last executing test programs: 1.345506184s ago: executing program 1 (id=2): r0 = syz_usb_connect(0x5, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000772904202404019957c2010203010902240001000010000904430002317d5500090502020002020000090582020002"], 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) r1 = socket$unix(0x1, 0x2, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000600)={'bridge0\x00', &(0x7f0000000640)=@ethtool_regs={0x4, 0x0, 0x1, "f4"}}) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000040)={0x44, &(0x7f00000000c0)=ANY=[@ANYBLOB="0004a204000000000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, &(0x7f0000000980)={0x14, &(0x7f0000000840)={0x20, 0x5, 0xa8, {0xa8, 0x0, "a29ffcb9a0db95e9a471d029c8b8b10d5f40bf3bd926243d31492d3e2f83df14b91d395e402d1a9b8c16f699a41e15625e3c2664514fc3c75153f9ba0a4183aee28999150825ef38761c1b6d693f1f088b5d438b80a94ed01514d27ea6f3e9b337a4c3a27f134870d9b9f0d1dafbe3e7ff40f440e1486d5e691659508af95f7b9328e6ce56ecf3861e918ccb71d9f2aa50c11ea508fc65f89400f4e5ecf0ed25183f9159b926"}}, 0x0}, 0x0) syz_usb_control_io$uac2(r0, &(0x7f0000000340)={0x14, &(0x7f00000009c0)=ANY=[@ANYBLOB="00313e0000003f11aab153ecae9dd3ec09b619728af748d0a07740e70b274c3d5bc2a87b2ae3c1b67ef2356d31e64fdc310d3432f22b0fcc8d05166ab46e66f480682410f6af19a10beab632ac3ea5a75b79ee209ddd7fea39263a952c045199d27da6be18381a41b6fda93c78499888392754b85677bd9cf29eba5b8c5be4e6e09e3bd8ac74a4b131611c1f7e0cadeab50532f3bddf8db334a86e502c27ccba56e1e800731d4a61ca283654e7d5d14c285445a4afb31dc272a2dac64e9907f2e72fc26de16a0863891191e6c999660a13828308e6692f107b914a8050d7905f90a8d8b2c227a9b7d932295f5ea1c93939883f2d25f7aa301480b778457c9d50e124da4dbd47f51daf2b2a3c0be8cae4365d1beafe2f6aed65a2d58c143e2c54d67282056d51"], &(0x7f0000000280)={0x0, 0x3, 0xac, @string={0xac, 0x3, "00e6477931343aa14ed63a1ff64f428383ce5451fc447c2a202b9fe912a9795b8fbc4a0dcc587ab1f6e0d71f83e9ee71062e4b39d4745e2f8edf4eea853a213b3c9984ff19518494be5fbe664150fecddaacb717320b2be354d4eb5c5a89f748cfab2c1ecb46c26195408a522b0e6e68e36343a90ef7e4029f27c4bc4a439e7e8cbc56f29b9cda312464d39c1611867b01dacdf24e53a0cade78b108e39ae104aeae79f60b9af5c17da8"}}}, &(0x7f0000000580)={0x44, &(0x7f0000000380)={0x40, 0x18, 0xf, "e54e0ab81fb9fbb1c6adf7d8e3b7d7"}, &(0x7f00000003c0)={0x0, 0xa, 0x1, 0x8}, &(0x7f0000000400)={0x0, 0x8, 0x1, 0xa}, &(0x7f0000000440)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], &(0x7f0000000480)={0x20, 0x82, 0x1, "bb"}, &(0x7f00000004c0)={0x20, 0x83, 0x2, "e838"}, &(0x7f0000000500)={0x20, 0x84, 0x1, "91"}, &(0x7f0000000540)={0x20, 0x85, 0x3, 'c#R'}}) r2 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r2, 0x11b, 0x4, &(0x7f0000000680)={&(0x7f00000006c0), 0x10000, 0x800}, 0x20) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r2, 0x8933, &(0x7f0000000140)={'batadv_slave_1\x00'}) read$ublk_bdev(0xffffffffffffffff, &(0x7f0000000c40)=""/236, 0xec) setsockopt$XDP_RX_RING(r2, 0x11b, 0x2, &(0x7f0000000700)=0x4, 0x4) setsockopt$XDP_UMEM_FILL_RING(r2, 0x11b, 0x5, &(0x7f0000000740)=0x4, 0x4) setsockopt$XDP_UMEM_COMPLETION_RING(r2, 0x11b, 0x6, &(0x7f0000000780)=0x4, 0x4) bind$xdp(r2, &(0x7f00000007c0)={0x2c, 0x0, 0x2, 0x0, 0x0}, 0x10) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000800)={0x1, &(0x7f0000000900)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) close_range(r3, 0xffffffffffffffff, 0x2000000000000) syz_usb_control_io(r0, 0x0, &(0x7f0000000180)={0x84, &(0x7f0000000240)={0x40, 0xe, 0x4, '9I{2'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r4 = pidfd_getfd(0xffffffffffffffff, r3, 0x0) ioctl$MON_IOCX_GET(r4, 0x40189206, &(0x7f0000000c00)={&(0x7f0000000100), &(0x7f0000000b00)=""/204, 0xcc}) 1.324978486s ago: executing program 0 (id=1): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=@newsa={0x150, 0x10, 0x401, 0x0, 0x0, {{@in6=@loopback, @in6=@loopback, 0x1234, 0xffff, 0x0, 0x0, 0xa, 0x80, 0x80, 0x11}, {@in6=@loopback, 0x4d2, 0x32}, @in6=@loopback, {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}, {}, {}, 0x0, 0x0, 0xa}, [@algo_aead={0x60, 0x12, {{'rfc4106(gcm(aes))\x00'}, 0xa0, 0x80, '1234567890123456dcba'}}]}, 0x150}}, 0x0) sendmsg$nl_xfrm(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@newpolicy={0xfc, 0x13, 0x401, 0x0, 0x0, {{@in6=@loopback, @in6=@loopback, 0x1234, 0xffff, 0x0, 0x0, 0xa, 0x80, 0x80, 0x11}, {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}, {}, 0x0, 0x0, 0x1}, [@tmpl={0x44, 0x5, [{{@in6=@loopback, 0x4d2, 0x32}, 0xa, @in6=@loopback}]}]}, 0xfc}}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) sendto$inet6(r1, &(0x7f0000000440), 0x97ff, 0x0, &(0x7f0000000480)={0xa, 0x1234, 0x0, @loopback}, 0x1c) mount$cgroup2(0x0, &(0x7f00000000c0)='./cgroup\x00', &(0x7f0000000000), 0x280c00c, &(0x7f0000000080)=ANY=[@ANYBLOB="6661766f7264796e6d6f72ad8a99dff22e71d45eef18687edebb3d795f6c6f63616c"]) 1.294595959s ago: executing program 2 (id=3): r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x30) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000300)='./dev\x00', &(0x7f0000000340)='devtmpfs\x00', 0x10083, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./mnt\x00', 0x1ff) mount(&(0x7f00000003c0)=@filename='./dev/sda1\x00', &(0x7f0000000400)='./mnt\x00', &(0x7f0000000440)='ext4\x00', 0x8410, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./mnt\x00', 0x0, 0x21) ioctl$EXT4_IOC_SETFSUUID(r1, 0x4008662c, &(0x7f00000004c0)={0x10, 0x0, "cd6354aaf48bd635ea1ffc70164cafa0"}) ioctl$XFS_IOC_FREE_EOFBLOCKS(r0, 0x8080583a, &(0x7f0000000280)={0x4, 0x8, 0x6, 0x8, 0xc0c, 0x0, 0x9}) syz_usb_connect(0x6, 0x371, 0x0, 0x0) mkdir(&(0x7f0000000540)='./sys\x00', 0x0) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000240)='sysfs\x00', 0x0, 0x0) r2 = fsopen(&(0x7f0000000040)='pstore\x00', 0x0) r3 = landlock_create_ruleset(&(0x7f0000000100)={0xc0d8, 0x1, 0x3}, 0x18, 0x0) landlock_restrict_self(r3, 0x0) landlock_restrict_self(r3, 0x0) landlock_restrict_self(r3, 0x0) r4 = landlock_create_ruleset(&(0x7f0000000140)={0x0, 0x3}, 0x10, 0x0) r5 = landlock_create_ruleset(&(0x7f00000001c0)={0x2832, 0x0, 0x2}, 0x18, 0x0) landlock_restrict_self(r5, 0x0) landlock_restrict_self(r4, 0x0) landlock_restrict_self(r4, 0x0) landlock_restrict_self(r4, 0x0) landlock_restrict_self(r4, 0x0) landlock_restrict_self(r4, 0x0) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/devices/0000:00:01.0/remove\x00', 0x1, 0x0) write(r6, 0x0, 0x0) write(r6, &(0x7f00000000c0)='1', 0x1) r7 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/rescan\x00', 0x1, 0x0) write(r7, &(0x7f0000000700)="3100d9", 0x3) 1.280962741s ago: executing program 3 (id=4): r0 = openat$kvm(0x0, 0x0, 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f0000000040)={0x0, &(0x7f0000000080)=[@enable_nested={0x12c, 0x18}, @nested_create_vm={0x12d, 0x18}, @nested_vmlaunch={0x12f, 0x18}, @nested_create_vm={0x12d, 0x18, 0x1}, @nested_intel_msr_list_add={0x155, 0x30, {0x1, 0x1, 0xb25}}, @nested_vmlaunch={0x12f, 0x18, 0x1}], 0xa8}) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) socket(0x10, 0x3, 0x0) munmap(&(0x7f0000cf2000/0x4000)=nil, 0x4000) 1.259900893s ago: executing program 3 (id=5): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'bond_slave_1\x00', 0x0}) sendmsg$nl_route_sched_retired(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=@delchain={0x24, 0x65, 0x1, 0x70bd25, 0x25dfdbff, {0x0, 0x0, 0x0, r1, {0xfff1, 0xffff}, {0xfff3, 0x8}, {0xffff, 0x8}}}, 0x24}}, 0x490d0) syz_usb_connect(0x0, 0x63, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000404c17aa5500010102030109025100010100c032090400000208065000070501020002000705820200020009040001040806620007050102000200032401070502020002000324020705030200020003"], 0x0) syz_usb_connect$cdc_ecm(0x0, 0x165, &(0x7f0000000380)={{0x12, 0x1, 0x201, 0x2, 0x0, 0x0, 0x20, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x153, 0x1, 0x1, 0x3, 0xe0, 0x1, "", [{{0x9, 0x4, 0x0, 0xa1, 0x2, 0x2, 0x6, 0x0, 0x4, {{0xb, 0x24, 0x6, 0x0, 0x0, "040033c70000"}, {0x5, 0x24, 0x0, 0xfff9}, {0xd, 0x24, 0xf, 0x1, 0x80000000, 0x9, 0x2a8c, 0xc}, [@call_mgmt={0x5, 0x24, 0x1, 0x3, 0x3}, @country_functional={0x10, 0x24, 0x7, 0x7f, 0x5, [0x5, 0x3, 0x9, 0x3, 0x9de]}, @mdlm_detail={0xf4, 0x24, 0x13, 0x4, "754138ba211e441685fb3077773c01d607560afb42261c775dd83b4dff4d58f1b6e62bc3d7a536d98f6ee0cf348b4f4164b50079f659a5fec0ac03133180ce580a5507f90f5f4263912a3821bb5756a42aff8750fa9b626b8a1aa8bf100f2b04f4c78a5a3a34479105e4fb699a13a0067fd7525b5bc4c1b034450c96546d51d684564351b9f4fc984b5a241fba42c1f1f4ed4be152a7b73b3a524c914bb748454edbde0e7a108cdb899e63a32e02a9d36a042d9af34bbb55f35141869966b92980ee7d1c5e05c3a5a0bc0f9e1a4e1177fbc5075390510fc57b2decb24f8a5280dddfbd3efffd34d0d7f982d244100016"}]}, {[{{0x9, 0x5, 0x81, 0x3, 0x400, 0x8, 0xf, 0x6}}], {{0x9, 0x5, 0x82, 0x2, 0x10, 0x2, 0x6, 0x5}}, {{0x9, 0x5, 0x3, 0x2, 0x200, 0x3, 0x0, 0x8d}}}}}]}}]}}, &(0x7f0000000340)={0xa, &(0x7f0000000200)={0xa, 0x6, 0x201, 0x7, 0xff, 0x7f, 0x40, 0x4}, 0x38, &(0x7f0000000240)={0x5, 0xf, 0x38, 0x3, [@ss_container_id={0x14, 0x10, 0x4, 0xc7, "819760e5ee3d6336aa097fd9261267e6"}, @wireless={0xb, 0x10, 0x1, 0xc, 0x81, 0x8, 0x2, 0x401, 0xc8}, @ss_container_id={0x14, 0x10, 0x4, 0x8, "b3865fd080185532822bf5715d1cfdd9"}]}, 0x2, [{0x4, &(0x7f0000000280)=@lang_id={0x4, 0x3, 0x1007}}, {0x79, &(0x7f00000002c0)=@string={0x79, 0x3, "6dba9e9eb443676ef3b92dbe389059a136ab76ae5cc182e96fb5941d08dfa3fac44a47f1d36ca2370450922b042877ae1cfc1c3c76a5a6251928f2a9f0b59b94be8b7e5faed7775cde916d55fa6f9a9fa63b2d2f291d4d04211105c3d91c3dee2c1b44f2045e11e737ebe41d72ac0f9c2da9a7d29f1560"}}]}) socket$nl_route(0x10, 0x3, 0x0) (async) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'bond_slave_1\x00'}) (async) sendmsg$nl_route_sched_retired(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=@delchain={0x24, 0x65, 0x1, 0x70bd25, 0x25dfdbff, {0x0, 0x0, 0x0, r1, {0xfff1, 0xffff}, {0xfff3, 0x8}, {0xffff, 0x8}}}, 0x24}}, 0x490d0) (async) syz_usb_connect(0x0, 0x63, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000404c17aa5500010102030109025100010100c032090400000208065000070501020002000705820200020009040001040806620007050102000200032401070502020002000324020705030200020003"], 0x0) (async) syz_usb_connect$cdc_ecm(0x0, 0x165, &(0x7f0000000380)={{0x12, 0x1, 0x201, 0x2, 0x0, 0x0, 0x20, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x153, 0x1, 0x1, 0x3, 0xe0, 0x1, "", [{{0x9, 0x4, 0x0, 0xa1, 0x2, 0x2, 0x6, 0x0, 0x4, {{0xb, 0x24, 0x6, 0x0, 0x0, "040033c70000"}, {0x5, 0x24, 0x0, 0xfff9}, {0xd, 0x24, 0xf, 0x1, 0x80000000, 0x9, 0x2a8c, 0xc}, [@call_mgmt={0x5, 0x24, 0x1, 0x3, 0x3}, @country_functional={0x10, 0x24, 0x7, 0x7f, 0x5, [0x5, 0x3, 0x9, 0x3, 0x9de]}, @mdlm_detail={0xf4, 0x24, 0x13, 0x4, "754138ba211e441685fb3077773c01d607560afb42261c775dd83b4dff4d58f1b6e62bc3d7a536d98f6ee0cf348b4f4164b50079f659a5fec0ac03133180ce580a5507f90f5f4263912a3821bb5756a42aff8750fa9b626b8a1aa8bf100f2b04f4c78a5a3a34479105e4fb699a13a0067fd7525b5bc4c1b034450c96546d51d684564351b9f4fc984b5a241fba42c1f1f4ed4be152a7b73b3a524c914bb748454edbde0e7a108cdb899e63a32e02a9d36a042d9af34bbb55f35141869966b92980ee7d1c5e05c3a5a0bc0f9e1a4e1177fbc5075390510fc57b2decb24f8a5280dddfbd3efffd34d0d7f982d244100016"}]}, {[{{0x9, 0x5, 0x81, 0x3, 0x400, 0x8, 0xf, 0x6}}], {{0x9, 0x5, 0x82, 0x2, 0x10, 0x2, 0x6, 0x5}}, {{0x9, 0x5, 0x3, 0x2, 0x200, 0x3, 0x0, 0x8d}}}}}]}}]}}, &(0x7f0000000340)={0xa, &(0x7f0000000200)={0xa, 0x6, 0x201, 0x7, 0xff, 0x7f, 0x40, 0x4}, 0x38, &(0x7f0000000240)={0x5, 0xf, 0x38, 0x3, [@ss_container_id={0x14, 0x10, 0x4, 0xc7, "819760e5ee3d6336aa097fd9261267e6"}, @wireless={0xb, 0x10, 0x1, 0xc, 0x81, 0x8, 0x2, 0x401, 0xc8}, @ss_container_id={0x14, 0x10, 0x4, 0x8, "b3865fd080185532822bf5715d1cfdd9"}]}, 0x2, [{0x4, &(0x7f0000000280)=@lang_id={0x4, 0x3, 0x1007}}, {0x79, &(0x7f00000002c0)=@string={0x79, 0x3, "6dba9e9eb443676ef3b92dbe389059a136ab76ae5cc182e96fb5941d08dfa3fac44a47f1d36ca2370450922b042877ae1cfc1c3c76a5a6251928f2a9f0b59b94be8b7e5faed7775cde916d55fa6f9a9fa63b2d2f291d4d04211105c3d91c3dee2c1b44f2045e11e737ebe41d72ac0f9c2da9a7d29f1560"}}]}) (async) 1.233844415s ago: executing program 0 (id=6): openat$kvm(0x0, &(0x7f0000000100), 0x0, 0x0) (async) r0 = openat$kvm(0x0, &(0x7f0000000100), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil) r3 = socket$inet6(0xa, 0x3, 0x7) sendmmsg$inet6(r3, &(0x7f0000000980)=[{{&(0x7f0000000000)={0xa, 0x4e22, 0x0, @remote, 0x23}, 0x1c, &(0x7f0000000840)=[{&(0x7f0000000240)="c3803180611c6496793d4ae282556edf24baf1a5ddac7be659a7d5f84c1bd8835f7d073d137753e85d2a257a02b181651e5ab960c5cf50d5da29282414698dd127d1611a124d3e7a3f2f1bd4b4df6b59c41b4a25a034e81a47f1e38a1f58efcc63c6505d98d950d4066b1276aefcf47f732fe57ea62b91b7da154a15e9e0c30b78b261775aecd9e3e15779be294f1b528f2db88757158020cc7b39da97471231a08ed2b7c5b2b9e20d0279bbbbc9d3efd19efbfd051557d2f9d59582e692e0f647f8c92aafadaee3184562d1", 0xcc}, {&(0x7f0000000340)="45b8600d75543b6cb86ee0e28c34371c031908bff1c82b2947b42f3a6c237ca5ed7b6518f6b7e633842a1a2cde61d1476e48e79ea5e432c35fc4f9aa70d7b9b3f2ba06aba0d953ab959619d74898cecc306dbb645d12c702d6ea8d8317987c407b31030e3a5c60d6fab0f39712c19cc12355555d4e0147d0aff31929dc371a856aab8ce340b9c4a59eeabbf246e5e4b1c4cc8b0ddb057a2ad0cde902f16f57038bfd7d3833387de9ced3396d4abd6fa4da4287a3fc780d6487b75aaabaabd870ccb6ccbc", 0xc4}, {&(0x7f00000009c0)="2d507efbf36e8dd31d01589a4eec0ace46208b6dc86b99694564c9500c865be404280cb8a58c4acbfe929e2fba67ea4f049d24000acb37c7d8195b13ab864711470e3c1126cb0a45ed496c6b6fd120bd3701a24df96d3bbfe5a7648ba0539090ed7401771fd11bd379e00ffd11c1244d54efbcf88f4d27352f6a36f6c99f82a2cb18b361eb7923a28fe880f353e5a8fd4d26493e8bb15a593429dc56a1812a4da1141c86b80754cf766a8cb3a62b5599c421943f709158646923e6917bd4e1198d33da624324b0175fbf71df7ad2b2f69de2922fb3f690c26424d8c7edcd596844dc3ffd87edb7ebbc4f9f4f2f15a479535fb70be918e092884e", 0xfa}, {&(0x7f0000000480)="01a0bb6292009debd4fff9a111d934ac399f6250a937c5a0f7bbea6bf90ffe4ae1ed6e84d7c79c05015546f6186809d8e8e7ad6a70eba84ad703b2c28541a79e9f2c098ee43b810b5638350aa65e33623bd530683ca5ffafdbda122e7a5698ad51e16b8bf8c66b5f2e998692782eae3e0bf7296201da1351e6340d699c", 0x7d}, {&(0x7f0000000500)="eee213cad0b93a6f06fe5fff7075b5289548314687700db61b7f12f2a977f377398c1459599f8295a8583b7b78ed85bc2ffeb0e85874e6c84433d20acf0e73d84cf47c6298e749eadd0c455d1d5a1edc359d759b53c4d57fbd30eb8781618378a3e24f0c48db620904ba4caa8b6647f9f8b370fb3fd5c234fce768cbc8e23fb1df7ebf2438a997", 0x87}, {&(0x7f00000005c0)="cf7da31567f198d5559acdebc4b936faa02e892c212590c3beba3f769b8bf05554c3bbce15695c589c6a78573bcbeb7ffc7287cf421e23fdd18e2d7b635aab4f5d9e9c6823fe185d5559aa36cbaec3de904b8bc72bae9b156c777a6d468e81929fc4e85d639a270d9c355fe798095a2c9e9ce94a2883d48edebb43f7210c1a10e4ba1780041fe9c052348f16719b7d7b539a6b29e4950a217c68628b8a15760c483d1bf02c22b2a5b091ff471be7ae9e1022affc18a0e80e60822fc6bdcd66e91805ce2ed26d83bdcc36158ba150967de69909b3f138b47d364367843190e31b42b28a574b11fb", 0xe7}, {&(0x7f00000006c0)="4dc30c66183f17ac8086163a910a750cbd622a17914ae8b09b78d658dabbb6d9a9a355238158a0932241ff22e4dfba394c92b74fc612ff1a585afa0a28813315becb7319c3238dd2ad8aa14fd6a6150c0f5399c26fe7f809d70f869dc9dda8a9fef9323017dcb4f8c65ee6259ed3bfe8594822a0aebd80a225bf73644efe6616af3f0d3d4a6bfe98d4e6a74588959274fcfbed995fa123b604f323106a82f84fa7eb41f90fcdd369fcbe1fa34cf34f36701022c8d4b285faf99f8b1f6a3a8ab90e613a65ef893bc393b49e7e", 0xcc}, {&(0x7f00000007c0)="a8576aa64a81343188515d3b24981270615d4218a4017452b5f2a9b5c14f96889def50fba84ff57d560ebedb8680e5c3bd", 0x31}, {&(0x7f0000000800)="4d10f60deb2a7ecf849d1014d56bd059b5bf53bb8f9a0643463942f2ce81a32b6e4b6455b7be0e51234d561e4fc1f28e3230c6b5bdee411e35c0", 0x3a}], 0x9, &(0x7f0000000900)=[@hoplimit={{0x14, 0x29, 0x34, 0x4bd}}, @dontfrag={{0x14, 0x29, 0x3e, 0x7}}, @rthdr_2292={{0x18, 0x29, 0x39, {0x3a, 0x0, 0x0, 0x81}}}], 0x48}}], 0x1, 0x20004041) r4 = syz_kvm_add_vcpu$x86(r2, &(0x7f0000000180)={0x0, &(0x7f00000001c0)=[@enable_nested={0x12c, 0x18}, @nested_create_vm={0x12d, 0x18}, @nested_intel_vmwrite_mask={0x154, 0x38, {0x0, @guest32=0x480e, 0x7f, 0x3, 0x9}}], 0x68}) ioctl$KVM_RUN(r4, 0xae80, 0x0) 1.000395749s ago: executing program 0 (id=7): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)) r1 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) read$FUSE(r1, 0x0, 0x0) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) r2 = ioctl$NS_GET_PARENT(0xffffffffffffffff, 0xb702, 0x0) setns(r2, 0x8000000) setresuid(0xee00, 0xee00, 0x0) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x109001, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r7, 0x4008ae89, &(0x7f0000000400)={0x1, 0x0, [{0x40000090, 0x0, 0x2}]}) r8 = getpgid(0x0) ioctl$int_in(r4, 0x5452, &(0x7f0000000240)=0xfffffffffffffffa) fcntl$setownex(r4, 0xf, &(0x7f0000000300)={0x2, r8}) close(r3) setns(0xc9, 0x0) r9 = socket(0x10, 0x803, 0x0) sendto(r9, &(0x7f0000000000)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r9, &(0x7f0000000080)=[{{0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000000c0)=""/23, 0x17}, 0x80009}], 0x16c, 0x10002, 0x0) r10 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r10, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000380)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0xffffffff, 0x30, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0}, @fda={0x66646185, 0x4}, @fd={0x66642a85, 0x0, r10, 0x0, 0x1}}, &(0x7f0000000040)={0x0, 0x28, 0x48}}, 0x40}]}) 1.000078679s ago: executing program 0 (id=8): syz_usb_connect$printer(0x0, 0x2d, &(0x7f0000000380)=ANY=[@ANYBLOB="12010000000000402505a8a4410001020b0109021b00010100c000090400000207010100090501020002"], 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='fd\x00') r1 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r1, 0x0, 0x23, &(0x7f00000000c0)={@multicast2, @loopback}, 0xc) setsockopt$inet_msfilter(r1, 0x0, 0x29, &(0x7f0000000100)=ANY=[@ANYBLOB="e00000027fa80a010100000004"], 0x57) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000140)={0x1, &(0x7f0000000180)=[{0x6, 0x72, 0x0, 0x7fff0000}]}) close_range(r2, 0xffffffffffffffff, 0x0) getdents64(r0, 0x0, 0x0) r3 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) keyctl$KEYCTL_PKEY_VERIFY(0x1c, 0x0, 0x0, 0x0, 0x0) sendmsg$NL80211_CMD_DEAUTHENTICATE(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={0x0}, 0x1, 0x0, 0x0, 0x49800}, 0x4) pwritev2(r3, &(0x7f0000000440)=[{&(0x7f0000000480)="ec", 0x1}], 0x1, 0xfffff, 0x0, 0x0) 616.500118ms ago: executing program 2 (id=9): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cpuacct.usage_percpu_user\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000000), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000003, 0x28011, r1, 0x0) preadv(r1, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x1, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000640)="430fc73f0f2390b9800000c00f3235010000000f300f20d835080000000f22d8c4e18173f53866baf80cb83879e487ef66bafc0cec66b88e008ec02d1aa80000460f1c460041ae", 0x47}], 0x1, 0x74, 0x0, 0x0) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x0, 0x0, &(0x7f0000000240)) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) sendmsg$inet6(r1, &(0x7f0000000800)={&(0x7f0000000080)={0xa, 0x4e20, 0x3, @dev={0xfe, 0x80, '\x00', 0x15}, 0xac}, 0x1c, 0x0, 0xffffffffffffffaf}, 0x4048442) setrlimit(0xf, &(0x7f0000000000)={0x1, 0x5}) getpeername(0xffffffffffffffff, 0x0, &(0x7f0000000080)) 0s ago: executing program 3 (id=10): r0 = openat$dm_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$DM_DEV_CREATE(r0, 0xc138fd03, &(0x7f0000000080)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, {'syz', 0x0, '0\x00'}}}) ioctl$DM_TABLE_LOAD(r0, 0xc138fd09, &(0x7f0000000200)={0x4, 0x0, 0x0, 0x1c0, 0x138, 0x1, 0x0, 0x0, 0x0, 0x0, @by_dev={r1}, [@snapshot={0x0, 0x840, 0x0, 0x88, 'snapshot-merge\x00', {@ram_num={'1:', 0x1}, 0x20, @ram_num={'1:', 0x1}, 0x20, 'P', 0x20, '8', ' 2 discard_zeroes_cow discard_passdown_origin'}}]}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x405c5503, 0x0) ioctl$PAGEMAP_SCAN(0xffffffffffffffff, 0xc0606610, 0x0) syz_init_net_socket$bt_rfcomm(0x1f, 0x3, 0x3) ioctl$DM_DEV_SUSPEND(r0, 0xc138fd06, &(0x7f0000000580)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x5800, 0x0, 0x0, @by_name={0x0, {'syz', 0x0, '0\x00'}}}) r2 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r2) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(0xffffffffffffffff, &(0x7f00000003c0)={0xa, 0x4e21, 0x0, @empty, 0x4}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, &(0x7f0000000400), 0x28) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x11a, 0x3, 0x0, 0x0) ptrace$setregs(0xd, r2, 0x1005, 0xfffffffffffffffe) mknodat$dm(0xffffffffffffff9c, &(0x7f00000006c0)='./dm0\x00', 0x6180, r1) openat$dm_dev(0xffffffffffffff9c, &(0x7f0000000700)='./dm0\x00', 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r3 = mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, r3, 0x0, 0x0, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r5, &(0x7f00000001c0)={0x0, 0x4000, &(0x7f0000000540)=[{&(0x7f0000000740)=ANY=[@ANYBLOB="3c0000001100010000000000ffdbdf252c0000002500"], 0x3c}], 0x1, 0x0, 0x0, 0xc010}, 0x40080) r6 = dup3(r4, r4, 0x0) connect$inet(r6, &(0x7f0000000440)={0x2, 0x4e21, @rand_addr=0x64010102}, 0x6b) dup(r4) r7 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000480)={'wlan1\x00'}) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r8, 0x6, 0x13, &(0x7f00000004c0)=0x100000001, 0x4) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.141' (ED25519) to the list of known hosts. [ 21.629171][ T36] audit: type=1400 audit(1794072899.500:64): avc: denied { mounton } for pid=286 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 21.652377][ T36] audit: type=1400 audit(1794072899.530:65): avc: denied { mount } for pid=286 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 21.653442][ T286] cgroup: Unknown subsys name 'net' [ 21.681786][ T36] audit: type=1400 audit(1794072899.550:66): avc: denied { unmount } for pid=286 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 21.681938][ T286] cgroup: Unknown subsys name 'devices' [ 21.807511][ T286] cgroup: Unknown subsys name 'hugetlb' [ 21.813295][ T286] cgroup: Unknown subsys name 'rlimit' [ 21.966599][ T36] audit: type=1400 audit(1794072899.840:67): avc: denied { setattr } for pid=286 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 21.992316][ T36] audit: type=1400 audit(1794072899.840:68): avc: denied { mounton } for pid=286 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 22.000282][ T288] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 22.019249][ T36] audit: type=1400 audit(1794072899.840:69): avc: denied { mount } for pid=286 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 22.043929][ T286] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 22.054285][ T36] audit: type=1400 audit(1794072899.900:70): avc: denied { relabelto } for pid=288 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.091400][ T36] audit: type=1400 audit(1794072899.900:71): avc: denied { write } for pid=288 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.119022][ T36] audit: type=1400 audit(1794072899.910:72): avc: denied { read } for pid=286 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.145643][ T36] audit: type=1400 audit(1794072899.910:73): avc: denied { open } for pid=286 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.297784][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.304900][ T293] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.314895][ T293] bridge_slave_0: entered allmulticast mode [ 23.321742][ T293] bridge_slave_0: entered promiscuous mode [ 23.336109][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.343628][ T293] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.350794][ T293] bridge_slave_1: entered allmulticast mode [ 23.357396][ T293] bridge_slave_1: entered promiscuous mode [ 23.474688][ T297] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.482016][ T297] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.489500][ T297] bridge_slave_0: entered allmulticast mode [ 23.495841][ T297] bridge_slave_0: entered promiscuous mode [ 23.503598][ T297] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.511310][ T297] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.519037][ T297] bridge_slave_1: entered allmulticast mode [ 23.525905][ T297] bridge_slave_1: entered promiscuous mode [ 23.553078][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.560340][ T293] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.568075][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.575233][ T293] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.615961][ T298] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.623121][ T298] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.630572][ T298] bridge_slave_0: entered allmulticast mode [ 23.637079][ T298] bridge_slave_0: entered promiscuous mode [ 23.644184][ T298] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.651693][ T298] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.659431][ T298] bridge_slave_1: entered allmulticast mode [ 23.666975][ T298] bridge_slave_1: entered promiscuous mode [ 23.681079][ T299] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.688197][ T299] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.695861][ T299] bridge_slave_0: entered allmulticast mode [ 23.703577][ T299] bridge_slave_0: entered promiscuous mode [ 23.714665][ T299] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.721990][ T299] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.729308][ T299] bridge_slave_1: entered allmulticast mode [ 23.735550][ T299] bridge_slave_1: entered promiscuous mode [ 23.867906][ T299] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.875321][ T299] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.884537][ T299] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.892667][ T299] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.904195][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.913620][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.922166][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.930616][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.949481][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.957897][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.975933][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.983777][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.047494][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.055549][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.063620][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.072600][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.084224][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.091656][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.112911][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.120547][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.129738][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.137645][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.145943][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.155174][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.170165][ T293] veth0_vlan: entered promiscuous mode [ 24.219088][ T299] veth0_vlan: entered promiscuous mode [ 24.228350][ T293] veth1_macvtap: entered promiscuous mode [ 24.242728][ T297] veth0_vlan: entered promiscuous mode [ 24.263114][ T297] veth1_macvtap: entered promiscuous mode [ 24.293556][ T298] veth0_vlan: entered promiscuous mode [ 24.306773][ T299] veth1_macvtap: entered promiscuous mode [ 24.320795][ T293] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 24.343253][ T298] veth1_macvtap: entered promiscuous mode [ 24.446867][ T317] cgroup2: Unknown parameter 'favordynmor­Š™ßò.qÔ^ïh~Þ»' [ 24.464432][ T329] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 24.636096][ T311] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 24.685723][ T9] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 24.785633][ T311] usb 2-1: Using ep0 maxpacket: 32 [ 24.791817][ T311] usb 2-1: config 0 has an invalid interface number: 67 but max is 0 [ 24.799978][ T311] usb 2-1: config 0 has no interface number 0 [ 24.807926][ T311] usb 2-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 24.817238][ T311] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 24.825244][ T311] usb 2-1: Product: syz [ 24.829708][ T311] usb 2-1: Manufacturer: syz [ 24.834300][ T311] usb 2-1: SerialNumber: syz [ 24.836927][ T9] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 24.839860][ T311] usb 2-1: config 0 descriptor?? [ 24.854729][ T9] usb 4-1: config 1 interface 0 altsetting 1 has 3 endpoint descriptors, different from the interface descriptor's value: 4 [ 24.855451][ T311] smsc95xx v2.0.0 [ 24.870350][ T9] usb 4-1: New USB device found, idVendor=174c, idProduct=55aa, bcdDevice= 1.00 [ 24.882671][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 24.891468][ T9] usb 4-1: Product: syz [ 24.895999][ T65] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 24.903737][ T9] usb 4-1: Manufacturer: syz [ 24.909066][ T9] usb 4-1: SerialNumber: syz [ 24.916762][ T9] usb-storage 4-1:1.0: USB Mass Storage device detected [ 24.924932][ T9] usb-storage 4-1:1.0: Quirks match for vid 174c pid 55aa: 400000 [ 24.933276][ T9] scsi host1: usb-storage 4-1:1.0 [ 25.056660][ T65] usb 1-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 25.072448][ T65] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 25.081831][ T65] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 25.090022][ T65] usb 1-1: Product: syz [ 25.094631][ T65] usb 1-1: Manufacturer: syz [ 25.099422][ T65] usb 1-1: SerialNumber: syz [ 25.115825][ T327] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 25.127518][ T327] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 25.137744][ T327] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 25.147556][ T345] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 25.158684][ T327] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 25.164917][ T345] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 25.178630][ T9] usb 4-1: USB disconnect, device number 2 [ 25.323013][ T65] usblp 1-1:1.0: usblp0: USB Unidirectional printer dev 2 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 25.335709][ T65] usb 1-1: USB disconnect, device number 2 [ 25.345865][ T65] usblp0: removed [ 25.673361][ T311] smsc95xx 2-1:0.67 (unnamed net_device) (uninitialized): EEPROM read operation timeout [ 25.708668][ T350] ================================================================== [ 25.718240][ T350] BUG: KASAN: slab-use-after-free in snapshot_ctr+0x586/0x1350 [ 25.727162][ T350] Read of size 8 at addr ffff88810b6b8718 by task syz.3.10/350 [ 25.735126][ T350] [ 25.737608][ T350] CPU: 0 UID: 0 PID: 350 Comm: syz.3.10 Not tainted syzkaller #0 ff996278633adec6fd25d1632b496761701c4fe9 [ 25.737637][ T350] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 25.737655][ T350] Call Trace: [ 25.737662][ T350] [ 25.737670][ T350] __dump_stack+0x21/0x30 [ 25.737692][ T350] dump_stack_lvl+0x140/0x1c0 [ 25.737706][ T350] ? __cfi_dump_stack_lvl+0x10/0x10 [ 25.737721][ T350] ? __cfi__printk+0x10/0x10 [ 25.737745][ T350] print_address_description+0x71/0x210 [ 25.737761][ T350] print_report+0x4a/0x70 [ 25.737774][ T350] kasan_report+0x162/0x1a0 [ 25.737792][ T350] ? snapshot_ctr+0x586/0x1350 [ 25.737810][ T350] ? snapshot_ctr+0x586/0x1350 [ 25.737825][ T350] __asan_report_load8_noabort+0x18/0x20 [ 25.737843][ T350] snapshot_ctr+0x586/0x1350 [ 25.737858][ T350] ? dm_split_args+0xa1/0x740 [ 25.737875][ T350] ? __cfi_snapshot_ctr+0x10/0x10 [ 25.737891][ T350] ? dm_split_args+0x5d0/0x740 [ 25.737904][ T350] dm_table_add_target+0x59f/0xcb0 [ 25.737920][ T350] table_load+0x2eb/0x7d0 [ 25.737938][ T350] ? __check_object_size+0x99/0x870 [ 25.737960][ T350] ? __cfi_table_load+0x10/0x10 [ 25.737979][ T350] ? __kasan_check_write+0x18/0x20 [ 25.737998][ T350] ? __cfi_table_load+0x10/0x10 [ 25.738017][ T350] dm_ctl_ioctl+0x8f3/0xde0 [ 25.738036][ T350] ? __cfi_dm_ctl_ioctl+0x10/0x10 [ 25.738056][ T350] ? __fget_files+0x2bc/0x330 [ 25.738071][ T350] ? bpf_lsm_file_ioctl+0xd/0x20 [ 25.738087][ T350] ? security_file_ioctl+0x3e/0x110 [ 25.738106][ T350] ? __cfi_dm_ctl_ioctl+0x10/0x10 [ 25.738124][ T350] __se_sys_ioctl+0x123/0x1b0 [ 25.738143][ T350] __x64_sys_ioctl+0x7f/0xa0 [ 25.738158][ T350] x64_sys_call+0x1878/0x2ee0 [ 25.738175][ T350] do_syscall_64+0x57/0xf0 [ 25.738190][ T350] ? clear_bhb_loop+0x50/0xa0 [ 25.738209][ T350] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 25.738227][ T350] RIP: 0033:0x7f28c1f9fb19 [ 25.738246][ T350] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 25.738257][ T350] RSP: 002b:00007f28c2e95028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 25.738280][ T350] RAX: ffffffffffffffda RBX: 00007f28c2225fa0 RCX: 00007f28c1f9fb19 [ 25.738292][ T350] RDX: 0000200000000200 RSI: 00000000c138fd09 RDI: 0000000000000003 [ 25.738303][ T350] RBP: 00007f28c2037b70 R08: 0000000000000000 R09: 0000000000000000 [ 25.738313][ T350] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 25.738323][ T350] R13: 00007f28c2226038 R14: 00007f28c2225fa0 R15: 00007ffcb8e756c8 [ 25.738336][ T350] [ 25.738342][ T350] [ 26.013807][ T350] Allocated by task 350: [ 26.018081][ T350] kasan_save_track+0x3e/0x80 [ 26.023036][ T350] kasan_save_alloc_info+0x3a/0x50 [ 26.030390][ T350] __kasan_kmalloc+0x96/0xb0 [ 26.036943][ T350] __kmalloc_cache_node_noprof+0x225/0x430 [ 26.045164][ T350] dm_get_table_device+0x1e3/0x6c0 [ 26.050748][ T350] dm_get_device+0x32b/0x7f0 [ 26.055904][ T350] snapshot_ctr+0x292/0x1350 [ 26.060694][ T350] dm_table_add_target+0x59f/0xcb0 [ 26.065828][ T350] table_load+0x2eb/0x7d0 [ 26.070185][ T350] dm_ctl_ioctl+0x8f3/0xde0 [ 26.074688][ T350] __se_sys_ioctl+0x123/0x1b0 [ 26.079412][ T350] __x64_sys_ioctl+0x7f/0xa0 [ 26.084013][ T350] x64_sys_call+0x1878/0x2ee0 [ 26.088709][ T350] do_syscall_64+0x57/0xf0 [ 26.093125][ T350] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 26.099063][ T350] [ 26.101408][ T350] Freed by task 350: [ 26.105289][ T350] kasan_save_track+0x3e/0x80 [ 26.109985][ T350] kasan_save_free_info+0x44/0x50 [ 26.115007][ T350] __kasan_slab_free+0x5f/0x80 [ 26.119767][ T350] kfree+0x158/0x440 [ 26.123668][ T350] dm_put_table_device+0x298/0x2e0 [ 26.129012][ T350] dm_get_device+0x571/0x7f0 [ 26.133825][ T350] snapshot_ctr+0x435/0x1350 [ 26.138434][ T350] dm_table_add_target+0x59f/0xcb0 [ 26.143543][ T350] table_load+0x2eb/0x7d0 [ 26.147871][ T350] dm_ctl_ioctl+0x8f3/0xde0 [ 26.152383][ T350] __se_sys_ioctl+0x123/0x1b0 [ 26.157055][ T350] __x64_sys_ioctl+0x7f/0xa0 [ 26.161666][ T350] x64_sys_call+0x1878/0x2ee0 [ 26.166355][ T350] do_syscall_64+0x57/0xf0 [ 26.170768][ T350] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 26.176688][ T350] [ 26.179107][ T350] The buggy address belongs to the object at ffff88810b6b8700 [ 26.179107][ T350] which belongs to the cache kmalloc-96 of size 96 [ 26.193018][ T350] The buggy address is located 24 bytes inside of [ 26.193018][ T350] freed 96-byte region [ffff88810b6b8700, ffff88810b6b8760) [ 26.207366][ T350] [ 26.209776][ T350] The buggy address belongs to the physical page: [ 26.216238][ T350] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10b6b8 [ 26.225818][ T350] anon flags: 0x4000000000000000(zone=1) [ 26.234779][ T350] page_type: f5(slab) [ 26.239226][ T350] raw: 4000000000000000 ffff888100041280 ffffea00042db100 dead000000000005 [ 26.248355][ T350] raw: 0000000000000000 0000000080200020 00000001f5000000 0000000000000000 [ 26.258008][ T350] page dumped because: kasan: bad access detected [ 26.265264][ T350] page_owner tracks the page as allocated [ 26.271445][ T350] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 1, tgid 1 (swapper/0), ts 4643298616, free_ts 0 [ 26.291513][ T350] post_alloc_hook+0x37d/0x3b0 [ 26.298394][ T350] prep_new_page+0x2d/0x180 [ 26.303192][ T350] get_page_from_freelist+0x4aea/0x4ba0 [ 26.308753][ T350] __alloc_pages_noprof+0x35a/0x7e0 [ 26.314009][ T350] alloc_slab_page+0x6b/0x1e0 [ 26.319163][ T350] allocate_slab+0x69/0x430 [ 26.323905][ T350] ___slab_alloc+0x591/0x8c0 [ 26.328704][ T350] __kmalloc_cache_noprof+0x2cd/0x470 [ 26.334799][ T350] call_usermodehelper_setup+0x97/0x300 [ 26.340449][ T350] kobject_uevent_env+0x65f/0x7e0 [ 26.345488][ T350] kobject_uevent+0x21/0x40 [ 26.350009][ T350] driver_register+0x373/0x3c0 [ 26.354793][ T350] __hid_register_driver+0x12e/0x190 [ 26.360098][ T350] keytouch_driver_init+0x22/0x30 [ 26.365117][ T350] do_one_initcall+0x1e8/0x6a0 [ 26.369894][ T350] do_initcall_level+0x174/0x2e5 [ 26.374841][ T350] page_owner free stack trace missing [ 26.380231][ T350] [ 26.382649][ T350] Memory state around the buggy address: [ 26.388296][ T350] ffff88810b6b8600: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc [ 26.396387][ T350] ffff88810b6b8680: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc [ 26.405523][ T350] >ffff88810b6b8700: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc [ 26.414286][ T350] ^ [ 26.419137][ T350] ffff88810b6b8780: 00 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc [ 26.427196][ T350] ffff88810b6b8800: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc [ 26.435839][ T350] ================================================================== [ 26.449249][ T350] Disabling lock debugging due to kernel taint [ 26.462868][ T350] device-mapper: table: 252:0: device 1:7 not in table devices list [ 26.474475][ T352] netlink: 28 bytes leftover after parsing attributes in process `syz.3.10'. [ 26.482004][ T350] device-mapper: table: 252:0: snapshot-merge: COW device cannot be the same as origin device (-EINVAL) [ 26.500641][ T350] device-mapper: ioctl: error adding target to table [ 26.509115][ T350] device-mapper: table: 252:0: dm_table_destroy: dm_put_device call missing for 1:7 [ 26.516644][ T311] smsc95xx 2-1:0.67 (unnamed net_device) (uninitialized): Failed to write reg index 0x00000014: -71 [ 26.531721][ T311] smsc95xx 2-1:0.67: probe with driver smsc95xx failed with error -71 [ 26.543245][ T311] usb 2-1: USB disconnect, device number 2