.718757][ T1485] ? __kvmalloc_node_noprof+0x128/0x300 [ 76.718784][ T1485] __kvmalloc_node_noprof+0x128/0x300 [ 76.718809][ T1485] ? __cfi___kvmalloc_node_noprof+0x10/0x10 [ 76.718834][ T1485] ? __kasan_check_write+0x18/0x20 [ 76.718859][ T1485] ? _raw_spin_lock+0x92/0x120 [ 76.718897][ T1485] ? __cfi__raw_spin_lock+0x10/0x10 [ 76.718935][ T1485] simple_xattr_alloc+0x67/0x140 [ 76.718966][ T1485] shmem_initxattrs+0x24f/0x530 [ 76.719011][ T1485] ? security_inode_init_security+0x11c/0x600 [ 76.719050][ T1485] security_inode_init_security+0x431/0x600 [ 76.719083][ T1485] ? current_umask+0x1a/0x80 [ 76.719110][ T1485] ? __cfi_shmem_initxattrs+0x10/0x10 [ 76.719148][ T1485] ? __cfi_security_inode_init_security+0x10/0x10 [ 76.719183][ T1485] ? simple_acl_create+0x190/0x1c0 [ 76.719211][ T1485] shmem_mknod+0xd5/0x200 [ 76.719248][ T1485] shmem_create+0x38/0x50 [ 76.719284][ T1485] vfs_create+0x4f5/0x730 [ 76.719319][ T1485] pending_reads_dispatch_ioctl+0x1973/0x2080 [ 76.719365][ T1485] ? __cfi_pending_reads_dispatch_ioctl+0x10/0x10 [ 76.719405][ T1485] ? selinux_file_ioctl+0x732/0x1480 [ 76.719431][ T1485] ? vfs_write+0xbcf/0xfd0 [ 76.719457][ T1485] ? __cfi_selinux_file_ioctl+0x10/0x10 [ 76.719484][ T1485] ? __cfi_vfs_write+0x10/0x10 [ 76.719511][ T1485] ? __kasan_check_write+0x18/0x20 [ 76.719537][ T1485] ? mutex_unlock+0x90/0x240 [ 76.719571][ T1485] ? __cfi_mutex_unlock+0x10/0x10 [ 76.719604][ T1485] ? bpf_lsm_file_ioctl+0xd/0x20 [ 76.719637][ T1485] ? security_file_ioctl+0x3e/0x110 [ 76.719661][ T1485] ? __cfi_pending_reads_dispatch_ioctl+0x10/0x10 [ 76.719700][ T1485] __se_sys_ioctl+0x123/0x1b0 [ 76.719733][ T1485] __x64_sys_ioctl+0x7f/0xa0 [ 76.719764][ T1485] x64_sys_call+0x1878/0x2ee0 [ 76.719788][ T1485] do_syscall_64+0x57/0xf0 [ 76.719825][ T1485] ? clear_bhb_loop+0x50/0xa0 [ 76.719855][ T1485] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 76.719883][ T1485] RIP: 0033:0x7f40c8b9e159 [ 76.719905][ T1485] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 76.719927][ T1485] RSP: 002b:00007f40c9b1b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 76.719967][ T1485] RAX: ffffffffffffffda RBX: 00007f40c8e25fa0 RCX: 00007f40c8b9e159 [ 76.719986][ T1485] RDX: 00002000000000c0 RSI: 00000000c058671e RDI: 0000000000000004 [ 76.720004][ T1485] RBP: 00007f40c9b1b090 R08: 0000000000000000 R09: 0000000000000000 [ 76.720021][ T1485] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 76.720036][ T1485] R13: 00007f40c8e26038 R14: 00007f40c8e25fa0 R15: 00007fff272358d8 [ 76.720058][ T1485] [ 77.073245][ T1487] tipc: Started in network mode [ 77.090621][ T1489] FAULT_INJECTION: forcing a failure. [ 77.090621][ T1489] name failslab, interval 1, probability 0, space 0, times 0 [ 77.097950][ T1487] tipc: Node identity , cluster identity 4711 [ 77.103787][ T1489] CPU: 1 UID: 0 PID: 1489 Comm: syz.2.483 Not tainted syzkaller #0 998a4fffdb5e6e31f7f8340a226dd9d0893c7622 [ 77.103879][ T1489] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 77.103913][ T1489] Call Trace: [ 77.103934][ T1489] [ 77.103963][ T1489] __dump_stack+0x21/0x30 [ 77.104061][ T1489] dump_stack_lvl+0x140/0x1c0 [ 77.104150][ T1489] ? __cfi_dump_stack_lvl+0x10/0x10 [ 77.104234][ T1489] dump_stack+0x19/0x20 [ 77.104314][ T1489] should_fail_ex+0x3c2/0x510 [ 77.104379][ T1489] should_failslab+0xac/0x100 [ 77.104464][ T1489] __kmalloc_node_track_caller_noprof+0x65/0x4f0 [ 77.104537][ T1489] ? __se_sys_ioctl+0x123/0x1b0 [ 77.104617][ T1489] ? x64_sys_call+0x1878/0x2ee0 [ 77.104671][ T1489] ? sidtab_sid2str_get+0x135/0x360 [ 77.104762][ T1489] ? entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 77.104846][ T1489] kmemdup_noprof+0x31/0x80 [ 77.104919][ T1489] sidtab_sid2str_get+0x135/0x360 [ 77.105012][ T1489] security_sid_to_context_core+0x30d/0x5d0 [ 77.105106][ T1489] security_sid_to_context_force+0x31/0x40 [ 77.105190][ T1489] selinux_inode_init_security+0x659/0x950 [ 77.105274][ T1489] ? __cfi_selinux_inode_init_security+0x10/0x10 [ 77.105359][ T1489] ? security_inode_init_security+0x11c/0x600 [ 77.105440][ T1489] ? __cfi_shmem_initxattrs+0x10/0x10 [ 77.105529][ T1489] ? __cfi_shmem_initxattrs+0x10/0x10 [ 77.105622][ T1489] security_inode_init_security+0x1a8/0x600 [ 77.105702][ T1489] ? current_umask+0x1a/0x80 [ 77.105778][ T1489] ? __cfi_security_inode_init_security+0x10/0x10 [ 77.105862][ T1489] ? simple_acl_create+0x190/0x1c0 [ 77.105924][ T1489] shmem_mknod+0xd5/0x200 [ 77.106024][ T1489] shmem_create+0x38/0x50 [ 77.106098][ T1489] vfs_create+0x4f5/0x730 [ 77.106172][ T1489] pending_reads_dispatch_ioctl+0x1973/0x2080 [ 77.106299][ T1489] ? __cfi_pending_reads_dispatch_ioctl+0x10/0x10 [ 77.106397][ T1489] ? selinux_file_ioctl+0x732/0x1480 [ 77.106452][ T1489] ? vfs_write+0xbcf/0xfd0 [ 77.106513][ T1489] ? __cfi_selinux_file_ioctl+0x10/0x10 [ 77.106570][ T1489] ? __cfi_vfs_write+0x10/0x10 [ 77.106633][ T1489] ? __kasan_check_write+0x18/0x20 [ 77.106694][ T1489] ? mutex_unlock+0x90/0x240 [ 77.106757][ T1489] ? __cfi_mutex_unlock+0x10/0x10 [ 77.106830][ T1489] ? bpf_lsm_file_ioctl+0xd/0x20 [ 77.106909][ T1489] ? security_file_ioctl+0x3e/0x110 [ 77.106973][ T1489] ? __cfi_pending_reads_dispatch_ioctl+0x10/0x10 [ 77.107076][ T1489] __se_sys_ioctl+0x123/0x1b0 [ 77.107152][ T1489] __x64_sys_ioctl+0x7f/0xa0 [ 77.107217][ T1489] x64_sys_call+0x1878/0x2ee0 [ 77.107276][ T1489] do_syscall_64+0x57/0xf0 [ 77.107358][ T1489] ? clear_bhb_loop+0x50/0xa0 [ 77.107423][ T1489] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 77.107491][ T1489] RIP: 0033:0x7f40c8b9e159 [ 77.107542][ T1489] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 77.107603][ T1489] RSP: 002b:00007f40c9b1b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 77.107700][ T1489] RAX: ffffffffffffffda RBX: 00007f40c8e25fa0 RCX: 00007f40c8b9e159 [ 77.107751][ T1489] RDX: 00002000000000c0 RSI: 00000000c058671e RDI: 0000000000000004 [ 77.107792][ T1489] RBP: 00007f40c9b1b090 R08: 0000000000000000 R09: 0000000000000000 [ 77.107827][ T1489] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 77.107867][ T1489] R13: 00007f40c8e26038 R14: 00007f40c8e25fa0 R15: 00007fff272358d8 [ 77.107921][ T1489] [ 77.473526][ T1495] loop5: detected capacity change from 0 to 7 [ 77.486223][ T1487] tipc: Failed to set node id, please configure manually [ 77.493334][ T1487] tipc: Enabling of bearer rejected, failed to enable media [ 77.498197][ T1495] Buffer I/O error on dev loop5, logical block 0, async page read [ 77.521845][ T1495] Buffer I/O error on dev loop5, logical block 0, async page read [ 77.556960][ T36] audit: type=1400 audit(1788273955.569:294): avc: denied { map } for pid=1494 comm="syz.2.484" path="/dev/zero" dev="devtmpfs" ino=5 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:zero_device_t tclass=chr_file permissive=1 [ 77.586083][ T1495] loop5: unable to read partition table [ 77.606122][ T1495] loop_reread_partitions: partition scan of loop5 (þ被xüŸÑø éÚ¬§½dƤ´à–ƒÝ¡¯¨â·û [ 77.606122][ T1495] ) failed (rc=-5) [ 77.620862][ T396] Buffer I/O error on dev loop5, logical block 0, async page read [ 77.643752][ T396] Buffer I/O error on dev loop5, logical block 0, async page read [ 77.665247][ T310] logitech-hidpp-device 0003:046D:C082.0006: hidraw0: USB HID v0.00 Device [syz0] on syz0 [ 77.681743][ T396] Buffer I/O error on dev loop5, logical block 0, async page read [ 77.705016][ T1503] FAULT_INJECTION: forcing a failure. [ 77.705016][ T1503] name failslab, interval 1, probability 0, space 0, times 0 [ 77.736499][ T396] Buffer I/O error on dev loop5, logical block 0, async page read [ 77.744547][ T396] Buffer I/O error on dev loop5, logical block 0, async page read [ 77.746203][ T1503] CPU: 1 UID: 0 PID: 1503 Comm: syz.3.488 Not tainted syzkaller #0 998a4fffdb5e6e31f7f8340a226dd9d0893c7622 [ 77.746295][ T1503] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 77.746338][ T1503] Call Trace: [ 77.746368][ T1503] [ 77.746391][ T1503] __dump_stack+0x21/0x30 [ 77.746500][ T1503] dump_stack_lvl+0x140/0x1c0 [ 77.746593][ T1503] ? __cfi_dump_stack_lvl+0x10/0x10 [ 77.746698][ T1503] dump_stack+0x19/0x20 [ 77.746781][ T1503] should_fail_ex+0x3c2/0x510 [ 77.746865][ T1503] should_failslab+0xac/0x100 [ 77.746951][ T1503] kmem_cache_alloc_noprof+0x42/0x410 [ 77.747021][ T1503] ? security_inode_alloc+0x51/0x230 [ 77.747103][ T1503] ? __cfi_make_kgid+0x10/0x10 [ 77.747180][ T1503] security_inode_alloc+0x51/0x230 [ 77.747261][ T1503] inode_init_always_gfp+0x756/0x9e0 [ 77.747344][ T1503] alloc_inode+0xc5/0x270 [ 77.747450][ T1503] new_inode_pseudo+0x19/0x40 [ 77.747561][ T1503] alloc_anon_inode+0x21/0x340 [ 77.747654][ T1503] aio_setup_ring+0xfa/0xc60 [ 77.747735][ T1503] ? pcpu_alloc_noprof+0xd93/0x1440 [ 77.747811][ T1503] ? free_ioctx_reqs+0x170/0x170 [ 77.747901][ T1503] ioctx_alloc+0x337/0x840 [ 77.747973][ T1503] __se_sys_io_setup+0x6f/0x230 [ 77.748046][ T1503] __x64_sys_io_setup+0x5f/0x80 [ 77.748118][ T1503] x64_sys_call+0x26a4/0x2ee0 [ 77.748180][ T1503] do_syscall_64+0x57/0xf0 [ 77.748273][ T1503] ? clear_bhb_loop+0x50/0xa0 [ 77.748347][ T1503] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 77.748421][ T1503] RIP: 0033:0x7f88b379e159 [ 77.748474][ T1503] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 77.748529][ T1503] RSP: 002b:00007f88b4674028 EFLAGS: 00000246 ORIG_RAX: 00000000000000ce [ 77.748601][ T1503] RAX: ffffffffffffffda RBX: 00007f88b3a25fa0 RCX: 00007f88b379e159 [ 77.748651][ T1503] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000008001 [ 77.748692][ T1503] RBP: 00007f88b3835024 R08: 0000000000000000 R09: 0000000000000000 [ 77.748734][ T1503] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 77.748776][ T1503] R13: 00007f88b3a26038 R14: 00007f88b3a25fa0 R15: 00007ffdcb5ccf58 [ 77.748844][ T1503] [ 77.979490][ T396] Buffer I/O error on dev loop5, logical block 0, async page read [ 77.987563][ T396] Buffer I/O error on dev loop5, logical block 0, async page read [ 77.995555][ T396] Buffer I/O error on dev loop5, logical block 0, async page read [ 78.015396][ T1505] ./dev/sda1: Can't lookup blockdev [ 78.061260][ T36] audit: type=1400 audit(1788273956.089:295): avc: denied { read write } for pid=1510 comm="syz.3.490" name="control" dev="devtmpfs" ino=198 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 78.101185][ T36] audit: type=1400 audit(1788273956.089:296): avc: denied { open } for pid=1510 comm="syz.3.490" path="/114/dev/mapper/control" dev="devtmpfs" ino=198 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 78.126118][ T36] audit: type=1400 audit(1788273956.089:297): avc: denied { ioctl } for pid=1510 comm="syz.3.490" path="/114/dev/mapper/control" dev="devtmpfs" ino=198 ioctlcmd=0xfd04 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 78.234337][ T1526] netlink: 8 bytes leftover after parsing attributes in process `syz.1.492'. [ 78.321736][ T1531] FAULT_INJECTION: forcing a failure. [ 78.321736][ T1531] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 78.335070][ T1531] CPU: 1 UID: 0 PID: 1531 Comm: syz.4.494 Not tainted syzkaller #0 998a4fffdb5e6e31f7f8340a226dd9d0893c7622 [ 78.335114][ T1531] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 78.335130][ T1531] Call Trace: [ 78.335139][ T1531] [ 78.335150][ T1531] __dump_stack+0x21/0x30 [ 78.335191][ T1531] dump_stack_lvl+0x140/0x1c0 [ 78.335227][ T1531] ? __cfi_dump_stack_lvl+0x10/0x10 [ 78.335264][ T1531] ? check_stack_object+0x81/0x150 [ 78.335291][ T1531] ? __virt_addr_valid+0x2a1/0x370 [ 78.335323][ T1531] dump_stack+0x19/0x20 [ 78.335357][ T1531] should_fail_ex+0x3c2/0x510 [ 78.335388][ T1531] should_fail+0xf/0x20 [ 78.335416][ T1531] should_fail_usercopy+0x1e/0x30 [ 78.335448][ T1531] _copy_from_user+0x20/0xa0 [ 78.335483][ T1531] csum_and_copy_from_iter_full+0x1ee/0x1c70 [ 78.335526][ T1531] ? kasan_save_alloc_info+0x3a/0x50 [ 78.335552][ T1531] ? __cfi_csum_and_copy_from_iter_full+0x10/0x10 [ 78.335584][ T1531] ? __alloc_skb+0x13f/0x360 [ 78.335613][ T1531] ? __build_skb_around+0x2a4/0x590 [ 78.335642][ T1531] ping_getfrag+0x7a/0x260 [ 78.335676][ T1531] __ip_append_data+0x2d31/0x3b60 [ 78.335715][ T1531] ? __cfi_ping_getfrag+0x10/0x10 [ 78.335750][ T1531] ? ip_setup_cork+0x9f0/0x9f0 [ 78.335780][ T1531] ? __kasan_check_read+0x15/0x20 [ 78.335804][ T1531] ? ip_setup_cork+0x583/0x9f0 [ 78.335840][ T1531] ip_append_data+0x109/0x1a0 [ 78.335867][ T1531] ? __cfi_ping_getfrag+0x10/0x10 [ 78.335869][ T310] usb 3-1: new high-speed USB device number 23 using dummy_hcd [ 78.335898][ T1531] ping_v4_sendmsg+0xfa9/0x1380 [ 78.335976][ T1531] ? __cfi_ping_v4_sendmsg+0x10/0x10 [ 78.336093][ T1531] ? ip4_datagram_release_cb+0x637/0x820 [ 78.336180][ T1531] ? is_bpf_text_address+0x17b/0x1a0 [ 78.336272][ T1531] ? release_sock+0x171/0x1f0 [ 78.336334][ T1531] ? inet_send_prepare+0x1e7/0x4e0 [ 78.336399][ T1531] ? __cfi_ping_v4_sendmsg+0x10/0x10 [ 78.336484][ T1531] inet_sendmsg+0x113/0x120 [ 78.336548][ T1531] ____sys_sendmsg+0x822/0xa00 [ 78.336646][ T1531] ? __sys_sendmsg_sock+0x50/0x50 [ 78.336729][ T1531] ? import_iovec+0x80/0xb0 [ 78.336812][ T1531] ___sys_sendmsg+0x2a6/0x370 [ 78.336886][ T1531] ? __sys_sendmsg+0x260/0x260 [ 78.336970][ T1531] ? proc_fail_nth_write+0x184/0x220 [ 78.337059][ T1531] ? __cfi_proc_fail_nth_write+0x10/0x10 [ 78.337160][ T1531] ? __fget_files+0x2bc/0x330 [ 78.337233][ T1531] __x64_sys_sendmsg+0x1be/0x2a0 [ 78.337312][ T1531] ? fput+0x1a4/0x230 [ 78.337385][ T1531] ? __cfi___x64_sys_sendmsg+0x10/0x10 [ 78.337494][ T1531] ? ksys_write+0x1f3/0x260 [ 78.337571][ T1531] ? __kasan_check_read+0x15/0x20 [ 78.337634][ T1531] x64_sys_call+0x2a4c/0x2ee0 [ 78.337694][ T1531] do_syscall_64+0x57/0xf0 [ 78.337778][ T1531] ? clear_bhb_loop+0x50/0xa0 [ 78.337850][ T1531] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 78.337920][ T1531] RIP: 0033:0x7f699579e159 [ 78.337973][ T1531] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 78.338028][ T1531] RSP: 002b:00007f69965d0028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 78.338099][ T1531] RAX: ffffffffffffffda RBX: 00007f6995a25fa0 RCX: 00007f699579e159 [ 78.338148][ T1531] RDX: 000000000000ee00 RSI: 0000200000000600 RDI: 0000000000000003 [ 78.338189][ T1531] RBP: 00007f69965d0090 R08: 0000000000000000 R09: 0000000000000000 [ 78.338231][ T1531] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 78.338265][ T1531] R13: 00007f6995a26038 R14: 00007f6995a25fa0 R15: 00007ffeee1e8d68 [ 78.338316][ T1531] [ 78.727340][ T1540] ./dev/sda1: Can't lookup blockdev [ 78.835875][ T310] usb 3-1: Using ep0 maxpacket: 32 [ 78.842349][ T310] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 78.852756][ T310] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 78.861843][ T310] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 78.874325][ T310] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 78.885862][ T310] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 78.893915][ T310] usb 3-1: Product: syz [ 78.915870][ T310] usb 3-1: Manufacturer: syz [ 78.920535][ T310] usb 3-1: SerialNumber: syz [ 78.937155][ T310] cdc_ncm 3-1:1.0: CDC Union missing and no IAD found [ 78.945226][ T310] cdc_ncm 3-1:1.0: bind() failure [ 78.960688][ T1549] FAULT_INJECTION: forcing a failure. [ 78.960688][ T1549] name failslab, interval 1, probability 0, space 0, times 0 [ 78.973416][ T1549] CPU: 1 UID: 0 PID: 1549 Comm: syz.3.501 Not tainted syzkaller #0 998a4fffdb5e6e31f7f8340a226dd9d0893c7622 [ 78.973456][ T1549] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 78.973473][ T1549] Call Trace: [ 78.973482][ T1549] [ 78.973494][ T1549] __dump_stack+0x21/0x30 [ 78.973547][ T1549] dump_stack_lvl+0x140/0x1c0 [ 78.973583][ T1549] ? __cfi_dump_stack_lvl+0x10/0x10 [ 78.973619][ T1549] ? __kmalloc_node_noprof+0x252/0x500 [ 78.973647][ T1549] ? __kvmalloc_node_noprof+0x128/0x300 [ 78.973674][ T1549] dump_stack+0x19/0x20 [ 78.973708][ T1549] should_fail_ex+0x3c2/0x510 [ 78.973738][ T1549] ? shmem_initxattrs+0x2a8/0x530 [ 78.973776][ T1549] should_failslab+0xac/0x100 [ 78.973809][ T1549] __kmalloc_noprof+0x69/0x510 [ 78.973836][ T1549] ? shmem_initxattrs+0x2a8/0x530 [ 78.973873][ T1549] ? simple_xattr_alloc+0xa2/0x140 [ 78.973903][ T1549] shmem_initxattrs+0x2a8/0x530 [ 78.973942][ T1549] security_inode_init_security+0x431/0x600 [ 78.973977][ T1549] ? current_umask+0x1a/0x80 [ 78.974004][ T1549] ? __cfi_shmem_initxattrs+0x10/0x10 [ 78.974041][ T1549] ? __cfi_security_inode_init_security+0x10/0x10 [ 78.974077][ T1549] ? simple_acl_create+0x190/0x1c0 [ 78.974103][ T1549] shmem_mknod+0xd5/0x200 [ 78.974140][ T1549] shmem_create+0x38/0x50 [ 78.974175][ T1549] vfs_create+0x4f5/0x730 [ 78.974210][ T1549] pending_reads_dispatch_ioctl+0x1973/0x2080 [ 78.974252][ T1549] ? __cfi_pending_reads_dispatch_ioctl+0x10/0x10 [ 78.974293][ T1549] ? selinux_file_ioctl+0x732/0x1480 [ 78.974358][ T1549] ? vfs_write+0xbcf/0xfd0 [ 78.974385][ T1549] ? __cfi_selinux_file_ioctl+0x10/0x10 [ 78.974412][ T1549] ? __cfi_vfs_write+0x10/0x10 [ 78.974440][ T1549] ? __kasan_check_write+0x18/0x20 [ 78.974466][ T1549] ? mutex_unlock+0x90/0x240 [ 78.974495][ T1549] ? __cfi_mutex_unlock+0x10/0x10 [ 78.974528][ T1549] ? bpf_lsm_file_ioctl+0xd/0x20 [ 78.974561][ T1549] ? security_file_ioctl+0x3e/0x110 [ 78.974586][ T1549] ? __cfi_pending_reads_dispatch_ioctl+0x10/0x10 [ 78.974625][ T1549] __se_sys_ioctl+0x123/0x1b0 [ 78.974658][ T1549] __x64_sys_ioctl+0x7f/0xa0 [ 78.974690][ T1549] x64_sys_call+0x1878/0x2ee0 [ 78.974714][ T1549] do_syscall_64+0x57/0xf0 [ 78.974751][ T1549] ? clear_bhb_loop+0x50/0xa0 [ 78.974782][ T1549] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 78.974810][ T1549] RIP: 0033:0x7f88b379e159 [ 78.974832][ T1549] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 78.974856][ T1549] RSP: 002b:00007f88b4674028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 78.974884][ T1549] RAX: ffffffffffffffda RBX: 00007f88b3a25fa0 RCX: 00007f88b379e159 [ 78.974905][ T1549] RDX: 00002000000000c0 RSI: 00000000c058671e RDI: 0000000000000004 [ 78.974924][ T1549] RBP: 00007f88b4674090 R08: 0000000000000000 R09: 0000000000000000 [ 78.974942][ T1549] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 78.974959][ T1549] R13: 00007f88b3a26038 R14: 00007f88b3a25fa0 R15: 00007ffdcb5ccf58 [ 78.974982][ T1549] [ 79.341463][ T1555] FAULT_INJECTION: forcing a failure. [ 79.341463][ T1555] name failslab, interval 1, probability 0, space 0, times 0 [ 79.371105][ T1555] CPU: 1 UID: 0 PID: 1555 Comm: syz.3.504 Not tainted syzkaller #0 998a4fffdb5e6e31f7f8340a226dd9d0893c7622 [ 79.371147][ T1555] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 79.371166][ T1555] Call Trace: [ 79.371175][ T1555] [ 79.371185][ T1555] __dump_stack+0x21/0x30 [ 79.371229][ T1555] dump_stack_lvl+0x140/0x1c0 [ 79.371265][ T1555] ? __cfi_dump_stack_lvl+0x10/0x10 [ 79.371301][ T1555] ? __kasan_kmalloc+0x96/0xb0 [ 79.371335][ T1555] dump_stack+0x19/0x20 [ 79.371369][ T1555] should_fail_ex+0x3c2/0x510 [ 79.371399][ T1555] should_failslab+0xac/0x100 [ 79.371432][ T1555] __kmalloc_node_track_caller_noprof+0x65/0x4f0 [ 79.371464][ T1555] ? simple_xattr_set+0x5e/0x300 [ 79.371494][ T1555] ? __asan_memcpy+0x5a/0x80 [ 79.371521][ T1555] kstrdup+0x4d/0x130 [ 79.371558][ T1555] simple_xattr_set+0x5e/0x300 [ 79.371588][ T1555] shmem_xattr_handler_set+0x198/0x2d0 [ 79.371624][ T1555] ? __cfi_shmem_xattr_handler_set+0x10/0x10 [ 79.371659][ T1555] __vfs_setxattr+0x456/0x4a0 [ 79.371686][ T1555] __vfs_setxattr_noperm+0x12d/0x670 [ 79.371712][ T1555] __vfs_setxattr_locked+0x212/0x240 [ 79.371738][ T1555] vfs_setxattr+0x16b/0x2f0 [ 79.371762][ T1555] ? __cfi_vfs_setxattr+0x10/0x10 [ 79.371788][ T1555] ? __kasan_check_write+0x18/0x20 [ 79.371815][ T1555] pending_reads_dispatch_ioctl+0x1ab4/0x2080 [ 79.371857][ T1555] ? __cfi_pending_reads_dispatch_ioctl+0x10/0x10 [ 79.371907][ T1555] ? selinux_file_ioctl+0x732/0x1480 [ 79.371933][ T1555] ? vfs_write+0xbcf/0xfd0 [ 79.371959][ T1555] ? __cfi_selinux_file_ioctl+0x10/0x10 [ 79.371987][ T1555] ? __cfi_vfs_write+0x10/0x10 [ 79.372014][ T1555] ? __kasan_check_write+0x18/0x20 [ 79.372040][ T1555] ? mutex_unlock+0x90/0x240 [ 79.372068][ T1555] ? __cfi_mutex_unlock+0x10/0x10 [ 79.372101][ T1555] ? bpf_lsm_file_ioctl+0xd/0x20 [ 79.372135][ T1555] ? security_file_ioctl+0x3e/0x110 [ 79.372160][ T1555] ? __cfi_pending_reads_dispatch_ioctl+0x10/0x10 [ 79.372200][ T1555] __se_sys_ioctl+0x123/0x1b0 [ 79.372233][ T1555] __x64_sys_ioctl+0x7f/0xa0 [ 79.372263][ T1555] x64_sys_call+0x1878/0x2ee0 [ 79.372287][ T1555] do_syscall_64+0x57/0xf0 [ 79.372324][ T1555] ? clear_bhb_loop+0x50/0xa0 [ 79.372354][ T1555] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 79.372381][ T1555] RIP: 0033:0x7f88b379e159 [ 79.372404][ T1555] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 79.372426][ T1555] RSP: 002b:00007f88b4674028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 79.372455][ T1555] RAX: ffffffffffffffda RBX: 00007f88b3a25fa0 RCX: 00007f88b379e159 [ 79.372475][ T1555] RDX: 00002000000000c0 RSI: 00000000c058671e RDI: 0000000000000004 [ 79.372494][ T1555] RBP: 00007f88b4674090 R08: 0000000000000000 R09: 0000000000000000 [ 79.372512][ T1555] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 79.372529][ T1555] R13: 00007f88b3a26038 R14: 00007f88b3a25fa0 R15: 00007ffdcb5ccf58 [ 79.372553][ T1555] [ 79.713717][ T1562] FAULT_INJECTION: forcing a failure. [ 79.713717][ T1562] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 79.744333][ T1562] CPU: 0 UID: 0 PID: 1562 Comm: syz.4.506 Not tainted syzkaller #0 998a4fffdb5e6e31f7f8340a226dd9d0893c7622 [ 79.744382][ T1562] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 79.744399][ T1562] Call Trace: [ 79.744408][ T1562] [ 79.744418][ T1562] __dump_stack+0x21/0x30 [ 79.744456][ T1562] dump_stack_lvl+0x140/0x1c0 [ 79.744488][ T1562] ? __cfi_dump_stack_lvl+0x10/0x10 [ 79.744521][ T1562] ? check_stack_object+0x138/0x150 [ 79.744547][ T1562] dump_stack+0x19/0x20 [ 79.744577][ T1562] should_fail_ex+0x3c2/0x510 [ 79.744606][ T1562] should_fail+0xf/0x20 [ 79.744632][ T1562] should_fail_usercopy+0x1e/0x30 [ 79.744662][ T1562] _copy_to_user+0x24/0xa0 [ 79.744696][ T1562] simple_read_from_buffer+0xed/0x160 [ 79.744730][ T1562] proc_fail_nth_read+0x1aa/0x220 [ 79.744763][ T1562] ? __cfi_proc_fail_nth_read+0x10/0x10 [ 79.744797][ T1562] ? bpf_lsm_file_permission+0xd/0x20 [ 79.744827][ T1562] ? __cfi_proc_fail_nth_read+0x10/0x10 [ 79.744861][ T1562] vfs_read+0x288/0xc70 [ 79.744885][ T1562] ? __cfi_selinux_file_ioctl+0x10/0x10 [ 79.744911][ T1562] ? __cfi_vfs_read+0x10/0x10 [ 79.744934][ T1562] ? __kasan_check_write+0x18/0x20 [ 79.744958][ T1562] ? mutex_lock+0x97/0x1d0 [ 79.744985][ T1562] ? __cfi_mutex_lock+0x10/0x10 [ 79.745014][ T1562] ksys_read+0x145/0x260 [ 79.745037][ T1562] ? __cfi_ksys_read+0x10/0x10 [ 79.745060][ T1562] ? __kasan_check_write+0x18/0x20 [ 79.745083][ T1562] ? fput+0x1a4/0x230 [ 79.745113][ T1562] ? __kasan_check_read+0x15/0x20 [ 79.745137][ T1562] __x64_sys_read+0x7f/0x90 [ 79.745162][ T1562] x64_sys_call+0x2638/0x2ee0 [ 79.745184][ T1562] do_syscall_64+0x57/0xf0 [ 79.745219][ T1562] ? clear_bhb_loop+0x50/0xa0 [ 79.745247][ T1562] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 79.745274][ T1562] RIP: 0033:0x7f699575e98e [ 79.745294][ T1562] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 79.745312][ T1562] RSP: 002b:00007f69965cffe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 79.745347][ T1562] RAX: ffffffffffffffda RBX: 00007f69965d06c0 RCX: 00007f699575e98e [ 79.745363][ T1562] RDX: 000000000000000f RSI: 00007f69965d00a0 RDI: 0000000000000004 [ 79.745378][ T1562] RBP: 00007f69965d0090 R08: 0000000000000000 R09: 0000000000000000 [ 79.745393][ T1562] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 79.745407][ T1562] R13: 00007f6995a26038 R14: 00007f6995a25fa0 R15: 00007ffeee1e8d68 [ 79.745428][ T1562] [ 80.039083][ T36] audit: type=1400 audit(1788273958.069:298): avc: denied { create } for pid=1563 comm="syz.3.508" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=user_namespace permissive=1 [ 80.087788][ T36] audit: type=1400 audit(1788273958.079:299): avc: denied { sys_admin } for pid=1563 comm="syz.3.508" capability=21 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=cap_userns permissive=1 [ 80.115927][ T31] usb 2-1: new high-speed USB device number 26 using dummy_hcd [ 80.255879][ T31] usb 2-1: device descriptor read/64, error -71 [ 80.495906][ T31] usb 2-1: device descriptor read/64, error -71 [ 80.627444][ T1512] bridge_slave_1: left allmulticast mode [ 80.633219][ T1512] bridge_slave_1: left promiscuous mode [ 80.640278][ T1512] bridge0: port 2(bridge_slave_1) entered disabled state [ 80.648371][ T1512] bridge_slave_0: left allmulticast mode [ 80.654143][ T1512] bridge_slave_0: left promiscuous mode [ 80.660244][ T1512] bridge0: port 1(bridge_slave_0) entered disabled state [ 80.745936][ T31] usb 2-1: new high-speed USB device number 27 using dummy_hcd [ 80.760177][ T1577] bridge0: port 1(bridge_slave_0) entered blocking state [ 80.773886][ T1577] bridge0: port 1(bridge_slave_0) entered disabled state [ 80.786493][ T1577] bridge_slave_0: entered allmulticast mode [ 80.798457][ T1577] bridge_slave_0: entered promiscuous mode [ 80.812779][ T1512] veth1_macvtap: left promiscuous mode [ 80.818445][ T1512] veth0_vlan: left promiscuous mode [ 80.885900][ T31] usb 2-1: device descriptor read/64, error -71 [ 80.964917][ T1577] bridge0: port 2(bridge_slave_1) entered blocking state [ 80.976467][ T1577] bridge0: port 2(bridge_slave_1) entered disabled state [ 80.991319][ T1577] bridge_slave_1: entered allmulticast mode [ 81.005560][ T1577] bridge_slave_1: entered promiscuous mode [ 81.101639][ T10] usb 3-1: USB disconnect, device number 23 [ 81.125878][ T31] usb 2-1: device descriptor read/64, error -71 [ 81.173489][ T1577] bridge0: port 2(bridge_slave_1) entered blocking state [ 81.180732][ T1577] bridge0: port 2(bridge_slave_1) entered forwarding state [ 81.188086][ T1577] bridge0: port 1(bridge_slave_0) entered blocking state [ 81.195187][ T1577] bridge0: port 1(bridge_slave_0) entered forwarding state [ 81.204875][ T1592] ./dev/sda1: Can't lookup blockdev [ 81.237348][ T31] usb usb2-port1: attempt power cycle [ 81.242405][ T1594] FAULT_INJECTION: forcing a failure. [ 81.242405][ T1594] name failslab, interval 1, probability 0, space 0, times 0 [ 81.264625][ T1508] bridge0: port 1(bridge_slave_0) entered disabled state [ 81.275802][ T1594] CPU: 0 UID: 0 PID: 1594 Comm: syz.3.521 Not tainted syzkaller #0 998a4fffdb5e6e31f7f8340a226dd9d0893c7622 [ 81.275842][ T1594] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 81.275857][ T1594] Call Trace: [ 81.275865][ T1594] [ 81.275874][ T1594] __dump_stack+0x21/0x30 [ 81.275912][ T1594] dump_stack_lvl+0x140/0x1c0 [ 81.275944][ T1594] ? __cfi_dump_stack_lvl+0x10/0x10 [ 81.275978][ T1594] ? csum_and_copy_from_iter_full+0x2e8/0x1c70 [ 81.276021][ T1594] dump_stack+0x19/0x20 [ 81.276067][ T1594] should_fail_ex+0x3c2/0x510 [ 81.276095][ T1594] should_failslab+0xac/0x100 [ 81.276133][ T1594] kmem_cache_alloc_node_noprof+0x45/0x420 [ 81.276159][ T1594] ? __alloc_skb+0x10c/0x360 [ 81.276183][ T1594] ? __build_skb_around+0x2a4/0x590 [ 81.276210][ T1594] __alloc_skb+0x10c/0x360 [ 81.276235][ T1594] __ip_append_data+0x2965/0x3b60 [ 81.276270][ T1594] ? __cfi_ping_getfrag+0x10/0x10 [ 81.276302][ T1594] ? ip_setup_cork+0x9f0/0x9f0 [ 81.276329][ T1594] ? __kasan_check_read+0x15/0x20 [ 81.276353][ T1594] ? ip_setup_cork+0x583/0x9f0 [ 81.276382][ T1594] ip_append_data+0x109/0x1a0 [ 81.276411][ T1594] ? __cfi_ping_getfrag+0x10/0x10 [ 81.276439][ T1594] ping_v4_sendmsg+0xfa9/0x1380 [ 81.276471][ T1594] ? __cfi_ping_v4_sendmsg+0x10/0x10 [ 81.276501][ T1594] ? ip4_datagram_release_cb+0x637/0x820 [ 81.276527][ T1594] ? is_bpf_text_address+0x17b/0x1a0 [ 81.276564][ T1594] ? release_sock+0x171/0x1f0 [ 81.276588][ T1594] ? inet_send_prepare+0x1e7/0x4e0 [ 81.276610][ T1594] ? __cfi_ping_v4_sendmsg+0x10/0x10 [ 81.276640][ T1594] inet_sendmsg+0x113/0x120 [ 81.276662][ T1594] ____sys_sendmsg+0x822/0xa00 [ 81.276695][ T1594] ? __sys_sendmsg_sock+0x50/0x50 [ 81.276727][ T1594] ? import_iovec+0x80/0xb0 [ 81.276762][ T1594] ___sys_sendmsg+0x2a6/0x370 [ 81.276793][ T1594] ? __sys_sendmsg+0x260/0x260 [ 81.276824][ T1594] ? proc_fail_nth_write+0x184/0x220 [ 81.276860][ T1594] ? __cfi_proc_fail_nth_write+0x10/0x10 [ 81.276899][ T1594] ? __fget_files+0x2bc/0x330 [ 81.276929][ T1594] __x64_sys_sendmsg+0x1be/0x2a0 [ 81.276960][ T1594] ? fput+0x1a4/0x230 [ 81.276991][ T1594] ? __cfi___x64_sys_sendmsg+0x10/0x10 [ 81.277023][ T1594] ? ksys_write+0x1f3/0x260 [ 81.277048][ T1594] ? __kasan_check_read+0x15/0x20 [ 81.277073][ T1594] x64_sys_call+0x2a4c/0x2ee0 [ 81.277094][ T1594] do_syscall_64+0x57/0xf0 [ 81.277137][ T1594] ? clear_bhb_loop+0x50/0xa0 [ 81.277165][ T1594] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 81.277190][ T1594] RIP: 0033:0x7f88b379e159 [ 81.277209][ T1594] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 81.277230][ T1594] RSP: 002b:00007f88b4674028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 81.277256][ T1594] RAX: ffffffffffffffda RBX: 00007f88b3a25fa0 RCX: 00007f88b379e159 [ 81.277275][ T1594] RDX: 000000000000ee00 RSI: 0000200000000600 RDI: 0000000000000003 [ 81.277290][ T1594] RBP: 00007f88b4674090 R08: 0000000000000000 R09: 0000000000000000 [ 81.277304][ T1594] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 81.277318][ T1594] R13: 00007f88b3a26038 R14: 00007f88b3a25fa0 R15: 00007ffdcb5ccf58 [ 81.277338][ T1594] [ 81.593182][ T1508] bridge0: port 2(bridge_slave_1) entered disabled state [ 81.615357][ T1508] bridge0: port 1(bridge_slave_0) entered blocking state [ 81.622492][ T1508] bridge0: port 1(bridge_slave_0) entered forwarding state [ 81.641612][ T1508] bridge0: port 2(bridge_slave_1) entered blocking state [ 81.648864][ T1508] bridge0: port 2(bridge_slave_1) entered forwarding state [ 81.656358][ T31] usb 2-1: new high-speed USB device number 28 using dummy_hcd [ 81.703880][ T31] usb 2-1: device descriptor read/8, error -71 [ 81.720650][ T1577] veth0_vlan: entered promiscuous mode [ 81.737415][ T1577] veth1_macvtap: entered promiscuous mode [ 81.817694][ T1603] mmap: syz.3.525 (1603): VmData 29192192 exceed data ulimit 0. Update limits or use boot option ignore_rlimit_data. [ 81.850687][ T31] usb 2-1: device descriptor read/8, error -71 [ 81.885906][ T66] usb 3-1: new full-speed USB device number 24 using dummy_hcd [ 82.001190][ T1613] ./dev/sda1: Can't lookup blockdev [ 82.015928][ T66] usb 3-1: device descriptor read/64, error -71 [ 82.095944][ T31] usb 2-1: new high-speed USB device number 29 using dummy_hcd [ 82.105921][ T1618] netlink: 56 bytes leftover after parsing attributes in process `syz.3.531'. [ 82.126891][ T31] usb 2-1: device descriptor read/8, error -71 [ 82.257034][ T31] usb 2-1: device descriptor read/8, error -71 [ 82.276086][ T66] usb 3-1: device descriptor read/64, error -71 [ 82.367337][ T31] usb usb2-port1: unable to enumerate USB device [ 82.375967][ T310] usb 6-1: new full-speed USB device number 2 using dummy_hcd [ 82.384578][ T1624] FAULT_INJECTION: forcing a failure. [ 82.384578][ T1624] name failslab, interval 1, probability 0, space 0, times 0 [ 82.397295][ T1624] CPU: 0 UID: 0 PID: 1624 Comm: syz.1.534 Not tainted syzkaller #0 998a4fffdb5e6e31f7f8340a226dd9d0893c7622 [ 82.397334][ T1624] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 82.397351][ T1624] Call Trace: [ 82.397361][ T1624] [ 82.397372][ T1624] __dump_stack+0x21/0x30 [ 82.397416][ T1624] dump_stack_lvl+0x140/0x1c0 [ 82.397452][ T1624] ? __cfi_dump_stack_lvl+0x10/0x10 [ 82.397489][ T1624] ? mas_alloc_nodes+0x371/0x9d0 [ 82.397522][ T1624] dump_stack+0x19/0x20 [ 82.397556][ T1624] should_fail_ex+0x3c2/0x510 [ 82.397588][ T1624] should_failslab+0xac/0x100 [ 82.397621][ T1624] __kmalloc_node_noprof+0x69/0x500 [ 82.397650][ T1624] ? __kvmalloc_node_noprof+0x128/0x300 [ 82.397677][ T1624] __kvmalloc_node_noprof+0x128/0x300 [ 82.397702][ T1624] ? __cfi___kvmalloc_node_noprof+0x10/0x10 [ 82.397729][ T1624] simple_xattr_alloc+0x67/0x140 [ 82.397760][ T1624] simple_xattr_set+0x45/0x300 [ 82.397790][ T1624] shmem_xattr_handler_set+0x198/0x2d0 [ 82.397826][ T1624] ? __cfi_shmem_xattr_handler_set+0x10/0x10 [ 82.397863][ T1624] __vfs_setxattr+0x456/0x4a0 [ 82.397889][ T1624] __vfs_setxattr_noperm+0x12d/0x670 [ 82.397916][ T1624] __vfs_setxattr_locked+0x212/0x240 [ 82.397943][ T1624] vfs_setxattr+0x16b/0x2f0 [ 82.397968][ T1624] ? __cfi_vfs_setxattr+0x10/0x10 [ 82.397993][ T1624] ? __kasan_check_write+0x18/0x20 [ 82.398028][ T1624] pending_reads_dispatch_ioctl+0x1ab4/0x2080 [ 82.398071][ T1624] ? __cfi_pending_reads_dispatch_ioctl+0x10/0x10 [ 82.398113][ T1624] ? selinux_file_ioctl+0x732/0x1480 [ 82.398140][ T1624] ? vfs_write+0xbcf/0xfd0 [ 82.398168][ T1624] ? __cfi_selinux_file_ioctl+0x10/0x10 [ 82.398195][ T1624] ? __cfi_vfs_write+0x10/0x10 [ 82.398222][ T1624] ? __kasan_check_write+0x18/0x20 [ 82.398248][ T1624] ? mutex_unlock+0x90/0x240 [ 82.398277][ T1624] ? __cfi_mutex_unlock+0x10/0x10 [ 82.398309][ T1624] ? bpf_lsm_file_ioctl+0xd/0x20 [ 82.398343][ T1624] ? security_file_ioctl+0x3e/0x110 [ 82.398368][ T1624] ? __cfi_pending_reads_dispatch_ioctl+0x10/0x10 [ 82.398408][ T1624] __se_sys_ioctl+0x123/0x1b0 [ 82.398441][ T1624] __x64_sys_ioctl+0x7f/0xa0 [ 82.398472][ T1624] x64_sys_call+0x1878/0x2ee0 [ 82.398504][ T1624] do_syscall_64+0x57/0xf0 [ 82.398540][ T1624] ? clear_bhb_loop+0x50/0xa0 [ 82.398571][ T1624] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 82.398603][ T1624] RIP: 0033:0x7f493899e159 [ 82.398632][ T1624] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 82.398655][ T1624] RSP: 002b:00007f49398ad028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 82.398683][ T1624] RAX: ffffffffffffffda RBX: 00007f4938c25fa0 RCX: 00007f493899e159 [ 82.398704][ T1624] RDX: 00002000000000c0 RSI: 00000000c058671e RDI: 0000000000000004 [ 82.398722][ T1624] RBP: 00007f49398ad090 R08: 0000000000000000 R09: 0000000000000000 [ 82.398740][ T1624] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 82.398756][ T1624] R13: 00007f4938c26038 R14: 00007f4938c25fa0 R15: 00007ffd30614058 [ 82.398780][ T1624] [ 82.618448][ T66] usb 3-1: new full-speed USB device number 25 using dummy_hcd [ 82.676058][ T9] usb 4-1: new high-speed USB device number 23 using dummy_hcd [ 82.722170][ T36] kauditd_printk_skb: 5 callbacks suppressed [ 82.722221][ T36] audit: type=1400 audit(1788273960.739:305): avc: denied { create } for pid=1625 comm="syz.1.535" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 82.817122][ T310] usb 6-1: too many endpoints for config 0 interface 0 altsetting 0: 255, using maximum allowed: 30 [ 82.828065][ T310] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 88, setting to 64 [ 82.838923][ T310] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 255 [ 82.852097][ T9] usb 4-1: device descriptor read/64, error -71 [ 82.858734][ T310] usb 6-1: New USB device found, idVendor=04f3, idProduct=074d, bcdDevice= 0.00 [ 82.869256][ T310] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 82.878251][ T310] usb 6-1: config 0 descriptor?? [ 82.883553][ T1609] raw-gadget.2 gadget.5: fail, usb_ep_enable returned -22 [ 82.896017][ T66] usb 3-1: device descriptor read/64, error -71 [ 83.095879][ T9] usb 4-1: device descriptor read/64, error -71 [ 83.098160][ T1609] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 83.111866][ T1609] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 83.123713][ T1609] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 83.133260][ T1609] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 83.141333][ T66] usb 3-1: device descriptor read/64, error -71 [ 83.150587][ T1609] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 83.160400][ T1609] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 83.171158][ T310] usbhid 6-1:0.0: can't add hid device: -71 [ 83.186108][ T310] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 83.206363][ T310] usb 6-1: USB disconnect, device number 2 [ 83.256001][ T66] usb usb3-port1: attempt power cycle [ 83.345901][ T9] usb 4-1: new high-speed USB device number 24 using dummy_hcd [ 83.495917][ T9] usb 4-1: device descriptor read/64, error -71 [ 83.565015][ T1629] SELinux: policydb string does not match my string SE Linux [ 83.585986][ T1629] SELinux: failed to load policy [ 83.615911][ T66] usb 3-1: new full-speed USB device number 26 using dummy_hcd [ 83.637150][ T66] usb 3-1: device descriptor read/8, error -71 [ 83.745872][ T9] usb 4-1: device descriptor read/64, error -71 [ 83.771863][ T66] usb 3-1: device descriptor read/8, error -71 [ 83.865992][ T9] usb usb4-port1: attempt power cycle [ 83.896056][ T1639] x_tables: unsorted underflow at hook 4 [ 84.002676][ T1641] FAULT_INJECTION: forcing a failure. [ 84.002676][ T1641] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 84.016293][ T66] usb 3-1: new full-speed USB device number 27 using dummy_hcd [ 84.024015][ T1641] CPU: 1 UID: 0 PID: 1641 Comm: syz.5.542 Not tainted syzkaller #0 998a4fffdb5e6e31f7f8340a226dd9d0893c7622 [ 84.024052][ T1641] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 84.024073][ T1641] Call Trace: [ 84.024081][ T1641] [ 84.024090][ T1641] __dump_stack+0x21/0x30 [ 84.024130][ T1641] dump_stack_lvl+0x140/0x1c0 [ 84.024162][ T1641] ? __cfi_dump_stack_lvl+0x10/0x10 [ 84.024195][ T1641] ? check_stack_object+0x138/0x150 [ 84.024222][ T1641] dump_stack+0x19/0x20 [ 84.024252][ T1641] should_fail_ex+0x3c2/0x510 [ 84.024279][ T1641] should_fail+0xf/0x20 [ 84.024304][ T1641] should_fail_usercopy+0x1e/0x30 [ 84.024332][ T1641] _copy_to_user+0x24/0xa0 [ 84.024363][ T1641] simple_read_from_buffer+0xed/0x160 [ 84.024404][ T1641] proc_fail_nth_read+0x1aa/0x220 [ 84.024438][ T1641] ? __cfi_proc_fail_nth_read+0x10/0x10 [ 84.024492][ T1641] ? bpf_lsm_file_permission+0xd/0x20 [ 84.024524][ T1641] ? __cfi_proc_fail_nth_read+0x10/0x10 [ 84.024559][ T1641] vfs_read+0x288/0xc70 [ 84.024582][ T1641] ? __cfi_selinux_file_ioctl+0x10/0x10 [ 84.024608][ T1641] ? __cfi_vfs_read+0x10/0x10 [ 84.024632][ T1641] ? __kasan_check_write+0x18/0x20 [ 84.024657][ T1641] ? mutex_lock+0x97/0x1d0 [ 84.024683][ T1641] ? __cfi_mutex_lock+0x10/0x10 [ 84.024713][ T1641] ksys_read+0x145/0x260 [ 84.024738][ T1641] ? __cfi_ksys_read+0x10/0x10 [ 84.024762][ T1641] ? __kasan_check_write+0x18/0x20 [ 84.024786][ T1641] ? fput+0x1a4/0x230 [ 84.024817][ T1641] ? __kasan_check_read+0x15/0x20 [ 84.024842][ T1641] __x64_sys_read+0x7f/0x90 [ 84.024867][ T1641] x64_sys_call+0x2638/0x2ee0 [ 84.024888][ T1641] do_syscall_64+0x57/0xf0 [ 84.024922][ T1641] ? clear_bhb_loop+0x50/0xa0 [ 84.024949][ T1641] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 84.024988][ T1641] RIP: 0033:0x7f2d4975e98e [ 84.025009][ T1641] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 84.025030][ T1641] RSP: 002b:00007f2d4a5abfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 84.025055][ T1641] RAX: ffffffffffffffda RBX: 00007f2d4a5ac6c0 RCX: 00007f2d4975e98e [ 84.025071][ T1641] RDX: 000000000000000f RSI: 00007f2d4a5ac0a0 RDI: 0000000000000005 [ 84.025088][ T1641] RBP: 00007f2d4a5ac090 R08: 0000000000000000 R09: 0000000000000000 [ 84.025104][ T1641] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 84.025118][ T1641] R13: 00007f2d49a26038 R14: 00007f2d49a25fa0 R15: 00007ffdc8267cd8 [ 84.025138][ T1641] [ 84.276517][ T66] usb 3-1: device descriptor read/8, error -71 [ 84.318693][ T36] audit: type=1400 audit(1788273962.349:306): avc: denied { set_context_mgr } for pid=1642 comm="syz.5.543" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 84.485883][ T9] usb 4-1: new high-speed USB device number 25 using dummy_hcd [ 84.516914][ T9] usb 4-1: device descriptor read/8, error -71 [ 84.531937][ T1650] SELinux: policydb string length 0 does not match expected length 8 [ 84.545918][ T1650] SELinux: failed to load policy [ 84.547166][ T66] usb 3-1: device descriptor read/8, error -71 [ 84.602773][ T1652] ./dev/sda1: Can't lookup blockdev [ 84.650593][ T9] usb 4-1: device descriptor read/8, error -71 [ 84.675974][ T66] usb usb3-port1: unable to enumerate USB device [ 84.838441][ T36] audit: type=1400 audit(1788273962.869:307): avc: denied { setopt } for pid=1662 comm="syz.2.551" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 84.876702][ T36] audit: type=1400 audit(1788273962.869:308): avc: denied { bind } for pid=1662 comm="syz.2.551" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 84.896005][ T9] usb 4-1: new high-speed USB device number 26 using dummy_hcd [ 84.925878][ T46] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 84.935606][ T9] usb 4-1: device descriptor read/8, error -71 [ 85.066846][ T9] usb 4-1: device descriptor read/8, error -71 [ 85.086933][ T46] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 85.097351][ T46] usb 6-1: config 0 has no interfaces? [ 85.102901][ T46] usb 6-1: New USB device found, idVendor=076d, idProduct=0006, bcdDevice= 1.00 [ 85.125879][ T46] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 85.145153][ T46] usb 6-1: config 0 descriptor?? [ 85.184777][ T9] usb usb4-port1: unable to enumerate USB device [ 85.265876][ T10] usb 3-1: new full-speed USB device number 28 using dummy_hcd [ 85.286086][ T1670] SELinux: policydb string length 0 does not match expected length 8 [ 85.294344][ T1670] SELinux: failed to load policy [ 85.337115][ T1672] ./dev/sda1: Can't lookup blockdev [ 85.360424][ T46] usb 6-1: USB disconnect, device number 3 [ 85.465153][ T10] usb 3-1: unable to get BOS descriptor or descriptor too short [ 85.473340][ T10] usb 3-1: not running at top speed; connect to a high speed hub [ 85.482434][ T36] audit: type=1400 audit(1788273963.509:309): avc: denied { write } for pid=1675 comm="syz.3.557" path="socket:[11160]" dev="sockfs" ino=11160 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 85.506378][ T10] usb 3-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 120, changing to 4 [ 85.537274][ T10] usb 3-1: New USB device found, idVendor=0582, idProduct=00e6, bcdDevice= 0.40 [ 85.555887][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 85.564040][ T10] usb 3-1: Product: syz [ 85.586492][ T10] usb 3-1: Manufacturer: syz [ 85.591165][ T10] usb 3-1: SerialNumber: syz [ 85.645036][ T1680] netlink: 80 bytes leftover after parsing attributes in process `syz.3.559'. [ 85.809453][ T10] usb 3-1: 1:1 : invalid UAC_FORMAT_TYPE desc [ 85.826135][ T10] usb 3-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 85.849506][ T10] usb 3-1: USB disconnect, device number 28 [ 85.861439][ T396] udevd[396]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 85.906097][ T46] usb 4-1: new high-speed USB device number 27 using dummy_hcd [ 86.086980][ T46] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 86.098145][ T46] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 86.116470][ T46] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 86.145883][ T46] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 86.165249][ T46] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 86.186330][ T46] usb 4-1: config 0 descriptor?? [ 86.347161][ T1694] SELinux: policydb string length 0 does not match expected length 8 [ 86.375806][ T1694] SELinux: failed to load policy [ 86.471767][ T36] audit: type=1400 audit(1788273964.499:310): avc: denied { create } for pid=1698 comm="syz.2.567" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=dccp_socket permissive=1 [ 86.487083][ T1700] FAULT_INJECTION: forcing a failure. [ 86.487083][ T1700] name failslab, interval 1, probability 0, space 0, times 0 [ 86.542245][ T1700] CPU: 0 UID: 0 PID: 1700 Comm: syz.5.566 Not tainted syzkaller #0 998a4fffdb5e6e31f7f8340a226dd9d0893c7622 [ 86.542283][ T1700] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 86.542299][ T1700] Call Trace: [ 86.542307][ T1700] [ 86.542316][ T1700] __dump_stack+0x21/0x30 [ 86.542356][ T1700] dump_stack_lvl+0x140/0x1c0 [ 86.542388][ T1700] ? __cfi_dump_stack_lvl+0x10/0x10 [ 86.542421][ T1700] ? expand_files+0xda/0x6f0 [ 86.542452][ T1700] ? mtree_alloc_cyclic+0x1bd/0x250 [ 86.542485][ T1700] dump_stack+0x19/0x20 [ 86.542516][ T1700] should_fail_ex+0x3c2/0x510 [ 86.542544][ T1700] should_failslab+0xac/0x100 [ 86.542575][ T1700] kmem_cache_alloc_noprof+0x42/0x410 [ 86.542612][ T1700] ? alloc_empty_file+0xbf/0x270 [ 86.542643][ T1700] ? _raw_spin_unlock+0x45/0x60 [ 86.542680][ T1700] alloc_empty_file+0xbf/0x270 [ 86.542712][ T1700] dentry_open+0x4b/0xb0 [ 86.542745][ T1700] dir_relative_path_resolve+0x7e/0x110 [ 86.542783][ T1700] notify_create+0x1c8/0x7c0 [ 86.542817][ T1700] ? fsnotify_link+0x223/0x2a0 [ 86.542838][ T1700] ? init_new_file+0x530/0x530 [ 86.542875][ T1700] ? incfs_link+0x89/0xa0 [ 86.542899][ T1700] pending_reads_dispatch_ioctl+0x1e68/0x2080 [ 86.542936][ T1700] ? __cfi_pending_reads_dispatch_ioctl+0x10/0x10 [ 86.542975][ T1700] ? selinux_file_ioctl+0x732/0x1480 [ 86.543000][ T1700] ? vfs_write+0xbcf/0xfd0 [ 86.543025][ T1700] ? __cfi_selinux_file_ioctl+0x10/0x10 [ 86.543049][ T1700] ? __cfi_vfs_write+0x10/0x10 [ 86.543074][ T1700] ? __kasan_check_write+0x18/0x20 [ 86.543101][ T1700] ? mutex_unlock+0x90/0x240 [ 86.543126][ T1700] ? __cfi_mutex_unlock+0x10/0x10 [ 86.543157][ T1700] ? bpf_lsm_file_ioctl+0xd/0x20 [ 86.543188][ T1700] ? security_file_ioctl+0x3e/0x110 [ 86.543212][ T1700] ? __cfi_pending_reads_dispatch_ioctl+0x10/0x10 [ 86.543250][ T1700] __se_sys_ioctl+0x123/0x1b0 [ 86.543284][ T1700] __x64_sys_ioctl+0x7f/0xa0 [ 86.543313][ T1700] x64_sys_call+0x1878/0x2ee0 [ 86.543336][ T1700] do_syscall_64+0x57/0xf0 [ 86.543370][ T1700] ? clear_bhb_loop+0x50/0xa0 [ 86.543399][ T1700] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 86.543426][ T1700] RIP: 0033:0x7f2d4979e159 [ 86.543448][ T1700] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 86.543468][ T1700] RSP: 002b:00007f2d4a5ac028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 86.543495][ T1700] RAX: ffffffffffffffda RBX: 00007f2d49a25fa0 RCX: 00007f2d4979e159 [ 86.543515][ T1700] RDX: 00002000000000c0 RSI: 00000000c058671e RDI: 0000000000000004 [ 86.543532][ T1700] RBP: 00007f2d4a5ac090 R08: 0000000000000000 R09: 0000000000000000 [ 86.543549][ T1700] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 86.543565][ T1700] R13: 00007f2d49a26038 R14: 00007f2d49a25fa0 R15: 00007ffdc8267cd8 [ 86.543610][ T1700] [ 86.543665][ T1700] notify_create failed with error -12 [ 86.967223][ T46] plantronics 0003:047F:FFFF.0007: nested delimiters [ 86.973986][ T46] plantronics 0003:047F:FFFF.0007: item 0 4 2 10 parsing failed [ 87.006158][ T46] plantronics 0003:047F:FFFF.0007: parse failed [ 87.012551][ T46] plantronics 0003:047F:FFFF.0007: probe with driver plantronics failed with error -22 [ 87.221432][ T10] usb 4-1: USB disconnect, device number 27 [ 87.255897][ T310] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 87.416187][ T310] usb 6-1: Using ep0 maxpacket: 8 [ 87.435930][ T310] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 87.465871][ T310] usb 6-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 87.496326][ T310] usb 6-1: config 1 interface 1 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 87.527239][ T310] usb 6-1: New USB device found, idVendor=0499, idProduct=1002, bcdDevice= 0.40 [ 87.545865][ T310] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 87.554000][ T310] usb 6-1: Product: syz [ 87.564110][ T310] usb 6-1: Manufacturer: syz [ 87.574209][ T310] usb 6-1: SerialNumber: syz [ 87.788876][ T36] audit: type=1400 audit(1788273965.819:311): avc: denied { getopt } for pid=1716 comm="syz.5.571" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 87.829754][ T310] snd-usb-audio 6-1:1.0: probe with driver snd-usb-audio failed with error -2 [ 87.856783][ T36] audit: type=1400 audit(1788273965.879:312): avc: denied { listen } for pid=1720 comm="syz.3.574" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 87.877363][ T310] snd-usb-audio 6-1:1.1: probe with driver snd-usb-audio failed with error -2 [ 87.896107][ T1721] ./file1/file0: Can't lookup blockdev [ 87.906030][ T310] usb 6-1: USB disconnect, device number 4 [ 87.922234][ T36] audit: type=1400 audit(1788273965.879:313): avc: denied { accept } for pid=1720 comm="syz.3.574" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 87.968227][ T396] udevd[396]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.1/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 87.994627][ T36] audit: type=1400 audit(1788273966.019:314): avc: denied { map } for pid=1722 comm="syz.3.575" path="socket:[12392]" dev="sockfs" ino=12392 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 88.046710][ T36] audit: type=1400 audit(1788273966.019:315): avc: denied { read } for pid=1722 comm="syz.3.575" path="socket:[12392]" dev="sockfs" ino=12392 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 88.188577][ T46] rust_binder: 1722: undelivered death notification, 0000000000000000 [ 88.505921][ T1739] SELinux: policydb string does not match my string SE Linux [ 88.513593][ T1739] SELinux: failed to load policy [ 88.655886][ T310] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 88.825870][ T9] usb 4-1: new high-speed USB device number 28 using dummy_hcd [ 88.834319][ T310] usb 6-1: config 1 has an invalid descriptor of length 9, skipping remainder of the config [ 88.864874][ T310] usb 6-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 88.906774][ T310] usb 6-1: New USB device found, idVendor=0bda, idProduct=8150, bcdDevice= 0.00 [ 88.935874][ T310] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 88.944006][ T310] usb 6-1: Product: syz [ 88.954479][ T310] usb 6-1: Manufacturer: syz [ 88.964577][ T310] usb 6-1: SerialNumber: syz [ 88.996301][ T310] rtl8150 6-1:1.0: couldn't find required endpoints [ 89.003036][ T310] rtl8150 6-1:1.0: probe with driver rtl8150 failed with error -5 [ 89.016027][ T9] usb 4-1: Using ep0 maxpacket: 32 [ 89.046731][ T9] usb 4-1: unable to get BOS descriptor or descriptor too short [ 89.055270][ T9] usb 4-1: config 1 has an invalid descriptor of length 186, skipping remainder of the config [ 89.075941][ T9] usb 4-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 28, changing to 7 [ 89.095886][ T9] usb 4-1: config 1 interface 2 altsetting 1 endpoint 0x82 has invalid maxpacket 26487, setting to 1024 [ 89.124632][ T9] usb 4-1: New USB device found, idVendor=2b53, idProduct=0023, bcdDevice= 0.40 [ 89.133874][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 89.155865][ T9] usb 4-1: Product: syz [ 89.160203][ T9] usb 4-1: Manufacturer: syz [ 89.164844][ T9] usb 4-1: SerialNumber: syz [ 89.279115][ T1737] input: syz1 as /devices/virtual/input/input7 [ 89.288946][ T36] audit: type=1400 audit(1788273967.319:316): avc: denied { read } for pid=96 comm="acpid" name="event3" dev="devtmpfs" ino=567 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 89.365941][ T36] audit: type=1400 audit(1788273967.319:317): avc: denied { open } for pid=96 comm="acpid" path="/dev/input/event3" dev="devtmpfs" ino=567 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 89.388045][ T310] usb 6-1: USB disconnect, device number 5 [ 89.405915][ T36] audit: type=1400 audit(1788273967.319:318): avc: denied { ioctl } for pid=96 comm="acpid" path="/dev/input/event3" dev="devtmpfs" ino=567 ioctlcmd=0x4520 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 90.017366][ T1745] FAULT_INJECTION: forcing a failure. [ 90.017366][ T1745] name failslab, interval 1, probability 0, space 0, times 0 [ 90.030083][ T1745] CPU: 1 UID: 0 PID: 1745 Comm: syz.3.584 Not tainted syzkaller #0 998a4fffdb5e6e31f7f8340a226dd9d0893c7622 [ 90.030126][ T1745] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 90.030144][ T1745] Call Trace: [ 90.030154][ T1745] [ 90.030164][ T1745] __dump_stack+0x21/0x30 [ 90.030207][ T1745] dump_stack_lvl+0x140/0x1c0 [ 90.030243][ T1745] ? __cfi_dump_stack_lvl+0x10/0x10 [ 90.030280][ T1745] ? selinux_inode_post_setxattr+0xd1/0x4b0 [ 90.030323][ T1745] dump_stack+0x19/0x20 [ 90.030357][ T1745] should_fail_ex+0x3c2/0x510 [ 90.030388][ T1745] should_failslab+0xac/0x100 [ 90.030421][ T1745] kmem_cache_alloc_noprof+0x42/0x410 [ 90.030449][ T1745] ? alloc_empty_file+0xbf/0x270 [ 90.030502][ T1745] alloc_empty_file+0xbf/0x270 [ 90.030537][ T1745] dentry_open+0x4b/0xb0 [ 90.030573][ T1745] init_new_file+0x106/0x530 [ 90.030612][ T1745] ? chmod+0x310/0x310 [ 90.030649][ T1745] ? __kasan_check_write+0x18/0x20 [ 90.030677][ T1745] pending_reads_dispatch_ioctl+0x1c49/0x2080 [ 90.030719][ T1745] ? __cfi_pending_reads_dispatch_ioctl+0x10/0x10 [ 90.030760][ T1745] ? selinux_file_ioctl+0x732/0x1480 [ 90.030786][ T1745] ? vfs_write+0xbcf/0xfd0 [ 90.030813][ T1745] ? __cfi_selinux_file_ioctl+0x10/0x10 [ 90.030844][ T1745] ? __cfi_vfs_write+0x10/0x10 [ 90.030872][ T1745] ? __kasan_check_write+0x18/0x20 [ 90.030898][ T1745] ? mutex_unlock+0x90/0x240 [ 90.030927][ T1745] ? __cfi_mutex_unlock+0x10/0x10 [ 90.030959][ T1745] ? bpf_lsm_file_ioctl+0xd/0x20 [ 90.030993][ T1745] ? security_file_ioctl+0x3e/0x110 [ 90.031018][ T1745] ? __cfi_pending_reads_dispatch_ioctl+0x10/0x10 [ 90.031057][ T1745] __se_sys_ioctl+0x123/0x1b0 [ 90.031090][ T1745] __x64_sys_ioctl+0x7f/0xa0 [ 90.031122][ T1745] x64_sys_call+0x1878/0x2ee0 [ 90.031146][ T1745] do_syscall_64+0x57/0xf0 [ 90.031183][ T1745] ? clear_bhb_loop+0x50/0xa0 [ 90.031214][ T1745] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 90.031242][ T1745] RIP: 0033:0x7f88b379e159 [ 90.031265][ T1745] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 90.031289][ T1745] RSP: 002b:00007f88b4674028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 90.031318][ T1745] RAX: ffffffffffffffda RBX: 00007f88b3a25fa0 RCX: 00007f88b379e159 [ 90.031338][ T1745] RDX: 00002000000000c0 RSI: 00000000c058671e RDI: 0000000000000004 [ 90.031357][ T1745] RBP: 00007f88b4674090 R08: 0000000000000000 R09: 0000000000000000 [ 90.031375][ T1745] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 90.031392][ T1745] R13: 00007f88b3a26038 R14: 00007f88b3a25fa0 R15: 00007ffdcb5ccf58 [ 90.031415][ T1745] [ 90.206339][ T9] usb 4-1: USB disconnect, device number 28 [ 90.376709][ T1749] netlink: 'syz.3.586': attribute type 28 has an invalid length. [ 90.525866][ T36] audit: type=1400 audit(1788273968.549:319): avc: denied { getopt } for pid=1752 comm="syz.3.588" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 90.606023][ T324] usb 6-1: new high-speed USB device number 6 using dummy_hcd [ 90.709286][ T1758] ./dev/sda1: Can't lookup blockdev [ 90.775976][ T324] usb 6-1: Using ep0 maxpacket: 8 [ 90.816510][ T324] usb 6-1: config 1 interface 0 altsetting 2 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 90.845880][ T324] usb 6-1: config 1 interface 0 has no altsetting 0 [ 90.902785][ T324] usb 6-1: New USB device found, idVendor=0b0e, idProduct=ffff, bcdDevice= 0.40 [ 90.925874][ T324] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 90.933948][ T324] usb 6-1: Product: syz [ 90.955905][ T324] usb 6-1: Manufacturer: syz [ 90.960592][ T324] usb 6-1: SerialNumber: syz [ 91.135948][ T9] usb 4-1: new full-speed USB device number 29 using dummy_hcd [ 91.238759][ T324] usbhid 6-1:1.0: can't add hid device: -71 [ 91.244790][ T324] usbhid 6-1:1.0: probe with driver usbhid failed with error -71 [ 91.285447][ T324] usb 6-1: USB disconnect, device number 6 [ 91.306950][ T9] usb 4-1: too many endpoints for config 0 interface 0 altsetting 0: 255, using maximum allowed: 30 [ 91.317944][ T9] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 88, setting to 64 [ 91.339081][ T9] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 255 [ 91.365878][ T9] usb 4-1: New USB device found, idVendor=04f3, idProduct=074d, bcdDevice= 0.00 [ 91.386015][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 91.409973][ T9] usb 4-1: config 0 descriptor?? [ 91.435606][ T1762] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 91.666893][ T9] usbhid 4-1:0.0: can't add hid device: -71 [ 91.672937][ T9] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 91.699350][ T9] usb 4-1: USB disconnect, device number 29 [ 92.298007][ T1769] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 92.469874][ T1773] No source specified [ 92.558035][ T36] audit: type=1400 audit(1788273970.589:320): avc: denied { name_bind } for pid=1776 comm="syz.3.598" src=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:reserved_port_t tclass=udp_socket permissive=1 [ 92.630420][ T1778] ./dev/sda1: Can't lookup blockdev [ 92.717227][ T1782] FAULT_INJECTION: forcing a failure. [ 92.717227][ T1782] name failslab, interval 1, probability 0, space 0, times 0 [ 92.743638][ T1782] CPU: 1 UID: 0 PID: 1782 Comm: syz.3.600 Not tainted syzkaller #0 998a4fffdb5e6e31f7f8340a226dd9d0893c7622 [ 92.743691][ T1782] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 92.743710][ T1782] Call Trace: [ 92.743719][ T1782] [ 92.743730][ T1782] __dump_stack+0x21/0x30 [ 92.743773][ T1782] dump_stack_lvl+0x140/0x1c0 [ 92.743809][ T1782] ? __cfi_dump_stack_lvl+0x10/0x10 [ 92.743845][ T1782] ? stack_depot_save_flags+0x38/0x800 [ 92.743880][ T1782] ? avc_has_perm_noaudit+0x26b/0x360 [ 92.743913][ T1782] dump_stack+0x19/0x20 [ 92.743947][ T1782] should_fail_ex+0x3c2/0x510 [ 92.743978][ T1782] should_failslab+0xac/0x100 [ 92.744010][ T1782] kmem_cache_alloc_noprof+0x42/0x410 [ 92.744038][ T1782] ? lockref_get+0x131/0x1c0 [ 92.744076][ T1782] ? alloc_empty_file+0xbf/0x270 [ 92.744112][ T1782] alloc_empty_file+0xbf/0x270 [ 92.744146][ T1782] dentry_open+0x4b/0xb0 [ 92.744181][ T1782] file_open+0x28b/0x6e0 [ 92.744208][ T1782] ? __cfi_file_open+0x10/0x10 [ 92.744235][ T1782] ? bpf_lsm_file_open+0xd/0x20 [ 92.744269][ T1782] ? __cfi_file_open+0x10/0x10 [ 92.744294][ T1782] do_dentry_open+0x97f/0x1510 [ 92.744333][ T1782] vfs_open+0x86/0x240 [ 92.744367][ T1782] ? __cfi_vfs_open+0x10/0x10 [ 92.744402][ T1782] ? alloc_empty_file+0x120/0x270 [ 92.744437][ T1782] dentry_open+0x68/0xb0 [ 92.744471][ T1782] dir_relative_path_resolve+0x7e/0x110 [ 92.744511][ T1782] notify_create+0x1c8/0x7c0 [ 92.744548][ T1782] ? fsnotify_link+0x223/0x2a0 [ 92.744572][ T1782] ? init_new_file+0x530/0x530 [ 92.744611][ T1782] ? incfs_link+0x89/0xa0 [ 92.744637][ T1782] pending_reads_dispatch_ioctl+0x1e68/0x2080 [ 92.744686][ T1782] ? __cfi_pending_reads_dispatch_ioctl+0x10/0x10 [ 92.744727][ T1782] ? selinux_file_ioctl+0x732/0x1480 [ 92.744752][ T1782] ? vfs_write+0xbcf/0xfd0 [ 92.744778][ T1782] ? __cfi_selinux_file_ioctl+0x10/0x10 [ 92.744805][ T1782] ? __cfi_vfs_write+0x10/0x10 [ 92.744832][ T1782] ? __kasan_check_write+0x18/0x20 [ 92.744858][ T1782] ? mutex_unlock+0x90/0x240 [ 92.744886][ T1782] ? __cfi_mutex_unlock+0x10/0x10 [ 92.744918][ T1782] ? bpf_lsm_file_ioctl+0xd/0x20 [ 92.744950][ T1782] ? security_file_ioctl+0x3e/0x110 [ 92.744975][ T1782] ? __cfi_pending_reads_dispatch_ioctl+0x10/0x10 [ 92.745013][ T1782] __se_sys_ioctl+0x123/0x1b0 [ 92.745047][ T1782] __x64_sys_ioctl+0x7f/0xa0 [ 92.745078][ T1782] x64_sys_call+0x1878/0x2ee0 [ 92.745103][ T1782] do_syscall_64+0x57/0xf0 [ 92.745139][ T1782] ? clear_bhb_loop+0x50/0xa0 [ 92.745169][ T1782] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 92.745198][ T1782] RIP: 0033:0x7f88b379e159 [ 92.745220][ T1782] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 92.745242][ T1782] RSP: 002b:00007f88b4674028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 92.745271][ T1782] RAX: ffffffffffffffda RBX: 00007f88b3a25fa0 RCX: 00007f88b379e159 [ 92.745292][ T1782] RDX: 00002000000000c0 RSI: 00000000c058671e RDI: 0000000000000004 [ 92.745311][ T1782] RBP: 00007f88b4674090 R08: 0000000000000000 R09: 0000000000000000 [ 92.745329][ T1782] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 92.745346][ T1782] R13: 00007f88b3a26038 R14: 00007f88b3a25fa0 R15: 00007ffdcb5ccf58 [ 92.745369][ T1782] [ 92.745402][ T1782] notify_create failed with error -12 [ 93.673473][ T36] audit: type=1400 audit(1788273971.699:321): avc: denied { bind } for pid=1794 comm="syz.3.604" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 93.726984][ T1797] No source specified [ 94.065880][ T9] usb 4-1: new high-speed USB device number 30 using dummy_hcd [ 94.215262][ T36] audit: type=1400 audit(1788273972.239:322): avc: denied { read } for pid=1810 comm="syz.5.612" name="msr" dev="devtmpfs" ino=16 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 94.235983][ T9] usb 4-1: Using ep0 maxpacket: 32 [ 94.245309][ T9] usb 4-1: config 2 has an invalid interface number: 32 but max is 0 [ 94.253782][ T9] usb 4-1: config 2 has no interface number 0 [ 94.275879][ T9] usb 4-1: config 2 interface 32 has no altsetting 0 [ 94.282745][ T36] audit: type=1400 audit(1788273972.239:323): avc: denied { open } for pid=1810 comm="syz.5.612" path="/dev/cpu/0/msr" dev="devtmpfs" ino=16 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 94.346739][ T9] usb 4-1: New USB device found, idVendor=04b4, idProduct=6831, bcdDevice=6b.27 [ 94.355938][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 94.376553][ T9] usb 4-1: Product: syz [ 94.380800][ T9] usb 4-1: Manufacturer: syz [ 94.415974][ T9] usb 4-1: SerialNumber: syz [ 94.505915][ T46] usb 6-1: new high-speed USB device number 7 using dummy_hcd [ 94.627410][ T36] audit: type=1400 audit(1788273972.659:324): avc: denied { ioctl } for pid=1802 comm="syz.3.608" path="socket:[12672]" dev="sockfs" ino=12672 ioctlcmd=0x941c scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 94.632199][ T9] ums-cypress 4-1:2.32: USB Mass Storage device detected [ 94.652401][ T46] usb 6-1: device descriptor read/64, error -71 [ 94.705874][ T36] audit: type=1400 audit(1788273972.659:325): avc: denied { accept } for pid=1802 comm="syz.3.608" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 94.769452][ T9] usb 4-1: USB disconnect, device number 30 [ 94.915896][ T46] usb 6-1: device descriptor read/64, error -71 [ 95.176784][ T46] usb 6-1: new high-speed USB device number 8 using dummy_hcd [ 95.237360][ T1818] FAULT_INJECTION: forcing a failure. [ 95.237360][ T1818] name failslab, interval 1, probability 0, space 0, times 0 [ 95.265932][ T1818] CPU: 0 UID: 0 PID: 1818 Comm: syz.3.614 Not tainted syzkaller #0 998a4fffdb5e6e31f7f8340a226dd9d0893c7622 [ 95.265972][ T1818] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 95.265987][ T1818] Call Trace: [ 95.265996][ T1818] [ 95.266006][ T1818] __dump_stack+0x21/0x30 [ 95.266042][ T1818] dump_stack_lvl+0x140/0x1c0 [ 95.266075][ T1818] ? __cfi_dump_stack_lvl+0x10/0x10 [ 95.266108][ T1818] ? file_ra_state_init+0x40/0xc0 [ 95.266137][ T1818] dump_stack+0x19/0x20 [ 95.266168][ T1818] should_fail_ex+0x3c2/0x510 [ 95.266195][ T1818] should_failslab+0xac/0x100 [ 95.266226][ T1818] __kmalloc_cache_noprof+0x41/0x470 [ 95.266253][ T1818] ? incfs_open_dir_file+0xba/0x240 [ 95.266285][ T1818] incfs_open_dir_file+0xba/0x240 [ 95.266315][ T1818] file_open+0x3f8/0x6e0 [ 95.266339][ T1818] ? __cfi_file_open+0x10/0x10 [ 95.266364][ T1818] ? bpf_lsm_file_open+0xd/0x20 [ 95.266395][ T1818] ? __cfi_file_open+0x10/0x10 [ 95.266419][ T1818] do_dentry_open+0x97f/0x1510 [ 95.266456][ T1818] vfs_open+0x86/0x240 [ 95.266488][ T1818] ? __cfi_vfs_open+0x10/0x10 [ 95.266521][ T1818] ? alloc_empty_file+0x120/0x270 [ 95.266554][ T1818] dentry_open+0x68/0xb0 [ 95.266586][ T1818] dir_relative_path_resolve+0x7e/0x110 [ 95.266624][ T1818] notify_create+0x1c8/0x7c0 [ 95.266658][ T1818] ? fsnotify_link+0x223/0x2a0 [ 95.266681][ T1818] ? init_new_file+0x530/0x530 [ 95.266716][ T1818] ? incfs_link+0x89/0xa0 [ 95.266741][ T1818] pending_reads_dispatch_ioctl+0x1e68/0x2080 [ 95.266779][ T1818] ? __cfi_pending_reads_dispatch_ioctl+0x10/0x10 [ 95.266816][ T1818] ? selinux_file_ioctl+0x732/0x1480 [ 95.266841][ T1818] ? vfs_write+0xbcf/0xfd0 [ 95.266866][ T1818] ? __cfi_selinux_file_ioctl+0x10/0x10 [ 95.266899][ T1818] ? __cfi_vfs_write+0x10/0x10 [ 95.266925][ T1818] ? __kasan_check_write+0x18/0x20 [ 95.266949][ T1818] ? mutex_unlock+0x90/0x240 [ 95.266976][ T1818] ? __cfi_mutex_unlock+0x10/0x10 [ 95.267007][ T1818] ? bpf_lsm_file_ioctl+0xd/0x20 [ 95.267038][ T1818] ? security_file_ioctl+0x3e/0x110 [ 95.267062][ T1818] ? __cfi_pending_reads_dispatch_ioctl+0x10/0x10 [ 95.267098][ T1818] __se_sys_ioctl+0x123/0x1b0 [ 95.267128][ T1818] __x64_sys_ioctl+0x7f/0xa0 [ 95.267157][ T1818] x64_sys_call+0x1878/0x2ee0 [ 95.267180][ T1818] do_syscall_64+0x57/0xf0 [ 95.267214][ T1818] ? clear_bhb_loop+0x50/0xa0 [ 95.267241][ T1818] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 95.267267][ T1818] RIP: 0033:0x7f88b379e159 [ 95.267287][ T1818] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 95.267308][ T1818] RSP: 002b:00007f88b4674028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 95.267335][ T1818] RAX: ffffffffffffffda RBX: 00007f88b3a25fa0 RCX: 00007f88b379e159 [ 95.267353][ T1818] RDX: 00002000000000c0 RSI: 00000000c058671e RDI: 0000000000000004 [ 95.267369][ T1818] RBP: 00007f88b4674090 R08: 0000000000000000 R09: 0000000000000000 [ 95.267386][ T1818] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 95.267402][ T1818] R13: 00007f88b3a26038 R14: 00007f88b3a25fa0 R15: 00007ffdcb5ccf58 [ 95.267424][ T1818] [ 95.267460][ T1818] notify_create failed with error -12 [ 95.336014][ T46] usb 6-1: device descriptor read/64, error -71 [ 95.905874][ T324] usb 4-1: new high-speed USB device number 31 using dummy_hcd [ 96.035914][ T324] usb 4-1: device descriptor read/64, error -71 [ 96.085906][ T46] usb 6-1: device descriptor read/64, error -71 [ 96.205995][ T46] usb usb6-port1: attempt power cycle [ 96.285902][ T324] usb 4-1: device descriptor read/64, error -71 [ 96.525913][ T324] usb 4-1: new high-speed USB device number 32 using dummy_hcd [ 96.565903][ T46] usb 6-1: new high-speed USB device number 9 using dummy_hcd [ 96.596895][ T46] usb 6-1: device descriptor read/8, error -71 [ 96.675878][ T324] usb 4-1: device descriptor read/64, error -71 [ 96.736893][ T46] usb 6-1: device descriptor read/8, error -71 [ 96.915895][ T324] usb 4-1: device descriptor read/64, error -71 [ 96.985921][ T46] usb 6-1: new high-speed USB device number 10 using dummy_hcd [ 97.006909][ T46] usb 6-1: device descriptor read/8, error -71 [ 97.035984][ T324] usb usb4-port1: attempt power cycle [ 97.156711][ T46] usb 6-1: device descriptor read/8, error -71 [ 97.266085][ T46] usb usb6-port1: unable to enumerate USB device [ 97.388221][ T324] usb 4-1: new high-speed USB device number 33 using dummy_hcd [ 97.426940][ T324] usb 4-1: device descriptor read/8, error -71 [ 97.537318][ T1834] netlink: 32 bytes leftover after parsing attributes in process `syz.5.622'. [ 97.566888][ T324] usb 4-1: device descriptor read/8, error -71 [ 97.753056][ T1834] fuse: Bad value for 'group_id' [ 97.765901][ T1834] fuse: Bad value for 'group_id' [ 97.805873][ T324] usb 4-1: new high-speed USB device number 34 using dummy_hcd [ 97.825255][ T1837] FAULT_INJECTION: forcing a failure. [ 97.825255][ T1837] name failslab, interval 1, probability 0, space 0, times 0 [ 97.839138][ T324] usb 4-1: device descriptor read/8, error -71 [ 97.865905][ T1837] CPU: 1 UID: 0 PID: 1837 Comm: syz.5.623 Not tainted syzkaller #0 998a4fffdb5e6e31f7f8340a226dd9d0893c7622 [ 97.865950][ T1837] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 97.865968][ T1837] Call Trace: [ 97.865977][ T1837] [ 97.865989][ T1837] __dump_stack+0x21/0x30 [ 97.866031][ T1837] dump_stack_lvl+0x140/0x1c0 [ 97.866066][ T1837] ? __cfi_dump_stack_lvl+0x10/0x10 [ 97.866117][ T1837] dump_stack+0x19/0x20 [ 97.866151][ T1837] should_fail_ex+0x3c2/0x510 [ 97.866183][ T1837] should_failslab+0xac/0x100 [ 97.866217][ T1837] kmem_cache_alloc_lru_noprof+0x44/0x410 [ 97.866247][ T1837] ? __d_alloc+0x42/0x8c0 [ 97.866272][ T1837] ? kasan_save_stack+0x4d/0x60 [ 97.866303][ T1837] __d_alloc+0x42/0x8c0 [ 97.866327][ T1837] ? pending_reads_dispatch_ioctl+0x1e68/0x2080 [ 97.866368][ T1837] ? __se_sys_ioctl+0x123/0x1b0 [ 97.866400][ T1837] d_alloc_parallel+0xe4/0x1370 [ 97.866428][ T1837] ? avc_has_perm_noaudit+0x26b/0x360 [ 97.866460][ T1837] ? __asan_memcpy+0x5a/0x80 [ 97.866488][ T1837] ? selinux_inode_permission+0x3f2/0x5d0 [ 97.866528][ T1837] ? __cfi_d_alloc_parallel+0x10/0x10 [ 97.866555][ T1837] ? __cfi_selinux_inode_permission+0x10/0x10 [ 97.866595][ T1837] ? make_vfsuid+0x4d/0xa0 [ 97.866618][ T1837] ? generic_permission+0x1ec/0x590 [ 97.866649][ T1837] __lookup_slow+0x150/0x420 [ 97.866680][ T1837] ? __d_lookup+0x4e8/0x550 [ 97.866707][ T1837] ? lookup_one_len+0x300/0x300 [ 97.866739][ T1837] ? lookup_one_common+0x320/0x470 [ 97.866773][ T1837] lookup_one_len+0x1a1/0x300 [ 97.866804][ T1837] ? __kasan_check_write+0x18/0x20 [ 97.866831][ T1837] ? __cfi_lookup_one_len+0x10/0x10 [ 97.866864][ T1837] ? close_fd+0x7e/0xa0 [ 97.866893][ T1837] incfs_lookup_dentry+0x64/0xc0 [ 97.866924][ T1837] notify_create+0x1ef/0x7c0 [ 97.866961][ T1837] ? fsnotify_link+0x223/0x2a0 [ 97.866985][ T1837] ? init_new_file+0x530/0x530 [ 97.867024][ T1837] ? incfs_link+0x89/0xa0 [ 97.867050][ T1837] pending_reads_dispatch_ioctl+0x1e68/0x2080 [ 97.867092][ T1837] ? __cfi_pending_reads_dispatch_ioctl+0x10/0x10 [ 97.867141][ T1837] ? selinux_file_ioctl+0x732/0x1480 [ 97.867167][ T1837] ? vfs_write+0xbcf/0xfd0 [ 97.867193][ T1837] ? __cfi_selinux_file_ioctl+0x10/0x10 [ 97.867220][ T1837] ? __cfi_vfs_write+0x10/0x10 [ 97.867246][ T1837] ? __kasan_check_write+0x18/0x20 [ 97.867273][ T1837] ? mutex_unlock+0x90/0x240 [ 97.867301][ T1837] ? __cfi_mutex_unlock+0x10/0x10 [ 97.867334][ T1837] ? bpf_lsm_file_ioctl+0xd/0x20 [ 97.867367][ T1837] ? security_file_ioctl+0x3e/0x110 [ 97.867392][ T1837] ? __cfi_pending_reads_dispatch_ioctl+0x10/0x10 [ 97.867431][ T1837] __se_sys_ioctl+0x123/0x1b0 [ 97.867462][ T1837] __x64_sys_ioctl+0x7f/0xa0 [ 97.867493][ T1837] x64_sys_call+0x1878/0x2ee0 [ 97.867518][ T1837] do_syscall_64+0x57/0xf0 [ 97.867554][ T1837] ? clear_bhb_loop+0x50/0xa0 [ 97.867585][ T1837] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 97.867613][ T1837] RIP: 0033:0x7f2d4979e159 [ 97.867635][ T1837] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 97.867658][ T1837] RSP: 002b:00007f2d4a5ac028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 97.867686][ T1837] RAX: ffffffffffffffda RBX: 00007f2d49a25fa0 RCX: 00007f2d4979e159 [ 97.867707][ T1837] RDX: 00002000000000c0 RSI: 00000000c058671e RDI: 0000000000000004 [ 97.867725][ T1837] RBP: 00007f2d4a5ac090 R08: 0000000000000000 R09: 0000000000000000 [ 97.867742][ T1837] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 97.867760][ T1837] R13: 00007f2d49a26038 R14: 00007f2d49a25fa0 R15: 00007ffdc8267cd8 [ 97.867783][ T1837] [ 97.867794][ T1837] incfs_lookup_dentry err:-12 [ 97.967464][ T324] usb 4-1: device descriptor read/8, error -71 [ 98.016002][ T1837] notify_create failed with error -12 [ 98.217039][ T324] usb usb4-port1: unable to enumerate USB device [ 98.486153][ T1848] FAULT_INJECTION: forcing a failure. [ 98.486153][ T1848] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 98.525893][ T1848] CPU: 1 UID: 0 PID: 1848 Comm: syz.5.628 Not tainted syzkaller #0 998a4fffdb5e6e31f7f8340a226dd9d0893c7622 [ 98.525932][ T1848] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 98.525948][ T1848] Call Trace: [ 98.525955][ T1848] [ 98.525964][ T1848] __dump_stack+0x21/0x30 [ 98.526001][ T1848] dump_stack_lvl+0x140/0x1c0 [ 98.526032][ T1848] ? __cfi_dump_stack_lvl+0x10/0x10 [ 98.526064][ T1848] ? check_stack_object+0x138/0x150 [ 98.526089][ T1848] dump_stack+0x19/0x20 [ 98.526120][ T1848] should_fail_ex+0x3c2/0x510 [ 98.526145][ T1848] should_fail+0xf/0x20 [ 98.526169][ T1848] should_fail_usercopy+0x1e/0x30 [ 98.526196][ T1848] _copy_to_user+0x24/0xa0 [ 98.526229][ T1848] simple_read_from_buffer+0xed/0x160 [ 98.526260][ T1848] proc_fail_nth_read+0x1aa/0x220 [ 98.526295][ T1848] ? __cfi_proc_fail_nth_read+0x10/0x10 [ 98.526327][ T1848] ? bpf_lsm_file_permission+0xd/0x20 [ 98.526356][ T1848] ? __cfi_proc_fail_nth_read+0x10/0x10 [ 98.526388][ T1848] vfs_read+0x288/0xc70 [ 98.526411][ T1848] ? __kasan_check_read+0x15/0x20 [ 98.526433][ T1848] ? static_key_count+0x45/0x70 [ 98.526464][ T1848] ? __cfi_vfs_read+0x10/0x10 [ 98.526487][ T1848] ? __kasan_check_write+0x18/0x20 [ 98.526512][ T1848] ? mutex_lock+0x97/0x1d0 [ 98.526539][ T1848] ? __cfi_mutex_lock+0x10/0x10 [ 98.526568][ T1848] ksys_read+0x145/0x260 [ 98.526603][ T1848] ? __cfi_ksys_read+0x10/0x10 [ 98.526627][ T1848] ? __kasan_check_read+0x15/0x20 [ 98.526653][ T1848] __x64_sys_read+0x7f/0x90 [ 98.526678][ T1848] x64_sys_call+0x2638/0x2ee0 [ 98.526700][ T1848] do_syscall_64+0x57/0xf0 [ 98.526733][ T1848] ? clear_bhb_loop+0x50/0xa0 [ 98.526760][ T1848] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 98.526787][ T1848] RIP: 0033:0x7f2d4975e98e [ 98.526807][ T1848] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 98.526827][ T1848] RSP: 002b:00007f2d4a5abfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 98.526854][ T1848] RAX: ffffffffffffffda RBX: 00007f2d4a5ac6c0 RCX: 00007f2d4975e98e [ 98.526873][ T1848] RDX: 000000000000000f RSI: 00007f2d4a5ac0a0 RDI: 0000000000000004 [ 98.526890][ T1848] RBP: 00007f2d4a5ac090 R08: 0000000000000000 R09: 0000000000000000 [ 98.526906][ T1848] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 98.526922][ T1848] R13: 00007f2d49a26038 R14: 00007f2d49a25fa0 R15: 00007ffdc8267cd8 [ 98.526944][ T1848] [ 98.928108][ T36] audit: type=1400 audit(1788273976.959:326): avc: denied { search } for pid=1855 comm="syz.5.631" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 99.114650][ T1866] FAULT_INJECTION: forcing a failure. [ 99.114650][ T1866] name fail_page_alloc, interval 1, probability 0, space 0, times 1 [ 99.128154][ T1866] CPU: 1 UID: 0 PID: 1866 Comm: syz.5.634 Not tainted syzkaller #0 998a4fffdb5e6e31f7f8340a226dd9d0893c7622 [ 99.128190][ T1866] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 99.128205][ T1866] Call Trace: [ 99.128213][ T1866] [ 99.128223][ T1866] __dump_stack+0x21/0x30 [ 99.128263][ T1866] dump_stack_lvl+0x140/0x1c0 [ 99.128296][ T1866] ? __cfi_dump_stack_lvl+0x10/0x10 [ 99.128328][ T1866] ? selinux_file_open+0x46c/0x630 [ 99.128354][ T1866] dump_stack+0x19/0x20 [ 99.128386][ T1866] should_fail_ex+0x3c2/0x510 [ 99.128414][ T1866] should_fail_alloc_page+0xec/0x110 [ 99.128445][ T1866] __alloc_pages_noprof+0x1c0/0x7e0 [ 99.128491][ T1866] ? __cfi___alloc_pages_noprof+0x10/0x10 [ 99.128526][ T1866] ? is_bpf_text_address+0x17b/0x1a0 [ 99.128563][ T1866] ? kernel_text_address+0xa9/0xe0 [ 99.128596][ T1866] ? unwind_get_return_address+0x51/0x90 [ 99.128626][ T1866] ? __cfi_stack_trace_consume_entry+0x10/0x10 [ 99.128657][ T1866] __folio_alloc_noprof+0x14/0x80 [ 99.128690][ T1866] folio_prealloc+0x46/0x220 [ 99.128720][ T1866] do_pte_missing+0x16af/0x4440 [ 99.128754][ T1866] ? pte_marker_clear+0x1b0/0x1b0 [ 99.128784][ T1866] ? kstrtouint_from_user+0x117/0x170 [ 99.128811][ T1866] ? __x64_sys_openat+0x13a/0x170 [ 99.128846][ T1866] ? selinux_file_permission+0x318/0xb60 [ 99.128872][ T1866] ? pte_offset_map_rw_nolock+0x236/0x2c0 [ 99.128897][ T1866] handle_mm_fault+0x1189/0x1ba0 [ 99.128927][ T1866] ? __cfi_handle_mm_fault+0x10/0x10 [ 99.128954][ T1866] ? lock_vma_under_rcu+0x4cf/0x590 [ 99.128985][ T1866] ? __kasan_check_write+0x18/0x20 [ 99.129010][ T1866] do_user_addr_fault+0x951/0x1230 [ 99.129044][ T1866] ? __cfi_ksys_write+0x10/0x10 [ 99.129068][ T1866] ? fpregs_assert_state_consistent+0xb6/0xe0 [ 99.129097][ T1866] exc_page_fault+0x58/0xc0 [ 99.129124][ T1866] asm_exc_page_fault+0x2b/0x30 [ 99.129147][ T1866] RIP: 0033:0x7f2d496659e6 [ 99.129167][ T1866] Code: fc ff ff 90 41 57 31 c0 41 56 49 89 fe 48 8d 3d 11 01 1d 00 41 55 49 89 d5 41 54 49 89 f4 48 89 d6 55 53 48 81 ec 88 20 00 00 <48> 89 0c 24 4c 89 44 24 08 e8 cc ca fe ff 4d 85 ed 0f 84 2b 0a 00 [ 99.129187][ T1866] RSP: 002b:00007f2d4a5a9f60 EFLAGS: 00010206 [ 99.129207][ T1866] RAX: 0000000000000000 RBX: 00007f2d49a25fa0 RCX: 0000000000000000 [ 99.129224][ T1866] RDX: 0000200000000080 RSI: 0000200000000080 RDI: 00007f2d49835ae1 [ 99.129241][ T1866] RBP: 00007f2d4a5ac090 R08: 00007f2d49652850 R09: 0000000000000000 [ 99.129256][ T1866] R10: 0000000000000002 R11: 0000200000000080 R12: 0000000000000036 [ 99.129271][ T1866] R13: 0000200000000080 R14: 0000000000000002 R15: 00007ffdc8267cd8 [ 99.129291][ T1866] [ 99.129306][ T1866] Huh VM_FAULT_OOM leaked out to the #PF handler. Retrying PF [ 99.393718][ T1512] bridge_slave_1: left allmulticast mode [ 99.400639][ T1512] bridge_slave_1: left promiscuous mode [ 99.420841][ T1512] bridge0: port 2(bridge_slave_1) entered disabled state [ 99.446830][ T1512] bridge_slave_0: left allmulticast mode [ 99.462829][ T1512] bridge_slave_0: left promiscuous mode [ 99.468803][ T1512] bridge0: port 1(bridge_slave_0) entered disabled state [ 99.576151][ T1512] bridge0 (unregistering): left allmulticast mode [ 99.657605][ T1859] bridge0: port 1(bridge_slave_0) entered blocking state [ 99.665879][ T46] usb 6-1: new full-speed USB device number 11 using dummy_hcd [ 99.666988][ T1859] bridge0: port 1(bridge_slave_0) entered disabled state [ 99.710602][ T1859] bridge_slave_0: entered allmulticast mode [ 99.726369][ T1859] bridge_slave_0: entered promiscuous mode [ 99.736511][ T1512] tipc: Disabling bearer [ 99.745886][ T1512] tipc: Disabling bearer [ 99.756110][ T1512] tipc: Left network mode [ 99.760582][ T1859] bridge0: port 2(bridge_slave_1) entered blocking state [ 99.776069][ T1859] bridge0: port 2(bridge_slave_1) entered disabled state [ 99.793445][ T1859] bridge_slave_1: entered allmulticast mode [ 99.803971][ T1859] bridge_slave_1: entered promiscuous mode [ 99.835143][ T46] usb 6-1: too many endpoints for config 0 interface 0 altsetting 0: 255, using maximum allowed: 30 [ 99.846080][ T46] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 88, setting to 64 [ 99.866864][ T46] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 255 [ 99.886737][ T1512] veth1_macvtap: left promiscuous mode [ 99.892311][ T1512] veth0_vlan: left promiscuous mode [ 99.905893][ T46] usb 6-1: New USB device found, idVendor=04f3, idProduct=074d, bcdDevice= 0.00 [ 99.915123][ T46] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 100.016641][ T46] usb 6-1: config 0 descriptor?? [ 100.022585][ T1866] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 100.232860][ T46] usbhid 6-1:0.0: can't add hid device: -71 [ 100.239227][ T46] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 100.259330][ T46] usb 6-1: USB disconnect, device number 11 [ 100.323661][ T1874] FAULT_INJECTION: forcing a failure. [ 100.323661][ T1874] name failslab, interval 1, probability 0, space 0, times 0 [ 100.336470][ T1874] CPU: 1 UID: 0 PID: 1874 Comm: syz.3.638 Not tainted syzkaller #0 998a4fffdb5e6e31f7f8340a226dd9d0893c7622 [ 100.336507][ T1874] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 100.336523][ T1874] Call Trace: [ 100.336531][ T1874] [ 100.336540][ T1874] __dump_stack+0x21/0x30 [ 100.336578][ T1874] dump_stack_lvl+0x140/0x1c0 [ 100.336610][ T1874] ? __cfi_dump_stack_lvl+0x10/0x10 [ 100.336642][ T1874] ? stack_depot_save_flags+0x38/0x800 [ 100.336671][ T1874] ? avc_has_perm_noaudit+0x26b/0x360 [ 100.336700][ T1874] dump_stack+0x19/0x20 [ 100.336731][ T1874] should_fail_ex+0x3c2/0x510 [ 100.336757][ T1874] should_failslab+0xac/0x100 [ 100.336786][ T1874] kmem_cache_alloc_noprof+0x42/0x410 [ 100.336811][ T1874] ? lockref_get+0x131/0x1c0 [ 100.336846][ T1874] ? alloc_empty_file+0xbf/0x270 [ 100.336878][ T1874] alloc_empty_file+0xbf/0x270 [ 100.336908][ T1874] dentry_open+0x4b/0xb0 [ 100.336948][ T1874] file_open+0x28b/0x6e0 [ 100.336973][ T1874] ? __cfi_file_open+0x10/0x10 [ 100.336996][ T1874] ? bpf_lsm_file_open+0xd/0x20 [ 100.337026][ T1874] ? __cfi_file_open+0x10/0x10 [ 100.337048][ T1874] do_dentry_open+0x97f/0x1510 [ 100.337082][ T1874] vfs_open+0x86/0x240 [ 100.337112][ T1874] ? __cfi_vfs_open+0x10/0x10 [ 100.337142][ T1874] ? alloc_empty_file+0x120/0x270 [ 100.337173][ T1874] dentry_open+0x68/0xb0 [ 100.337204][ T1874] dir_relative_path_resolve+0x7e/0x110 [ 100.337239][ T1874] notify_create+0x1c8/0x7c0 [ 100.337271][ T1874] ? fsnotify_link+0x223/0x2a0 [ 100.337294][ T1874] ? init_new_file+0x530/0x530 [ 100.337327][ T1874] ? incfs_link+0x89/0xa0 [ 100.337350][ T1874] pending_reads_dispatch_ioctl+0x1e68/0x2080 [ 100.337387][ T1874] ? __cfi_pending_reads_dispatch_ioctl+0x10/0x10 [ 100.337422][ T1874] ? selinux_file_ioctl+0x732/0x1480 [ 100.337446][ T1874] ? vfs_write+0xbcf/0xfd0 [ 100.337469][ T1874] ? __cfi_selinux_file_ioctl+0x10/0x10 [ 100.337493][ T1874] ? __cfi_vfs_write+0x10/0x10 [ 100.337516][ T1874] ? __kasan_check_write+0x18/0x20 [ 100.337539][ T1874] ? mutex_unlock+0x90/0x240 [ 100.337565][ T1874] ? __cfi_mutex_unlock+0x10/0x10 [ 100.337594][ T1874] ? bpf_lsm_file_ioctl+0xd/0x20 [ 100.337622][ T1874] ? security_file_ioctl+0x3e/0x110 [ 100.337645][ T1874] ? __cfi_pending_reads_dispatch_ioctl+0x10/0x10 [ 100.337679][ T1874] __se_sys_ioctl+0x123/0x1b0 [ 100.337708][ T1874] __x64_sys_ioctl+0x7f/0xa0 [ 100.337736][ T1874] x64_sys_call+0x1878/0x2ee0 [ 100.337757][ T1874] do_syscall_64+0x57/0xf0 [ 100.337790][ T1874] ? clear_bhb_loop+0x50/0xa0 [ 100.337817][ T1874] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 100.337842][ T1874] RIP: 0033:0x7f88b379e159 [ 100.337861][ T1874] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 100.337883][ T1874] RSP: 002b:00007f88b4674028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 100.337908][ T1874] RAX: ffffffffffffffda RBX: 00007f88b3a25fa0 RCX: 00007f88b379e159 [ 100.337926][ T1874] RDX: 00002000000000c0 RSI: 00000000c058671e RDI: 0000000000000004 [ 100.337948][ T1874] RBP: 00007f88b4674090 R08: 0000000000000000 R09: 0000000000000000 [ 100.337963][ T1874] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 100.337978][ T1874] R13: 00007f88b3a26038 R14: 00007f88b3a25fa0 R15: 00007ffdcb5ccf58 [ 100.337999][ T1874] [ 100.338033][ T1874] notify_create failed with error -12 [ 100.685116][ T1520] bridge0: port 1(bridge_slave_0) entered blocking state [ 100.692262][ T1520] bridge0: port 1(bridge_slave_0) entered forwarding state [ 100.735934][ T1520] bridge0: port 2(bridge_slave_1) entered blocking state [ 100.743065][ T1520] bridge0: port 2(bridge_slave_1) entered forwarding state [ 100.864639][ T1859] veth0_vlan: entered promiscuous mode [ 100.907154][ T1859] veth1_macvtap: entered promiscuous mode [ 101.011944][ T36] audit: type=1326 audit(1788273979.039:327): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1886 comm="syz.6.632" exe="/root/ci2-android-6-12-rust/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f0e9e19e159 code=0x0 [ 101.189219][ T1893] netlink: 104 bytes leftover after parsing attributes in process `syz.5.645'. [ 101.557476][ T1907] FAULT_INJECTION: forcing a failure. [ 101.557476][ T1907] name failslab, interval 1, probability 0, space 0, times 0 [ 101.570182][ T1907] CPU: 0 UID: 0 PID: 1907 Comm: syz.5.651 Not tainted syzkaller #0 998a4fffdb5e6e31f7f8340a226dd9d0893c7622 [ 101.570221][ T1907] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 101.570237][ T1907] Call Trace: [ 101.570245][ T1907] [ 101.570255][ T1907] __dump_stack+0x21/0x30 [ 101.570300][ T1907] dump_stack_lvl+0x140/0x1c0 [ 101.570332][ T1907] ? __cfi_dump_stack_lvl+0x10/0x10 [ 101.570367][ T1907] dump_stack+0x19/0x20 [ 101.570398][ T1907] should_fail_ex+0x3c2/0x510 [ 101.570426][ T1907] should_failslab+0xac/0x100 [ 101.570456][ T1907] kmem_cache_alloc_noprof+0x42/0x410 [ 101.570481][ T1907] ? security_file_alloc+0x49/0x220 [ 101.570502][ T1907] ? kasan_save_alloc_info+0x3a/0x50 [ 101.570525][ T1907] security_file_alloc+0x49/0x220 [ 101.570546][ T1907] init_file+0x9e/0x210 [ 101.570576][ T1907] alloc_empty_file+0xd9/0x270 [ 101.570608][ T1907] dentry_open+0x4b/0xb0 [ 101.570639][ T1907] dir_relative_path_resolve+0x7e/0x110 [ 101.570675][ T1907] notify_create+0x1c8/0x7c0 [ 101.570708][ T1907] ? fsnotify_link+0x223/0x2a0 [ 101.570730][ T1907] ? init_new_file+0x530/0x530 [ 101.570764][ T1907] ? incfs_link+0x89/0xa0 [ 101.570788][ T1907] pending_reads_dispatch_ioctl+0x1e68/0x2080 [ 101.570826][ T1907] ? __cfi_pending_reads_dispatch_ioctl+0x10/0x10 [ 101.570867][ T1907] ? selinux_file_ioctl+0x732/0x1480 [ 101.570891][ T1907] ? vfs_write+0xbcf/0xfd0 [ 101.570915][ T1907] ? __cfi_selinux_file_ioctl+0x10/0x10 [ 101.570939][ T1907] ? __cfi_vfs_write+0x10/0x10 [ 101.570963][ T1907] ? __kasan_check_write+0x18/0x20 [ 101.570987][ T1907] ? mutex_unlock+0x90/0x240 [ 101.571012][ T1907] ? __cfi_mutex_unlock+0x10/0x10 [ 101.571041][ T1907] ? bpf_lsm_file_ioctl+0xd/0x20 [ 101.571071][ T1907] ? security_file_ioctl+0x3e/0x110 [ 101.571093][ T1907] ? __cfi_pending_reads_dispatch_ioctl+0x10/0x10 [ 101.571128][ T1907] __se_sys_ioctl+0x123/0x1b0 [ 101.571158][ T1907] __x64_sys_ioctl+0x7f/0xa0 [ 101.571186][ T1907] x64_sys_call+0x1878/0x2ee0 [ 101.571208][ T1907] do_syscall_64+0x57/0xf0 [ 101.571241][ T1907] ? clear_bhb_loop+0x50/0xa0 [ 101.571269][ T1907] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 101.571302][ T1907] RIP: 0033:0x7f2d4979e159 [ 101.571322][ T1907] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 101.571342][ T1907] RSP: 002b:00007f2d4a5ac028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 101.571367][ T1907] RAX: ffffffffffffffda RBX: 00007f2d49a25fa0 RCX: 00007f2d4979e159 [ 101.571386][ T1907] RDX: 00002000000000c0 RSI: 00000000c058671e RDI: 0000000000000004 [ 101.571401][ T1907] RBP: 00007f2d4a5ac090 R08: 0000000000000000 R09: 0000000000000000 [ 101.571417][ T1907] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 101.571432][ T1907] R13: 00007f2d49a26038 R14: 00007f2d49a25fa0 R15: 00007ffdc8267cd8 [ 101.571452][ T1907] [ 101.571479][ T1907] notify_create failed with error -12 [ 101.915922][ T324] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 101.936860][ T1913] netlink: 352 bytes leftover after parsing attributes in process `syz.5.654'. [ 102.099554][ T324] usb 7-1: unable to get BOS descriptor or descriptor too short [ 102.116606][ T324] usb 7-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 64, changing to 7 [ 102.147418][ T324] usb 7-1: string descriptor 0 read error: -22 [ 102.153689][ T324] usb 7-1: New USB device found, idVendor=041e, idProduct=3237, bcdDevice= 0.40 [ 102.185864][ T324] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 102.222570][ T324] usb 7-1: unit 4 not found! [ 102.244331][ T324] usb 7-1: unit 0 not found! [ 102.365880][ T36] audit: type=1400 audit(1788273980.389:328): avc: denied { unlink } for pid=1930 comm="syz.5.662" name="#1" dev="tmpfs" ino=384 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 102.422814][ T1520] bridge_slave_1: left allmulticast mode [ 102.433738][ T1520] bridge_slave_1: left promiscuous mode [ 102.446023][ T1520] bridge0: port 2(bridge_slave_1) entered disabled state [ 102.466409][ T1520] bridge_slave_0: left allmulticast mode [ 102.474349][ T1520] bridge_slave_0: left promiscuous mode [ 102.486697][ T1520] bridge0: port 1(bridge_slave_0) entered disabled state [ 102.655589][ T36] audit: type=1400 audit(1788273980.679:329): avc: denied { bind } for pid=1935 comm="syz.5.664" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 102.719117][ T36] audit: type=1400 audit(1788273980.679:330): avc: denied { name_bind } for pid=1935 comm="syz.5.664" src=20001 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=icmp_socket permissive=1 [ 102.765693][ T1938] netlink: 'syz.5.665': attribute type 8 has an invalid length. [ 102.773872][ T36] audit: type=1400 audit(1788273980.679:331): avc: denied { node_bind } for pid=1935 comm="syz.5.664" saddr=224.0.0.1 src=20001 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=icmp_socket permissive=1 [ 102.816698][ T1520] veth1_macvtap: left promiscuous mode [ 102.822426][ T1520] veth0_vlan: left promiscuous mode [ 102.934013][ T1932] bridge0: port 1(bridge_slave_0) entered blocking state [ 102.960183][ T1932] bridge0: port 1(bridge_slave_0) entered disabled state [ 102.975912][ T1932] bridge_slave_0: entered allmulticast mode [ 102.989329][ T1932] bridge_slave_0: entered promiscuous mode [ 103.017229][ T1932] bridge0: port 2(bridge_slave_1) entered blocking state [ 103.036227][ T1932] bridge0: port 2(bridge_slave_1) entered disabled state [ 103.058506][ T1932] bridge_slave_1: entered allmulticast mode [ 103.080226][ T1932] bridge_slave_1: entered promiscuous mode [ 103.266158][ T36] audit: type=1400 audit(1788273981.279:332): avc: denied { create } for pid=1944 comm="syz.3.666" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_nflog_socket permissive=1 [ 103.303417][ T1947] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 103.306050][ T1932] bridge0: port 2(bridge_slave_1) entered blocking state [ 103.319230][ T1932] bridge0: port 2(bridge_slave_1) entered forwarding state [ 103.326583][ T1932] bridge0: port 1(bridge_slave_0) entered blocking state [ 103.333654][ T1932] bridge0: port 1(bridge_slave_0) entered forwarding state [ 103.399180][ T1512] bridge0: port 1(bridge_slave_0) entered disabled state [ 103.406741][ T1512] bridge0: port 2(bridge_slave_1) entered disabled state [ 103.447050][ T1508] bridge0: port 1(bridge_slave_0) entered blocking state [ 103.454247][ T1508] bridge0: port 1(bridge_slave_0) entered forwarding state [ 103.508821][ T1508] bridge0: port 2(bridge_slave_1) entered blocking state [ 103.515969][ T1508] bridge0: port 2(bridge_slave_1) entered forwarding state [ 103.595871][ T66] usb 6-1: new full-speed USB device number 12 using dummy_hcd [ 103.605123][ T1932] veth0_vlan: entered promiscuous mode [ 103.641785][ T1932] veth1_macvtap: entered promiscuous mode [ 103.725911][ T66] usb 6-1: device descriptor read/64, error -71 [ 103.796063][ T36] audit: type=1400 audit(1788273981.829:333): avc: denied { execute } for pid=1959 comm="syz.3.669" path="/selinux/policy" dev="selinuxfs" ino=20 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=file permissive=1 [ 103.976103][ T66] usb 6-1: device descriptor read/64, error -71 [ 104.027753][ T324] usb 7-1: USB disconnect, device number 2 [ 104.195357][ T36] audit: type=1400 audit(1788273982.219:334): avc: denied { mount } for pid=1980 comm="syz.7.678" name="/" dev="bpf" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bpf_t tclass=filesystem permissive=1 [ 104.223288][ T66] usb 6-1: new full-speed USB device number 13 using dummy_hcd [ 104.249722][ T36] audit: type=1400 audit(1788273982.229:335): avc: denied { create } for pid=1980 comm="syz.7.678" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=mctp_socket permissive=1 [ 104.289151][ T36] audit: type=1400 audit(1788273982.249:336): avc: denied { mount } for pid=1982 comm="syz.6.679" name="/" dev="ramfs" ino=14414 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ramfs_t tclass=filesystem permissive=1 [ 104.348262][ T36] audit: type=1400 audit(1788273982.249:337): avc: denied { unmount } for pid=1982 comm="syz.6.679" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ramfs_t tclass=filesystem permissive=1 [ 104.368215][ T66] usb 6-1: device descriptor read/64, error -71 [ 104.403025][ T36] audit: type=1400 audit(1788273982.359:338): avc: denied { unmount } for pid=1932 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bpf_t tclass=filesystem permissive=1 [ 104.475572][ T1992] FAULT_INJECTION: forcing a failure. [ 104.475572][ T1992] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 104.497639][ T1992] CPU: 0 UID: 0 PID: 1992 Comm: syz.7.683 Not tainted syzkaller #0 998a4fffdb5e6e31f7f8340a226dd9d0893c7622 [ 104.497684][ T1992] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 104.497701][ T1992] Call Trace: [ 104.497710][ T1992] [ 104.497720][ T1992] __dump_stack+0x21/0x30 [ 104.497762][ T1992] dump_stack_lvl+0x140/0x1c0 [ 104.497798][ T1992] ? __cfi_dump_stack_lvl+0x10/0x10 [ 104.497836][ T1992] dump_stack+0x19/0x20 [ 104.497868][ T1992] should_fail_ex+0x3c2/0x510 [ 104.497898][ T1992] should_fail+0xf/0x20 [ 104.497924][ T1992] should_fail_usercopy+0x1e/0x30 [ 104.497957][ T1992] _copy_to_user+0x24/0xa0 [ 104.497993][ T1992] ext4_ioctl_get_encryption_pwsalt+0x57f/0x9b0 [ 104.498026][ T1992] ext4_ioctl+0xb0d/0x3b50 [ 104.498060][ T1992] ? __cfi_ext4_ioctl+0x10/0x10 [ 104.498093][ T1992] ? __ia32_compat_sys_ioctl+0x980/0x980 [ 104.498131][ T1992] ? _parse_integer+0x2e/0x40 [ 104.498162][ T1992] ? ioctl_has_perm+0x39a/0x500 [ 104.498188][ T1992] ? has_cap_mac_admin+0xd0/0xd0 [ 104.498214][ T1992] ? proc_fail_nth_write+0x184/0x220 [ 104.498247][ T1992] ? __cfi_proc_fail_nth_write+0x10/0x10 [ 104.498283][ T1992] ? selinux_file_ioctl+0x732/0x1480 [ 104.498306][ T1992] ? vfs_write+0xbcf/0xfd0 [ 104.498331][ T1992] ? __cfi_selinux_file_ioctl+0x10/0x10 [ 104.498357][ T1992] ? __cfi_vfs_write+0x10/0x10 [ 104.498384][ T1992] ? __kasan_check_write+0x18/0x20 [ 104.498412][ T1992] ? mutex_unlock+0x90/0x240 [ 104.498441][ T1992] ? __cfi_mutex_unlock+0x10/0x10 [ 104.498472][ T1992] ? __fget_files+0x2bc/0x330 [ 104.498505][ T1992] ? bpf_lsm_file_ioctl+0xd/0x20 [ 104.498549][ T1992] ? security_file_ioctl+0x3e/0x110 [ 104.498574][ T1992] ? __cfi_ext4_ioctl+0x10/0x10 [ 104.498608][ T1992] __se_sys_ioctl+0x123/0x1b0 [ 104.498645][ T1992] __x64_sys_ioctl+0x7f/0xa0 [ 104.498677][ T1992] x64_sys_call+0x1878/0x2ee0 [ 104.498701][ T1992] do_syscall_64+0x57/0xf0 [ 104.498738][ T1992] ? clear_bhb_loop+0x50/0xa0 [ 104.498768][ T1992] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 104.498797][ T1992] RIP: 0033:0x7fb4fdb9e159 [ 104.498819][ T1992] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 104.498842][ T1992] RSP: 002b:00007fb4fea0b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 104.498870][ T1992] RAX: ffffffffffffffda RBX: 00007fb4fde25fa0 RCX: 00007fb4fdb9e159 [ 104.498891][ T1992] RDX: 0000000000000000 RSI: 0000000040106614 RDI: 0000000000000003 [ 104.498908][ T1992] RBP: 00007fb4fea0b090 R08: 0000000000000000 R09: 0000000000000000 [ 104.498926][ T1992] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 104.498943][ T1992] R13: 00007fb4fde26038 R14: 00007fb4fde25fa0 R15: 00007ffe021c6158 [ 104.498966][ T1992] [ 104.706084][ T66] usb 6-1: device descriptor read/64, error -71 [ 104.823242][ T1998] ./dev/sda1: Can't lookup blockdev [ 104.873046][ T1996] kvm: kvm [1995]: vcpu0, guest rIP: 0x9114 Unhandled WRMSR(0xc2) = 0x7 [ 104.881900][ T1996] kvm: kvm [1995]: vcpu0, guest rIP: 0x9114 Unhandled WRMSR(0xc1) = 0x7 [ 104.915934][ T66] usb usb6-port1: attempt power cycle [ 105.075923][ T31] usb 4-1: new high-speed USB device number 35 using dummy_hcd [ 105.227022][ T31] usb 4-1: config 0 has an invalid interface number: 1 but max is 0 [ 105.235104][ T31] usb 4-1: config 0 has no interface number 0 [ 105.241526][ T31] usb 4-1: config 0 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 105.252716][ T31] usb 4-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 105.262557][ T66] usb 6-1: new full-speed USB device number 14 using dummy_hcd [ 105.270478][ T31] usb 4-1: New USB device found, idVendor=041e, idProduct=2801, bcdDevice= 0.00 [ 105.279890][ T31] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 105.289320][ T31] usb 4-1: config 0 descriptor?? [ 105.308660][ T66] usb 6-1: device descriptor read/8, error -71 [ 105.355869][ T10] usb 7-1: new high-speed USB device number 3 using dummy_hcd [ 105.436961][ T66] usb 6-1: device descriptor read/8, error -71 [ 105.506061][ T10] usb 7-1: device descriptor read/64, error -71 [ 105.685958][ T66] usb 6-1: new full-speed USB device number 15 using dummy_hcd [ 105.701623][ T31] prodikeys 0003:041E:2801.0008: collection stack underflow [ 105.729317][ T31] prodikeys 0003:041E:2801.0008: item 0 1 0 12 parsing failed [ 105.747717][ T31] prodikeys 0003:041E:2801.0008: hid parse failed [ 105.764650][ T31] prodikeys 0003:041E:2801.0008: probe with driver prodikeys failed with error -22 [ 105.765946][ T10] usb 7-1: device descriptor read/64, error -71 [ 105.904277][ T1998] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 105.923351][ T1998] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 105.943981][ T1998] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 105.963569][ T1998] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 106.005247][ T1998] fuse: Bad value for 'fd' [ 106.012332][ T36] audit: type=1400 audit(1788273984.029:339): avc: denied { mounton } for pid=1997 comm="syz.3.686" path="/195/dev" dev="bpf" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bpf_t tclass=dir permissive=1 [ 106.026048][ T324] usb 4-1: USB disconnect, device number 35 [ 106.056100][ T10] usb 7-1: new high-speed USB device number 4 using dummy_hcd [ 106.061462][ T66] usb 6-1: device descriptor read/8, error -71 [ 106.206674][ T66] usb 6-1: device descriptor read/8, error -71 [ 106.216187][ T10] usb 7-1: device descriptor read/64, error -71 [ 106.322531][ T66] usb usb6-port1: unable to enumerate USB device [ 106.335927][ T394] usb 8-1: new high-speed USB device number 2 using dummy_hcd [ 106.456007][ T10] usb 7-1: device descriptor read/64, error -71 [ 106.498614][ T394] usb 8-1: New USB device found, idVendor=1235, idProduct=8215, bcdDevice= 0.40 [ 106.507925][ T394] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 106.515980][ T394] usb 8-1: Product: syz [ 106.520304][ T394] usb 8-1: Manufacturer: syz [ 106.524937][ T394] usb 8-1: SerialNumber: syz [ 106.575879][ T10] usb usb7-port1: attempt power cycle [ 106.625892][ T66] usb 6-1: new high-speed USB device number 16 using dummy_hcd [ 106.747402][ T394] usb 8-1: Focusrite Scarlett Gen 3 Mixer Driver enabled (pid=0x8215); report any issues to https://github.com/geoffreybennett/scarlett-gen2/issues [ 106.764677][ T394] usb 8-1: Error initialising Scarlett Gen 3 Mixer Driver: -22 [ 106.785463][ T394] snd-usb-audio 8-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 106.795232][ T66] usb 6-1: too many configurations: 72, using maximum allowed: 8 [ 106.804104][ T66] usb 6-1: config 0 has no interfaces? [ 106.809890][ T31] usb 4-1: new full-speed USB device number 36 using dummy_hcd [ 106.819148][ T66] usb 6-1: config 0 has no interfaces? [ 106.833939][ T396] udevd[396]: error opening ATTR{/sys/devices/platform/dummy_hcd.7/usb8/8-1/8-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 106.850588][ T394] usb 8-1: USB disconnect, device number 2 [ 106.857073][ T66] usb 6-1: config 0 has no interfaces? [ 106.868097][ T66] usb 6-1: config 0 has no interfaces? [ 106.881077][ T66] usb 6-1: config 0 has no interfaces? [ 106.887628][ T66] usb 6-1: config 0 has no interfaces? [ 106.893883][ T66] usb 6-1: config 0 has no interfaces? [ 106.900424][ T66] usb 6-1: config 0 has no interfaces? [ 106.906270][ T66] usb 6-1: New USB device found, idVendor=7de0, idProduct=676e, bcdDevice=77.db [ 106.915434][ T66] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 106.916003][ T10] usb 7-1: new high-speed USB device number 5 using dummy_hcd [ 106.935735][ T66] usb 6-1: config 0 descriptor?? [ 106.956942][ T10] usb 7-1: device descriptor read/8, error -71 [ 107.027108][ T31] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 107.040286][ T31] usb 4-1: config 1 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 107.052304][ T31] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 107.063603][ T31] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 64 [ 107.075346][ T31] usb 4-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 22 [ 107.089261][ T10] usb 7-1: device descriptor read/8, error -71 [ 107.089578][ T31] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 107.105096][ T31] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 107.113336][ T31] usb 4-1: SerialNumber: syz [ 107.123523][ T2027] raw-gadget.3 gadget.3: fail, usb_ep_enable returned -22 [ 107.148146][ T36] audit: type=1400 audit(1788273985.179:340): avc: denied { map } for pid=2024 comm="syz.5.697" path="socket:[15372]" dev="sockfs" ino=15372 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_route_socket permissive=1 [ 107.176685][ T9] usb 6-1: USB disconnect, device number 16 [ 107.299646][ T2031] tipc: Started in network mode [ 107.304623][ T2031] tipc: Node identity 7f000001, cluster identity 4711 [ 107.311789][ T2031] tipc: New replicast peer: 127.0.0.1 [ 107.317510][ T2031] tipc: Enabled bearer , priority 10 [ 107.340760][ T10] usb 7-1: new high-speed USB device number 6 using dummy_hcd [ 107.352908][ T31] usb 4-1: USB disconnect, device number 36 [ 107.366941][ T10] usb 7-1: device descriptor read/8, error -71 [ 107.504556][ T10] usb 7-1: device descriptor read/8, error -71 [ 107.595906][ T9] usb 8-1: new high-speed USB device number 3 using dummy_hcd [ 107.616124][ T10] usb usb7-port1: unable to enumerate USB device [ 107.705527][ T36] audit: type=1400 audit(1788273985.729:341): avc: denied { create } for pid=2036 comm="syz.5.701" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_crypto_socket permissive=1 [ 107.767700][ T9] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 107.779592][ T9] usb 8-1: New USB device found, idVendor=0a46, idProduct=9621, bcdDevice=4f.32 [ 107.795866][ T9] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 107.812456][ T9] usb 8-1: Product: syz [ 107.818490][ T9] usb 8-1: Manufacturer: syz [ 107.823245][ T9] usb 8-1: SerialNumber: syz [ 107.837022][ T9] usb 8-1: config 0 descriptor?? [ 107.844207][ T9] dm9601 8-1:0.0: probe with driver dm9601 failed with error -22 [ 107.905456][ T36] audit: type=1400 audit(1788273985.929:342): avc: denied { getopt } for pid=2046 comm="syz.5.706" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 107.979786][ T36] audit: type=1326 audit(1788273986.009:343): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2051 comm="syz.5.708" exe="/root/ci2-android-6-12-rust/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f2d4979e159 code=0x0 [ 108.124670][ T31] usb 8-1: USB disconnect, device number 3 [ 108.415887][ T46] usb 4-1: new high-speed USB device number 37 using dummy_hcd [ 108.445886][ T10] tipc: Node number set to 2130706433 [ 108.577358][ T46] usb 4-1: unable to get BOS descriptor or descriptor too short [ 108.586001][ T46] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 108.596620][ T46] usb 4-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 108.605764][ T46] usb 4-1: too many endpoints for config 1 interface 1 altsetting 76: 188, using maximum allowed: 30 [ 108.617107][ T46] usb 4-1: config 1 interface 1 altsetting 76 has 0 endpoint descriptors, different from the interface descriptor's value: 188 [ 108.630747][ T46] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 108.661198][ T46] usb 4-1: config 1 interface 1 has no altsetting 0 [ 108.674108][ T46] usb 4-1: string descriptor 0 read error: -22 [ 108.680729][ T46] usb 4-1: New USB device found, idVendor=21b4, idProduct=0081, bcdDevice= 0.40 [ 108.692764][ T46] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 108.909780][ T46] usb 4-1: 2:0: failed to get current value for ch 0 (-71) [ 108.928370][ T46] usb 4-1: 2:0: cannot get min/max values for control 2 (id 2) [ 108.950909][ T46] usb 4-1: USB disconnect, device number 37 [ 108.965978][ T10] usb 8-1: new high-speed USB device number 4 using dummy_hcd [ 108.976065][ T396] udevd[396]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 109.056390][ T2079] netlink: 'syz.6.717': attribute type 5 has an invalid length. [ 109.135887][ T10] usb 8-1: device descriptor read/64, error -71 [ 109.247127][ T2081] netlink: 20 bytes leftover after parsing attributes in process `syz.6.718'. [ 109.267172][ T2077] ./dev/sda1: Can't lookup blockdev [ 109.309124][ T36] kauditd_printk_skb: 1 callbacks suppressed [ 109.309146][ T36] audit: type=1400 audit(1788273987.339:345): avc: denied { setattr } for pid=2083 comm="syz.6.719" name="NETLINK" dev="sockfs" ino=15703 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 109.395704][ T10] usb 8-1: device descriptor read/64, error -71 [ 109.637977][ T10] usb 8-1: new high-speed USB device number 5 using dummy_hcd [ 109.646261][ T2095] SELinux: policydb string does not match my string SE Linux [ 109.655054][ T36] audit: type=1400 audit(1788273987.679:346): avc: denied { load_policy } for pid=2093 comm="syz.6.723" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=security permissive=1 [ 109.684758][ T2095] SELinux: failed to load policy [ 109.785886][ T10] usb 8-1: device descriptor read/64, error -71 [ 110.035978][ T10] usb 8-1: device descriptor read/64, error -71 [ 110.095879][ T9] usb 7-1: new high-speed USB device number 7 using dummy_hcd [ 110.145968][ T10] usb usb8-port1: attempt power cycle [ 110.175892][ T31] usb 6-1: new high-speed USB device number 17 using dummy_hcd [ 110.246942][ T9] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 110.265863][ T9] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 110.287024][ T9] usb 7-1: New USB device found, idVendor=0582, idProduct=0074, bcdDevice= 0.40 [ 110.296669][ T9] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 110.304704][ T9] usb 7-1: Product: syz [ 110.309026][ T9] usb 7-1: Manufacturer: syz [ 110.313741][ T9] usb 7-1: SerialNumber: syz [ 110.336926][ T31] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 110.365461][ T31] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 110.382423][ T31] usb 6-1: New USB device found, idVendor=28de, idProduct=1142, bcdDevice= 0.00 [ 110.391843][ T31] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 110.401802][ T36] audit: type=1400 audit(1788273988.429:347): avc: denied { getopt } for pid=2104 comm="syz.3.727" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 110.425446][ T31] usb 6-1: config 0 descriptor?? [ 110.434125][ T36] audit: type=1326 audit(1788273988.429:348): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2104 comm="syz.3.727" exe="/root/ci2-android-6-12-rust/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f88b379e159 code=0x0 [ 110.495880][ T10] usb 8-1: new high-speed USB device number 6 using dummy_hcd [ 110.516906][ T10] usb 8-1: device descriptor read/8, error -71 [ 110.537932][ T9] usb 7-1: 0:1 : does not exist [ 110.542868][ T9] usb 7-1: 0:2 : does not exist [ 110.555888][ T9] usb 7-1: unit 5 not found! [ 110.567342][ T9] usb 7-1: USB disconnect, device number 7 [ 110.583664][ T396] udevd[396]: error opening ATTR{/sys/devices/platform/dummy_hcd.6/usb7/7-1/7-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 110.647649][ T10] usb 8-1: device descriptor read/8, error -71 [ 110.847393][ T31] hid-steam 0003:28DE:1142.0009: unknown main item tag 0x0 [ 110.855271][ T31] hid-steam 0003:28DE:1142.0009: : USB HID v0.00 Device [HID 28de:1142] on usb-dummy_hcd.5-1/input0 [ 110.905880][ T10] usb 8-1: new high-speed USB device number 7 using dummy_hcd [ 110.925869][ T31] hid-steam 0003:28DE:1142.0009: Steam wireless receiver connected [ 110.938980][ T31] hid-steam 0003:28DE:1142.000A: unknown main item tag 0x0 [ 110.947227][ T10] usb 8-1: device descriptor read/8, error -71 [ 110.955393][ T31] hid-steam 0003:28DE:1142.000A: hidraw0: USB HID v0.00 Device [HID 28de:1142] on usb-dummy_hcd.5-1/input0 [ 111.058915][ T31] usb 6-1: USB disconnect, device number 17 [ 111.072641][ T31] hid-steam 0003:28DE:1142.0009: Steam wireless receiver disconnected [ 111.081966][ T10] usb 8-1: device descriptor read/8, error -71 [ 111.162394][ T2112] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 111.176253][ T2112] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 111.186196][ T2113] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 111.194729][ T2113] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 111.215948][ T10] usb usb8-port1: unable to enumerate USB device [ 111.395890][ T66] usb 7-1: new low-speed USB device number 8 using dummy_hcd [ 111.535886][ T66] usb 7-1: device descriptor read/64, error -71 [ 111.628273][ T31] usb 4-1: new high-speed USB device number 38 using dummy_hcd [ 111.785907][ T31] usb 4-1: Using ep0 maxpacket: 16 [ 111.791177][ T66] usb 7-1: device descriptor read/64, error -71 [ 111.809861][ T31] usb 4-1: config 0 has an invalid interface number: 105 but max is 0 [ 111.819565][ T31] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 111.830085][ T31] usb 4-1: config 0 has no interface number 0 [ 111.838162][ T31] usb 4-1: New USB device found, idVendor=046d, idProduct=08f3, bcdDevice= b.28 [ 111.847879][ T31] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 111.856180][ T46] usb 6-1: new full-speed USB device number 18 using dummy_hcd [ 111.864149][ T31] usb 4-1: Product: syz [ 111.868631][ T31] usb 4-1: Manufacturer: syz [ 111.873384][ T31] usb 4-1: SerialNumber: syz [ 111.880427][ T2130] bpf: Bad value for 'gid' [ 111.886029][ T31] usb 4-1: config 0 descriptor?? [ 111.894489][ T31] usb 4-1: Found UVC 0.00 device syz (046d:08f3) [ 111.896914][ T2129] netlink: 12 bytes leftover after parsing attributes in process `syz.7.736'. [ 111.902705][ T31] usb 4-1: No valid video chain found. [ 112.030617][ T36] audit: type=1400 audit(1788273990.059:349): avc: denied { cmd } for pid=2133 comm="iou-wrk-2134" path="socket:[14806]" dev="sockfs" ino=14806 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 112.055001][ T46] usb 6-1: too many endpoints for config 0 interface 0 altsetting 0: 255, using maximum allowed: 30 [ 112.066348][ T66] usb 7-1: new low-speed USB device number 9 using dummy_hcd [ 112.074238][ T46] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 88, setting to 64 [ 112.102593][ T46] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 255 [ 112.115961][ T46] usb 6-1: New USB device found, idVendor=04f3, idProduct=074d, bcdDevice= 0.00 [ 112.125047][ T46] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 112.137039][ T36] audit: type=1400 audit(1788273990.169:350): avc: denied { setopt } for pid=2117 comm="syz.3.731" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 112.166734][ T46] usb 6-1: config 0 descriptor?? [ 112.172408][ T2122] raw-gadget.5 gadget.5: fail, usb_ep_enable returned -22 [ 112.215927][ T66] usb 7-1: device descriptor read/64, error -71 [ 112.244160][ T2143] tipc: Enabling of bearer rejected, failed to enable media [ 112.277721][ T36] audit: type=1400 audit(1788273990.309:351): avc: denied { setattr } for pid=2144 comm="syz.7.740" name="secretmem" dev="secretmem" ino=15875 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 112.387707][ T46] usb 6-1: string descriptor 0 read error: -71 [ 112.400595][ T46] usbhid 6-1:0.0: can't add hid device: -71 [ 112.416054][ T46] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 112.434455][ T46] usb 6-1: USB disconnect, device number 18 [ 112.455891][ T66] usb 7-1: device descriptor read/64, error -71 [ 112.566028][ T66] usb usb7-port1: attempt power cycle [ 112.815758][ T36] audit: type=1400 audit(1788273990.839:352): avc: denied { search } for pid=2164 comm="syz.3.748" name="/" dev="configfs" ino=2303 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 112.842750][ T2165] BUG: scheduling while atomic: syz.3.748/2165/0x00000002 [ 112.850000][ T2165] Modules linked in: [ 112.853980][ T2165] CPU: 1 UID: 0 PID: 2165 Comm: syz.3.748 Not tainted syzkaller #0 998a4fffdb5e6e31f7f8340a226dd9d0893c7622 [ 112.854017][ T2165] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 112.854035][ T2165] Call Trace: [ 112.854045][ T2165] [ 112.854056][ T2165] __dump_stack+0x21/0x30 [ 112.854100][ T2165] dump_stack_lvl+0x140/0x1c0 [ 112.854136][ T2165] ? __cfi_dump_stack_lvl+0x10/0x10 [ 112.854174][ T2165] dump_stack+0x19/0x20 [ 112.854208][ T2165] __schedule_bug+0x12b/0x200 [ 112.854236][ T2165] ? find_proxy_task+0x2460/0x2460 [ 112.854263][ T2165] ? __kasan_check_read+0x15/0x20 [ 112.854290][ T2165] ? psi_group_change+0xab6/0x10a0 [ 112.854334][ T2165] __schedule+0xb85/0x20b0 [ 112.854362][ T2165] ? update_curr+0xf1/0x9c0 [ 112.854389][ T2165] ? __sched_text_start+0x10/0x10 [ 112.854414][ T2165] ? __kasan_check_read+0x15/0x20 [ 112.854440][ T2165] ? rwsem_spin_on_owner+0xa4/0x3b0 [ 112.854480][ T2165] ? __kasan_check_write+0x18/0x20 [ 112.854506][ T2165] ? _raw_spin_lock_irq+0x93/0x120 [ 112.854544][ T2165] ? __cfi__raw_spin_lock_irq+0x10/0x10 [ 112.854583][ T2165] schedule+0xc5/0x240 [ 112.854607][ T2165] schedule_preempt_disabled+0x14/0x30 [ 112.854633][ T2165] rwsem_down_write_slowpath+0x5c9/0x1b60 [ 112.854666][ T2165] ? activate_task+0x43b/0x480 [ 112.854694][ T2165] ? rwsem_down_read_slowpath+0x14c0/0x14c0 [ 112.854727][ T2165] ? try_to_wake_up+0x111a/0x1fd0 [ 112.854757][ T2165] ? __kasan_check_write+0x18/0x20 [ 112.854782][ T2165] ? wake_q_add_safe+0x29/0x100 [ 112.854807][ T2165] ? __cfi_try_to_wake_up+0x10/0x10 [ 112.854835][ T2165] ? rwsem_mark_wake+0x507/0x770 [ 112.854875][ T2165] ? rwsem_read_trylock+0x275/0x5a0 [ 112.854912][ T2165] ? wake_up_q+0x10a/0x1c0 [ 112.854935][ T2165] ? downgrade_write+0x470/0x470 [ 112.854973][ T2165] down_write+0x163/0x2b0 [ 112.855003][ T2165] ? __cfi_down_write+0x10/0x10 [ 112.855034][ T2165] ? down_read+0x7f/0xe0 [ 112.855062][ T2165] ? __cfi_down_read+0x10/0x10 [ 112.855092][ T2165] ? __kasan_check_write+0x18/0x20 [ 112.855120][ T2165] kernfs_remove+0x87/0xc0 [ 112.855154][ T2165] sysfs_remove_group+0x22d/0x250 [ 112.855186][ T2165] dpm_sysfs_remove+0x99/0xd0 [ 112.855221][ T2165] device_del+0x241/0xcf0 [ 112.855259][ T2165] ? __cfi_class_find_device+0x10/0x10 [ 112.855288][ T2165] ? __cfi_device_del+0x10/0x10 [ 112.855339][ T2165] ? __kasan_check_write+0x18/0x20 [ 112.855372][ T2165] ? kobject_put+0x1cc/0x2a0 [ 112.855409][ T2165] device_destroy+0xb0/0x100 [ 112.855434][ T2165] ? __cfi_device_destroy+0x10/0x10 [ 112.855458][ T2165] ? __kasan_check_write+0x18/0x20 [ 112.855486][ T2165] android_device_destroy+0x118/0x180 [ 112.855524][ T2165] gadgets_drop+0x1d/0x30 [ 112.855549][ T2165] ? __cfi_gadgets_drop+0x10/0x10 [ 112.855575][ T2165] configfs_rmdir+0x8b7/0x9b0 [ 112.855612][ T2165] vfs_rmdir+0x3db/0x560 [ 112.855648][ T2165] do_rmdir+0x29a/0x590 [ 112.855684][ T2165] ? __cfi_do_rmdir+0x10/0x10 [ 112.855721][ T2165] ? __kasan_check_write+0x18/0x20 [ 112.855749][ T2165] __x64_sys_rmdir+0x4b/0x60 [ 112.855785][ T2165] x64_sys_call+0xaf7/0x2ee0 [ 112.855812][ T2165] do_syscall_64+0x57/0xf0 [ 112.855844][ T2165] ? clear_bhb_loop+0x50/0xa0 [ 112.855870][ T2165] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 112.855894][ T2165] RIP: 0033:0x7f88b379e159 [ 112.855912][ T2165] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 112.855931][ T2165] RSP: 002b:00007f88b4674028 EFLAGS: 00000246 ORIG_RAX: 0000000000000054 [ 112.855954][ T2165] RAX: ffffffffffffffda RBX: 00007f88b3a25fa0 RCX: 00007f88b379e159 [ 112.855972][ T2165] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000600 [ 112.855988][ T2165] RBP: 00007f88b3835024 R08: 0000000000000000 R09: 0000000000000000 [ 112.856003][ T2165] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 112.856016][ T2165] R13: 00007f88b3a26038 R14: 00007f88b3a25fa0 R15: 00007ffdcb5ccf58 [ 112.856036][ T2165] [ 113.254170][ T36] audit: type=1400 audit(1788273990.839:353): avc: denied { write } for pid=2164 comm="syz.3.748" name="usb_gadget" dev="configfs" ino=2304 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 113.277042][ T36] audit: type=1400 audit(1788273990.839:354): avc: denied { add_name } for pid=2164 comm="syz.3.748" name="g1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 113.345500][ T2165] ------------[ cut here ]------------ [ 113.351351][ T2165] WARNING: CPU: 1 PID: 2165 at lib/stackdepot.c:635 stack_depot_save_flags+0x266/0x800 [ 113.361116][ T2165] Modules linked in: [ 113.365079][ T2165] CPU: 1 UID: 0 PID: 2165 Comm: syz.3.748 Tainted: G W syzkaller #0 998a4fffdb5e6e31f7f8340a226dd9d0893c7622 [ 113.378099][ T2165] Tainted: [W]=WARN [ 113.381942][ T2165] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 113.392062][ T2165] RIP: 0010:stack_depot_save_flags+0x266/0x800 [ 113.398324][ T2165] Code: 48 83 3d b4 ea db 05 00 0f 84 00 04 00 00 48 c7 45 c0 00 00 00 00 48 89 d3 65 8b 05 cc 4b 1e 7d 4d 89 d7 a9 00 00 f0 00 74 2d <0f> 0b 48 c7 45 c8 00 00 00 00 9c 8f 45 c8 4c 8b 6d c8 fa 48 c7 c7 [ 113.418058][ T2165] RSP: 0018:ffffc900010ff9d0 EFLAGS: 00010206 [ 113.424181][ T2165] RAX: 000000007fffffff RBX: ffff8881f58f02f0 RCX: 00000000006f02f0 [ 113.432249][ T2165] RDX: ffff8881f58f02f0 RSI: 0000000000000001 RDI: 00000000ee831078 [ 113.440298][ T2165] RBP: ffffc900010ffa30 R08: 0000000067e90999 R09: 00000000e1275e1c [ 113.448339][ T2165] R10: 000000000000000d R11: ffffffff8175a5c0 R12: 00000000cf36f02f [ 113.456407][ T2165] R13: 0000000000000000 R14: ffffc900010ffa40 R15: 000000000000000d [ 113.464434][ T2165] FS: 00007f88b46746c0(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 113.473445][ T2165] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 113.480097][ T2165] CR2: 00007f2d499ef2f8 CR3: 00000001224ba000 CR4: 00000000003526b0 [ 113.488137][ T2165] Call Trace: [ 113.491451][ T2165] [ 113.494411][ T2165] ? kasan_save_free_info+0x44/0x50 [ 113.499677][ T2165] kasan_save_track+0x4f/0x80 [ 113.504394][ T2165] ? kasan_save_track+0x3e/0x80 [ 113.509313][ T2165] ? kasan_save_free_info+0x44/0x50 [ 113.514557][ T2165] ? __kasan_slab_free+0x5f/0x80 [ 113.519864][ T2165] ? kfree+0x158/0x440 [ 113.523974][ T2165] ? configfs_d_iput+0x1d8/0x290 [ 113.529014][ T2165] ? dentry_unlink_inode+0x363/0x430 [ 113.534351][ T2165] ? d_delete+0xa8/0x120 [ 113.538662][ T2165] ? vfs_rmdir+0x264/0x560 [ 113.543130][ T2165] ? do_rmdir+0x29a/0x590 [ 113.547562][ T2165] ? __x64_sys_rmdir+0x4b/0x60 [ 113.552377][ T2165] ? x64_sys_call+0xaf7/0x2ee0 [ 113.557205][ T2165] ? do_syscall_64+0x57/0xf0 [ 113.561849][ T2165] ? entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 113.568000][ T2165] kasan_save_free_info+0x44/0x50 [ 113.573083][ T2165] __kasan_slab_free+0x5f/0x80 [ 113.578633][ T2165] kfree+0x158/0x440 [ 113.582598][ T2165] ? configfs_d_iput+0x1d8/0x290 [ 113.587825][ T2165] configfs_d_iput+0x1d8/0x290 [ 113.592644][ T2165] ? __cfi_configfs_d_iput+0x10/0x10 [ 113.598110][ T2165] dentry_unlink_inode+0x363/0x430 [ 113.603271][ T2165] d_delete+0xa8/0x120 [ 113.607444][ T2165] vfs_rmdir+0x264/0x560 [ 113.611743][ T2165] do_rmdir+0x29a/0x590 [ 113.616063][ T2165] ? __cfi_do_rmdir+0x10/0x10 [ 113.620791][ T2165] ? __kasan_check_write+0x18/0x20 [ 113.625991][ T2165] __x64_sys_rmdir+0x4b/0x60 [ 113.630633][ T2165] x64_sys_call+0xaf7/0x2ee0 [ 113.635266][ T2165] do_syscall_64+0x57/0xf0 [ 113.639790][ T2165] ? clear_bhb_loop+0x50/0xa0 [ 113.644516][ T2165] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 113.650494][ T2165] RIP: 0033:0x7f88b379e159 [ 113.654948][ T2165] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 113.674644][ T2165] RSP: 002b:00007f88b4674028 EFLAGS: 00000246 ORIG_RAX: 0000000000000054 [ 113.683141][ T2165] RAX: ffffffffffffffda RBX: 00007f88b3a25fa0 RCX: 00007f88b379e159 [ 113.691253][ T2165] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000600 [ 113.699331][ T2165] RBP: 00007f88b3835024 R08: 0000000000000000 R09: 0000000000000000 [ 113.707375][ T2165] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 113.715434][ T2165] R13: 00007f88b3a26038 R14: 00007f88b3a25fa0 R15: 00007ffdcb5ccf58 [ 113.723561][ T2165] [ 113.726904][ T2165] ---[ end trace 0000000000000000 ]--- [ 113.732654][ T66] usb 7-1: new low-speed USB device number 10 using dummy_hcd [ 113.743600][ T31] usb 4-1: USB disconnect, device number 38 [ 113.758254][ T66] usb 7-1: device descriptor read/8, error -71 [ 113.802939][ T2165] BUG: scheduling while atomic: syz.3.748/2165/0x00000000 [ 113.825947][ T2165] Modules linked in: [ 113.829971][ T2165] CPU: 1 UID: 0 PID: 2165 Comm: syz.3.748 Tainted: G W syzkaller #0 998a4fffdb5e6e31f7f8340a226dd9d0893c7622 [ 113.830016][ T2165] Tainted: [W]=WARN [ 113.830026][ T2165] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 113.830042][ T2165] Call Trace: [ 113.830068][ T2140] ------------[ cut here ]------------ [ 113.865923][ T2140] refcount_t: underflow; use-after-free. [ 113.871759][ T2140] WARNING: CPU: 1 PID: 2140 at lib/refcount.c:28 refcount_warn_saturate+0x119/0x1c0 [ 113.881264][ T2140] Modules linked in: [ 113.885198][ T2140] CPU: 1 UID: 0 PID: 2140 Comm: syz.3.731 Tainted: G W syzkaller #0 998a4fffdb5e6e31f7f8340a226dd9d0893c7622 [ 113.898237][ T2140] Tainted: [W]=WARN [ 113.902083][ T2140] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 113.912299][ T2140] RIP: 0010:refcount_warn_saturate+0x119/0x1c0 [ 113.918532][ T2140] Code: 05 01 48 c7 c7 a0 f3 51 86 e8 63 21 55 fe 0f 0b eb da e8 aa 4e d8 fe c6 05 29 30 36 05 01 48 c7 c7 00 f4 51 86 e8 47 21 55 fe <0f> 0b eb be e8 8e 4e d8 fe c6 05 0a 30 36 05 01 48 c7 c7 40 f3 51 [ 113.938226][ T2140] RSP: 0018:ffffc900103767d0 EFLAGS: 00010246 [ 113.944346][ T2140] RAX: b6c669480886d900 RBX: 0000000000000003 RCX: ffff888117322600 [ 113.952400][ T2140] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000002 [ 113.960461][ T2140] RBP: ffffc900103767e0 R08: ffff8881f6f294d3 R09: 1ffff1103ede529a [ 113.968513][ T2140] R10: dffffc0000000000 R11: ffffed103ede529b R12: ffff8881f6f4fa40 [ 113.976545][ T2140] R13: dffffc0000000000 R14: ffff888114068c70 R15: 0000000000000000 [ 113.984570][ T2140] FS: 0000000000000000(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 113.993578][ T2140] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 114.000248][ T2140] CR2: 00007f2d499ef2f8 CR3: 00000000074aa000 CR4: 00000000003526b0 [ 114.008308][ T2140] Call Trace: [ 114.011657][ T2140] [ 114.014627][ T2140] put_task_stack+0x20f/0x230 [ 114.019439][ T2140] finish_task_switch+0x31d/0x770 [ 114.024522][ T2140] __schedule+0x149e/0x20b0 [ 114.029128][ T2140] ? __sched_text_start+0x10/0x10 [ 114.034220][ T2140] ? is_bpf_text_address+0x17b/0x1a0 [ 114.039618][ T2140] ? kernel_text_address+0xa9/0xe0 [ 114.044785][ T2140] ? __kernel_text_address+0x11/0x40 [ 114.050166][ T2140] preempt_schedule_irq+0xab/0x110 [ 114.055324][ T2140] ? __cfi_preempt_schedule_irq+0x10/0x10 [ 114.061135][ T2140] raw_irqentry_exit_cond_resched+0x32/0x40 [ 114.067095][ T2140] irqentry_exit+0x4a/0x60 [ 114.071569][ T2140] sysvec_apic_timer_interrupt+0x50/0x90 [ 114.077287][ T2140] asm_sysvec_apic_timer_interrupt+0x1f/0x30 [ 114.083314][ T2140] RIP: 0010:unwind_get_return_address+0xa/0x90 [ 114.089578][ T2140] Code: 9b 00 e9 79 ff ff ff cc cc cc cc cc cc cc cc cc b8 cf 49 cb b9 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 55 48 89 e5 41 57 <41> 56 53 48 89 fb 49 be 00 00 00 00 00 fc ff df 48 89 f8 48 c1 e8 [ 114.109241][ T2140] RSP: 0018:ffffc90010376bd0 EFLAGS: 00000202 [ 114.115360][ T2140] RAX: 1ffff9200206ed01 RBX: ffffc90010376ca0 RCX: 000000000206ed01 [ 114.123431][ T2140] RDX: ffffc900103771b8 RSI: 1ffff9200206ed7e RDI: ffffc90010376be8 [ 114.131469][ T2140] RBP: ffffc90010376bd8 R08: ffffc90010376cb0 R09: ffffc90010376ca8 [ 114.139537][ T2140] R10: 0000000000000001 R11: ffffffff8175a5c0 R12: ffff888117322600 [ 114.147570][ T2140] R13: 1ffff11022e64580 R14: ffffffff8175a5c0 R15: ffffc90010376be8 [ 114.155899][ T2140] ? __cfi_stack_trace_consume_entry+0x10/0x10 [ 114.162114][ T2140] ? __cfi_stack_trace_consume_entry+0x10/0x10 [ 114.168388][ T2140] arch_stack_walk+0x10a/0x170 [ 114.173253][ T2140] ? __folio_batch_release+0xac/0x100 [ 114.178735][ T2140] stack_trace_save+0xaa/0x100 [ 114.183545][ T2140] ? __cfi_stack_trace_save+0x10/0x10 [ 114.189007][ T2140] ? stack_depot_save_flags+0x38/0x800 [ 114.194518][ T2140] ? __asan_memset+0x39/0x50 [ 114.199303][ T2140] save_stack+0x125/0x240 [ 114.203697][ T2140] ? __cfi_cgroup_rstat_updated+0x10/0x10 [ 114.209513][ T2140] ? __reset_page_owner+0x450/0x450 [ 114.214773][ T2140] ? free_unref_folios+0xd36/0x16a0 [ 114.220897][ T2140] ? folios_put_refs+0x73f/0x860 [ 114.226129][ T2140] ? kvm_sched_clock_read+0x15/0x30 [ 114.231423][ T2140] __reset_page_owner+0x79/0x450 [ 114.236474][ T2140] free_unref_folios+0xd36/0x16a0 [ 114.241568][ T2140] ? __kasan_check_write+0x18/0x20 [ 114.246770][ T2140] ? __cfi_free_unref_folios+0x10/0x10 [ 114.252284][ T2140] ? folios_put_refs+0x7f0/0x860 [ 114.257314][ T2140] folios_put_refs+0x73f/0x860 [ 114.262148][ T2140] ? __cfi_folios_put_refs+0x10/0x10 [ 114.267527][ T2140] ? __kasan_check_write+0x18/0x20 [ 114.272678][ T2140] ? folio_unlock+0x137/0x1b0 [ 114.277431][ T2140] ? __cfi_filemap_remove_folio+0x10/0x10 [ 114.283192][ T2140] ? __cfi_folio_unlock+0x10/0x10 [ 114.288331][ T2140] __folio_batch_release+0xac/0x100 [ 114.293574][ T2140] shmem_undo_range+0x4e0/0x1400 [ 114.298606][ T2140] ? shmem_truncate_range+0xc0/0xc0 [ 114.303855][ T2140] ? __kernel_text_address+0x11/0x40 [ 114.309217][ T2140] ? unwind_get_return_address+0x51/0x90 [ 114.314894][ T2140] ? __cfi_stack_trace_consume_entry+0x10/0x10 [ 114.321178][ T2140] ? __cfi_stack_trace_consume_entry+0x10/0x10 [ 114.327400][ T2140] ? kasan_save_stack+0x4d/0x60 [ 114.332303][ T2140] ? kasan_save_stack+0x3e/0x60 [ 114.337230][ T2140] ? __kasan_record_aux_stack+0xb2/0xd0 [ 114.342814][ T2140] ? __call_rcu_common+0xd5/0x710 [ 114.347949][ T2140] ? call_rcu+0x14/0x20 [ 114.352150][ T2140] shmem_evict_inode+0x286/0xaa0 [ 114.357191][ T2140] ? __kasan_check_read+0x15/0x20 [ 114.362254][ T2140] ? __cfi_shmem_evict_inode+0x10/0x10 [ 114.367789][ T2140] ? __cfi_inode_wait_for_writeback+0x10/0x10 [ 114.373921][ T2140] ? __cfi_shmem_evict_inode+0x10/0x10 [ 114.379534][ T2140] evict+0x51c/0xaf0 [ 114.383474][ T2140] ? mapping_shrinkable+0x150/0x150 [ 114.388773][ T2140] ? __cfi_locks_remove_file+0x10/0x10 [ 114.394392][ T2140] ? __call_rcu_common+0x53c/0x710 [ 114.399592][ T2140] ? __kasan_check_write+0x18/0x20 [ 114.404738][ T2140] iput+0x651/0x910 [ 114.408640][ T2140] dentry_unlink_inode+0x379/0x430 [ 114.413831][ T2140] __dentry_kill+0x1ad/0x5f0 [ 114.418521][ T2140] dput+0x3fd/0x520 [ 114.422375][ T2140] __fput+0x5c1/0xa30 [ 114.426440][ T2140] ____fput+0x20/0x30 [ 114.430505][ T2140] task_work_run+0x1e5/0x260 [ 114.435180][ T2140] ? __cfi_task_work_run+0x10/0x10 [ 114.440459][ T2140] ? __kasan_check_write+0x18/0x20 [ 114.445695][ T2140] do_exit+0xa46/0x2850 [ 114.449959][ T2140] ? __cfi_do_exit+0x10/0x10 [ 114.454661][ T2140] ? __kasan_slab_free+0x6a/0x80 [ 114.459699][ T2140] do_group_exit+0x21f/0x2f0 [ 114.464343][ T2140] get_signal+0x134c/0x1490 [ 114.468945][ T2140] arch_do_signal_or_restart+0xbc/0x700 [ 114.474536][ T2140] ? __cfi_arch_do_signal_or_restart+0x10/0x10 [ 114.480806][ T2140] ? __kasan_check_read+0x15/0x20 [ 114.485908][ T2140] irqentry_exit_to_user_mode+0x4d/0xb0 [ 114.491515][ T2140] irqentry_exit+0x16/0x60 [ 114.496007][ T2140] exc_page_fault+0x65/0xc0 [ 114.500559][ T2140] asm_exc_page_fault+0x2b/0x30 [ 114.505487][ T2140] RIP: 0033:0x0 [ 114.509015][ T2140] Code: Unable to access opcode bytes at 0xffffffffffffffd6. [ 114.516473][ T2140] RSP: 002b:0000000000000028 EFLAGS: 00010217 [ 114.522585][ T2140] RAX: 0000000000000000 RBX: 00007f88b3a25fa0 RCX: 00007f88b379e159 [ 114.530621][ T2140] RDX: 0000000000000000 RSI: 0000000000000020 RDI: 0000000080000200 [ 114.538678][ T2140] RBP: 00007f88b3835024 R08: 0000000000000000 R09: 0000000000000000 [ 114.546721][ T2140] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 114.554723][ T2140] R13: 00007f88b3a26038 R14: 00007f88b3a25fa0 R15: 00007ffdcb5ccf58 [ 114.562784][ T2140] [ 114.565866][ T2140] ---[ end trace 0000000000000000 ]--- [ 114.586429][ T66] usb 7-1: device descriptor read/8, error -71 [ 114.607190][ T33] ------------[ cut here ]------------ [ 114.612735][ T33] WARNING: CPU: 0 PID: 33 at kernel/fork.c:595 free_task+0x12c/0x260 [ 114.620913][ T33] Modules linked in: [ 114.624857][ T33] CPU: 0 UID: 0 PID: 33 Comm: rcuop/1 Tainted: G W syzkaller #0 998a4fffdb5e6e31f7f8340a226dd9d0893c7622 [ 114.637524][ T33] Tainted: [W]=WARN [ 114.641358][ T33] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 114.651587][ T33] RIP: 0010:free_task+0x12c/0x260 [ 114.656712][ T33] Code: 3d 99 7e 6d 07 48 89 de e8 51 2f 8e 00 5b 41 5e 41 5f 5d c3 cc cc cc cc cc e8 80 74 39 00 0f 0b e9 24 ff ff ff e8 74 74 39 00 <0f> 0b e9 75 ff ff ff 44 89 f1 80 e1 07 80 c1 03 38 c1 0f 8c 49 ff [ 114.676580][ T33] RSP: 0018:ffffc90000227a88 EFLAGS: 00010293 [ 114.682714][ T33] RAX: ffffffff814e02cc RBX: ffff888114068000 RCX: ffff888103678000 [ 114.690760][ T33] RDX: 0000000000000000 RSI: 00000000c0000000 RDI: 0000000000000000 [ 114.698796][ T33] RBP: ffffc90000227aa0 R08: ffff888114068c73 R09: 1ffff1102280d18e [ 114.706871][ T33] R10: dffffc0000000000 R11: ffffed102280d18f R12: dffffc0000000000 [ 114.714880][ T33] R13: 1ffff1102280d170 R14: 00000000c0000000 R15: dffffc0000000000 [ 114.722918][ T33] FS: 0000000000000000(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 114.731911][ T33] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 114.738558][ T33] CR2: 00007f0e9e3ef2f8 CR3: 000000010c702000 CR4: 00000000003526b0 [ 114.746598][ T33] Call Trace: [ 114.749911][ T33] [ 114.752869][ T33] __put_task_struct+0x2ed/0x450 [ 114.757868][ T33] ? delayed_put_task_struct+0x6b/0x1d0 [ 114.763459][ T33] ? __cfi_delayed_put_task_struct+0x10/0x10 [ 114.769514][ T33] delayed_put_task_struct+0x73/0x1d0 [ 114.774936][ T33] rcu_do_batch+0x56d/0xcb0 [ 114.779517][ T33] ? rcu_core+0xcc0/0xcc0 [ 114.783892][ T33] ? __kasan_check_write+0x18/0x20 [ 114.789082][ T33] ? __kasan_check_read+0x15/0x20 [ 114.794158][ T33] ? rcu_nocb_cb_kthread+0x51e/0xb60 [ 114.799510][ T33] rcu_nocb_cb_kthread+0x533/0xb60 [ 114.804640][ T33] ? __cfi_rcu_nocb_cb_kthread+0x10/0x10 [ 114.810317][ T33] ? __kasan_check_write+0x18/0x20 [ 114.815476][ T33] ? _raw_spin_lock_irqsave+0xc1/0x160 [ 114.821020][ T33] ? __cfi__raw_spin_lock_irqsave+0x10/0x10 [ 114.826978][ T33] ? _raw_spin_lock_irqsave+0xc1/0x160 [ 114.832486][ T33] ? set_cpus_allowed_ptr+0xa1/0xf0 [ 114.837763][ T33] ? __cfi_set_cpus_allowed_ptr+0x10/0x10 [ 114.843525][ T33] ? __kasan_check_read+0x15/0x20 [ 114.848629][ T33] ? __kthread_parkme+0x12f/0x180 [ 114.853691][ T33] ? schedule+0xc5/0x240 [ 114.858016][ T33] kthread+0x2c4/0x360 [ 114.862123][ T33] ? __cfi_rcu_nocb_cb_kthread+0x10/0x10 [ 114.867848][ T33] ? __cfi_kthread+0x10/0x10 [ 114.872492][ T33] ret_from_fork+0x64/0xa0 [ 114.877003][ T33] ? __cfi_kthread+0x10/0x10 [ 114.881634][ T33] ret_from_fork_asm+0x1a/0x30 [ 114.886474][ T33] [ 114.889516][ T33] ---[ end trace 0000000000000000 ]---