last executing test programs: 6.16432391s ago: executing program 4 (id=1272): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x2) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000380)={&(0x7f0000000080)=ANY=[@ANYBLOB="9feb010018000000000000001c0000001c00000003000000010000000020000e0200000000000000000000000000000504000000002e"], 0x0, 0x37}, 0x20) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000004440)=@base={0x9, 0x4, 0x4, 0x7, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, r1, 0x2, 0x1}, 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000003c0)="bdba45fa3ad603ef48ba3cc4a580bf6de29114dc13edacfde4bea44df08437ce62f8070792d712f078dc58008e18da374c7e74c240763f748c476c1bd92fb7bedd096a481cdd0c70fb2c405b3a7d9f8a43aac45151bfb758cf355aac64d9d8bb5ad1dba928b492543a25cf00c3f28ac10ed91acc7a74fcc9927e85717831c7f39372ef3a6310a225", &(0x7f0000000480)="f4113078488b8c1a751fc3782a73fa2508cfab59624e8ab2b6d3005da6427bd38f36c872aea7791ad895522ff808fd3f2f0f64db0818cb4e65ed12d27a428ae7eed872cbef39e503165894bf77586e4ee497057ee9a5dbc52457995bc93d43ed0a053ca418e1d902eee8b5e503282262180c617d28625938e6e1b6411cca43250badb70c7b7a8721d0e28de4b064cbe3fcec534bded3e6a75a75bf88b4610775333a93b70935929be7d6da00972997eb807d63aa945078f95b6fdc23969feda961e9c2380c7b53840e9489124ffa558efac7000000000000000000", 0xfbf, r2}, 0x38) bpf$MAP_LOOKUP_BATCH(0x18, 0x0, 0x0) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) write$UHID_INPUT(r3, 0x0, 0x0) 6.06955466s ago: executing program 4 (id=1274): syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000380)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a00000804800200090581", @ANYRES16], 0x0) r0 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) write$char_usb(r0, &(0x7f0000000100), 0x0) 6.0069846s ago: executing program 3 (id=1275): r0 = syz_open_dev$usbfs(&(0x7f0000000180), 0x205, 0x2581) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$USBDEVFS_SUBMITURB(r1, 0x8038550a, 0x0) ioctl$USBDEVFS_REAPURBNDELAY(r1, 0x4004550d, &(0x7f0000000500)) 5.889565975s ago: executing program 3 (id=1277): syz_usb_connect$uac1(0x2, 0xa6, &(0x7f0000000240)=ANY=[@ANYBLOB="12010000000000106b1d01010000000003010902940003010040000904000000010100000a2401000000020102132406000006000000281ab0ab2c90619b34000000000000000000000924030000000000000924050000f8211cfd0924030500000004000724050401"], 0x0) r0 = syz_open_dev$sndpcmc(0x0, 0x0, 0x0) ioctl$SNDRV_PCM_IOCTL_DRAIN(r0, 0xc0884123, 0x40944f9c780000) openat(0xffffffffffffff9c, &(0x7f0000000080)='./file3\x00', 0x105042, 0x0) r1 = socket$inet(0x2, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) setsockopt$bt_hci_HCI_FILTER(0xffffffffffffffff, 0x0, 0x2, 0x0, 0x0) openat$nullb(0xffffffffffffff9c, 0x0, 0x28280, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={0x0}, 0x18) socketpair$nbd(0x1, 0x1, 0x0, 0x0) exit(0x10000) io_uring_register$IORING_REGISTER_SYNC_CANCEL(0xffffffffffffffff, 0x18, &(0x7f0000000000)={0x2, 0xffffffffffffffff, 0x6, {0x1, 0x8000000000000001}, 0x54}, 0x1) socket$inet6(0xa, 0x802, 0x0) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r5, 0x29, 0x40, 0x0, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f0000000c00)=@raw={'raw\x00', 0x8, 0x3, 0x1e8, 0x0, 0x8, 0xfa04, 0x0, 0x6c02, 0x180, 0x194, 0x194, 0x180, 0x194, 0x3, 0x0, {[{{@ip={@empty=0x1e00, @broadcast, 0x0, 0x0, 'veth0_to_hsr\x00', 'veth0_virt_wifi\x00', {}, {}, 0x6}, 0x0, 0x70, 0x98, 0x0, {0x0, 0x74020000}}, @common=@inet=@TCPMSS={0x28, 'TCPMSS\x00', 0x0, {0xffff}}}, {{@ip={@multicast2, @multicast2, 0x0, 0x0, '\x00', 'tunl0\x00'}, 0x0, 0x70, 0xb8}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 'snmp\x00'}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x248) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x3, &(0x7f0000000040)=@framed={{0x66, 0xa, 0x0, 0x0, 0x0, 0x61, 0x11, 0x70}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe}, 0x94) mount(&(0x7f0000000280)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000300)='./file3\x00', &(0x7f0000000000)='erofs\x00', 0x0, &(0x7f0000000380)='acl') syz_usb_connect$printer(0x6, 0x0, 0x0, &(0x7f0000000200)={0xa, &(0x7f0000000040)={0xa, 0x6, 0x110, 0x7, 0x40, 0x5, 0x20, 0x7}, 0x5, &(0x7f0000000080)={0x5, 0xf, 0x5}, 0x3, [{0x6d, &(0x7f00000000c0)=@string={0x6d, 0x3, "552f237fc046f097f06a4f325832b108dff28cc95638b79158d105b02442a853e3be7c98719a8113723574f8b1f87e77c4e8764001e1f36ae4cdd9d1f1498d8c4383051c2188c5649e4f38f6286d9437af274d1914e0184016afc1874d2e554c3a796a13d87b2470f19c34"}}, {0x4, &(0x7f0000000140)=@lang_id={0x4, 0x3, 0x3401}}, {0x79, &(0x7f0000000180)=@string={0x79, 0x3, "658be4bde48ba2d8e9d8a73716bdbb1f7f7bdd91efcaf671f744037f5731206d48301cde802fcfdc8c06f5a3d6c8b0384e7cd4b62a722efb82aaa6f9796e6e530b4c9ca97285d500bd0e5091f7709a2ce988c9d271c20483abda7ad4cdbb04c60b6d16c5b44c1f112d8d07e762edbc14305caeb4fbcaf5"}}]}) 5.063713257s ago: executing program 1 (id=1281): r0 = io_uring_setup(0xaab, &(0x7f00000003c0)={0x0, 0x2c97, 0x8}) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) recvmsg(r1, &(0x7f0000000380)={0x0, 0x0, 0x0}, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) setreuid(0xee00, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r2 = io_uring_setup(0x4, &(0x7f0000000040)={0x0, 0xc89c, 0xc000, 0x8, 0x20002f7}) syz_io_uring_setup(0x88f, &(0x7f0000000400)={0x0, 0xaee2, 0x0, 0x2, 0x1b4}, &(0x7f0000000000), 0x0) io_uring_enter(r2, 0x146b, 0xc597, 0x12, 0x0, 0x0) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x1000001, 0x3032, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) r3 = socket(0x28, 0x5, 0x0) r4 = socket(0x28, 0x5, 0x0) bind$vsock_stream(r4, &(0x7f0000000040)={0x28, 0x0, 0x0, @local}, 0x10) listen(r4, 0x4) connect$vsock_stream(r3, &(0x7f0000000080)={0x28, 0x0, 0x0, @local}, 0x10) sendmmsg(r3, &(0x7f0000000100)=[{{0x0, 0x2d, &(0x7f00000000c0)=[{&(0x7f0000000000)="1b", 0x40000}], 0x1}}], 0x51, 0x0) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) r5 = accept4$unix(r4, 0x0, 0x0, 0x800) recvfrom$unix(r5, &(0x7f0000000140)=""/248, 0xffffffffffffff6f, 0x22, 0x0, 0x0) r6 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r6, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) getsockname$packet(r6, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="400000001000390400"/20, @ANYRES32=r7, @ANYBLOB="01980000000000002000128008000100677265001400028008000100", @ANYRES32=r7], 0x40}, 0x1, 0x0, 0x0, 0x4014}, 0x0) r9 = socket(0x10, 0x3, 0x0) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) sendmsg$nl_route_sched(r9, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x44, 0x24, 0x5820a61ca228659, 0x0, 0x0, {0x0, 0x0, 0x0, r10, {0xfff3, 0x9}, {0xffff, 0xffff}, {0x1, 0x7}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_RSC={0x10, 0x1, {0x2a6, 0xb, 0xa}}}}]}, 0x44}}, 0x800) 4.410744223s ago: executing program 2 (id=1282): r0 = fsopen(0x0, 0x0) openat$dsp(0xffffffffffffff9c, 0x0, 0x1a003, 0x0) socket$packet(0x11, 0x3, 0x300) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r1}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r5, 0x40345410, &(0x7f00000083c0)={{0x1}}) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r5, 0x40505412, &(0x7f0000000300)={0xc, 0xf, 0x2, 0x0, 0x3}) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r6 = openat$full(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close_range(r6, 0xffffffffffffffff, 0x0) r7 = syz_open_dev$dri(0x0, 0x1f, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r7, 0xc04064a0, 0x0) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)={0x48, 0x2, 0x6, 0x101, 0x0, 0x0, {0xa}, [@IPSET_ATTR_REVISION={0x5, 0x4, 0x2}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_TYPENAME={0xd, 0x3, 'hash:net\x00'}]}, 0x48}}, 0x80) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000001100)='iocharset', &(0x7f0000001140)='\xe0^@&&}\'\x00', 0x0) r9 = socket(0x2c, 0x3, 0x0) bind$packet(r9, 0x0, 0x0) 4.349587471s ago: executing program 1 (id=1284): r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="020d000014000000000000000000000005000600000000000a00000000000000000000000200000000000000001a2c89120000000000000005000500000000000a00000000000400200100000000000000000000000000000000000000000000080012"], 0xa0}}, 0x0) 4.117611409s ago: executing program 1 (id=1286): r0 = socket$kcm(0x2, 0x5, 0x84) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = gettid() r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) bind$bt_l2cap(r2, &(0x7f0000000380)={0x1f, 0x7, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xe) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r3, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r3, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x2c, &(0x7f0000000400)=[@in6={0xa, 0x4e24, 0x5, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x3c8}, @in={0x2, 0x4e20, @broadcast}]}, &(0x7f0000000240)=0x10) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(r3, 0x84, 0x7c, &(0x7f0000000080)={r4, 0x6, 0x1}, &(0x7f00000000c0)=0x8) listen(r2, 0x9) getsockopt$bt_BT_DEFER_SETUP(r2, 0x112, 0x7, &(0x7f0000000080), &(0x7f0000000200)=0x4) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(0xffffffffffffffff, 0x0, 0x24000800) socket(0x2a, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x20000015) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0) rseq(&(0x7f00000003c0)={0x0, 0x0, 0x0, 0x3}, 0x20, 0x0, 0x0) nanosleep(&(0x7f00000000c0), 0x0) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000006, @tid=r1}, &(0x7f0000bbdffc)) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f00000000c0)={'batadv_slave_0\x00'}) prlimit64(r1, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x3) sched_setaffinity(r1, 0x8, &(0x7f00000002c0)=0x600000bce) r6 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r6, &(0x7f0000019680)=""/102392, 0x18ff8) r7 = socket$inet_tcp(0x2, 0x1, 0x0) syz_open_dev$dri(&(0x7f0000000040), 0xf8, 0x650700) setsockopt$inet_buf(r7, 0x0, 0x8008000000010, &(0x7f0000001640), 0x0) r8 = socket$key(0xf, 0x3, 0x2) rseq(&(0x7f0000000280)={0x0, 0x0, &(0x7f0000000300)={0x0, 0x3, 0x7, 0xba}, 0x6}, 0x20, 0x0, 0x0) sendmsg$key(r8, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)=ANY=[@ANYRESOCT=r5], 0x10}}, 0x0) 3.415685197s ago: executing program 2 (id=1288): syz_80211_inject_frame(0x0, 0x0, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000003c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_CHANNEL_SWITCH(r0, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000000}, 0x0) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000b80)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010026bd7000000000003b00000008000388", @ANYRES32=r1, @ANYBLOB="26003300b0910300ffffffffffff080211"], 0x50}, 0x1, 0x0, 0x0, 0xc0}, 0x0) 3.313806942s ago: executing program 0 (id=1289): io_setup(0x9, &(0x7f00000000c0)=0x0) r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000200)='/sys/power/sync_on_suspend', 0x20001, 0x0) io_submit(r0, 0x1, &(0x7f0000000040)=[&(0x7f0000001500)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000000100)='9', 0x20000101}]) socket$nl_netfilter(0x10, 0x3, 0xc) mkdir(&(0x7f0000000440)='./file1\x00', 0x0) mount(0x0, 0x0, &(0x7f0000000000)='tmpfs\x00', 0x0, 0x0) chdir(&(0x7f0000000100)='./file1\x00') r2 = open(&(0x7f0000000080)='./bus\x00', 0x4001410c2, 0x766c618eb221465a) quotactl_fd$Q_SETINFO(r2, 0xffffffff80000600, 0x0, &(0x7f0000000040)={0x1, 0xfffffffffffffffc, 0x0, 0x4}) quotactl$Q_SYNC(0xffffffff80000100, 0x0, 0x0, 0x0) r3 = syz_io_uring_setup(0x881, &(0x7f0000000480)={0x0, 0xe7ae, 0x0, 0x2, 0x3}, &(0x7f0000000440)=0x0, &(0x7f0000000080)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, 0x0, 0x0) setsockopt$inet_sctp_SCTP_AUTH_DELETE_KEY(0xffffffffffffffff, 0x84, 0x19, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=@newchain={0x3c, 0x64, 0x10, 0x70bd28, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, {0x6, 0x7}, {0xc, 0xfff1}, {0x0, 0xffff}}, [@TCA_CHAIN={0x8, 0xb, 0xfffffffc}, @TCA_CHAIN={0x8, 0xb, 0x6}, @TCA_CHAIN={0x8, 0xb, 0x8}]}, 0x3c}, 0x1, 0x0, 0x0, 0x804}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r6 = getpid() sched_setscheduler(r6, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r8, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r6, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r7, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_GET_KEEP_ORPHAN(0xffffffffffffffff, 0x2288, 0x0) syz_io_uring_submit(r4, r5, &(0x7f00000001c0)=@IORING_OP_POLL_REMOVE={0x7, 0x0, 0x0, 0x0, 0x0, 0x23456}) io_uring_enter(r3, 0x47ba, 0x0, 0x0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="180200009b1aecb60000000000000000850000007500000095"], 0x0}, 0x94) 3.166616661s ago: executing program 1 (id=1290): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_COMPAT_GET(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)={0x24, 0x0, 0xb, 0x3, 0x0, 0x0, {0x1, 0x0, 0xa}, [@NFTA_COMPAT_NAME={0x7, 0x1, '@.\x00'}, @NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x5}]}, 0x24}, 0x1, 0x0, 0x0, 0x24040810}, 0x4080c) (async) sendmsg$NFNL_MSG_COMPAT_GET(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)={0x24, 0x0, 0xb, 0x3, 0x0, 0x0, {0x1, 0x0, 0xa}, [@NFTA_COMPAT_NAME={0x7, 0x1, '@.\x00'}, @NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x5}]}, 0x24}, 0x1, 0x0, 0x0, 0x24040810}, 0x4080c) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) (async) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000180)=ANY=[], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, r1, 0x0) (async) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, r1, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000640), r2) sendmsg$MPTCP_PM_CMD_GET_ADDR(r2, &(0x7f0000000b80)={0x0, 0x0, &(0x7f0000000b40)={&(0x7f0000000840)={0x20, r3, 0x1, 0x70bd27, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_ADDR={0x4}, @MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0x3}]}, 0x20}, 0x1, 0x0, 0x0, 0x5800}, 0x4) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000140)={'erspan0\x00', &(0x7f0000000080)={'ip_vti0\x00', 0x0, 0x7, 0x10, 0x841, 0x8, {{0xa, 0x4, 0x2, 0x1, 0x28, 0x65, 0x0, 0x9, 0x2f, 0x0, @loopback, @rand_addr=0x64010101, {[@lsrr={0x83, 0x7, 0x93, [@dev={0xac, 0x14, 0x14, 0x1d}]}, @noop, @generic={0x8b, 0x2}, @lsrr={0x83, 0x7, 0x99, [@initdev={0xac, 0x1e, 0x0, 0x0}]}]}}}}}) (async) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000140)={'erspan0\x00', &(0x7f0000000080)={'ip_vti0\x00', 0x0, 0x7, 0x10, 0x841, 0x8, {{0xa, 0x4, 0x2, 0x1, 0x28, 0x65, 0x0, 0x9, 0x2f, 0x0, @loopback, @rand_addr=0x64010101, {[@lsrr={0x83, 0x7, 0x93, [@dev={0xac, 0x14, 0x14, 0x1d}]}, @noop, @generic={0x8b, 0x2}, @lsrr={0x83, 0x7, 0x99, [@initdev={0xac, 0x1e, 0x0, 0x0}]}]}}}}}) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x24, &(0x7f0000000200)={@empty, @local, 0x0}, &(0x7f0000000240)=0xc) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000300)={'batadv0\x00', 0x0}) sendmsg$MPTCP_PM_CMD_REMOVE(r1, &(0x7f00000004c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000480)={&(0x7f0000000340)={0x110, r3, 0x2, 0x70bd2c, 0x25dfdbfc, {}, [@MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0x1}, @MPTCP_PM_ATTR_ADDR={0x40, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x17}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private1}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x7}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x5}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e24}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x2}, @MPTCP_PM_ATTR_ADDR={0x2c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast2}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r4}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x4}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r5}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r6}]}, @MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0x3}, @MPTCP_PM_ATTR_LOC_ID={0x5}, @MPTCP_PM_ATTR_ADDR={0x54, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private1}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x4}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @initdev={0xac, 0x1e, 0x1, 0x0}}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @ipv4={'\x00', '\xff\xff', @multicast1}}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x39}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x4}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x1}]}, @MPTCP_PM_ATTR_ADDR_REMOTE={0x1c, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e23}]}]}, 0x110}, 0x1, 0x0, 0x0, 0x20040080}, 0x4) add_key(&(0x7f0000000000)='big_key\x00', &(0x7f0000000280)={'syz', 0x3}, &(0x7f00000002c0)="1d", 0x1, 0xfffffffffffffffe) 2.763847163s ago: executing program 3 (id=1291): ioctl$TCSBRK(0xffffffffffffffff, 0x5409, 0x57) openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = syz_open_dev$sndmidi(0x0, 0x2, 0x141102) writev(r0, 0x0, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x1000, 0x2}) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r3 = dup3(r2, r1, 0x0) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r4, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x1, 0xfff0, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x30, 0x0, 0x0}, 0x1000}], 0x0, 0x0, 0x0}) 2.742650496s ago: executing program 4 (id=1292): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x5, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000002000)=""/102400, 0x19000) openat$cuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$SOUND_PCM_READ_CHANNELS(0xffffffffffffffff, 0x80045006, &(0x7f0000000280)) r2 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000bc0), r1) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000940)={0x0, 0xfffffff0, &(0x7f0000000900)={&(0x7f0000000400)=ANY=[@ANYBLOB="54020000170001000000000000000000200100000000000000000000000000010000000000000000ac141400000000000000000000000000fc020000000000000003000000000000e000000200001000000000000000040000000000000000080a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="1242ffff040000000000000000000037660b6aff00000000000000000000000000000000000000000200002000000000", @ANYRES32, @ANYRES32, @ANYBLOB="00000000000000000000000000000000000000000000000000000000000000e0270300000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000650d000000000000e1000000000000000007000000ff0f0000000000000000000008000b000000000008001600000000000c001500000000005d0000000401050000000000000000000000ffff00000000000000003300000002000000e00000020000000000000000000000000000000000000000000000000000000000000000ff010000000000000000000000000001000000003c0000000a000000fe8000000000000000000000000000aa0000000001000000000000000000000000000000ff010000000000000000000000000001000000002b0000000a000000fe8800000000000000000000000000010000000000000000000000000000000000000000ff020000000000000000000000000001000000003200000002000000fe8000000000000000000000000000000000000004"], 0x254}}, 0x0) r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f00000000c0)=0xe) ioctl$TCSETSW2(r4, 0x80047456, &(0x7f0000000040)={0x3, 0xb, 0xfffffffc, 0x7fffffff, 0x0, "23f555d9adb42d4408020e90d1beaa82dc1ecf", 0xfffffffe, 0x4}) sendmsg$NLBL_CIPSOV4_C_ADD(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000140)=ANY=[@ANYBLOB="d00000", @ANYRES16=r2, @ANYBLOB="010000000000000000000100000008000100000000000400048008000c8004000b800800020001000000a00008801c0007800837d73ec300000008000600000000000800050000000000240007800800050000230000000005000000000061ff05000000000008000500000000"], 0xd0}}, 0x0) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r5, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x110b, 0x8000000000002}) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_TYPE(r6, &(0x7f0000000100)={0x0, 0x3a, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="380000000d060103040000000000000003000006"], 0x38}, 0x1, 0x0, 0x0, 0x4000000}, 0x4008080) r7 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) socket$inet_smc(0x2b, 0x1, 0x0) r8 = dup3(r7, r5, 0x0) ioctl$BINDER_WRITE_READ(r8, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$SNDCTL_DSP_STEREO(0xffffffffffffffff, 0xc0045003, &(0x7f0000000100)=0x1) write$dsp(0xffffffffffffffff, &(0x7f0000000000), 0x0) 2.561248893s ago: executing program 1 (id=1293): syz_emit_ethernet(0x7e, &(0x7f0000000000)={@broadcast, @random="1704b45adbde", @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0xe0, 0x0, 0xe000, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11, 0x0, @empty=0xac1414aa, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@lsrr={0x83, 0x3}, @end, @timestamp_prespec={0x44, 0x3c, 0x0, 0x3, 0x0, [{@rand_addr=0x64010100}, {@remote}, {@multicast1}, {@dev}, {@empty}, {}, {}]}]}}}}}}}, 0x0) r0 = socket$kcm(0x10, 0x400000002, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)=@base={0x12, 0x3, 0x4, 0x8}, 0x50) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0xd, &(0x7f0000000300)=ANY=[@ANYBLOB="18000000000000000000000000000000850000002a00000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x18, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f0000000280)=r2, 0x4) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f00000001c0)={'ip_vti0\x00', &(0x7f0000000400)={'tunl0\x00', 0x0, 0x8000, 0x8000, 0x7fffffff, 0x9, {{0x26, 0x4, 0x1, 0x38, 0x98, 0x67, 0x0, 0x3, 0x29, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x20}, {[@timestamp_prespec={0x44, 0x24, 0x43, 0x3, 0x6, [{@broadcast, 0x5}, {@loopback, 0x8}, {@multicast2, 0x1}, {@multicast1}]}, @timestamp_prespec={0x44, 0x2c, 0x98, 0x3, 0x3, [{@remote, 0xff}, {@multicast2, 0x3}, {@local, 0xce}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x400}, {@loopback, 0x6}]}, @timestamp_addr={0x44, 0x1c, 0x45, 0x1, 0x4, [{@local, 0x6}, {@rand_addr=0x64010100, 0x1}, {@dev={0xac, 0x14, 0x14, 0x17}, 0xfffffff0}]}, @timestamp={0x44, 0x18, 0x68, 0x0, 0x7, [0x164d, 0x3ff, 0xdb, 0x40, 0xfad]}]}}}}}) r4 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000002c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="9feb000018000000000000001c0000001c0000000c00000010000000000000650100000002000000020000000000000b04000000005f307a5f00300030005000"], &(0x7f00000006c0)=""/240, 0x40, 0xf0, 0x0, 0xe}, 0x28) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000008c0)=@bpf_lsm={0x1d, 0x21, &(0x7f0000000580)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r1}}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r1}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x7}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x2}}, @call={0x85, 0x0, 0x0, 0xcf}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xfff}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r1}}, @alu={0x4, 0x0, 0xd, 0x2, 0x9, 0x2, 0x8}, @exit, @map_idx_val={0x18, 0x2, 0x6, 0x0, 0x1, 0x0, 0x0, 0x0, 0x7}, @initr0={0x18, 0x0, 0x0, 0x0, 0x8}], &(0x7f0000000080)='syzkaller\x00', 0x6, 0x19, &(0x7f0000000180)=""/25, 0x41000, 0x6f, '\x00', r3, 0x1b, r4, 0x8, &(0x7f00000004c0)={0x3, 0x5}, 0x8, 0x10, &(0x7f00000007c0)={0x1, 0x0, 0x4, 0x7}, 0x10, 0xffffffffffffffff, 0x0, 0x5, &(0x7f0000000800)=[r1, r1, r1, r1, r1], &(0x7f0000000840)=[{0x1, 0x1, 0xd, 0x1}, {0x2, 0x2, 0x5, 0x4}, {0x1, 0x1, 0x10, 0x5}, {0x2, 0x3, 0x7}, {0x0, 0x3, 0xc, 0xb}], 0x10, 0x13b}, 0x94) syz_clone3(&(0x7f0000000500)={0x81103280, &(0x7f0000000000), 0x0, 0x0, {0x1a}, 0x0, 0x0, 0x0, 0x0}, 0x58) 2.493886822s ago: executing program 0 (id=1294): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) close(0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0xffffffffffffff1a, &(0x7f0000000200)=0x400000bce) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f00000000c0)={'team0\x00', &(0x7f0000000300)=@ethtool_link_settings={0x4c, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x4, [0x0, 0x0, 0x0, 0xffffffff]}}) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x0, 0x0}, 0x10) r3 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) r4 = fsmount(r3, 0x0, 0x0) fchdir(r4) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x20) r5 = open(&(0x7f0000000040)='./file0\x00', 0x551083, 0x28) r6 = socket(0x10, 0x3, 0x9) connect$netlink(r6, &(0x7f0000000040)=@proc={0x10, 0x0, 0x25dfdbfc, 0x8}, 0x6) futex_waitv(&(0x7f0000001a40)=[{0x3, &(0x7f0000000000)=0x800, 0x82}, {0x4, &(0x7f0000000240)=0x9, 0x2}, {0x4, &(0x7f00000002c0)=0xa7, 0x2}, {0x9, &(0x7f0000000300)=0x6, 0x82}, {0x6, &(0x7f0000000340)=0x100, 0x2}, {0x263e, &(0x7f0000000380)=0x3, 0x2}, {0x7fff, 0x0, 0x2}, {0x3, &(0x7f0000000400)=0x8, 0x2}, {0x2, &(0x7f0000000440)=0xc2, 0x82}, {0x5, &(0x7f0000000480)=0xb05, 0x82}, {0x7, &(0x7f0000000500)=0x6fb, 0x2}, {0x2, &(0x7f0000000540)=0x800, 0x82}, {0xffffffffffffff8a, &(0x7f00000005c0)=0x3, 0x2}, {0x6, &(0x7f0000000640)=0x8000000000000000, 0x2}, {0x0, &(0x7f0000000680)=0x5, 0x2}, {0x5377, &(0x7f00000006c0)=0xffffffffffffffae, 0x2}, {0x7fffffffffffffff, &(0x7f0000000700), 0x82}, {0x5, &(0x7f0000000740)=0x3}, {0x200, &(0x7f0000001500)=0xfffffffffffffffb, 0x2}, {0x7, &(0x7f00000007c0)=0x4, 0x2}, {0xe234, &(0x7f0000000880)=0x9, 0x82}, {0x799, &(0x7f00000008c0)=0x6, 0x2}, {0x7, &(0x7f0000000900)=0x8001, 0x2}, {0x200, &(0x7f0000000940)=0x9, 0x2}, {0x7, &(0x7f0000000980)=0x5, 0x2}, {0x9, &(0x7f00000009c0)=0x1, 0x82}, {0x20000000003, &(0x7f0000000a00)=0x5, 0x82}, {0x40000000000000, &(0x7f0000000a40)=0xed, 0x82}, {0xec2, &(0x7f0000000a80)=0x10}, {0x0, &(0x7f0000000ac0)=0x100, 0x2}, {0x2, &(0x7f0000000b00)=0xb, 0x82}, {0x5, &(0x7f0000000b40)=0x1, 0x2}, {0x6b4, &(0x7f0000000b80)=0x3}, {0x6, &(0x7f0000000bc0)=0x7b, 0x2}, {0x3, &(0x7f0000000c00)=0x8, 0x82}, {0x8, &(0x7f0000000cc0)=0x1, 0x82}, {0x1, &(0x7f0000000d00)=0xffffffffffffffff, 0x2}, {0x9, &(0x7f0000000d40)=0xfffffffffffff396, 0x80}, {0x265a, &(0x7f0000000d80)=0x9, 0x2}, {0xc4bd, &(0x7f0000000dc0)=0x9, 0x2}, {0x60, &(0x7f0000000e00)=0x8000, 0x2}, {0x2, &(0x7f0000000f00)=0x7, 0x2}, {0x2, &(0x7f0000000f40)=0x5, 0x82}, {0x5, &(0x7f0000000f80)=0x2, 0x2}, {0x7f, &(0x7f0000001000), 0x2}, {0x9, &(0x7f0000001040), 0x82}, {0x2, &(0x7f0000001080)=0x200, 0x2}, {0x3, &(0x7f00000010c0)=0x4, 0x2}, {0x7fff, &(0x7f0000001100)=0x1ff, 0x80}, {0x7, &(0x7f0000001140)=0x3, 0x82}, {0x200, &(0x7f0000001180)=0xb38f, 0x2}, {0x2, &(0x7f00000011c0)=0x1, 0xc2a80d4ae11d5a6}, {0x0, &(0x7f0000001200)=0x7fff, 0x2}, {0x3bd, &(0x7f0000001240)=0x8, 0x2}, {0xffffffffffffffff, &(0x7f0000001280)=0x5, 0x82}, {0x1, &(0x7f00000012c0)=0x3, 0x82}, {0x1, &(0x7f0000001300)=0x290a70a5, 0x82}, {0x5, &(0x7f0000001340)=0x93ac, 0x82}, {0xffffffff, &(0x7f0000001380)=0x6, 0x2}, {0x7fffffffffffffff, &(0x7f00000013c0)=0x80000000, 0x2}], 0x3c, 0x0, &(0x7f0000001400)={0x0, 0x989680}, 0x1) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000140)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0xe4}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000100)='bbr\x00', 0x4) sendmmsg$inet(r0, &(0x7f0000000e80)=[{{0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000c40)="5c5eafd3ae55a73702d6befaee97f47f4be65587e1fca708cee084691e4587d887a5eaab43ac5edc4886496910cd7a153cd84b93208c7b1a625b3ea990092389b19dab4f61e30ee60a4d7e51ffc9a5accb", 0x51}, {&(0x7f0000000800)="104b0b7073fbd7f77a847bdbfdf6da474f700bf113b18d16d8380f42e296b49f1326c7d0d97be798e205654b8a885df6ee57ec7b690491c55ca484b54170549c7a72b8a579005ffcb0b309dae34571b17126534a763ca881f12d750072abc05a7cb8f0e32fc3ec3ed14c3322630ae8e710fb6829", 0x74}], 0x2}}, {{0x0, 0x0, &(0x7f0000000e40)=[{&(0x7f0000001800)="353a35d6094e4ee7d764b6993f65136c5d6b84d9b1324a0b25e094700c9a66f9181738098f32e3e48859c3878d53a9752474da0d6af299d849d48f2fa2c8c807d7a1521da940585790ff1e6f9da83e32b751d1af9cfac640c1361f5ae8b99c187dafe9ea854120f6eaab11e7fdeb3f2152ebdbc21520ca01f64bb821576deef4ed6696cdddc1768b5b4fbd68a687cb6ba52ecf5cc6f8f05062f26de19d6aaaeb6cbca00e46685f77d2b3e8dd9d0d099e799cd5a76c67ab283f790366f7f744508edc9e48fa101b89215bd330c4e706c1f09d781a5a50aef5e424a7a88b3241a338ca7411cda28aa167b5628b79e8a7d588efb69636181b9c54f6d296386c95f8a08e27d5792dcb20fa3b5b4f60c71f310b31bb1ab4a825c2dc10fac150a17d92bb51849d9eea53c78d427d8d1036dc906084046fcae09499c220ef50c2c7c475f392bc288eb5efb8032d1ade92e88e50a05a95dd5c6cbbdfb086fa53bca14d40c8c3f7149b39b16b7c7370978389366174db5fbc99dbe958f8c1690cd695dfbe6c384162a412c8d3cfd7cf223f9df4c67b92514111891f53d4e19826797302e1a87e7a627c52740bb3bd311771a68d349c0a68ef6f2a765f8220323add67b2b6695ca41adcda387a4264bcd94c8578a9ccca3b55ebcda45369b56068cfeec34abc2cbd94b9b12d057fa9d4328d57073f40e5ae64443e4a10ed400575bbd1168a170a0134b9ad28735dbd9603a9e417cce864f2141a92f57e1fdfcff4776f94a794", 0x221}], 0x1}}], 0x2, 0x0) ioctl$COMEDI_DEVCONFIG(r5, 0x40946400, &(0x7f0000001440)={'amplc_pc236\x00', [0x7, 0x6, 0x1, 0x9, 0x8, 0x4, 0x6, 0x7, 0x5, 0xd8, 0x5, 0x1, 0xffffffbc, 0x376a, 0x2, 0x2e1, 0xfffffffb, 0x3, 0x1, 0xac, 0x0, 0x7ff, 0x200, 0x5, 0x4, 0xbae, 0x5, 0x5, 0xd1e9, 0x9, 0x39, 0xd459]}) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r0, 0x89f8, 0x0) sendto$inet(r0, &(0x7f0000000580)="17", 0x59a, 0x10008095, 0x0, 0x0) 2.23667258s ago: executing program 3 (id=1295): r0 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x44, 0x86}, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f0000000100), 0xffffffffffffffff) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x5) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f0000000480), 0x400034f, 0x2, 0x0) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0600000004000000ff0f000007"], 0x48) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000400007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000340)={0x0, r6}, 0x18) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) sendmsg$nl_route_sched(r1, &(0x7f00000037c0)={0x0, 0x0, &(0x7f0000003780)={&(0x7f0000000940)=@newtaction={0x488, 0x30, 0x12f, 0x0, 0x1000000, {}, [{0x474, 0x1, [@m_police={0x470, 0x1, 0x0, 0x0, {{0xb}, {0x444, 0x2, 0x0, 0x1, [[@TCA_POLICE_RATE={0x404, 0x2, [0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0xfffffffe, 0x0, 0x0, 0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x400000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x3, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10007, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x3, 0x8, 0x0, 0x20003, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x100, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x7ff, 0x0, 0x1, 0x0, 0x400, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1afa, 0x0, 0x45, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0xffff, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0xffffffff, 0x0, 0xa, 0x0, 0x0, 0x4, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xba14, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x6]}, @TCA_POLICE_TBF={0x3c, 0x1, {0x0, 0x1, 0x1, 0x0, 0x6, {0x7, 0x0, 0x0, 0x0, 0x3, 0x5}}}]]}, {0x4}, {0xc, 0xb}, {0xc, 0xa}}}]}]}, 0x488}}, 0x0) r7 = openat$selinux_policy(0xffffff9c, &(0x7f0000001040), 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x100000a, 0x12, r7, 0x0) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) write$selinux_load(r0, &(0x7f0000000580)=ANY=[@ANYBLOB="8cff7cf9080000005345204c696e757879a413031fc007619cc2a25c749126cb43a1c463a36aeb7126c9c9435aa2b32268b091608e103fc1a5d738496954d6f9b102a1c57c86ffc9679d816c59fe6a80a0d8a6be8e2972e13148d47db540805c85e60c08a019bc40d99ee100d54dabe7dbc525190267ba4f8ae4195daa6278dfb488a1c4e5c8d0fe"], 0x81) r8 = socket$kcm(0xa, 0x1, 0x106) setsockopt$sock_int(r8, 0x1, 0x7, &(0x7f0000000340)=0x1, 0x4) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r9 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x3, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="18020000000000000000000001050000850000009b000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000ff4cff80850000007100000095"], &(0x7f0000000080)='GPL\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r9, 0x11, 0xe, 0x0, &(0x7f00000009c0)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x4004, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 2.173447863s ago: executing program 2 (id=1296): bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000100)={0x3ff8, 0x0, 0x0, 0x4}, 0x10, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0xfffffffe}, 0x94) r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) getsockopt$inet6_tcp_buf(r0, 0x6, 0xd, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000600)=ANY=[@ANYBLOB='l\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="01000000000000000000030000005800018044000400200001000a000004000000000000000000000000000000000000000100000000200002000af5ffffff00000000000000000000000000000000000000000000000d000100756470", @ANYBLOB="0e6efb51cff4"], 0x6c}}, 0x0) add_key(0x0, &(0x7f0000000100)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffe) r3 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_ADD_VIF(r3, 0x0, 0xca, &(0x7f0000003d80)={0x0, 0x1, 0xfe, 0x2000, @vifc_lcl_ifindex, @dev}, 0x10) r4 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_ADD_VIF(r4, 0x0, 0xca, &(0x7f00000000c0)={0x8, 0x0, 0x0, 0x0, @vifc_lcl_addr=@local, @dev={0xac, 0x14, 0x14, 0x40}}, 0x10) setsockopt$MRT_FLUSH(r3, 0x0, 0xd4, &(0x7f0000000140)=0x8, 0x4) getsockopt$inet6_mptcp_buf(r0, 0x11c, 0x2, &(0x7f0000000100)=""/222, &(0x7f0000000000)=0x61637876) 1.4335212s ago: executing program 1 (id=1297): sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) syz_clone3(&(0x7f00000003c0)={0x400, 0x0, &(0x7f0000000040), &(0x7f0000000080), {0x5}, &(0x7f0000000200)=""/86, 0x56, &(0x7f0000000340)=""/70, &(0x7f00000000c0)=[0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0xa}, 0x58) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) r1 = socket(0x1, 0x803, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@newlink={0x58, 0x10, 0x403, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x90646}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @vlan={{0x9}, {0x18, 0x2, 0x0, 0x1, [@IFLA_VLAN_FLAGS={0xc, 0x2, {0x1f, 0x1f}}, @IFLA_VLAN_ID={0x6, 0x1, 0x1}]}}}, @IFLA_LINK={0x8, 0x5, r2}, @IFLA_MASTER={0x8, 0xa, r2}]}, 0x58}, 0x1, 0x0, 0x0, 0x600}, 0x0) 1.417995076s ago: executing program 4 (id=1298): socket$nl_generic(0x10, 0x3, 0x10) syz_open_dev$evdev(&(0x7f0000000040), 0x1000, 0x0) r0 = landlock_create_ruleset(&(0x7f0000000480)={0x4200, 0x2, 0x1}, 0x18, 0x2) landlock_restrict_self(0xffffffffffffffff, 0x0) mkdirat(r0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080000000000000", @ANYRES32, @ANYBLOB="0000000087cbb6690000f231005e0600b7e7de00", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000240)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7cb080800070000007b8af8ff00000000bfa200000000000007020000f8ffffff0000000008000000b7040000000000008500000082000000950b000000000000"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x3a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x10) r6 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000940)=ANY=[@ANYBLOB="b4050000200080066110000000000000c6000020000000009500d800000000009f33ef60916e55893f1eeb0b2ae13d922e6235592ce847e2566c43d72918a897323fd0723043c47c896ce0bce66a245ad9d6817fd98cd824498949714ffaac8a6f77ef0000ca5d82054d54d53cd2b6db714e75d9bdae214fa68a0557eb2c5ca683a4b6fcfcff0bffffffffffd47042eaebfa6fa26fa7a347c7faa8e700458c60897d4a6148a1c11428427c40de60beacf871ab5c2ff88a02084e5b5271e45f00003826fb8579c1fb01d2c5553d2ccb5fc5b51fe6b174ebd9907dcff414ed55b0c20cdbe7009a6fe7cc78762f1d4dcdbca64920db9a50f86c21632f7a4bd344e0bd74ff05d37ef68e3b9db863c758ffffffffabe90ac5d08dd9d4e0359c41cf3626e1230bc1cd4c02c460ceb44276e9bd94d1c2e6d17dc5c2edf332a62f5fe68fbbbbfcfd00000000000fbf940e6652d357474ed5f816f66ac3027460ae66317f83cdd7a7eb2a7003d1a6cf5478533584961c329fcf5a43e05c92bfef0dcd28000000003f2915a3039c9a78f63b8ec7e60a0000fed7d67c440e23d130e51eea1e085bebabe7059de9cbfc5117c024185a062acb6b8eec31c21b3af8b9eedb4660ed2deb7acf2a33a376a5cb7d4266d5b0be14488d14b473502486ad8dd600000000000000000000c7766ea7c581782c0d90f42a85303835fc291c25d29e6bead5d7360f2e1929d7736ebc8558c4506407d3046022bdf25485bd5442169e9b4c1278343581b7a06f65e8ea6b042c4fd08381e5000000000000006398d6480000001a723b91030000006480304c66b217aea0156ce9eef911fe5b7370f79987303ecb3aabc53c60014a0101ab766754f596b41da9534d12b8306a1b36cf3b03f0d790879f523eabfbee83d8bd472ef69660cf6ec897106c51e54a17497f384c4956b41f3843e7c878b1e11316d8ddae1c6c3b85aaf7a9fcaf8f5d6186c42542d68ba72682c938d3c0a2e6e10eed71b1d31c9f300b41745329bf34495c63e43fb896e4903fb0fae54a8f0fe3b48a5b29d279070647e65097c8ecf32a15080000000000000001007ba4a70a084bd994ac5e00000000000000000000000000351a30cd97f83d72631d0fe92efa974a53f4dc1eb9a86df632a6d463688123f64d42a919bcfc44a90ffd680200000091f842a91c977f6075d07e39e669b0713af0498a99bf5261cb3269d499a5202d7a08b33ade7b38829b9bd39619688d5e9af22170ef83e5b92cbb32b655c45de1c154aad81bf64351668a3f76d5afa958aff76249e0ffdf8e45155536a1a44bfcbfbfd232af000052f9002a"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x366, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) close(r6) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000140)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f00000000c0), &(0x7f0000000100)=r6}, 0x20) close(r8) close(r7) r9 = syz_open_dev$tty1(0xc, 0x4, 0x1) write$UHID_INPUT(r9, &(0x7f00000005c0)={0x9, {"a2e3ad21ed0d52f91b5a090987f70e06d038e7ff7fc6e5539b5b43078b089b3b073172090890e0878f0e1ac6e7049b3371959b6e9a240d5b67f3988f7ef319520100ffe8d178708c523c921b1b5b31070d074c0936cd3b78130daa61d8e809ea882f5802b77f07227227b7ba67e0e78657a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae193973735b36d5b1b63dd1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000000000075271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6b922f17959d1f416e56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617669314e2fbe70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d546a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9963ac4f4bb3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6a62fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce3803f465e41e610c20d80421d653a5520000008213b704c7fb082ff27590678ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc946813591ad8deff4b05f60cea0da7710ac0000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4fb8a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d97b9a6d6d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2aed9e53803ed0ca4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4350aeae9ca1207e78283cd0b20ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034ef655b253ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827467cfa5c4e72730d56bd068ed211cf847535edecb7b373f78b095b68441a34cb51682a8ae4d24ad0465f3927f889b813076038e79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdcce04579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93aec92a5de203717aa49c2d284acfabe262fccfcbb2b75a2183c46eb65ca8104e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43eaeb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e94265c803b35ee5f83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369dde50e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aae501b20f7694a00f16e2d0174035a2c22656dc29880acebdbe8ddbd75c2f998d8ac2dfad2ba3a504767b6b45a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40426db6fe29068c0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf46366e7205dd8d6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7c5419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa0b9d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaee5ee6cf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c71568f3144345f48843dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6d594f88a4facfd4c735a20307c737afae5136651b1b9bd522d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a3766d5439020484f4113c4c859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02dae17b118e5d6787463183b4b87c1050000002f7809959bc048850613d17ca51055f2f416a44fe180d2d50c312cca7cb14a2bdc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb42913777c06376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7f96093530e76692839d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7348663a52190202c7af288a4510de03dab19d26285eda89156d50dd385a60333ba5bbf5d77cd7007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00398e8bd1f4908b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf652f406c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6528341b648cdd56fed7cdcbb1575912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae033a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a3cd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08758897f3411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2de8a50ddefeb12c46342856935125102bb784ed7148b6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b8081c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c971d90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f02f4cded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36d7d3e5db21b094b8b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1162dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1dfb1c68cc164b0a0780d971a96ea2c4d4ca0398c2235980a9307b3d5bd3b01faffd0a5dbed2881a9700af561ac8c7e36bb2fc4c40e9cf96f06817fb903729a7db6ff957697c9ede7885d94ffb0969be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c148cd2f9c55f4901203a9a8a2c3e90f3943dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d0fc5a752f9000", 0x1000}}, 0x1006) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000380)=@raw={'raw\x00', 0x3c1, 0x3, 0x2f8, 0x140, 0x5c, 0x160, 0x0, 0x3e0, 0x250, 0x228, 0x25a, 0x250, 0x228, 0x4, 0x0, {[{{@ipv6={@remote, @dev, [], [], 'veth0_to_batadv\x00', 'pim6reg\x00', {0xff}, {}, 0x3a}, 0x5002, 0xd0, 0x118, 0x52020000, {0x0, 0x6802000000000000}, [@common=@icmp6={{0x28}, {0x8, "d176", 0x1}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x2000000, 0x1}}}, {{@ipv6={@local, @empty, [0xffffffff], [], 'veth1_to_hsr\x00', 'dummy0\x00'}, 0x0, 0xa8, 0x110}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x10, 0x0, 0x0, 0x0, 'snmp\x00', 'syz0\x00', {0x2}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x358) syz_emit_ethernet(0x3e, &(0x7f00000001c0)=ANY=[@ANYBLOB="aaaaaaaaaaaaff5effffffff0800450c00300000000000019078ac1e0001e000000103049078030000004500000000000000002f0000ac1414aae0000001"], 0x0) 1.255398731s ago: executing program 0 (id=1299): r0 = syz_open_dev$usbfs(&(0x7f0000000180), 0x205, 0x2581) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$USBDEVFS_SUBMITURB(r1, 0x8038550a, &(0x7f0000000000)=@urb_type_control={0x2, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48000000, 0x0, 0x0, 0x0}) ioctl$USBDEVFS_REAPURBNDELAY(r1, 0x4004550d, &(0x7f0000000500)) 664.282435ms ago: executing program 3 (id=1300): r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x11, 0xf, &(0x7f0000000200)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="000e000000000000b702000014000000b7030000000000d647425ec357e7ee00bf0900000000000055090100000000009500000000000000bf91000000000000b7090000000004008500000085000000b70000003f00000095"], &(0x7f0000001dc0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x22, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 585.453746ms ago: executing program 2 (id=1301): bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000200)={'bond0\x00'}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000240)={'vlan0\x00'}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)=ANY=[], 0x40}, 0x1, 0x0, 0x0, 0x40000}, 0x8000) futex(0x0, 0xc, 0x1, 0x0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="1801000021000000000000003b810000850000006d000000070000000000000095"], 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) r1 = userfaultfd(0x1) sendmsg$NFNL_MSG_CTHELPER_NEW(0xffffffffffffffff, &(0x7f0000000680)={0x0, 0x0, 0x0}, 0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000080)) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, 0x0) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000280)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x6, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000880)={&(0x7f0000000080)='rpc_stats_latency\x00', r2, 0x0, 0x40000000}, 0x18) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x4004004) sendmsg$netlink(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000002580)=[{&(0x7f0000000000)=ANY=[@ANYBLOB="140000002500010000480000f100000006"], 0x14}], 0x1, 0x0, 0x0, 0x400048c0}, 0x0) 585.069472ms ago: executing program 3 (id=1302): syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000380)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a00000804800200090581", @ANYRES16], 0x0) r0 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) write$char_usb(r0, &(0x7f0000000100), 0x0) 522.753318ms ago: executing program 0 (id=1303): r0 = bpf$MAP_CREATE(0x100000000000000, &(0x7f0000000140)=@base={0xa, 0x16, 0xb3, 0x7f}, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x12, &(0x7f0000000080)=@framed={{0x18, 0x8}, [@func={0x85, 0x0, 0x1, 0x0, 0x6}, @map_fd={0x18, 0x2, 0x1, 0x0, r0}, @generic={0x61, 0x0, 0x0, 0x9c4}, @initr0={0x18, 0x0, 0x0, 0xff90}, @exit, @printk={@x={0x18, 0x0}, {}, {}, {0x7, 0x0, 0x0, 0x1, 0x0, 0x0, 0xfffffe00}, {}, {}, {0x85, 0x0, 0x0, 0x9e}}]}, &(0x7f0000000000)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x4}, 0x94) 513.49969ms ago: executing program 4 (id=1304): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) (async, rerun: 64) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) (async, rerun: 64) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat$null(0xffffffffffffff9c, &(0x7f00000002c0), 0x200000, 0x0) readlinkat(r3, &(0x7f0000000300)='./file0\x00', &(0x7f0000000340)=""/197, 0xc5) (async) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000000000000000000004b64ffec850000006d000000850000000e00000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xd, '\x00', 0x0, 0x2}, 0x94) r5 = getpid() ptrace$PTRACE_GETSIGMASK(0x420a, r5, 0x8, &(0x7f0000000440)) (async, rerun: 32) clock_adjtime(0x0, &(0x7f0000000040)={0xd51, 0x0, 0x8, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7fffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x100}) (async, rerun: 32) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r4}, 0x10) (async, rerun: 32) openat$ppp(0xffffffffffffff9c, &(0x7f0000001740), 0x0, 0x0) (async, rerun: 32) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f0000000300)=@abs, 0x6e) (async) sendmmsg$unix(r7, &(0x7f00000bd000), 0x318, 0x0) (async) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) sendmsg(r7, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) (async, rerun: 32) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x8010, 0xffffffffffffffff, 0x0) (async, rerun: 32) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) (async) r8 = socket$inet_mptcp(0x2, 0x1, 0x106) (async, rerun: 32) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x0) (rerun: 32) setsockopt$inet_int(r8, 0x0, 0x1, 0x0, 0x0) openat$qrtrtun(0xffffffffffffff9c, 0x0, 0x2) 409.44723ms ago: executing program 0 (id=1305): ioctl$TCSBRK(0xffffffffffffffff, 0x5409, 0x57) openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = syz_open_dev$sndmidi(0x0, 0x2, 0x141102) writev(r0, 0x0, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x1000, 0x2}) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r3 = dup3(r2, r1, 0x0) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r4, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x1, 0x100000, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x30, 0x0, 0x0}, 0x1000}], 0x0, 0x0, 0x0}) 359.127286ms ago: executing program 0 (id=1306): creat(&(0x7f0000000000)='./file0\x00', 0xd931d3864d39ddd8) r0 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x1) r1 = creat(&(0x7f00000002c0)='./file0\x00', 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x8) mmap$xdp(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x12, r2, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000fe020010850000000700000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, r1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) write$qrtrtun(r1, &(0x7f0000000300)="ca0e808bb35bdabb", 0x8) r4 = fsopen(&(0x7f0000000200)='cifs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r4, 0x1, &(0x7f0000000ac0)='gid', &(0x7f0000000440)='0\x00#\x00\xd0\x00 \x00\x00qS\x00\x00\x00\x00\x00\x00\x00\x00$\xf6_\xbdI\x1c\xf2\xa9]\xcc\xe0*\xef\x01\x8d\x15\xd2h\x93\xc9\xb57\xc3\xea\\Eb\xf8\xe6,\xdf\xd4\xfae\x84\xcc\xd5\"d\xf0D-\x98\x9f\x81{\xfc$\xc4\xbcF\xf8\xc8\x8d\xcb\xb8\xf2\x1e\xe4\'U\xb3\xb8\xd3\xe6\xd7\x80Y\xc2\xeb\n\xb8_\xe8\x96YY\xe3\xc7\xe6\xf28\x19\xa6\xa7\xfa\xdb\x1ce\xc1\x03\x86J\xb2fh\x19\xee#\xcc\x0f\xed\xfea\xdc\x88\xcb%bW\xd35\xda=\xac\x1d\xae\x93\xfd\'T6\x94\n\xa4\x9cU\xc4\fA~[\xbf\x8b\x90\xfe\x04\xe7U\xf3h\x81\x14l7u\x95\x96t\\\x0f\xef;\x03\xa4C\xbc(Vc!a\xc1\xe39\xc6b\x905\xf8\xc9@h\x01\xf5\xcb\x88\xdf9\xaf5\xc8a:z\xe4\xcbag&67\x814\xf6}\xe10v6l\xd6,\x1e\xa0\xcc\xbf\xfdkm\b?\x839\x85N\x1c\xc1\xcb\xfc\x85\xd2\n\x02\"\xf2\x81g\x90\x01n%\x7f_\xe1.f>>\xa5\xfb\"\xab\xdb\x06\x12e\x14\x11~\x9a\bR-\x85\xc3\xa9\xe6\xf6R\x11\"\xc3\xc9\xfc\x14s X\xec\xdd\xc2qB\x85\xf0\xd7\x04\xdd<\x9a\x84\'\xa3\xf1\xd9<\xb9k', 0x0) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000005c0)={r3, 0x0, 0x30, 0x0, @val=@uprobe_multi={&(0x7f0000000140)='./file0\x00', &(0x7f00000001c0)=[0x7], &(0x7f0000000240)=[0x2], 0x0, 0x1}}, 0x40) mmap$xdp(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x1f, 0x12, r0, 0x0) r5 = fsopen(&(0x7f0000000280)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r5, 0x1, &(0x7f0000000640)='\xf0\x891\xb8R\xe6\x8d\x12\xe5\xe3+\xcd24\x01\x80\x1a\xc9A\x93\xb1@\xbf\x89K\xd0\x86\xd9\x86\x18\xc4:\xc3\xe0\xac\xed~\x97\a\xbe\xfb1d\xbe\xa1\xc1N\xd2p\xf0\xc6\xf3\x8eD\x1b\xc7q\x99?9\xf1\xe6\f\xa9\x90\xec:\x037\xe8\x0f\rX6\xf2\x88\x8d\r\xd2\xfc+\x19\x9a}\x9c\xd9\x1a\xef\xf1\x16d>ah\xa2\xa7\x02U\x06\xe1\xe1PY\x90\x17\xf0p\x01*!I\xd3$\xd00C\x88*NA\xc3\x95`\xb2\xf1\xb1\xed\x91\xe4\x87\xcf_9\x1eIpAfN\x99\xa9\v)\x98p\xea[\xc5&D\xe7\xf3\xba/\xcd\xdb\x9dz\xb2\xbf\xc6\xea?\x13(\x15\xc1\tm\xe7t,[\x14|bM\xfa\xeb\x91\xb0\xdfAR\xf3\xe2\xdf', &(0x7f00000007c0)='{\xe0e%m\"\x92\xb5\xcb\x00\x01\x0e!5\xd8\xf2\x92\x97\x86\xf9\xa8\xe7;\xdff3\x83\xb1a\xf2j\t\x7f??,\xd9\xe28\xae\xd6>\xbaN\x1d_N\xcbdIP2$\xbc\xc9\x89\xb5\n\x90-i%\xe2\x94\fH\xf1\xed\r\b\x1c\x81>\t\xc30-\xe2\xb3\xb00xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r1, 0x10e, 0x2, &(0x7f0000000180)=0xa, 0x4) (async) sendmmsg$unix(r7, &(0x7f0000000000), 0x0, 0x81) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) sendfile(r0, r1, 0x0, 0xffffffff004) r8 = socket$inet6_sctp(0xa, 0x801, 0x84) sendmmsg$inet6(r8, &(0x7f0000002680)=[{{&(0x7f0000000000)={0xa, 0x0, 0x0, @private1={0xfc, 0x1, '\x00', 0x1}}, 0x1c, &(0x7f0000000300)=[{&(0x7f0000000340)="18", 0x1}], 0x1a}}], 0x1, 0x0) (async) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, 0xffffffffffffffff, 0x0) (async, rerun: 64) shutdown(r8, 0x1) (async, rerun: 64) getsockopt$inet_sctp6_SCTP_STATUS(r8, 0x84, 0xe, &(0x7f00000001c0)={0x0, 0x5, 0x1, 0xd, 0x1c80, 0xfffa, 0xff4e, 0xced, {0x0, @in={{0x2, 0x4e21, @rand_addr=0x64010100}}, 0x2, 0x7, 0x9, 0xffffffff, 0x5}}, &(0x7f0000000040)=0xb0) 185.396075ms ago: executing program 2 (id=1308): r0 = open(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x400000, 0x2) syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000300)={'wlan1\x00'}) bind$inet(0xffffffffffffffff, 0x0, 0x0) connect$inet(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000040)=0x1) sched_setaffinity(0x0, 0xfffffffffffffdc5, &(0x7f00000002c0)=0x800002) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) removexattr(0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000280)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a010400000500000000000500fffe0900010073797a30000000002c000000030a01020000130000000000050000000900010073797a30000000000900030073797a300000000054000000060a010400000000000000000500000008000b40000000000900010073797a30000000002c0004802800018008000100647570001c000280080002"], 0xc8}}, 0x0) stat(&(0x7f0000000380)='\xe9\x1fq\x89Y\x1e\x923aK\x00', &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0}) quotactl$Q_QUOTAOFF(0xffffffff80000301, &(0x7f0000000200)=@sr0, r3, 0x0) openat$uhid(0xffffffffffffff9c, 0x0, 0x2, 0x0) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x3, &(0x7f0000000080)=ANY=[@ANYBLOB="180000000000000000000000000000009500000000fa2100"], &(0x7f00000001c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='contention_end\x00', r4}, 0x10) r5 = syz_open_dev$dri(&(0x7f0000000080), 0x1ff, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000200)={0x8000, 0x2, 0x4}) r6 = syz_open_dev$dri(&(0x7f0000000000), 0x1ff, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r6, 0xc04064a0, &(0x7f0000000700)={0x0, &(0x7f0000000400)=[0x0, 0x0, 0x0, 0x0], 0x0, 0x0, 0x0, 0x4, 0x0, 0x47}) ioctl$DRM_IOCTL_MODE_CURSOR(r5, 0xc01c64a3, &(0x7f0000000040)={0x4, r7, 0x10000000, 0x80000001, 0x2d4a, 0x6, 0x1}) close_range(r5, 0xffffffffffffffff, 0x0) bind$unix(0xffffffffffffffff, &(0x7f00000006c0)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) 0s ago: executing program 4 (id=1309): r0 = openat$comedi(0xffffff9c, &(0x7f0000000040)='/dev/comedi1\x00', 0x2180, 0x0) r1 = socket$unix(0x1, 0x2, 0x0) bind$unix(r1, &(0x7f0000000100)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) setsockopt$SO_TIMESTAMP(r1, 0x1, 0x3f, &(0x7f0000000000)=0x3, 0x4) lsetxattr(&(0x7f0000000200)='\xe9\x1fq\x89Y\x1e\x923aK\x00', &(0x7f0000000280)=@known='system.posix_acl_default\x00', &(0x7f00000002c0)='\xd4\x00', 0x2, 0x2) syz_open_dev$vim2m(0x0, 0x7, 0x2) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, &(0x7f0000000080)={'pcl812\x00', [0x2f00, 0x80005, 0xd09a, 0x2, 0x0, 0x1, 0x3, 0x4000009, 0x1002, 0x1, 0xc, 0x40000002, 0x4, 0x4, 0xffff, 0x0, 0xffffffa5, 0x80000000, 0x832, 0x30000, 0x3ff, 0x7, 0x7ff, 0xe2df, 0x2, 0x1, 0x9, 0xffffffff, 0x4, 0x3, 0x70f]}) kernel console output (not intermixed with test programs): T9] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 211.756859][ T9] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 211.783509][ T9] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 211.835321][ T9] usb 2-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 211.847758][ T9] usb 2-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 211.864470][ T9] usb 2-1: Product: syz [ 211.869869][ T9] usb 2-1: Manufacturer: syz [ 211.934909][ T9] cdc_wdm 2-1:1.0: skipping garbage [ 211.944678][ T9] cdc_wdm 2-1:1.0: skipping garbage [ 212.229616][ T9] cdc_wdm 2-1:1.0: cdc-wdm0: USB WDM device [ 212.244157][ T9] cdc_wdm 2-1:1.0: Unknown control protocol [ 212.255589][ T9] usb 2-1: USB disconnect, device number 36 [ 212.439719][ T8037] syz.0.625: attempt to access beyond end of device [ 212.439719][ T8037] nbd0: rw=0, sector=0, nr_sectors = 1 limit=0 [ 212.646925][ T8027] netlink: 8 bytes leftover after parsing attributes in process `syz.4.623'. [ 212.735059][ T8039] lo speed is unknown, defaulting to 1000 [ 212.736672][ T8042] netlink: 8 bytes leftover after parsing attributes in process `syz.2.626'. [ 212.844208][ T10] usb 5-1: new full-speed USB device number 14 using dummy_hcd [ 212.871151][ T8042] input: syz0 as /devices/virtual/input/input17 [ 212.944300][ T1204] usb 1-1: new high-speed USB device number 15 using dummy_hcd [ 213.037432][ T8047] lo speed is unknown, defaulting to 1000 [ 213.075122][ T10] usb 5-1: config 0 has an invalid interface number: 151 but max is 0 [ 213.087437][ T10] usb 5-1: config 0 has no interface number 0 [ 213.105666][ T10] usb 5-1: config 0 interface 151 altsetting 0 endpoint 0x85 has invalid maxpacket 24840, setting to 64 [ 213.124902][ T10] usb 5-1: New USB device found, idVendor=0499, idProduct=6bab, bcdDevice=68.2f [ 213.136989][ T10] usb 5-1: New USB device strings: Mfr=20, Product=2, SerialNumber=3 [ 213.147733][ T10] usb 5-1: Product: syz [ 213.152845][ T10] usb 5-1: Manufacturer: syz [ 213.160296][ T10] usb 5-1: SerialNumber: syz [ 213.183610][ T10] usb 5-1: config 0 descriptor?? [ 213.196453][ T8031] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 213.250934][ T1204] usb 1-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 213.272650][ T1204] usb 1-1: New USB device found, idVendor=04fc, idProduct=504a, bcdDevice=43.02 [ 213.288299][ T1204] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 213.306001][ T1204] usb 1-1: Product: syz [ 213.310323][ T1204] usb 1-1: Manufacturer: syz [ 213.326502][ T1204] usb 1-1: SerialNumber: syz [ 213.343368][ T1204] usb 1-1: config 0 descriptor?? [ 213.355006][ T8057] netlink: 12 bytes leftover after parsing attributes in process `syz.2.632'. [ 213.365761][ T8056] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 213.514173][ T5831] usb 2-1: new full-speed USB device number 37 using dummy_hcd [ 213.665684][ T5831] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 213.680785][ T5831] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 213.698940][ T5831] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.00 [ 213.719378][ T5831] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 213.727715][ T5831] usb 2-1: SerialNumber: syz [ 213.755924][ T5831] usb 2-1: 0:2 : does not exist [ 214.754652][ T8071] erofs (device nbd1): cannot find valid erofs superblock [ 214.822371][ T8076] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 214.996220][ T30] audit: type=1800 audit(1752792860.263:381): pid=8035 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.4.623" name="/" dev="fuse" ino=0 res=0 errno=0 [ 215.495442][ T8087] netlink: 12 bytes leftover after parsing attributes in process `syz.2.638'. [ 215.543020][ T8087] netlink: 36 bytes leftover after parsing attributes in process `syz.2.638'. [ 216.003241][ T30] audit: type=1400 audit(1752792861.263:382): avc: denied { ioctl } for pid=8088 comm="syz.2.639" path="socket:[17835]" dev="sockfs" ino=17835 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 216.063804][ T8092] netlink: 'syz.3.640': attribute type 1 has an invalid length. [ 216.128857][ T8094] netlink: 28 bytes leftover after parsing attributes in process `syz.3.640'. [ 216.209346][ T8094] 8021q: adding VLAN 0 to HW filter on device bond1 [ 216.275017][ T8089] block nbd0: server does not support multiple connections per device. [ 216.384868][ T8089] block nbd0: shutting down sockets [ 216.397552][ T5831] usb 2-1: USB disconnect, device number 37 [ 216.450683][ T6228] udevd[6228]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 216.483486][ T10] usb 5-1: USB disconnect, device number 14 [ 216.707588][ T5829] udevd[5829]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.151/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 217.088949][ T8110] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(7) [ 217.095509][ T8110] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 217.131364][ T8110] vhci_hcd vhci_hcd.0: Device attached [ 217.144078][ T10] usb 5-1: new low-speed USB device number 15 using dummy_hcd [ 217.189079][ T5905] usb 1-1: USB disconnect, device number 15 [ 217.305032][ T10] usb 5-1: Invalid ep0 maxpacket: 64 [ 217.365464][ T5831] usb 37-1: new low-speed USB device number 3 using vhci_hcd [ 217.433996][ T1204] usb 3-1: new high-speed USB device number 12 using dummy_hcd [ 217.442635][ T8122] netlink: 8 bytes leftover after parsing attributes in process `syz.1.648'. [ 217.656241][ T10] usb 5-1: new low-speed USB device number 16 using dummy_hcd [ 217.687205][ T8118] netlink: 8 bytes leftover after parsing attributes in process `syz.0.647'. [ 217.724032][ T1204] usb 3-1: device descriptor read/64, error -71 [ 217.844572][ T10] usb 5-1: Invalid ep0 maxpacket: 64 [ 217.850449][ T10] usb usb5-port1: attempt power cycle [ 217.906257][ T5910] usb 1-1: new full-speed USB device number 16 using dummy_hcd [ 218.001218][ T1204] usb 3-1: new high-speed USB device number 13 using dummy_hcd [ 218.102589][ T5910] usb 1-1: config 0 has an invalid interface number: 151 but max is 0 [ 218.144254][ T5910] usb 1-1: config 0 has no interface number 0 [ 218.300445][ T5910] usb 1-1: config 0 interface 151 altsetting 0 endpoint 0x85 has invalid maxpacket 24840, setting to 64 [ 218.344253][ T1204] usb 3-1: device descriptor read/64, error -71 [ 218.354043][ T10] usb 5-1: new low-speed USB device number 17 using dummy_hcd [ 218.397826][ T10] usb 5-1: device descriptor read/8, error -71 [ 218.398476][ T5910] usb 1-1: New USB device found, idVendor=0499, idProduct=6bab, bcdDevice=68.2f [ 218.430697][ T5910] usb 1-1: New USB device strings: Mfr=20, Product=2, SerialNumber=3 [ 218.454469][ T5910] usb 1-1: Product: syz [ 218.456261][ T1204] usb usb3-port1: attempt power cycle [ 218.458668][ T5910] usb 1-1: Manufacturer: syz [ 218.458685][ T5910] usb 1-1: SerialNumber: syz [ 218.463058][ T5910] usb 1-1: config 0 descriptor?? [ 218.488698][ T8123] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 219.181358][ T8144] syz.4.654: attempt to access beyond end of device [ 219.181358][ T8144] nbd4: rw=0, sector=0, nr_sectors = 1 limit=0 [ 219.197040][ T1204] usb 3-1: new high-speed USB device number 14 using dummy_hcd [ 219.396668][ T8138] netlink: 12 bytes leftover after parsing attributes in process `syz.3.653'. [ 219.529237][ T1204] usb 3-1: device descriptor read/8, error -71 [ 219.568311][ T8138] netlink: 20 bytes leftover after parsing attributes in process `syz.3.653'. [ 219.641033][ T5910] usb 1-1: USB disconnect, device number 16 [ 219.747237][ T30] audit: type=1400 audit(1752792864.923:383): avc: denied { mounton } for pid=8145 comm="syz.4.655" path="/121/file0" dev="tmpfs" ino=645 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=fifo_file permissive=1 [ 219.890774][ T6228] udevd[6228]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.151/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 219.949248][ T1204] usb 3-1: new high-speed USB device number 15 using dummy_hcd [ 220.014901][ T1204] usb 3-1: device descriptor read/8, error -71 [ 220.021938][ T8111] vhci_hcd: connection reset by peer [ 220.049784][ T13] vhci_hcd: stop threads [ 220.057379][ T13] vhci_hcd: release socket [ 220.081796][ T13] vhci_hcd: disconnect device [ 220.098167][ T8152] lo speed is unknown, defaulting to 1000 [ 220.124263][ T1204] usb usb3-port1: unable to enumerate USB device [ 220.485939][ T8165] netlink: 8 bytes leftover after parsing attributes in process `syz.2.657'. [ 220.508378][ T8165] input: syz0 as /devices/virtual/input/input18 [ 220.624117][ T5927] usb 1-1: new high-speed USB device number 17 using dummy_hcd [ 220.701752][ T30] audit: type=1400 audit(1752792865.963:384): avc: denied { load_policy } for pid=8157 comm="syz.3.659" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=security permissive=1 [ 220.722932][ T8158] SELinux: failed to load policy [ 220.787062][ T5927] usb 1-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 220.953428][ T8174] netlink: 8 bytes leftover after parsing attributes in process `syz.4.661'. [ 221.134373][ T5927] usb 1-1: New USB device found, idVendor=04fc, idProduct=504a, bcdDevice=43.02 [ 221.172317][ T5927] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 221.198242][ T5927] usb 1-1: Product: syz [ 221.207528][ T5927] usb 1-1: Manufacturer: syz [ 221.762871][ T5927] usb 1-1: SerialNumber: syz [ 222.428052][ T5927] usb 1-1: config 0 descriptor?? [ 222.474521][ T5831] vhci_hcd: vhci_device speed not set [ 223.409631][ T8199] syz.4.671: attempt to access beyond end of device [ 223.409631][ T8199] nbd4: rw=0, sector=0, nr_sectors = 1 limit=0 [ 223.656271][ T5831] usb 4-1: new full-speed USB device number 26 using dummy_hcd [ 223.713008][ T30] audit: type=1400 audit(1752792868.973:385): avc: denied { accept } for pid=8200 comm="syz.2.672" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=unix_dgram_socket permissive=1 [ 223.887980][ T5831] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 223.907932][ T5831] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 223.935038][ T5831] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.00 [ 223.954195][ T5831] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 223.962241][ T5831] usb 4-1: SerialNumber: syz [ 223.995153][ T5927] usb 3-1: new low-speed USB device number 16 using dummy_hcd [ 224.050236][ T5831] usb 4-1: 0:2 : does not exist [ 224.086061][ T8213] netlink: 8 bytes leftover after parsing attributes in process `syz.1.675'. [ 224.194213][ T5927] usb 3-1: device descriptor read/64, error -71 [ 224.536183][ T8219] erofs (device nbd3): cannot find valid erofs superblock [ 224.947105][ T5927] usb 3-1: new low-speed USB device number 17 using dummy_hcd [ 225.164177][ T5927] usb 3-1: device descriptor read/64, error -71 [ 225.253817][ T1204] usb 1-1: USB disconnect, device number 17 [ 225.284444][ T5927] usb usb3-port1: attempt power cycle [ 225.350488][ T8229] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(6) [ 225.357032][ T8229] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 225.367224][ T8229] vhci_hcd vhci_hcd.0: Device attached [ 225.396213][ T8229] vhci_hcd vhci_hcd.0: pdev(0) rhport(1) sockfd(8) [ 225.402774][ T8229] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 225.427109][ T8229] vhci_hcd vhci_hcd.0: Device attached [ 225.544285][ T3086] vhci_hcd: vhci_device speed not set [ 225.784977][ T8229] vhci_hcd vhci_hcd.0: pdev(0) rhport(2) sockfd(10) [ 225.791605][ T8229] vhci_hcd vhci_hcd.0: devid(0) speed(2) speed_str(full-speed) [ 225.818672][ T8229] vhci_hcd vhci_hcd.0: Device attached [ 225.834587][ T3086] usb 33-1: new full-speed USB device number 4 using vhci_hcd [ 225.842126][ T5927] usb 3-1: new low-speed USB device number 18 using dummy_hcd [ 225.927388][ T5927] usb 3-1: device descriptor read/8, error -71 [ 225.939614][ T30] audit: type=1400 audit(1752792871.203:386): avc: denied { ioctl } for pid=8239 comm="syz.4.681" path="socket:[18127]" dev="sockfs" ino=18127 ioctlcmd=0x5404 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rose_socket permissive=1 [ 225.975696][ T64] dummy0: left promiscuous mode [ 226.005248][ T30] audit: type=1400 audit(1752792871.203:387): avc: denied { create } for pid=8239 comm="syz.4.681" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 226.025088][ T30] audit: type=1400 audit(1752792871.203:388): avc: denied { ioctl } for pid=8239 comm="syz.4.681" path="socket:[18129]" dev="sockfs" ino=18129 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 226.052899][ T30] audit: type=1400 audit(1752792871.273:389): avc: denied { read } for pid=8228 comm="syz.0.679" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 226.079461][ T30] audit: type=1400 audit(1752792871.343:390): avc: denied { remount } for pid=8228 comm="syz.0.679" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 226.166328][ T8243] netlink: 12 bytes leftover after parsing attributes in process `syz.1.682'. [ 226.184149][ T5927] usb 3-1: new low-speed USB device number 19 using dummy_hcd [ 226.202416][ T8243] netlink: 36 bytes leftover after parsing attributes in process `syz.1.682'. [ 226.205015][ T8230] vhci_hcd: connection reset by peer [ 226.217366][ T8237] vhci_hcd: connection closed [ 226.218617][ T8232] vhci_hcd: connection closed [ 226.224374][ T189] vhci_hcd: stop threads [ 226.225062][ T5927] usb 3-1: device descriptor read/8, error -71 [ 226.231575][ T189] vhci_hcd: release socket [ 226.268555][ T189] vhci_hcd: disconnect device [ 226.349140][ T189] vhci_hcd: stop threads [ 226.353431][ T189] vhci_hcd: release socket [ 226.406324][ T5927] usb usb3-port1: unable to enumerate USB device [ 226.591525][ T5831] usb 4-1: USB disconnect, device number 26 [ 226.595776][ T189] vhci_hcd: disconnect device [ 226.646158][ T189] vhci_hcd: stop threads [ 226.666909][ T189] vhci_hcd: release socket [ 226.704065][ T6228] udevd[6228]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 226.774090][ T189] vhci_hcd: disconnect device [ 227.048969][ T8252] netlink: 16 bytes leftover after parsing attributes in process `syz.2.685'. [ 227.133994][ T8254] netlink: 16 bytes leftover after parsing attributes in process `syz.1.686'. [ 227.600594][ T8269] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(9) [ 227.607138][ T8269] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 227.783675][ T8273] syz.1.691: attempt to access beyond end of device [ 227.783675][ T8273] nbd1: rw=0, sector=0, nr_sectors = 1 limit=0 [ 227.901686][ T8269] vhci_hcd vhci_hcd.0: Device attached [ 228.045858][ T8280] netlink: 8 bytes leftover after parsing attributes in process `syz.4.693'. [ 228.285169][ T30] audit: type=1400 audit(1752792873.543:391): avc: denied { accept } for pid=8274 comm="syz.3.692" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 228.304391][ C1] vkms_vblank_simulate: vblank timer overrun [ 228.384127][ T1204] usb 1-1: new high-speed USB device number 18 using dummy_hcd [ 228.778402][ T1204] usb 1-1: config 0 has no interfaces? [ 228.784068][ T1204] usb 1-1: New USB device found, idVendor=0de5, idProduct=0056, bcdDevice= 5.b5 [ 228.815186][ T1204] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 228.824675][ T8288] overlayfs: missing 'workdir' [ 228.844898][ T1204] usb 1-1: config 0 descriptor?? [ 228.931978][ T30] audit: type=1400 audit(1752792874.193:392): avc: denied { connect } for pid=8287 comm="syz.4.696" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 229.057148][ T8270] vhci_hcd: cannot find a urb of seqnum 1 max seqnum 3 [ 229.068087][ T189] vhci_hcd: stop threads [ 229.072356][ T189] vhci_hcd: release socket [ 229.092126][ T189] vhci_hcd: disconnect device [ 229.364152][ T1204] usb 2-1: new high-speed USB device number 38 using dummy_hcd [ 229.514336][ T1204] usb 2-1: Using ep0 maxpacket: 32 [ 229.528932][ T1204] usb 2-1: config 8 has an invalid interface number: 1 but max is 0 [ 229.550241][ T1204] usb 2-1: config 8 contains an unexpected descriptor of type 0x1, skipping [ 229.575791][ T1204] usb 2-1: config 8 has no interface number 0 [ 229.582033][ T1204] usb 2-1: config 8 interface 1 has no altsetting 0 [ 229.592889][ T1204] usb 2-1: New USB device found, idVendor=0733, idProduct=0430, bcdDevice=57.26 [ 229.605417][ T1204] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 229.761277][ T1204] usb 2-1: Product: syz [ 229.792526][ T1204] usb 2-1: Manufacturer: ь [ 229.874808][ T1204] usb 2-1: SerialNumber: syz [ 229.990628][ T30] audit: type=1400 audit(1752792875.253:393): avc: denied { write } for pid=8306 comm="syz.3.702" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 230.015504][ T8307] netlink: 'syz.3.702': attribute type 10 has an invalid length. [ 230.023341][ T8307] netlink: 55 bytes leftover after parsing attributes in process `syz.3.702'. [ 230.050397][ T8309] binder: 8308:8309 ioctl c0306201 200000001a80 returned -11 [ 230.192909][ T1204] gspca_main: spca505-2.14.0 probing 0733:0430 [ 230.220032][ T1204] gspca_spca505: reg write: error -71 [ 230.252164][ T1204] spca505 2-1:8.1: probe with driver spca505 failed with error -5 [ 230.273508][ T1204] usb 2-1: USB disconnect, device number 38 [ 231.079958][ T3086] vhci_hcd: vhci_device speed not set [ 231.267983][ T1204] usb 1-1: USB disconnect, device number 18 [ 231.417391][ T8333] netlink: 8 bytes leftover after parsing attributes in process `syz.2.712'. [ 231.432513][ T8333] vlan2: entered allmulticast mode [ 231.437732][ T8333] macsec0: entered allmulticast mode [ 231.443026][ T8333] veth1_macvtap: entered allmulticast mode [ 231.603344][ T8341] syz.4.714: attempt to access beyond end of device [ 231.603344][ T8341] nbd4: rw=0, sector=0, nr_sectors = 1 limit=0 [ 232.219919][ T30] audit: type=1400 audit(1752792877.473:394): avc: denied { mount } for pid=8332 comm="syz.2.712" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 232.265164][ T8342] lo speed is unknown, defaulting to 1000 [ 232.297104][ T8350] vivid-000: ================= START STATUS ================= [ 232.315800][ T8350] vivid-000: Test Pattern: 75% Colorbar [ 232.321549][ T8350] vivid-000: Fill Percentage of Frame: 100 [ 232.354173][ T8350] vivid-000: Horizontal Movement: No Movement [ 232.394271][ T8350] vivid-000: Vertical Movement: No Movement [ 232.574719][ T8350] vivid-000: OSD Text Mode: All [ 232.899459][ T8350] vivid-000: Show Border: false [ 232.920170][ T8359] netlink: 12 bytes leftover after parsing attributes in process `syz.0.718'. [ 232.934116][ T8350] vivid-000: Show Square: false [ 232.940773][ T1204] usb 2-1: new high-speed USB device number 39 using dummy_hcd [ 233.214128][ T8359] netlink: 36 bytes leftover after parsing attributes in process `syz.0.718'. [ 233.237629][ T8350] vivid-000: Sensor Flipped Horizontally: false [ 233.263706][ T8350] vivid-000: Sensor Flipped Vertically: false [ 233.298410][ T8350] vivid-000: Insert SAV Code in Image: false [ 233.338371][ T8350] vivid-000: Insert EAV Code in Image: false [ 233.355573][ T30] audit: type=1400 audit(1752792878.623:395): avc: denied { unmount } for pid=5827 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 233.393272][ T8350] vivid-000: Insert Video Guard Band: false [ 233.404124][ T1204] usb 2-1: device descriptor read/64, error -71 [ 233.524185][ T8350] vivid-000: Reduced Framerate: false [ 233.535105][ T8350] vivid-000: HDMI 000-0 Is Connected To: Test Pattern Generator [ 233.706613][ T8350] vivid-000: S-Video 000-0 Is Connected To: Test Pattern Generator [ 233.745384][ T8350] vivid-000: Enable Capture Cropping: true [ 233.753520][ T8350] vivid-000: Enable Capture Composing: true [ 233.760505][ T8350] vivid-000: Enable Capture Scaler: true [ 233.792065][ T8350] vivid-000: Timestamp Source: End of Frame [ 233.798602][ T8350] vivid-000: Colorspace: sRGB [ 233.807350][ T8350] vivid-000: Transfer Function: Default [ 233.813021][ T8350] vivid-000: Y'CbCr Encoding: Default [ 233.819280][ T8350] vivid-000: HSV Encoding: Hue 0-179 [ 233.845457][ T1204] usb 2-1: new high-speed USB device number 40 using dummy_hcd [ 233.855382][ T8350] vivid-000: Quantization: Default [ 233.860682][ T8350] vivid-000: Apply Alpha To Red Only: false [ 233.911644][ T8350] vivid-000: Standard Aspect Ratio: 4x3 [ 233.922542][ T8350] vivid-000: DV Timings Signal Mode: Current DV Timings inactive [ 233.935659][ T8350] vivid-000: DV Timings: 640x480p59 inactive [ 233.941805][ T8350] vivid-000: DV Timings Aspect Ratio: Source Width x Height [ 233.949895][ T8350] vivid-000: Maximum EDID Blocks: 2 [ 233.981982][ T8350] vivid-000: Limited RGB Range (16-235): false [ 233.991735][ T8350] vivid-000: Rx RGB Quantization Range: Automatic [ 234.001044][ T8380] lo speed is unknown, defaulting to 1000 [ 234.007564][ T8350] vivid-000: Power Present: 0x00000001 [ 234.013212][ T1204] usb 2-1: device descriptor read/64, error -71 [ 234.037307][ T30] audit: type=1326 audit(1752792879.303:396): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8381 comm="syz.2.726" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f7a8118e929 code=0x0 [ 234.066051][ T8350] tpg source WxH: 320x240 (Y'CbCr) [ 234.072910][ T8350] tpg field: 1 [ 234.076779][ T8350] tpg crop: (0,0)/320x240 [ 234.081098][ T8350] tpg compose: (0,0)/320x240 [ 234.084106][ T5905] usb 4-1: new high-speed USB device number 27 using dummy_hcd [ 234.093598][ T8350] tpg colorspace: 8 [ 234.099435][ T8350] tpg transfer function: 0/0 [ 234.104224][ T8350] tpg Y'CbCr encoding: 0/0 [ 234.108626][ T8350] tpg quantization: 0/0 [ 234.112917][ T8350] tpg RGB range: 0/2 [ 234.116907][ T3086] usb 1-1: new high-speed USB device number 19 using dummy_hcd [ 234.125938][ T8350] vivid-000: ================== END STATUS ================== [ 234.134339][ T1204] usb usb2-port1: attempt power cycle [ 234.244285][ T5905] usb 4-1: Using ep0 maxpacket: 32 [ 234.252006][ T5905] usb 4-1: config 222 has an invalid descriptor of length 87, skipping remainder of the config [ 234.269839][ T8390] netlink: 8 bytes leftover after parsing attributes in process `syz.4.725'. [ 234.286629][ T8390] input: syz0 as /devices/virtual/input/input19 [ 234.339826][ T3086] usb 1-1: Using ep0 maxpacket: 16 [ 234.348976][ T5905] usb 4-1: config 222 has 0 interfaces, different from the descriptor's value: 2 [ 234.358771][ T3086] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid maxpacket 42473, setting to 1024 [ 234.382257][ T3086] usb 1-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=7b.55 [ 234.469585][ T3086] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 234.665741][ T3086] usb 1-1: Product: syz [ 234.678556][ T1204] usb 2-1: new high-speed USB device number 41 using dummy_hcd [ 234.682259][ T3086] usb 1-1: Manufacturer: syz [ 234.694276][ T3086] usb 1-1: SerialNumber: syz [ 234.731991][ T1204] usb 2-1: device descriptor read/8, error -71 [ 234.732448][ T3086] usb 1-1: config 0 descriptor?? [ 234.751600][ T5905] usb 4-1: New USB device found, idVendor=0ccd, idProduct=0080, bcdDevice=4a.83 [ 234.752258][ T8378] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22 [ 234.782910][ T5905] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 234.947261][ T3086] usb 1-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 235.016204][ T5905] usb 4-1: Product: syz [ 235.031118][ T30] audit: type=1326 audit(1752792880.293:397): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8376 comm="syz.0.724" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fc859f8e929 code=0x0 [ 235.033290][ T5905] usb 4-1: Manufacturer: syz [ 235.071026][ T1204] usb 2-1: new high-speed USB device number 42 using dummy_hcd [ 235.128965][ T5905] usb 4-1: SerialNumber: syz [ 235.144453][ T1204] usb 2-1: device descriptor read/8, error -71 [ 235.150352][ T8401] netlink: 12 bytes leftover after parsing attributes in process `syz.2.729'. [ 235.165925][ T8400] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 235.265677][ T1204] usb usb2-port1: unable to enumerate USB device [ 235.377368][ T5905] usb 4-1: USB disconnect, device number 27 [ 235.508127][ T30] audit: type=1400 audit(1752792880.773:398): avc: denied { write } for pid=8412 comm="syz.1.733" name="001" dev="devtmpfs" ino=742 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 235.601831][ T8419] netdevsim netdevsim1 netdevsim0: entered promiscuous mode [ 235.615731][ T8419] netdevsim netdevsim1 netdevsim0: entered allmulticast mode [ 235.632216][ T8419] netlink: 44 bytes leftover after parsing attributes in process `syz.1.734'. [ 235.671756][ T30] audit: type=1400 audit(1752792880.933:399): avc: denied { getopt } for pid=8418 comm="syz.1.734" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 235.694203][ T10] usb 5-1: new high-speed USB device number 19 using dummy_hcd [ 235.930839][ T10] usb 5-1: device descriptor read/64, error -71 [ 235.994592][ T6043] usb 1-1: Failed to submit usb control message: -110 [ 236.066136][ T6043] usb 1-1: unable to send the bmi data to the device: -110 [ 236.073471][ T6043] usb 1-1: unable to get target info from device [ 236.082784][ T6043] usb 1-1: could not get target info (-110) [ 236.090870][ T6043] usb 1-1: could not probe fw (-110) [ 236.354038][ T10] usb 5-1: new high-speed USB device number 20 using dummy_hcd [ 236.694281][ T10] usb 5-1: device descriptor read/64, error -71 [ 236.937528][ T3086] usb 1-1: USB disconnect, device number 19 [ 236.967494][ T8440] netlink: 8 bytes leftover after parsing attributes in process `syz.3.740'. [ 236.986629][ T8440] input: syz0 as /devices/virtual/input/input20 [ 237.076367][ T10] usb usb5-port1: attempt power cycle [ 237.156018][ T30] audit: type=1400 audit(1752792882.413:400): avc: denied { block_suspend } for pid=8438 comm="syz.1.741" capability=36 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 237.383090][ T8450] netlink: 28 bytes leftover after parsing attributes in process `syz.1.741'. [ 237.397850][ T8450] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 237.433785][ T30] audit: type=1400 audit(1752792882.673:401): avc: denied { getopt } for pid=8438 comm="syz.1.741" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 237.433792][ T10] usb 5-1: new high-speed USB device number 21 using dummy_hcd [ 237.472960][ T8451] fuse: Bad value for 'fd' [ 237.497797][ T10] usb 5-1: device descriptor read/8, error -71 [ 238.143697][ T30] audit: type=1400 audit(1752792883.043:402): avc: denied { create } for pid=8449 comm="syz.0.744" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 238.204194][ T10] usb 5-1: new high-speed USB device number 22 using dummy_hcd [ 238.284862][ T10] usb 5-1: device descriptor read/8, error -71 [ 238.701431][ T30] audit: type=1400 audit(1752792883.953:403): avc: denied { mount } for pid=8457 comm="syz.0.746" name="/" dev="ramfs" ino=19355 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ramfs_t tclass=filesystem permissive=1 [ 238.796496][ T8458] netlink: 32 bytes leftover after parsing attributes in process `syz.0.746'. [ 238.809638][ T10] usb usb5-port1: unable to enumerate USB device [ 238.819407][ T30] audit: type=1400 audit(1752792884.013:404): avc: denied { create } for pid=8457 comm="syz.0.746" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 239.014559][ T8460] netlink: 32 bytes leftover after parsing attributes in process `syz.0.746'. [ 240.430505][ T8479] syz.2.751: attempt to access beyond end of device [ 240.430505][ T8479] nbd2: rw=0, sector=0, nr_sectors = 1 limit=0 [ 241.154279][ T8491] syz.4.755: attempt to access beyond end of device [ 241.154279][ T8491] nbd4: rw=0, sector=0, nr_sectors = 1 limit=0 [ 241.464151][ T3086] usb 1-1: new high-speed USB device number 20 using dummy_hcd [ 241.644741][ T3086] usb 1-1: device descriptor read/64, error -71 [ 241.954157][ T3086] usb 1-1: new high-speed USB device number 21 using dummy_hcd [ 242.523793][ T3086] usb 1-1: device descriptor read/64, error -71 [ 242.670414][ T3086] usb usb1-port1: attempt power cycle [ 242.983327][ T8543] syz.1.772: attempt to access beyond end of device [ 242.983327][ T8543] nbd1: rw=0, sector=0, nr_sectors = 1 limit=0 [ 243.205779][ T8545] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 243.214192][ T3086] usb 1-1: new high-speed USB device number 22 using dummy_hcd [ 243.234570][ T3086] usb 1-1: device descriptor read/8, error -71 [ 243.241124][ T8545] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 243.292848][ T8540] netlink: 8 bytes leftover after parsing attributes in process `syz.2.773'. [ 243.494162][ T3086] usb 1-1: new high-speed USB device number 23 using dummy_hcd [ 243.595463][ T3086] usb 1-1: device descriptor read/8, error -71 [ 243.658291][ T9] usb 3-1: new full-speed USB device number 20 using dummy_hcd [ 243.674020][ T5905] usb 2-1: new high-speed USB device number 43 using dummy_hcd [ 243.757861][ T3086] usb usb1-port1: unable to enumerate USB device [ 243.881929][ T8566] lo speed is unknown, defaulting to 1000 [ 243.896741][ T9] usb 3-1: config 0 has an invalid interface number: 151 but max is 0 [ 243.907299][ T9] usb 3-1: config 0 has no interface number 0 [ 243.916358][ T5905] usb 2-1: config 0 has no interfaces? [ 243.925084][ T9] usb 3-1: config 0 interface 151 altsetting 0 endpoint 0x85 has invalid maxpacket 24840, setting to 64 [ 243.939925][ T5905] usb 2-1: New USB device found, idVendor=056a, idProduct=0045, bcdDevice= 0.00 [ 243.949549][ T5905] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 243.962233][ T9] usb 3-1: New USB device found, idVendor=0499, idProduct=6bab, bcdDevice=68.2f [ 243.980408][ T9] usb 3-1: New USB device strings: Mfr=20, Product=2, SerialNumber=3 [ 243.996778][ T5905] usb 2-1: config 0 descriptor?? [ 244.008724][ T9] usb 3-1: Product: syz [ 244.181329][ T30] audit: type=1400 audit(1752792889.433:405): avc: denied { setopt } for pid=8563 comm="syz.4.781" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=mctp_socket permissive=1 [ 244.193190][ T9] usb 3-1: Manufacturer: syz [ 244.206848][ T9] usb 3-1: SerialNumber: syz [ 244.273469][ T8552] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 244.284042][ T9] usb 3-1: config 0 descriptor?? [ 244.290955][ T8552] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 244.300770][ T8546] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 244.312709][ T5841] usb 2-1: USB disconnect, device number 43 [ 244.493855][ T8575] netlink: 8 bytes leftover after parsing attributes in process `syz.3.782'. [ 244.554538][ T8575] input: syz0 as /devices/virtual/input/input22 [ 245.024264][ T5927] usb 2-1: new high-speed USB device number 44 using dummy_hcd [ 245.125163][ T8581] fuse: Bad value for 'fd' [ 245.211702][ T5927] usb 2-1: Using ep0 maxpacket: 8 [ 245.224508][ T5927] usb 2-1: config index 0 descriptor too short (expected 72, got 36) [ 245.242828][ T5927] usb 2-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 6 [ 245.323994][ T5927] usb 2-1: New USB device found, idVendor=0af0, idProduct=6751, bcdDevice= 1.08 [ 245.357432][ T5927] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 245.405941][ T5927] usb 2-1: Product: syz [ 245.436699][ T5927] usb 2-1: Manufacturer: syz [ 245.463281][ T5927] usb 2-1: SerialNumber: syz [ 245.927337][ T30] audit: type=1800 audit(1752792891.163:406): pid=8540 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.2.773" name="/" dev="fuse" ino=0 res=0 errno=0 [ 246.011086][ T5927] usb 2-1: USB disconnect, device number 44 [ 246.083466][ T9] usb 3-1: USB disconnect, device number 20 [ 246.305866][ T5841] usb 4-1: new high-speed USB device number 29 using dummy_hcd [ 246.327475][ T5834] udevd[5834]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.151/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 246.380038][ T8593] netlink: 12 bytes leftover after parsing attributes in process `syz.2.788'. [ 246.413297][ T8593] netlink: 36 bytes leftover after parsing attributes in process `syz.2.788'. [ 246.534555][ T5841] usb 4-1: Using ep0 maxpacket: 8 [ 246.542885][ T5841] usb 4-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 246.553561][ T5841] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 246.561954][ T5841] usb 4-1: Product: syz [ 246.582175][ T5841] usb 4-1: Manufacturer: syz [ 246.602471][ T5841] usb 4-1: SerialNumber: syz [ 246.652080][ T5841] usb 4-1: config 0 descriptor?? [ 246.889878][ T8589] CIFS: VFS: Malformed UNC in devname [ 246.914081][ T5841] usb 4-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 247.644319][ T3086] usb 5-1: new high-speed USB device number 23 using dummy_hcd [ 247.860793][ T8601] netlink: 8 bytes leftover after parsing attributes in process `syz.2.791'. [ 247.964075][ T3086] usb 5-1: device descriptor read/64, error -71 [ 248.010227][ T8622] netlink: 8 bytes leftover after parsing attributes in process `syz.0.798'. [ 248.051023][ T30] audit: type=1400 audit(1752792893.313:407): avc: denied { create } for pid=8626 comm="syz.1.800" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 248.229627][ T3086] usb 5-1: new high-speed USB device number 24 using dummy_hcd [ 248.255398][ T8634] netlink: 8 bytes leftover after parsing attributes in process `syz.2.799'. [ 248.268257][ T8634] input: syz0 as /devices/virtual/input/input23 [ 248.454047][ T3086] usb 5-1: device descriptor read/64, error -71 [ 248.464131][ T5905] usb 1-1: new full-speed USB device number 24 using dummy_hcd [ 248.629858][ T5905] usb 1-1: config 0 has an invalid interface number: 151 but max is 0 [ 248.640122][ T5905] usb 1-1: config 0 has no interface number 0 [ 248.695925][ T5841] dvb_usb_rtl28xxu 4-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 248.866506][ T5841] usb 4-1: USB disconnect, device number 29 [ 248.874117][ T5905] usb 1-1: config 0 interface 151 altsetting 0 endpoint 0x85 has invalid maxpacket 24840, setting to 64 [ 248.901055][ T5905] usb 1-1: New USB device found, idVendor=0499, idProduct=6bab, bcdDevice=68.2f [ 248.912260][ T5905] usb 1-1: New USB device strings: Mfr=20, Product=2, SerialNumber=3 [ 248.920660][ T5905] usb 1-1: Product: syz [ 248.925065][ T5905] usb 1-1: Manufacturer: syz [ 248.929670][ T5905] usb 1-1: SerialNumber: syz [ 248.934257][ T3086] usb usb5-port1: attempt power cycle [ 248.941058][ T5905] usb 1-1: config 0 descriptor?? [ 248.948204][ T8622] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22 [ 249.251005][ T30] audit: type=1400 audit(1752792894.513:408): avc: denied { append } for pid=8639 comm="syz.1.803" name="001" dev="devtmpfs" ino=742 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 249.334097][ T3086] usb 5-1: new high-speed USB device number 25 using dummy_hcd [ 249.354748][ T3086] usb 5-1: device descriptor read/8, error -71 [ 249.614354][ T3086] usb 5-1: new high-speed USB device number 26 using dummy_hcd [ 249.626468][ T8646] fuse: Bad value for 'fd' [ 249.814687][ T3086] usb 5-1: device descriptor read/8, error -71 [ 250.028470][ T30] audit: type=1400 audit(1752792895.133:409): avc: denied { write } for pid=8647 comm="syz.1.805" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 250.383572][ T3086] usb usb5-port1: unable to enumerate USB device [ 250.536277][ T8657] netlink: 16 bytes leftover after parsing attributes in process `syz.2.808'. [ 250.870025][ T8661] lo speed is unknown, defaulting to 1000 [ 250.904815][ T3086] usb 5-1: new full-speed USB device number 27 using dummy_hcd [ 250.954219][ T30] audit: type=1800 audit(1752792896.213:410): pid=8628 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.0.798" name="/" dev="fuse" ino=0 res=0 errno=0 [ 251.181672][ T8667] netlink: 12 bytes leftover after parsing attributes in process `syz.2.810'. [ 251.216832][ T8667] netlink: 36 bytes leftover after parsing attributes in process `syz.2.810'. [ 251.346690][ T3086] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 251.374140][ T5905] usb 1-1: USB disconnect, device number 24 [ 251.374275][ T3086] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 251.452557][ T3086] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.00 [ 251.478323][ T6228] udevd[6228]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.151/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 251.514900][ T30] audit: type=1400 audit(1752792896.773:411): avc: denied { name_bind } for pid=8672 comm="syz.2.812" src=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:reserved_port_t tclass=tcp_socket permissive=1 [ 251.552565][ T3086] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 251.582451][ T8661] netlink: 8 bytes leftover after parsing attributes in process `syz.1.809'. [ 251.587342][ T3086] usb 5-1: SerialNumber: syz [ 251.618808][ T3086] usb 5-1: 0:2 : does not exist [ 251.638354][ T8676] input: syz0 as /devices/virtual/input/input24 [ 251.815876][ T8669] tty tty3: ldisc open failed (-12), clearing slot 2 [ 252.381935][ T8684] erofs (device nbd4): cannot find valid erofs superblock [ 253.184036][ T5831] usb 3-1: new high-speed USB device number 21 using dummy_hcd [ 254.323338][ T5831] usb 3-1: device descriptor read/64, error -71 [ 254.662398][ T3086] usb 5-1: USB disconnect, device number 27 [ 254.922207][ T6228] udevd[6228]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 255.096360][ T5831] usb 3-1: new high-speed USB device number 22 using dummy_hcd [ 255.264367][ T3086] usb 5-1: new high-speed USB device number 28 using dummy_hcd [ 255.290669][ T5831] usb 3-1: device descriptor read/64, error -71 [ 255.428927][ T5831] usb usb3-port1: attempt power cycle [ 255.472138][ T8716] netlink: 16 bytes leftover after parsing attributes in process `syz.1.824'. [ 255.534539][ T1296] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.542033][ T1296] ieee802154 phy1 wpan1: encryption failed: -22 [ 255.561808][ T8716] netlink: 16 bytes leftover after parsing attributes in process `syz.1.824'. [ 255.604810][ T3086] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 255.633863][ T8719] netlink: 12 bytes leftover after parsing attributes in process `syz.0.826'. [ 255.643008][ T3086] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 255.643088][ T3086] usb 5-1: Product: syz [ 255.643138][ T3086] usb 5-1: Manufacturer: syz [ 255.643185][ T3086] usb 5-1: SerialNumber: syz [ 255.711209][ T8719] netlink: 36 bytes leftover after parsing attributes in process `syz.0.826'. [ 255.794170][ T5831] usb 3-1: new high-speed USB device number 23 using dummy_hcd [ 256.007713][ T3086] usb 5-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 256.016021][ T5831] usb 3-1: device descriptor read/8, error -71 [ 256.090354][ T3086] usb 5-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 256.709125][ T8729] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 256.764720][ T8729] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 257.388779][ T3086] usb 5-1: Service connection timeout for: 256 [ 257.402901][ T3086] ath9k_htc 5-1:1.0: ath9k_htc: Unable to initialize HTC services [ 257.435487][ T3086] ath9k_htc: Failed to initialize the device [ 257.497613][ T3086] usb 5-1: ath9k_htc: USB layer deinitialized [ 257.598690][ T6078] usb 5-1: USB disconnect, device number 28 [ 257.734808][ T8741] lo speed is unknown, defaulting to 1000 [ 258.699192][ T30] audit: type=1326 audit(1752792903.953:412): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8763 comm="syz.4.839" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f21fdf8e929 code=0x7ffc0000 [ 258.737047][ T30] audit: type=1326 audit(1752792903.953:413): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8763 comm="syz.4.839" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f21fdf8e929 code=0x7ffc0000 [ 259.209804][ T30] audit: type=1326 audit(1752792903.953:414): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8763 comm="syz.4.839" exe="/root/syz-executor" sig=0 arch=c000003e syscall=241 compat=0 ip=0x7f21fdf8e929 code=0x7ffc0000 [ 259.264041][ T9] usb 2-1: new high-speed USB device number 45 using dummy_hcd [ 259.288899][ T30] audit: type=1326 audit(1752792903.953:415): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8763 comm="syz.4.839" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f21fdf8e929 code=0x7ffc0000 [ 259.316072][ T30] audit: type=1326 audit(1752792903.953:416): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8763 comm="syz.4.839" exe="/root/syz-executor" sig=0 arch=c000003e syscall=83 compat=0 ip=0x7f21fdf8e929 code=0x7ffc0000 [ 259.363306][ T30] audit: type=1326 audit(1752792903.953:417): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8763 comm="syz.4.839" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f21fdf8e929 code=0x7ffc0000 [ 259.389519][ T30] audit: type=1326 audit(1752792903.953:418): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8763 comm="syz.4.839" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f21fdf8e929 code=0x7ffc0000 [ 259.487539][ T30] audit: type=1326 audit(1752792903.953:419): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8763 comm="syz.4.839" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f21fdf8e929 code=0x7ffc0000 [ 259.764130][ T30] audit: type=1326 audit(1752792903.953:420): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8763 comm="syz.4.839" exe="/root/syz-executor" sig=0 arch=c000003e syscall=54 compat=0 ip=0x7f21fdf8e929 code=0x7ffc0000 [ 259.815530][ T30] audit: type=1326 audit(1752792903.953:421): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8763 comm="syz.4.839" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f21fdf8e929 code=0x7ffc0000 [ 259.851359][ T8778] netlink: 12 bytes leftover after parsing attributes in process `syz.3.843'. [ 259.861164][ T9] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 259.863585][ T8778] netlink: 36 bytes leftover after parsing attributes in process `syz.3.843'. [ 259.884171][ T9] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 260.050650][ T9] usb 2-1: New USB device found, idVendor=054c, idProduct=0df2, bcdDevice=d6.af [ 260.137361][ T9] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 260.244513][ T9] usb 2-1: config 0 descriptor?? [ 261.106523][ T9] playstation 0003:054C:0DF2.0009: unknown main item tag 0x0 [ 261.124492][ T9] playstation 0003:054C:0DF2.0009: unknown main item tag 0x0 [ 261.131959][ T9] playstation 0003:054C:0DF2.0009: unknown main item tag 0x0 [ 261.164054][ T9] playstation 0003:054C:0DF2.0009: unknown main item tag 0x0 [ 261.184222][ T9] playstation 0003:054C:0DF2.0009: unknown main item tag 0x0 [ 261.247907][ T9] playstation 0003:054C:0DF2.0009: hidraw0: USB HID v1.01 Device [HID 054c:0df2] on usb-dummy_hcd.1-1/input0 [ 262.235516][ T9] playstation 0003:054C:0DF2.0009: Failed to retrieve feature with reportID 5: -71 [ 262.273636][ T9] playstation 0003:054C:0DF2.0009: Failed to retrieve DualSense calibration info: -71 [ 262.294148][ T9] playstation 0003:054C:0DF2.0009: Failed to get calibration data from DualSense [ 262.306211][ T8819] netlink: 16 bytes leftover after parsing attributes in process `syz.4.856'. [ 262.317969][ T9] playstation 0003:054C:0DF2.0009: Failed to create dualsense. [ 262.500907][ T9] playstation 0003:054C:0DF2.0009: probe with driver playstation failed with error -71 [ 262.591326][ T9] usb 2-1: USB disconnect, device number 45 [ 263.973234][ T8828] fuse: Bad value for 'fd' [ 266.184088][ T9] usb 3-1: new low-speed USB device number 25 using dummy_hcd [ 266.204126][ T5841] usb 4-1: new full-speed USB device number 30 using dummy_hcd [ 266.505966][ T9] usb 3-1: device descriptor read/64, error -71 [ 266.607768][ T5841] usb 4-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 266.631183][ T5841] usb 4-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 266.674352][ T5841] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 266.696307][ T5841] usb 4-1: config 0 descriptor?? [ 266.719146][ T5841] hub 4-1:0.0: bad descriptor, ignoring hub [ 266.744613][ T5841] hub 4-1:0.0: probe with driver hub failed with error -5 [ 266.806273][ T5841] usbhid 4-1:0.0: couldn't find an input interrupt endpoint [ 266.854207][ T9] usb 3-1: new low-speed USB device number 26 using dummy_hcd [ 266.877679][ T8878] netlink: 16 bytes leftover after parsing attributes in process `syz.0.872'. [ 267.230240][ T9] usb 3-1: device descriptor read/64, error -71 [ 267.845514][ T9] usb usb3-port1: attempt power cycle [ 268.266358][ T9] usb 3-1: new low-speed USB device number 27 using dummy_hcd [ 268.598463][ T9] usb 3-1: device descriptor read/8, error -71 [ 268.777955][ T8893] netlink: 12 bytes leftover after parsing attributes in process `syz.1.878'. [ 268.836770][ T8893] netlink: 36 bytes leftover after parsing attributes in process `syz.1.878'. [ 269.314427][ T9] usb 3-1: new low-speed USB device number 28 using dummy_hcd [ 269.334707][ T9] usb 3-1: device descriptor read/8, error -71 [ 269.667104][ T9] usb usb3-port1: unable to enumerate USB device [ 269.735537][ T5831] usb 2-1: new high-speed USB device number 46 using dummy_hcd [ 269.998558][ T8909] netlink: 12 bytes leftover after parsing attributes in process `syz.4.883'. [ 270.065269][ T8909] netlink: 36 bytes leftover after parsing attributes in process `syz.4.883'. [ 270.175276][ T5831] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 270.187451][ T5831] usb 2-1: New USB device found, idVendor=04fc, idProduct=504a, bcdDevice=43.02 [ 270.197845][ T5831] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 270.217789][ T5831] usb 2-1: Product: syz [ 270.226612][ T5831] usb 2-1: Manufacturer: syz [ 270.233527][ T5831] usb 2-1: SerialNumber: syz [ 270.241649][ T5831] usb 2-1: config 0 descriptor?? [ 270.245737][ T5905] usb 1-1: new high-speed USB device number 25 using dummy_hcd [ 270.344699][ T5841] usb 4-1: USB disconnect, device number 30 [ 270.444668][ T5905] usb 1-1: Using ep0 maxpacket: 16 [ 270.554774][ T5905] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 270.600854][ T5905] usb 1-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 270.617050][ T5905] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 270.763313][ T5905] usb 1-1: config 0 descriptor?? [ 271.117869][ T8928] netlink: 16 bytes leftover after parsing attributes in process `syz.4.889'. [ 271.187807][ T5905] mcp2221 0003:04D8:00DD.000A: USB HID v0.05 Device [HID 04d8:00dd] on usb-dummy_hcd.0-1/input0 [ 271.274437][ T9] usb 3-1: new high-speed USB device number 29 using dummy_hcd [ 271.435649][ T9] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 271.448254][ T9] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 271.461607][ T9] usb 3-1: New USB device found, idVendor=1e7d, idProduct=2d51, bcdDevice= 0.00 [ 271.470941][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 271.482796][ T9] usb 3-1: config 0 descriptor?? [ 271.912609][ T9] koneplus 0003:1E7D:2D51.000B: unbalanced delimiter at end of report description [ 271.922821][ T9] koneplus 0003:1E7D:2D51.000B: parse failed [ 271.931029][ T9] koneplus 0003:1E7D:2D51.000B: probe with driver koneplus failed with error -22 [ 272.109406][ T8927] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 272.126614][ T8927] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 272.154520][ T5831] usb 5-1: new low-speed USB device number 29 using dummy_hcd [ 272.205367][ T6078] usb 3-1: USB disconnect, device number 29 [ 272.317666][ T5831] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1023, setting to 8 [ 272.330703][ T5831] usb 5-1: config 1 interface 1 altsetting 1 endpoint 0x82 is Bulk; changing to Interrupt [ 272.342391][ T5831] usb 5-1: config 1 interface 1 altsetting 1 endpoint 0x3 is Bulk; changing to Interrupt [ 272.379749][ T5831] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 272.391057][ T5831] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 272.402807][ T5831] usb 5-1: Product: Г [ 272.407212][ T5831] usb 5-1: Manufacturer: О [ 272.413069][ T5831] usb 5-1: SerialNumber: ꃬ [ 272.458844][ T8940] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 273.012263][ T8940] netlink: 'syz.4.893': attribute type 4 has an invalid length. [ 273.020006][ T8940] netlink: 152 bytes leftover after parsing attributes in process `syz.4.893'. [ 273.035883][ T8940] : renamed from bond0 (while UP) [ 273.100830][ T5831] cdc_ncm 5-1:1.0: bind() failure [ 273.105870][ T9] usb 1-1: USB disconnect, device number 25 [ 273.125813][ T5831] cdc_ncm 5-1:1.1: CDC Union missing and no IAD found [ 273.153631][ T5831] cdc_ncm 5-1:1.1: bind() failure [ 273.179269][ T5831] usb 5-1: USB disconnect, device number 29 [ 273.208943][ T5905] usb 2-1: USB disconnect, device number 46 [ 273.314979][ T8964] netlink: 60 bytes leftover after parsing attributes in process `syz.2.900'. [ 273.324999][ T8963] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 273.627289][ T30] kauditd_printk_skb: 13 callbacks suppressed [ 273.627326][ T30] audit: type=1326 audit(1752792918.883:435): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8956 comm="syz.0.897" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fc859f8e929 code=0x0 [ 273.655162][ T8970] netlink: 12 bytes leftover after parsing attributes in process `syz.1.901'. [ 273.692433][ T8970] netlink: 36 bytes leftover after parsing attributes in process `syz.1.901'. [ 274.029302][ T8973] netlink: 8 bytes leftover after parsing attributes in process `syz.4.902'. [ 274.235158][ T5844] Bluetooth: hci5: command 0x1003 tx timeout [ 274.235170][ T5832] Bluetooth: hci5: Opcode 0x1003 failed: -110 [ 274.444135][ T5927] usb 5-1: new full-speed USB device number 30 using dummy_hcd [ 274.801960][ T5927] usb 5-1: config 0 has an invalid interface number: 151 but max is 0 [ 274.810678][ T5927] usb 5-1: config 0 has no interface number 0 [ 274.818206][ T5927] usb 5-1: config 0 interface 151 altsetting 0 endpoint 0x85 has invalid maxpacket 24840, setting to 64 [ 274.850597][ T5927] usb 5-1: New USB device found, idVendor=0499, idProduct=6bab, bcdDevice=68.2f [ 274.862202][ T5927] usb 5-1: New USB device strings: Mfr=20, Product=2, SerialNumber=3 [ 274.872584][ T5927] usb 5-1: Product: syz [ 274.878356][ T5927] usb 5-1: Manufacturer: syz [ 274.917454][ T5927] usb 5-1: SerialNumber: syz [ 275.178323][ T5927] usb 5-1: config 0 descriptor?? [ 275.185822][ T8973] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 275.730384][ T8995] netlink: 8 bytes leftover after parsing attributes in process `syz.3.908'. [ 275.771109][ T8995] bridge0: port 2(bridge_slave_1) entered disabled state [ 276.253781][ T9004] netlink: 84 bytes leftover after parsing attributes in process `syz.0.911'. [ 276.474190][ T5831] usb 4-1: new full-speed USB device number 31 using dummy_hcd [ 276.674243][ T9] usb 3-1: new full-speed USB device number 30 using dummy_hcd [ 276.798658][ T5831] usb 4-1: config 0 has an invalid interface number: 151 but max is 0 [ 276.863394][ T5831] usb 4-1: config 0 has no interface number 0 [ 276.907671][ T5831] usb 4-1: config 0 interface 151 altsetting 0 endpoint 0x85 has invalid maxpacket 24840, setting to 64 [ 276.965649][ T30] audit: type=1800 audit(1752792922.233:436): pid=8975 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.4.902" name="/" dev="fuse" ino=0 res=0 errno=0 [ 277.056313][ T5831] usb 4-1: New USB device found, idVendor=0499, idProduct=6bab, bcdDevice=68.2f [ 277.136618][ T5831] usb 4-1: New USB device strings: Mfr=20, Product=2, SerialNumber=3 [ 277.245803][ T5831] usb 4-1: Product: syz [ 277.316431][ T5831] usb 4-1: Manufacturer: syz [ 277.383612][ T5831] usb 4-1: SerialNumber: syz [ 277.560227][ T5831] usb 4-1: config 0 descriptor?? [ 277.595436][ T9] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 277.604321][ T8997] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 277.686012][ T9] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 277.696161][ T9] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.00 [ 277.705712][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 277.714274][ T9] usb 3-1: SerialNumber: syz [ 277.748738][ T9] usb 3-1: 0:2 : does not exist [ 277.775281][ T5927] usb 5-1: USB disconnect, device number 30 [ 277.832317][ T6228] udevd[6228]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.151/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 278.021958][ T9024] netlink: 12 bytes leftover after parsing attributes in process `syz.4.917'. [ 278.024079][ T9021] can0: slcan on ttyS3. [ 278.138307][ T9026] netlink: 36 bytes leftover after parsing attributes in process `syz.4.917'. [ 278.569890][ T9032] erofs (device nbd2): cannot find valid erofs superblock [ 278.606138][ T9025] can0 (unregistered): slcan off ttyS3. [ 279.032007][ T9031] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 279.089086][ T30] audit: type=1400 audit(1752792924.353:437): avc: denied { read open } for pid=9036 comm="dhcpcd-run-hook" path="/run/dhcpcd/hook-state/resolv.conf" dev="tmpfs" ino=1844 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 279.177025][ T30] audit: type=1400 audit(1752792924.383:438): avc: denied { getattr } for pid=9036 comm="dhcpcd-run-hook" path="/run/dhcpcd/hook-state/resolv.conf" dev="tmpfs" ino=1844 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 279.442926][ T9047] netlink: 8 bytes leftover after parsing attributes in process `syz.4.920'. [ 280.520064][ T9] usb 3-1: USB disconnect, device number 30 [ 280.623028][ T6228] udevd[6228]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 280.646245][ T30] audit: type=1400 audit(1752792925.903:439): avc: denied { add_name } for pid=9035 comm="dhcpcd-run-hook" name="resolv.conf.can0.link" scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 280.722354][ T5831] usb 4-1: USB disconnect, device number 31 [ 280.754451][ T30] audit: type=1400 audit(1752792925.913:440): avc: denied { create } for pid=9035 comm="dhcpcd-run-hook" name="resolv.conf.can0.link" scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 280.848466][ T5834] udevd[5834]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.151/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 281.161462][ T30] audit: type=1400 audit(1752792925.913:441): avc: denied { write } for pid=9035 comm="dhcpcd-run-hook" path="/run/dhcpcd/hook-state/resolv.conf.can0.link" dev="tmpfs" ino=4991 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 281.296245][ T30] audit: type=1400 audit(1752792925.913:442): avc: denied { append } for pid=9035 comm="dhcpcd-run-hook" name="resolv.conf.can0.link" dev="tmpfs" ino=4991 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 281.347239][ T9082] fuse: Bad value for 'fd' [ 281.390694][ T30] audit: type=1400 audit(1752792926.353:443): avc: denied { remove_name } for pid=9072 comm="rm" name="resolv.conf.can0.link" dev="tmpfs" ino=4991 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 281.495188][ T9090] FAULT_INJECTION: forcing a failure. [ 281.495188][ T9090] name failslab, interval 1, probability 0, space 0, times 1 [ 281.522548][ T30] audit: type=1400 audit(1752792926.413:444): avc: denied { unlink } for pid=9072 comm="rm" name="resolv.conf.can0.link" dev="tmpfs" ino=4991 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 281.532781][ T9090] CPU: 0 UID: 0 PID: 9090 Comm: syz.2.931 Not tainted 6.16.0-rc6-syzkaller-00037-ge2291551827f #0 PREEMPT(full) [ 281.532806][ T9090] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 281.532815][ T9090] Call Trace: [ 281.532820][ T9090] [ 281.532826][ T9090] dump_stack_lvl+0x16c/0x1f0 [ 281.532860][ T9090] should_fail_ex+0x512/0x640 [ 281.532882][ T9090] ? fs_reclaim_acquire+0xae/0x150 [ 281.532903][ T9090] ? tomoyo_encode2+0x100/0x3e0 [ 281.532917][ T9090] should_failslab+0xc2/0x120 [ 281.532932][ T9090] __kmalloc_noprof+0xd2/0x510 [ 281.532954][ T9090] ? d_absolute_path+0x136/0x1a0 [ 281.532976][ T9090] tomoyo_encode2+0x100/0x3e0 [ 281.532993][ T9090] tomoyo_encode+0x29/0x50 [ 281.533006][ T9090] tomoyo_realpath_from_path+0x18f/0x6e0 [ 281.533027][ T9090] tomoyo_path_number_perm+0x245/0x580 [ 281.533046][ T9090] ? tomoyo_path_number_perm+0x237/0x580 [ 281.533068][ T9090] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 281.533089][ T9090] ? find_held_lock+0x2b/0x80 [ 281.533129][ T9090] ? find_held_lock+0x2b/0x80 [ 281.533146][ T9090] ? hook_file_ioctl_common+0x145/0x410 [ 281.533168][ T9090] ? __fget_files+0x20e/0x3c0 [ 281.533185][ T9090] security_file_ioctl+0x9b/0x240 [ 281.533210][ T9090] __x64_sys_ioctl+0xb7/0x210 [ 281.533231][ T9090] do_syscall_64+0xcd/0x4c0 [ 281.533246][ T9090] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 281.533261][ T9090] RIP: 0033:0x7f7a8118e929 [ 281.533274][ T9090] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 281.533288][ T9090] RSP: 002b:00007f7a81fcd038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 281.533304][ T9090] RAX: ffffffffffffffda RBX: 00007f7a813b5fa0 RCX: 00007f7a8118e929 [ 281.533314][ T9090] RDX: 0000200000000180 RSI: 00000000c0306201 RDI: 0000000000000003 [ 281.533323][ T9090] RBP: 00007f7a81fcd090 R08: 0000000000000000 R09: 0000000000000000 [ 281.533332][ T9090] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 281.533341][ T9090] R13: 0000000000000000 R14: 00007f7a813b5fa0 R15: 00007fff233e1e58 [ 281.533361][ T9090] [ 281.533376][ T9090] ERROR: Out of memory at tomoyo_realpath_from_path. [ 282.123131][ T9098] netlink: 16 bytes leftover after parsing attributes in process `syz.0.934'. [ 282.581588][ T9106] netlink: 8 bytes leftover after parsing attributes in process `syz.1.935'. [ 284.183637][ T9116] lo speed is unknown, defaulting to 1000 [ 284.299136][ T9135] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(8) [ 284.305679][ T9135] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 284.323990][ T5841] usb 5-1: new high-speed USB device number 31 using dummy_hcd [ 284.331863][ T9135] vhci_hcd vhci_hcd.0: Device attached [ 284.345621][ T9135] xt_addrtype: ipv6 PROHIBIT (THROW, NAT ..) matching not supported [ 284.394983][ T9141] fuse: Bad value for 'fd' [ 284.736317][ T9145] netlink: 8 bytes leftover after parsing attributes in process `syz.1.939'. [ 284.752151][ T9145] input: syz0 as /devices/virtual/input/input25 [ 284.771905][ T5841] usb 5-1: Using ep0 maxpacket: 32 [ 284.803282][ T5841] usb 5-1: config 8 has an invalid interface number: 1 but max is 0 [ 284.812369][ T5841] usb 5-1: config 8 contains an unexpected descriptor of type 0x1, skipping [ 284.834132][ T9] usb 39-1: new low-speed USB device number 3 using vhci_hcd [ 284.884655][ T5841] usb 5-1: config 8 has no interface number 0 [ 284.890795][ T5841] usb 5-1: config 8 interface 1 has no altsetting 0 [ 284.975254][ T5841] usb 5-1: New USB device found, idVendor=0733, idProduct=0430, bcdDevice=57.26 [ 284.984421][ T5841] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 285.039938][ T5905] usb 4-1: new high-speed USB device number 32 using dummy_hcd [ 285.051644][ T5841] usb 5-1: Product: syz [ 285.060421][ T5841] usb 5-1: Manufacturer: ь [ 285.072219][ T5841] usb 5-1: SerialNumber: syz [ 285.286260][ T5905] usb 4-1: device descriptor read/64, error -71 [ 285.684078][ T5905] usb 4-1: new high-speed USB device number 33 using dummy_hcd [ 285.709547][ T5841] gspca_main: spca505-2.14.0 probing 0733:0430 [ 285.720598][ T5841] gspca_spca505: reg write: error -71 [ 285.726231][ T5841] spca505 5-1:8.1: probe with driver spca505 failed with error -5 [ 285.782745][ T5841] usb 5-1: USB disconnect, device number 31 [ 285.799839][ T9155] netlink: 'syz.1.949': attribute type 1 has an invalid length. [ 285.816753][ T5905] usb 4-1: device descriptor read/64, error -71 [ 285.888146][ T9155] 8021q: adding VLAN 0 to HW filter on device bond2 [ 285.904082][ T9160] bond2: (slave geneve2): making interface the new active one [ 285.933997][ T5905] usb usb4-port1: attempt power cycle [ 285.938993][ T9160] bond2: (slave geneve2): Enslaving as an active interface with an up link [ 286.052341][ T9164] netlink: 8 bytes leftover after parsing attributes in process `syz.0.951'. [ 286.217326][ T9155] bond2: entered promiscuous mode [ 286.248460][ T9155] geneve2: entered promiscuous mode [ 286.324025][ T5905] usb 4-1: new high-speed USB device number 34 using dummy_hcd [ 286.375481][ T5905] usb 4-1: device descriptor read/8, error -71 [ 287.147500][ T5905] usb 4-1: new high-speed USB device number 35 using dummy_hcd [ 287.485007][ T5905] usb 4-1: device descriptor read/8, error -71 [ 287.518165][ T9136] vhci_hcd: connection reset by peer [ 287.607649][ T5905] usb usb4-port1: unable to enumerate USB device [ 287.624291][ T189] vhci_hcd: stop threads [ 287.645211][ T189] vhci_hcd: release socket [ 287.661648][ T189] vhci_hcd: disconnect device [ 287.730422][ T9174] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 287.801138][ T9186] fuse: Bad value for 'fd' [ 287.963546][ T9165] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 288.006015][ T5841] usb 2-1: new high-speed USB device number 47 using dummy_hcd [ 288.074077][ T5905] usb 4-1: new high-speed USB device number 36 using dummy_hcd [ 288.164092][ T5841] usb 2-1: Using ep0 maxpacket: 8 [ 288.181568][ T5841] usb 2-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 288.191221][ T5841] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 288.199429][ T5841] usb 2-1: Product: syz [ 288.206731][ T5841] usb 2-1: Manufacturer: syz [ 288.210727][ T9196] usb usb8: usbfs: process 9196 (syz.4.961) did not claim interface 0 before use [ 288.211333][ T5841] usb 2-1: SerialNumber: syz [ 288.240513][ T5841] usb 2-1: config 0 descriptor?? [ 288.256847][ T5905] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 288.268683][ T5905] usb 4-1: New USB device found, idVendor=04fc, idProduct=504a, bcdDevice=43.02 [ 288.280667][ T5905] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 288.289114][ T5905] usb 4-1: Product: syz [ 288.293308][ T5905] usb 4-1: Manufacturer: syz [ 288.301421][ T9196] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 288.315560][ T5905] usb 4-1: SerialNumber: syz [ 288.334667][ T5905] usb 4-1: config 0 descriptor?? [ 288.556885][ T9191] CIFS: VFS: Malformed UNC in devname [ 288.562867][ T5841] usb 2-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 288.784500][ T9204] netlink: 8 bytes leftover after parsing attributes in process `syz.4.963'. [ 289.138119][ T30] audit: type=1400 audit(1752792934.403:445): avc: denied { read } for pid=9208 comm="syz.0.965" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 289.344948][ T1204] usb 5-1: new full-speed USB device number 32 using dummy_hcd [ 289.358866][ T9214] binder: BINDER_SET_CONTEXT_MGR already set [ 289.365249][ T9214] binder: 9213:9214 ioctl 4018620d 200000000040 returned -16 [ 289.383099][ T9214] binder: 9213:9214 ioctl c0306201 200000001a80 returned -11 [ 289.433659][ T30] audit: type=1400 audit(1752792934.693:446): avc: denied { accept } for pid=9216 comm="syz.0.967" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 289.555503][ T1204] usb 5-1: config 0 has an invalid interface number: 128 but max is 0 [ 289.563846][ T1204] usb 5-1: config 0 has no interface number 0 [ 290.074403][ T9] vhci_hcd: vhci_device speed not set [ 290.209826][ T5841] dvb_usb_rtl28xxu 2-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 290.389218][ T1204] usb 5-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 290.399174][ T1204] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 290.433857][ T5841] usb 2-1: USB disconnect, device number 47 [ 290.443829][ T1204] usb 5-1: Product: syz [ 290.450298][ T1204] usb 5-1: Manufacturer: syz [ 290.456458][ T1204] usb 5-1: SerialNumber: syz [ 290.473224][ T1204] usb 5-1: config 0 descriptor?? [ 290.718660][ T9227] netlink: 8 bytes leftover after parsing attributes in process `'. [ 290.859740][ T30] audit: type=1400 audit(1752792936.123:447): avc: denied { recv } for pid=0 comm="swapper/1" saddr=10.128.0.169 src=30006 daddr=10.128.0.56 dest=42340 netif=eth0 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=peer permissive=1 [ 291.078759][ T9233] netlink: 12 bytes leftover after parsing attributes in process `syz.1.970'. [ 291.131770][ T9233] netlink: 36 bytes leftover after parsing attributes in process `syz.1.970'. [ 291.258892][ T1204] usb 5-1: Firmware: major: 225, minor: 107, hardware type: RZUSB (3) [ 291.313136][ T9232] fuse: Bad value for 'fd' [ 291.402696][ T1204] usb 5-1: Read permanent extended address d0:27:37:e7:2a:25:f2:8c from device [ 291.473714][ T5905] usb 4-1: USB disconnect, device number 36 [ 291.598439][ T9] IPVS: starting estimator thread 0... [ 291.619815][ T9248] IPVS: lblc: UDP 224.0.0.2:0 - no destination available [ 291.640561][ T1204] usb 5-1: USB disconnect, device number 32 [ 291.764481][ T9251] IPVS: using max 53 ests per chain, 127200 per kthread [ 291.864113][ T9] usb 3-1: new full-speed USB device number 31 using dummy_hcd [ 292.175574][ T9] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 292.185964][ T9] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 292.216332][ T9] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.00 [ 292.235256][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 292.253731][ T9] usb 3-1: SerialNumber: syz [ 292.267035][ T9] usb 3-1: 0:2 : does not exist [ 292.283078][ T30] audit: type=1400 audit(1752792937.543:448): avc: denied { ioctl } for pid=9252 comm="syz.0.976" path="socket:[22270]" dev="sockfs" ino=22270 ioctlcmd=0x890c scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ax25_socket permissive=1 [ 292.822361][ T9271] erofs (device nbd2): cannot find valid erofs superblock [ 293.254041][ T1204] usb 5-1: new full-speed USB device number 33 using dummy_hcd [ 293.406299][ T1204] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 293.422454][ T1204] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 293.449184][ T1204] usb 5-1: New USB device found, idVendor=0419, idProduct=0001, bcdDevice= 0.00 [ 293.465889][ T1204] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 293.478459][ T1204] usb 5-1: config 0 descriptor?? [ 293.766310][ T9278] syz.1.983: attempt to access beyond end of device [ 293.766310][ T9278] nbd1: rw=0, sector=0, nr_sectors = 1 limit=0 [ 293.993768][ T1204] samsung 0003:0419:0001.000C: hidraw0: USB HID v0.00 Device [HID 0419:0001] on usb-dummy_hcd.4-1/input0 [ 295.425240][ T9] usb 3-1: USB disconnect, device number 31 [ 295.895892][ T9296] syz.1.988: attempt to access beyond end of device [ 295.895892][ T9296] nbd1: rw=0, sector=0, nr_sectors = 1 limit=0 [ 296.386692][ T9306] netlink: 16 bytes leftover after parsing attributes in process `syz.0.990'. [ 296.509624][ T6078] usb 5-1: USB disconnect, device number 33 [ 296.588340][ T30] audit: type=1400 audit(1752792941.853:449): avc: denied { accept } for pid=9312 comm="syz.1.996" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 296.607825][ C0] vkms_vblank_simulate: vblank timer overrun [ 296.699025][ T9314] netlink: 104 bytes leftover after parsing attributes in process `syz.1.996'. [ 296.712323][ T5841] usb 3-1: new high-speed USB device number 32 using dummy_hcd [ 297.015624][ T5841] usb 3-1: Using ep0 maxpacket: 16 [ 297.029364][ T5841] usb 3-1: config 0 has an invalid descriptor of length 255, skipping remainder of the config [ 297.102732][ T5841] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 297.192925][ T9319] netlink: 12 bytes leftover after parsing attributes in process `syz.3.997'. [ 297.235824][ T9319] netlink: 36 bytes leftover after parsing attributes in process `syz.3.997'. [ 297.419607][ T5841] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x2 has an invalid bInterval 255, changing to 11 [ 297.461200][ T5841] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid maxpacket 59391, setting to 1024 [ 297.493485][ T5841] usb 3-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 297.654219][ T5841] usb 3-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 297.689248][ T5841] usb 3-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 297.723765][ T5841] usb 3-1: Manufacturer: syz [ 297.738023][ T5841] usb 3-1: config 0 descriptor?? [ 298.354191][ T5841] rc_core: IR keymap rc-hauppauge not found [ 298.362823][ T5841] Registered IR keymap rc-empty [ 298.381227][ T5841] mceusb 3-1:0.0: Error: mce write urb status = -71 [ 298.455428][ T5841] mceusb 3-1:0.0: Error: mce write urb status = -71 [ 298.486678][ T5841] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0 [ 298.494082][ T30] audit: type=1400 audit(1752792943.753:450): avc: denied { bind } for pid=9341 comm="syz.1.1003" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 298.500581][ T5841] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0/input27 [ 298.656367][ T5841] mceusb 3-1:0.0: Error: mce write urb status = -71 [ 298.686248][ T5841] mceusb 3-1:0.0: Error: mce write urb status = -71 [ 298.705980][ T5841] mceusb 3-1:0.0: Error: mce write urb status = -71 [ 298.755090][ T5841] mceusb 3-1:0.0: Error: mce write urb status = -71 [ 298.886577][ T5841] mceusb 3-1:0.0: Error: mce write urb status = -71 [ 299.175100][ T5841] mceusb 3-1:0.0: Error: mce write urb status = -71 [ 299.284311][ T5841] mceusb 3-1:0.0: Error: mce write urb status = -71 [ 299.304243][ T5841] mceusb 3-1:0.0: Error: mce write urb status = -71 [ 299.311473][ T9342] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1003'. [ 299.324281][ T5841] mceusb 3-1:0.0: Error: mce write urb status = -71 [ 299.364347][ T5841] mceusb 3-1:0.0: Error: mce write urb status = -71 [ 299.407923][ T5841] mceusb 3-1:0.0: Registered with mce emulator interface version 1 [ 299.537266][ T5841] mceusb 3-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 300.086857][ T5841] usb 3-1: USB disconnect, device number 32 [ 300.613981][ T9376] syz.2.1011: attempt to access beyond end of device [ 300.613981][ T9376] nbd2: rw=0, sector=0, nr_sectors = 1 limit=0 [ 301.134467][ T9380] ptm ptm0: ldisc open failed (-12), clearing slot 0 [ 301.864076][ T30] audit: type=1400 audit(1752792946.343:451): avc: denied { shutdown } for pid=9377 comm="syz.3.1012" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 302.055801][ T30] audit: type=1400 audit(1752792946.343:452): avc: denied { read } for pid=9377 comm="syz.3.1012" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 302.575609][ T9386] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1014'. [ 303.790338][ T5927] usb 2-1: new high-speed USB device number 48 using dummy_hcd [ 303.808447][ T30] audit: type=1326 audit(1752792949.073:453): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9391 comm="syz.4.1017" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f21fdf8e929 code=0x0 [ 304.469811][ T5927] usb 2-1: Using ep0 maxpacket: 8 [ 304.689025][ T5927] usb 2-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 304.788764][ T5927] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 304.804422][ T5927] usb 2-1: Product: syz [ 304.808666][ T5927] usb 2-1: Manufacturer: syz [ 304.813242][ T5927] usb 2-1: SerialNumber: syz [ 304.850832][ T5927] usb 2-1: config 0 descriptor?? [ 305.091604][ T9418] syz.2.1024: attempt to access beyond end of device [ 305.091604][ T9418] nbd2: rw=0, sector=0, nr_sectors = 1 limit=0 [ 305.384455][ T9397] CIFS: VFS: Malformed UNC in devname [ 305.436776][ T5927] usb 2-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 306.682878][ T9431] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1029'. [ 306.753163][ T9430] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 307.373162][ T5927] dvb_usb_rtl28xxu 2-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 307.386226][ T5927] usb 2-1: USB disconnect, device number 48 [ 308.925657][ T9450] binder: BINDER_SET_CONTEXT_MGR already set [ 308.931765][ T9450] binder: 9449:9450 ioctl 4018620d 200000000040 returned -16 [ 310.340142][ T9482] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1042'. [ 310.924458][ T9497] syz.2.1049: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 310.978281][ T30] audit: type=1400 audit(1752792956.243:454): avc: denied { ioctl } for pid=9495 comm="syz.2.1049" path="socket:[23376]" dev="sockfs" ino=23376 ioctlcmd=0x8914 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 311.016497][ T9497] CPU: 0 UID: 0 PID: 9497 Comm: syz.2.1049 Not tainted 6.16.0-rc6-syzkaller-00037-ge2291551827f #0 PREEMPT(full) [ 311.016525][ T9497] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 311.016536][ T9497] Call Trace: [ 311.016543][ T9497] [ 311.016552][ T9497] dump_stack_lvl+0x16c/0x1f0 [ 311.016584][ T9497] warn_alloc+0x248/0x3a0 [ 311.016603][ T9497] ? __pfx_warn_alloc+0x10/0x10 [ 311.016618][ T9497] ? __pfx_stack_trace_save+0x10/0x10 [ 311.016633][ T9497] ? stack_depot_save_flags+0x28/0xa40 [ 311.016654][ T9497] ? kasan_save_stack+0x42/0x60 [ 311.016669][ T9497] ? kasan_save_stack+0x33/0x60 [ 311.016685][ T9497] ? kasan_save_track+0x14/0x30 [ 311.016703][ T9497] ? xskq_create+0x52/0x1d0 [ 311.016717][ T9497] ? xsk_setsockopt+0x640/0x840 [ 311.016729][ T9497] ? do_sock_setsockopt+0xf3/0x1d0 [ 311.016742][ T9497] ? xskq_create+0xfb/0x1d0 [ 311.016757][ T9497] __vmalloc_node_range_noprof+0xff5/0x14b0 [ 311.016777][ T9497] ? xskq_create+0xfb/0x1d0 [ 311.016794][ T9497] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 311.016814][ T9497] ? xskq_create+0xfb/0x1d0 [ 311.016828][ T9497] vmalloc_user_noprof+0x9e/0xe0 [ 311.016841][ T9497] ? xskq_create+0xfb/0x1d0 [ 311.016856][ T9497] xskq_create+0xfb/0x1d0 [ 311.016871][ T9497] xsk_setsockopt+0x640/0x840 [ 311.016888][ T9497] ? __pfx_xsk_setsockopt+0x10/0x10 [ 311.016901][ T9497] ? find_held_lock+0x2b/0x80 [ 311.016921][ T9497] ? selinux_socket_setsockopt+0x6a/0x80 [ 311.016937][ T9497] ? __pfx_xsk_setsockopt+0x10/0x10 [ 311.016956][ T9497] do_sock_setsockopt+0xf3/0x1d0 [ 311.016972][ T9497] __sys_setsockopt+0x1a0/0x230 [ 311.016991][ T9497] __x64_sys_setsockopt+0xbd/0x160 [ 311.017007][ T9497] ? do_syscall_64+0x91/0x4c0 [ 311.017017][ T9497] ? lockdep_hardirqs_on+0x7c/0x110 [ 311.017036][ T9497] do_syscall_64+0xcd/0x4c0 [ 311.017047][ T9497] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 311.017058][ T9497] RIP: 0033:0x7f7a8118e929 [ 311.017068][ T9497] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 311.017078][ T9497] RSP: 002b:00007f7a81fcd038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 311.017089][ T9497] RAX: ffffffffffffffda RBX: 00007f7a813b5fa0 RCX: 00007f7a8118e929 [ 311.017096][ T9497] RDX: 0000000000000006 RSI: 000000000000011b RDI: 0000000000000003 [ 311.017102][ T9497] RBP: 00007f7a81210ca1 R08: 0000000000000004 R09: 0000000000000000 [ 311.017108][ T9497] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 311.017114][ T9497] R13: 0000000000000000 R14: 00007f7a813b5fa0 R15: 00007fff233e1e58 [ 311.017127][ T9497] [ 311.545113][ T9497] Mem-Info: [ 311.614198][ T9497] active_anon:30611 inactive_anon:0 isolated_anon:0 [ 311.614198][ T9497] active_file:14411 inactive_file:40685 isolated_file:0 [ 311.614198][ T9497] unevictable:768 dirty:365 writeback:0 [ 311.614198][ T9497] slab_reclaimable:6778 slab_unreclaimable:99357 [ 311.614198][ T9497] mapped:34143 shmem:21336 pagetables:1291 [ 311.614198][ T9497] sec_pagetables:0 bounce:0 [ 311.614198][ T9497] kernel_misc_reclaimable:0 [ 311.614198][ T9497] free:1283403 free_pcp:16781 free_cma:0 [ 311.695118][ T9497] Node 0 active_anon:125576kB inactive_anon:0kB active_file:57592kB inactive_file:162540kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:138396kB dirty:1464kB writeback:0kB shmem:86860kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:12432kB pagetables:5196kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 312.148559][ T9497] Node 1 active_anon:0kB inactive_anon:0kB active_file:52kB inactive_file:200kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:80kB pagetables:148kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 312.225675][ T9497] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 312.267450][ T9497] lowmem_reserve[]: 0 2480 2482 2482 2482 [ 312.274424][ T9497] Node 0 DMA32 free:1236432kB boost:0kB min:34076kB low:42592kB high:51108kB reserved_highatomic:0KB free_highatomic:0KB active_anon:110964kB inactive_anon:0kB active_file:57592kB inactive_file:161224kB unevictable:1536kB writepending:1464kB present:3129332kB managed:2540192kB mlocked:0kB bounce:0kB free_pcp:41240kB local_pcp:23092kB free_cma:0kB [ 312.329361][ T9497] lowmem_reserve[]: 0 0 1 1 1 [ 312.439240][ T9497] Node 0 Normal free:20kB boost:0kB min:16kB low:20kB high:24kB reserved_highatomic:0KB free_highatomic:0KB active_anon:12kB inactive_anon:0kB active_file:0kB inactive_file:1316kB unevictable:0kB writepending:0kB present:1048580kB managed:1388kB mlocked:0kB bounce:0kB free_pcp:40kB local_pcp:28kB free_cma:0kB [ 312.524147][ T9516] hub 2-0:1.0: USB hub found [ 312.530244][ T9516] hub 2-0:1.0: 1 port detected [ 313.078940][ T9497] lowmem_reserve[]: 0 0 0 0 0 [ 313.094302][ T9497] Node 1 Normal free:3889152kB boost:0kB min:55804kB low:69752kB high:83700kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:52kB inactive_file:200kB unevictable:1536kB writepending:0kB present:4194300kB managed:4111164kB mlocked:0kB bounce:0kB free_pcp:26496kB local_pcp:12896kB free_cma:0kB [ 313.156584][ T9497] lowmem_reserve[]: 0 0 0 0 0 [ 313.180058][ T9497] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 313.235594][ T9497] Node 0 DMA32: 26*4kB (UME) 178*8kB (UME) 120*16kB (UME) 569*32kB (UME) 206*64kB (UME) 105*128kB (UME) 57*256kB (UME) 34*512kB (UME) 25*1024kB (UME) 4*2048kB (UME) 274*4096kB (UM) = 1236376kB [ 313.377387][ T9497] Node 0 Normal: 1*4kB (M) 2*8kB (M) 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 20kB [ 313.418689][ T9497] Node 1 Normal: 188*4kB (UME) 54*8kB (UME) 42*16kB (UME) 94*32kB (UME) 34*64kB (UME) 7*128kB (UME) 5*256kB (UME) 4*512kB (UME) 1*1024kB (M) 1*2048kB (E) 946*4096kB (UM) = 3889152kB [ 313.514109][ T9497] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 313.531326][ T9497] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 314.096474][ T9497] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 314.138339][ T9497] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 314.190878][ T9497] 66051 total pagecache pages [ 314.218721][ T9497] 0 pages in swap cache [ 314.222310][ T9530] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1058'. [ 314.324957][ T9497] Free swap = 124996kB [ 314.329422][ T9497] Total swap = 124996kB [ 314.333632][ T9497] 2097051 pages RAM [ 314.338207][ T9497] 0 pages HighMem/MovableOnly [ 314.344212][ T9497] 430025 pages reserved [ 314.349378][ T9497] 0 pages cma reserved [ 314.713094][ T30] audit: type=1400 audit(1752792959.973:455): avc: denied { create } for pid=9545 comm="syz.2.1065" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_iscsi_socket permissive=1 [ 314.739869][ T9546] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1065'. [ 315.004829][ T30] audit: type=1400 audit(1752792960.003:456): avc: denied { write } for pid=9545 comm="syz.2.1065" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_iscsi_socket permissive=1 [ 315.210543][ T30] audit: type=1400 audit(1752792960.123:457): avc: denied { connect } for pid=9545 comm="syz.2.1065" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 315.230141][ T30] audit: type=1400 audit(1752792960.293:458): avc: denied { write } for pid=9545 comm="syz.2.1065" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 315.273112][ T9559] IPVS: sync thread started: state = BACKUP, mcast_ifn = wlan0, syncid = 4, id = 0 [ 315.359018][ T9561] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1067'. [ 315.828765][ T9563] lo speed is unknown, defaulting to 1000 [ 315.983564][ T9571] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1068'. [ 315.994896][ T9571] input: syz0 as /devices/virtual/input/input28 [ 316.434101][ T1204] usb 2-1: new high-speed USB device number 49 using dummy_hcd [ 316.493501][ T9579] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1073'. [ 316.770540][ T1204] usb 2-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 316.785302][ T1204] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 316.827835][ T1204] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 316.858066][ T1204] usb 2-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 316.882119][ T1204] usb 2-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 316.897091][ T1204] usb 2-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 316.922474][ T1204] usb 2-1: Product: syz [ 316.984526][ T1296] ieee802154 phy0 wpan0: encryption failed: -22 [ 316.991083][ T1296] ieee802154 phy1 wpan1: encryption failed: -22 [ 317.077177][ T1204] usb 2-1: Manufacturer: syz [ 317.088020][ T1204] cdc_wdm 2-1:1.0: skipping garbage [ 317.093275][ T1204] cdc_wdm 2-1:1.0: skipping garbage [ 317.098546][ T1204] cdc_wdm 2-1:1.0: skipping garbage [ 317.103899][ T1204] cdc_wdm 2-1:1.0: probe with driver cdc_wdm failed with error -22 [ 317.107321][ T6078] usb 5-1: new high-speed USB device number 34 using dummy_hcd [ 317.691913][ T5905] usb 2-1: USB disconnect, device number 49 [ 317.706203][ T6078] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 317.719264][ T6078] usb 5-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 317.738873][ T6078] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 317.764751][ T6078] usb 5-1: config 0 descriptor?? [ 317.779822][ T6078] pwc: Askey VC010 type 2 USB webcam detected. [ 319.076648][ T6078] pwc: recv_control_msg error -32 req 02 val 2b00 [ 319.097276][ T6078] pwc: recv_control_msg error -32 req 02 val 2700 [ 319.139655][ T6078] pwc: recv_control_msg error -32 req 02 val 2c00 [ 319.272175][ T6078] pwc: recv_control_msg error -32 req 04 val 1000 [ 319.299214][ T6078] pwc: recv_control_msg error -32 req 04 val 1300 [ 319.312230][ T9603] FAULT_INJECTION: forcing a failure. [ 319.312230][ T9603] name failslab, interval 1, probability 0, space 0, times 0 [ 319.342610][ T6078] pwc: recv_control_msg error -32 req 04 val 1400 [ 319.369796][ T9603] CPU: 1 UID: 0 PID: 9603 Comm: syz.2.1081 Not tainted 6.16.0-rc6-syzkaller-00037-ge2291551827f #0 PREEMPT(full) [ 319.369827][ T9603] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 319.369838][ T9603] Call Trace: [ 319.369844][ T9603] [ 319.369851][ T9603] dump_stack_lvl+0x16c/0x1f0 [ 319.369884][ T9603] should_fail_ex+0x512/0x640 [ 319.369915][ T9603] ? kmem_cache_alloc_node_noprof+0x5e/0x3b0 [ 319.369945][ T9603] should_failslab+0xc2/0x120 [ 319.369963][ T9603] kmem_cache_alloc_node_noprof+0x71/0x3b0 [ 319.369989][ T9603] ? __alloc_skb+0x2b2/0x380 [ 319.370018][ T9603] __alloc_skb+0x2b2/0x380 [ 319.370041][ T9603] ? __pfx___alloc_skb+0x10/0x10 [ 319.370068][ T9603] ? __pfx_netlink_autobind.isra.0+0x10/0x10 [ 319.370091][ T9603] netlink_alloc_large_skb+0x69/0x130 [ 319.370110][ T9603] netlink_sendmsg+0x6a1/0xdd0 [ 319.370132][ T9603] ? __pfx_netlink_sendmsg+0x10/0x10 [ 319.370159][ T9603] ____sys_sendmsg+0xa95/0xc70 [ 319.370180][ T9603] ? copy_msghdr_from_user+0x10a/0x160 [ 319.370207][ T9603] ? __pfx_____sys_sendmsg+0x10/0x10 [ 319.370239][ T9603] ___sys_sendmsg+0x134/0x1d0 [ 319.370266][ T9603] ? __pfx____sys_sendmsg+0x10/0x10 [ 319.370290][ T9603] ? __lock_acquire+0x622/0x1c90 [ 319.370338][ T9603] __sys_sendmsg+0x16d/0x220 [ 319.370366][ T9603] ? __pfx___sys_sendmsg+0x10/0x10 [ 319.370409][ T9603] do_syscall_64+0xcd/0x4c0 [ 319.370427][ T9603] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 319.370444][ T9603] RIP: 0033:0x7f7a8118e929 [ 319.370458][ T9603] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 319.370475][ T9603] RSP: 002b:00007f7a81fcd038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 319.370493][ T9603] RAX: ffffffffffffffda RBX: 00007f7a813b5fa0 RCX: 00007f7a8118e929 [ 319.370515][ T9603] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 0000000000000003 [ 319.370525][ T9603] RBP: 00007f7a81fcd090 R08: 0000000000000000 R09: 0000000000000000 [ 319.370536][ T9603] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 319.370545][ T9603] R13: 0000000000000000 R14: 00007f7a813b5fa0 R15: 00007fff233e1e58 [ 319.370572][ T9603] [ 319.588099][ C1] vkms_vblank_simulate: vblank timer overrun [ 319.702462][ T9609] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 319.711419][ T9609] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 320.350875][ T9620] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1086'. [ 320.462371][ T9617] lo speed is unknown, defaulting to 1000 [ 320.934778][ T6078] pwc: recv_control_msg error -71 req 02 val 2100 [ 320.960150][ T6078] pwc: recv_control_msg error -71 req 04 val 1500 [ 321.176791][ T9628] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1084'. [ 321.196470][ T6078] pwc: recv_control_msg error -71 req 02 val 2500 [ 321.223372][ T6078] pwc: recv_control_msg error -71 req 02 val 2400 [ 321.231436][ T9630] block nbd4: not configured, cannot reconfigure [ 321.294511][ T6078] pwc: recv_control_msg error -71 req 02 val 2600 [ 321.326601][ T9617] input: syz0 as /devices/virtual/input/input30 [ 321.334395][ T6078] pwc: recv_control_msg error -71 req 02 val 2900 [ 321.343902][ T6078] pwc: recv_control_msg error -71 req 02 val 2800 [ 321.354010][ T6078] pwc: recv_control_msg error -71 req 04 val 1100 [ 321.374285][ T6078] pwc: recv_control_msg error -71 req 04 val 1200 [ 321.392433][ T6078] pwc: Registered as video103. [ 321.404892][ T6078] input: PWC snapshot button as /devices/platform/dummy_hcd.4/usb5/5-1/input/input31 [ 321.473675][ T6078] usb 5-1: USB disconnect, device number 34 [ 322.517421][ T9648] binder: BINDER_SET_CONTEXT_MGR already set [ 322.544066][ T9648] binder: 9646:9648 ioctl 4018620d 200000000040 returned -16 [ 322.630918][ T9651] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1093'. [ 322.874621][ T9648] binder: 9646:9648 ioctl c0306201 200000001a80 returned -11 [ 323.181346][ T9657] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1094'. [ 323.263618][ T9657] netlink: 36 bytes leftover after parsing attributes in process `syz.4.1094'. [ 323.552091][ T9665] Cannot find del_set index 4 as target [ 323.561801][ T30] audit: type=1400 audit(1752792968.803:459): avc: denied { execute_no_trans } for pid=9658 comm="syz.1.1097" path="/212/file0" dev="tmpfs" ino=1134 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 323.585170][ C0] vkms_vblank_simulate: vblank timer overrun [ 323.745213][ T9670] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1098'. [ 323.915589][ T9669] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1099'. [ 323.947638][ T9667] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 323.986194][ T30] audit: type=1804 audit(1752792969.253:460): pid=9672 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz.2.1100" name="/newroot/236/file0" dev="tmpfs" ino=1276 res=1 errno=0 [ 324.010827][ T9672] ref_ctr going negative. vaddr: 0x200000ffc002, curr val: -29824, delta: 1 [ 324.027312][ T9672] ref_ctr increment failed for inode: 0x4fc offset: 0x7 ref_ctr_offset: 0x2 of mm: 0xffff88807d199400 [ 324.249315][ T9679] Option ' ' to dns_resolver key: bad/missing value [ 324.475830][ T9672] ceph: No mds server is up or the cluster is laggy [ 326.168332][ T9712] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1111'. [ 326.484598][ T9713] No buffer was provided with the request [ 326.875547][ T9729] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1118'. [ 327.994068][ T5831] usb 4-1: new high-speed USB device number 37 using dummy_hcd [ 328.144208][ T5831] usb 4-1: device descriptor read/64, error -71 [ 328.384138][ T5831] usb 4-1: new high-speed USB device number 38 using dummy_hcd [ 328.514054][ T5831] usb 4-1: device descriptor read/64, error -71 [ 328.626296][ T5831] usb usb4-port1: attempt power cycle [ 328.628865][ T9751] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1126'. [ 329.678870][ T5831] usb 4-1: new high-speed USB device number 39 using dummy_hcd [ 329.723084][ T5831] usb 4-1: device descriptor read/8, error -71 [ 329.786031][ T9767] FAULT_INJECTION: forcing a failure. [ 329.786031][ T9767] name failslab, interval 1, probability 0, space 0, times 0 [ 329.807496][ T9767] CPU: 0 UID: 0 PID: 9767 Comm: syz.0.1131 Not tainted 6.16.0-rc6-syzkaller-00037-ge2291551827f #0 PREEMPT(full) [ 329.807523][ T9767] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 329.807533][ T9767] Call Trace: [ 329.807539][ T9767] [ 329.807546][ T9767] dump_stack_lvl+0x16c/0x1f0 [ 329.807579][ T9767] should_fail_ex+0x512/0x640 [ 329.807617][ T9767] should_failslab+0xc2/0x120 [ 329.807636][ T9767] kmem_cache_alloc_noprof+0x6d/0x3b0 [ 329.807663][ T9767] ? skb_clone+0x190/0x3f0 [ 329.807685][ T9767] skb_clone+0x190/0x3f0 [ 329.807701][ T9767] netlink_deliver_tap+0xabd/0xd30 [ 329.807727][ T9767] netlink_unicast+0x62f/0x850 [ 329.807750][ T9767] ? __pfx_netlink_unicast+0x10/0x10 [ 329.807777][ T9767] netlink_sendmsg+0x8d1/0xdd0 [ 329.807801][ T9767] ? __pfx_netlink_sendmsg+0x10/0x10 [ 329.807830][ T9767] ____sys_sendmsg+0xa95/0xc70 [ 329.807851][ T9767] ? copy_msghdr_from_user+0x10a/0x160 [ 329.807877][ T9767] ? __pfx_____sys_sendmsg+0x10/0x10 [ 329.807910][ T9767] ___sys_sendmsg+0x134/0x1d0 [ 329.807938][ T9767] ? __pfx____sys_sendmsg+0x10/0x10 [ 329.807963][ T9767] ? __lock_acquire+0x622/0x1c90 [ 329.808010][ T9767] __sys_sendmsg+0x16d/0x220 [ 329.808038][ T9767] ? __pfx___sys_sendmsg+0x10/0x10 [ 329.808078][ T9767] do_syscall_64+0xcd/0x4c0 [ 329.808096][ T9767] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 329.808113][ T9767] RIP: 0033:0x7fc859f8e929 [ 329.808127][ T9767] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 329.808144][ T9767] RSP: 002b:00007fc85ad65038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 329.808161][ T9767] RAX: ffffffffffffffda RBX: 00007fc85a1b5fa0 RCX: 00007fc859f8e929 [ 329.808172][ T9767] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 0000000000000003 [ 329.808182][ T9767] RBP: 00007fc85ad65090 R08: 0000000000000000 R09: 0000000000000000 [ 329.808191][ T9767] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 329.808201][ T9767] R13: 0000000000000000 R14: 00007fc85a1b5fa0 R15: 00007ffc9f6ece88 [ 329.808224][ T9767] [ 331.425330][ T9786] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1138'. [ 331.919451][ T30] audit: type=1400 audit(1752792977.183:461): avc: denied { getopt } for pid=9799 comm="syz.4.1143" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 332.011472][ T9808] binder: BINDER_SET_CONTEXT_MGR already set [ 332.026461][ T9808] binder: 9807:9808 ioctl 4018620d 200000000040 returned -16 [ 332.489472][ T9808] binder: 9807:9808 ioctl c0306201 200000001a80 returned -11 [ 332.519849][ T30] audit: type=1400 audit(1752792977.783:462): avc: denied { module_request } for pid=9811 comm="syz.4.1149" kmod="rtnl-link-bridge_slave" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 332.543479][ T5831] usb 4-1: new high-speed USB device number 41 using dummy_hcd [ 332.606604][ T9813] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1149'. [ 333.176641][ T5831] usb 4-1: Using ep0 maxpacket: 16 [ 333.278303][ T5831] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 333.382264][ T5831] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 333.486794][ T5831] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 333.555109][ T5831] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 333.596776][ T5831] usb 4-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 333.621342][ T5831] usb 4-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 333.632033][ T5831] usb 4-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 333.680495][ T5831] usb 4-1: Manufacturer: syz [ 333.701058][ T5831] usb 4-1: config 0 descriptor?? [ 333.764029][ T5947] usb 5-1: new full-speed USB device number 35 using dummy_hcd [ 333.776400][ T9841] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1158'. [ 333.925760][ T5947] usb 5-1: config 0 has an invalid interface number: 151 but max is 0 [ 333.944103][ T5927] usb 2-1: new high-speed USB device number 50 using dummy_hcd [ 333.961844][ T5947] usb 5-1: config 0 has no interface number 0 [ 333.981922][ T5947] usb 5-1: config 0 interface 151 altsetting 0 endpoint 0x85 has invalid maxpacket 24840, setting to 64 [ 334.009940][ T5947] usb 5-1: New USB device found, idVendor=0499, idProduct=6bab, bcdDevice=68.2f [ 334.019242][ T5947] usb 5-1: New USB device strings: Mfr=20, Product=2, SerialNumber=3 [ 334.027601][ T5947] usb 5-1: Product: syz [ 334.032922][ T5947] usb 5-1: Manufacturer: syz [ 334.045768][ T5947] usb 5-1: SerialNumber: syz [ 334.073001][ T5947] usb 5-1: config 0 descriptor?? [ 334.084299][ T9828] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 334.175497][ T5831] rc_core: IR keymap rc-hauppauge not found [ 334.182298][ T5831] Registered IR keymap rc-empty [ 334.194039][ T5927] usb 2-1: Using ep0 maxpacket: 32 [ 334.212777][ T5831] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 334.221074][ T5927] usb 2-1: config 0 has an invalid descriptor of length 244, skipping remainder of the config [ 334.231501][ T5927] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 334.241054][ T5831] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 334.252769][ T5927] usb 2-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e [ 334.794308][ T30] audit: type=1400 audit(1752792979.673:463): avc: denied { write } for pid=9845 comm="syz.2.1160" lport=43817 faddr=::ffff:100.1.1.0 fport=20003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=sctp_socket permissive=1 [ 334.830757][ T5831] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0 [ 334.842794][ T5927] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 334.851192][ T5927] usb 2-1: Product: syz [ 334.863252][ T5927] usb 2-1: Manufacturer: syz [ 334.869978][ T5831] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0/input32 [ 334.882233][ T5927] usb 2-1: SerialNumber: syz [ 334.903663][ T5927] usb 2-1: config 0 descriptor?? [ 334.996832][ T5831] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 335.027192][ T5831] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 335.054043][ T5831] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 335.070656][ T30] audit: type=1400 audit(1752792980.323:464): avc: denied { execute } for pid=9851 comm="syz.2.1161" path="/dev/nullb0" dev="devtmpfs" ino=696 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 335.104286][ T5831] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 335.175968][ T5831] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 335.199302][ T5831] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 335.234419][ T5831] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 335.332751][ T5831] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 335.350638][ T5927] usb 2-1: USB disconnect, device number 50 [ 335.387125][ T5831] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 335.418776][ T5831] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 335.452612][ T5947] usb 5-1: USB disconnect, device number 35 [ 335.471422][ T5831] mceusb 4-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 335.494905][ T5834] udevd[5834]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.151/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 335.529031][ T5831] mceusb 4-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 335.575231][ T5831] usb 4-1: USB disconnect, device number 41 [ 336.693339][ T9874] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1168'. [ 337.659388][ T9889] binder_alloc: 9882: binder_alloc_buf, no vma [ 337.668808][ T30] audit: type=1400 audit(1752792982.923:465): avc: denied { ioctl } for pid=9886 comm="syz.1.1176" path="socket:[25171]" dev="sockfs" ino=25171 ioctlcmd=0x9420 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 337.974199][ T5905] usb 2-1: new full-speed USB device number 51 using dummy_hcd [ 337.982624][ T1204] usb 3-1: new high-speed USB device number 33 using dummy_hcd [ 338.065129][ T9900] random: crng reseeded on system resumption [ 339.076046][ T5905] usb 2-1: unable to get BOS descriptor or descriptor too short [ 339.084314][ T5905] usb 2-1: not running at top speed; connect to a high speed hub [ 339.095691][ T5905] usb 2-1: config 1 has an invalid descriptor of length 103, skipping remainder of the config [ 339.120035][ T5905] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 147, changing to 4 [ 339.131356][ T5905] usb 2-1: too many endpoints for config 1 interface 2 altsetting 112: 105, using maximum allowed: 30 [ 339.142432][ T1204] usb 3-1: Using ep0 maxpacket: 32 [ 339.149658][ T5905] usb 2-1: config 1 interface 2 altsetting 112 has 0 endpoint descriptors, different from the interface descriptor's value: 105 [ 339.163413][ T1204] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 339.238857][ T5905] usb 2-1: config 1 interface 1 has no altsetting 0 [ 339.254035][ T1204] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 339.263878][ T5905] usb 2-1: config 1 interface 2 has no altsetting 0 [ 339.273398][ T1204] usb 3-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 339.296171][ T1204] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 339.306993][ T5947] usb 1-1: new high-speed USB device number 26 using dummy_hcd [ 339.314593][ T5905] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 339.324543][ T5905] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 339.332644][ T1204] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 339.344070][ T5905] usb 2-1: Product: syz [ 339.348272][ T1204] usb 3-1: Product: syz [ 339.352512][ T5905] usb 2-1: Manufacturer: syz [ 339.357673][ T1204] usb 3-1: Manufacturer: syz [ 339.369736][ T1204] usb 3-1: SerialNumber: syz [ 339.374479][ T5905] usb 2-1: SerialNumber: syz [ 339.391417][ T1204] cdc_ncm 3-1:1.0: skipping garbage [ 339.396264][ T9907] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1181'. [ 339.397185][ T1204] cdc_ncm 3-1:1.0: CDC Union missing and no IAD found [ 339.413184][ T9906] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 339.426658][ T1204] cdc_ncm 3-1:1.0: bind() failure [ 339.464029][ T5927] usb 4-1: new high-speed USB device number 42 using dummy_hcd [ 339.494114][ T5947] usb 1-1: device descriptor read/64, error -71 [ 339.590924][ T5905] usb 2-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 339.598048][ T5905] usb 2-1: selecting invalid altsetting 0 [ 339.631456][ T5927] usb 4-1: device descriptor read/64, error -71 [ 339.647143][ T5905] usb 2-1: USB disconnect, device number 51 [ 339.667901][ T6228] udevd[6228]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 339.754027][ T5947] usb 1-1: new high-speed USB device number 27 using dummy_hcd [ 339.885109][ T5927] usb 4-1: new high-speed USB device number 43 using dummy_hcd [ 339.894271][ T5947] usb 1-1: device descriptor read/64, error -71 [ 340.014404][ T5947] usb usb1-port1: attempt power cycle [ 340.015172][ T5927] usb 4-1: device descriptor read/64, error -71 [ 340.144444][ T5927] usb usb4-port1: attempt power cycle [ 340.364683][ T5947] usb 1-1: new high-speed USB device number 28 using dummy_hcd [ 340.418912][ T5947] usb 1-1: device descriptor read/8, error -71 [ 340.443987][ T3086] usb 5-1: new high-speed USB device number 36 using dummy_hcd [ 340.754488][ T5947] usb 1-1: new high-speed USB device number 29 using dummy_hcd [ 340.763296][ T5831] usb 3-1: USB disconnect, device number 33 [ 340.815793][ T5927] usb 4-1: new high-speed USB device number 44 using dummy_hcd [ 340.854512][ C1] Illegal XDP return value 16128 on prog (id 179) dev bond_slave_0, expect packet loss! [ 340.866015][ T5927] usb 4-1: device descriptor read/8, error -71 [ 340.914137][ T3086] usb 5-1: Using ep0 maxpacket: 32 [ 340.931950][ T3086] usb 5-1: config 8 has an invalid interface number: 1 but max is 0 [ 340.978343][ T3086] usb 5-1: config 8 contains an unexpected descriptor of type 0x1, skipping [ 341.054039][ T3086] usb 5-1: config 8 has no interface number 0 [ 341.550653][ T5927] usb 4-1: new high-speed USB device number 45 using dummy_hcd [ 341.564517][ T3086] usb 5-1: config 8 interface 1 has no altsetting 0 [ 341.567364][ T5947] usb 1-1: device descriptor read/8, error -71 [ 341.624837][ T5927] usb 4-1: device descriptor read/8, error -71 [ 341.687847][ T5947] usb usb1-port1: unable to enumerate USB device [ 341.688304][ T3086] usb 5-1: New USB device found, idVendor=0733, idProduct=0430, bcdDevice=57.26 [ 341.727371][ T3086] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 341.744375][ T5927] usb usb4-port1: unable to enumerate USB device [ 341.772895][ T3086] usb 5-1: Product: syz [ 341.778307][ T3086] usb 5-1: Manufacturer: ь [ 341.784228][ T3086] usb 5-1: SerialNumber: syz [ 342.020787][ T3086] gspca_main: spca505-2.14.0 probing 0733:0430 [ 342.035672][ T3086] gspca_spca505: reg write: error -71 [ 342.044050][ T3086] spca505 5-1:8.1: probe with driver spca505 failed with error -5 [ 342.098338][ T3086] usb 5-1: USB disconnect, device number 36 [ 342.206519][ T9950] lo speed is unknown, defaulting to 1000 [ 342.508095][ T9950] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1199'. [ 342.529403][ T9950] input: syz0 as /devices/virtual/input/input33 [ 343.366858][ T9979] FAULT_INJECTION: forcing a failure. [ 343.366858][ T9979] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 343.382867][ T9979] CPU: 0 UID: 0 PID: 9979 Comm: syz.0.1206 Not tainted 6.16.0-rc6-syzkaller-00037-ge2291551827f #0 PREEMPT(full) [ 343.382895][ T9979] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 343.382906][ T9979] Call Trace: [ 343.382911][ T9979] [ 343.382919][ T9979] dump_stack_lvl+0x16c/0x1f0 [ 343.382952][ T9979] should_fail_ex+0x512/0x640 [ 343.382983][ T9979] _copy_to_user+0x32/0xd0 [ 343.383003][ T9979] simple_read_from_buffer+0xcb/0x170 [ 343.383032][ T9979] proc_fail_nth_read+0x197/0x270 [ 343.383059][ T9979] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 343.383087][ T9979] ? rw_verify_area+0xcf/0x680 [ 343.383108][ T9979] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 343.383132][ T9979] vfs_read+0x1e4/0xc60 [ 343.383158][ T9979] ? __pfx___mutex_lock+0x10/0x10 [ 343.383174][ T9979] ? __pfx_vfs_read+0x10/0x10 [ 343.383205][ T9979] ? __fget_files+0x20e/0x3c0 [ 343.383229][ T9979] ksys_read+0x12a/0x250 [ 343.383253][ T9979] ? __pfx_ksys_read+0x10/0x10 [ 343.383286][ T9979] do_syscall_64+0xcd/0x4c0 [ 343.383305][ T9979] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 343.383323][ T9979] RIP: 0033:0x7fc859f8d33c [ 343.383337][ T9979] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 343.383355][ T9979] RSP: 002b:00007fc85ad65030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 343.383372][ T9979] RAX: ffffffffffffffda RBX: 00007fc85a1b5fa0 RCX: 00007fc859f8d33c [ 343.383384][ T9979] RDX: 000000000000000f RSI: 00007fc85ad650a0 RDI: 0000000000000004 [ 343.383394][ T9979] RBP: 00007fc85ad65090 R08: 0000000000000000 R09: 0000000000000000 [ 343.383404][ T9979] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 343.383414][ T9979] R13: 0000000000000000 R14: 00007fc85a1b5fa0 R15: 00007ffc9f6ece88 [ 343.383439][ T9979] [ 344.819666][ T9997] lo speed is unknown, defaulting to 1000 [ 344.855974][T10004] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1216'. [ 345.234980][T10003] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 345.474190][ T5927] usb 4-1: new high-speed USB device number 46 using dummy_hcd [ 345.736361][ T5927] usb 4-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 345.756266][ T5927] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 345.768200][ T5927] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 346.212779][T10036] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(8) [ 346.219336][T10036] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 346.238677][ T5927] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 346.240218][T10036] vhci_hcd vhci_hcd.0: Device attached [ 346.353375][ T5927] usb 4-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 346.384554][T10042] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1229'. [ 346.386509][ T5927] usb 4-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 346.453773][ T5927] usb 4-1: Product: syz [ 346.465268][ T5947] usb 2-1: new high-speed USB device number 52 using dummy_hcd [ 346.468430][ T5927] usb 4-1: Manufacturer: syz [ 346.504201][ T3086] usb 3-1: new high-speed USB device number 34 using dummy_hcd [ 346.545859][ T1204] usb 37-1: new low-speed USB device number 4 using vhci_hcd [ 346.606224][ T5927] cdc_wdm 4-1:1.0: skipping garbage [ 346.621784][ T5927] cdc_wdm 4-1:1.0: skipping garbage [ 346.631896][ T5927] cdc_wdm 4-1:1.0: cdc-wdm0: USB WDM device [ 346.639708][ T5927] cdc_wdm 4-1:1.0: Unknown control protocol [ 346.697571][ T3086] usb 3-1: config 0 has no interfaces? [ 346.709694][ T3086] usb 3-1: New USB device found, idVendor=0de5, idProduct=0056, bcdDevice= 5.b5 [ 346.723847][ T3086] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 346.867084][T10049] FAULT_INJECTION: forcing a failure. [ 346.867084][T10049] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 346.884516][T10049] CPU: 0 UID: 0 PID: 10049 Comm: syz.4.1230 Not tainted 6.16.0-rc6-syzkaller-00037-ge2291551827f #0 PREEMPT(full) [ 346.884541][T10049] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 346.884552][T10049] Call Trace: [ 346.884558][T10049] [ 346.884565][T10049] dump_stack_lvl+0x16c/0x1f0 [ 346.884596][T10049] should_fail_ex+0x512/0x640 [ 346.884625][T10049] _copy_from_user+0x2e/0xd0 [ 346.884642][T10049] memdup_user+0x6b/0xe0 [ 346.884669][T10049] strndup_user+0x78/0xe0 [ 346.884696][T10049] __x64_sys_mount+0x137/0x310 [ 346.884716][T10049] ? __pfx___x64_sys_mount+0x10/0x10 [ 346.884741][T10049] do_syscall_64+0xcd/0x4c0 [ 346.884759][T10049] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 346.884782][T10049] RIP: 0033:0x7f21fdf8e929 [ 346.884796][T10049] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 346.884813][T10049] RSP: 002b:00007f21fee6e038 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 346.884830][T10049] RAX: ffffffffffffffda RBX: 00007f21fe1b6080 RCX: 00007f21fdf8e929 [ 346.884840][T10049] RDX: 0000200000000000 RSI: 0000200000000080 RDI: 0000200000000140 [ 346.884851][T10049] RBP: 00007f21fee6e090 R08: 0000000000000000 R09: 0000000000000000 [ 346.884861][T10049] R10: 0000000000208000 R11: 0000000000000246 R12: 0000000000000001 [ 346.884871][T10049] R13: 0000000000000000 R14: 00007f21fe1b6080 R15: 00007ffd65650a48 [ 346.884895][T10049] [ 346.895921][ T3086] usb 3-1: config 0 descriptor?? [ 347.087665][T10047] binder: BINDER_SET_CONTEXT_MGR already set [ 347.105263][T10047] binder: 10044:10047 ioctl 4018620d 200000000040 returned -16 [ 347.105722][ T5947] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 347.125608][ T30] audit: type=1400 audit(1752792992.363:466): avc: denied { read write } for pid=10007 comm="syz.3.1218" name="cdc-wdm0" dev="devtmpfs" ino=3202 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:modem_device_t tclass=chr_file permissive=1 [ 347.254274][ T30] audit: type=1400 audit(1752792992.363:467): avc: denied { open } for pid=10007 comm="syz.3.1218" path="/dev/cdc-wdm0" dev="devtmpfs" ino=3202 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:modem_device_t tclass=chr_file permissive=1 [ 347.283557][ T5947] usb 2-1: New USB device found, idVendor=04fc, idProduct=504a, bcdDevice=43.02 [ 347.296941][ T5947] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 347.306790][ T5947] usb 2-1: Product: syz [ 347.310955][ T5947] usb 2-1: Manufacturer: syz [ 347.325459][T10051] vlan2: entered allmulticast mode [ 347.332135][ T5947] usb 2-1: SerialNumber: syz [ 347.342155][ T5947] usb 2-1: config 0 descriptor?? [ 347.348696][T10051] erspan0: entered allmulticast mode [ 347.378061][T10037] vhci_hcd: cannot find a urb of seqnum 1 max seqnum 3 [ 347.409693][ T2961] vhci_hcd: stop threads [ 347.416560][ T2961] vhci_hcd: release socket [ 347.429382][ T2961] vhci_hcd: disconnect device [ 347.443434][T10053] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 348.112045][ T3086] usb 4-1: USB disconnect, device number 46 [ 348.802564][T10079] binder_alloc: 10078: binder_alloc_buf, no vma [ 348.810263][T10079] binder: 10078:10079 ioctl c0306201 200000001a80 returned -11 [ 349.595354][ T5947] usb 3-1: USB disconnect, device number 34 [ 349.930804][ T3086] usb 2-1: USB disconnect, device number 52 [ 349.971298][T10112] vlan2: entered allmulticast mode [ 350.191216][ T5905] usb 5-1: new high-speed USB device number 37 using dummy_hcd [ 350.263696][ T5947] usb 3-1: new high-speed USB device number 35 using dummy_hcd [ 350.573571][T10120] syz.3.1255: attempt to access beyond end of device [ 350.573571][T10120] nbd3: rw=0, sector=0, nr_sectors = 1 limit=0 [ 350.594996][ T30] audit: type=1400 audit(1752792995.853:468): avc: denied { ioctl } for pid=10113 comm="syz.1.1254" path="/dev/rtc0" dev="devtmpfs" ino=921 ioctlcmd=0x7005 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 350.598016][ T5905] usb 5-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 350.644122][ T5905] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 350.666172][ T5947] usb 3-1: Using ep0 maxpacket: 16 [ 350.679328][ T5905] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 350.689492][ T5905] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 350.706805][ T5947] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 350.735796][ T5947] usb 3-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 350.753983][ T5947] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 350.762013][ T5947] usb 3-1: Product: syz [ 350.769325][ T5905] usb 5-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 350.780608][ T5947] usb 3-1: Manufacturer: syz [ 350.791251][ T5905] usb 5-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 350.800658][ T5947] usb 3-1: SerialNumber: syz [ 350.807945][ T5905] usb 5-1: Product: syz [ 350.812117][ T5905] usb 5-1: Manufacturer: syz [ 350.819372][ T5947] usb 3-1: config 0 descriptor?? [ 350.828117][ T5947] em28xx 3-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 350.839987][ T5947] em28xx 3-1:0.0: DVB interface 0 found: bulk [ 350.852521][ T5905] cdc_wdm 5-1:1.0: skipping garbage [ 350.907736][T10132] FAULT_INJECTION: forcing a failure. [ 350.907736][T10132] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 350.921564][T10132] CPU: 0 UID: 0 PID: 10132 Comm: syz.3.1259 Not tainted 6.16.0-rc6-syzkaller-00037-ge2291551827f #0 PREEMPT(full) [ 350.921591][T10132] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 350.921598][T10132] Call Trace: [ 350.921602][T10132] [ 350.921606][T10132] dump_stack_lvl+0x16c/0x1f0 [ 350.921626][T10132] should_fail_ex+0x512/0x640 [ 350.921645][T10132] _copy_from_user+0x2e/0xd0 [ 350.921656][T10132] memdup_user+0x6b/0xe0 [ 350.921674][T10132] strndup_user+0x78/0xe0 [ 350.921690][T10132] __x64_sys_mount+0x180/0x310 [ 350.921703][T10132] ? __pfx___x64_sys_mount+0x10/0x10 [ 350.921718][T10132] do_syscall_64+0xcd/0x4c0 [ 350.921729][T10132] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 350.921740][T10132] RIP: 0033:0x7f36f2b8e929 [ 350.921750][T10132] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 350.921760][T10132] RSP: 002b:00007f36f3a59038 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 350.921770][T10132] RAX: ffffffffffffffda RBX: 00007f36f2db6080 RCX: 00007f36f2b8e929 [ 350.921776][T10132] RDX: 0000200000000000 RSI: 0000200000000080 RDI: 0000200000000140 [ 350.921782][T10132] RBP: 00007f36f3a59090 R08: 0000000000000000 R09: 0000000000000000 [ 350.921788][T10132] R10: 0000000000208000 R11: 0000000000000246 R12: 0000000000000001 [ 350.921793][T10132] R13: 0000000000000000 R14: 00007f36f2db6080 R15: 00007ffe06f3d358 [ 350.921806][T10132] [ 351.264117][ T5905] cdc_wdm 5-1:1.0: skipping garbage [ 351.308974][ T5905] cdc_wdm 5-1:1.0: cdc-wdm0: USB WDM device [ 351.314987][ T5905] cdc_wdm 5-1:1.0: Unknown control protocol [ 351.532434][ T5905] usb 5-1: USB disconnect, device number 37 [ 351.546405][T10133] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1260'. [ 351.703159][T10144] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(8) [ 351.709693][T10144] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 351.717795][T10144] vhci_hcd vhci_hcd.0: Device attached [ 351.755982][ T1204] vhci_hcd: vhci_device speed not set [ 351.968082][ T5841] usb 1-1: new high-speed USB device number 30 using dummy_hcd [ 352.165220][ T5947] em28xx 3-1:0.0: unknown em28xx chip ID (0) [ 352.254010][ T5831] usb 33-1: new low-speed USB device number 5 using vhci_hcd [ 352.346733][ T5841] usb 1-1: config 0 has no interfaces? [ 352.352393][ T5841] usb 1-1: New USB device found, idVendor=0de5, idProduct=0056, bcdDevice= 5.b5 [ 352.375347][ T5841] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 352.393005][T10102] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 352.403422][ T5841] usb 1-1: config 0 descriptor?? [ 352.404323][T10102] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 352.433537][T10149] fuse: Bad value for 'fd' [ 352.622513][T10145] vhci_hcd: cannot find a urb of seqnum 1 max seqnum 4 [ 352.640508][T10117] vhci_hcd: stop threads [ 352.646378][T10117] vhci_hcd: release socket [ 352.650974][T10117] vhci_hcd: disconnect device [ 352.798614][T10158] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1267'. [ 352.930245][T10158] netlink: 36 bytes leftover after parsing attributes in process `syz.1.1267'. [ 353.195599][ T5947] em28xx 3-1:0.0: failed to get i2c transfer status from bridge register (error=-5) [ 353.211342][ T5947] em28xx 3-1:0.0: board has no eeprom [ 353.314090][ T5947] em28xx 3-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 353.326008][ T5947] em28xx 3-1:0.0: dvb set to bulk mode. [ 353.334523][ T5905] em28xx 3-1:0.0: Binding DVB extension [ 353.347381][ T5947] usb 3-1: USB disconnect, device number 35 [ 353.360004][ T5947] em28xx 3-1:0.0: Disconnecting em28xx [ 353.452195][ T5905] em28xx 3-1:0.0: Registering input extension [ 353.464336][ T5947] em28xx 3-1:0.0: Closing input extension [ 353.613991][ T3086] usb 5-1: new high-speed USB device number 38 using dummy_hcd [ 353.769154][ T3086] usb 5-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 353.769465][ T5947] em28xx 3-1:0.0: Freeing device [ 353.781554][ T3086] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 353.793628][ T3086] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 353.814750][ T3086] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 353.894571][ T5927] usb 4-1: new full-speed USB device number 47 using dummy_hcd [ 353.947767][ T3086] usb 5-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 353.966332][ T3086] usb 5-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 353.984258][ T3086] usb 5-1: Product: syz [ 353.991807][ T3086] usb 5-1: Manufacturer: syz [ 354.010747][ T3086] cdc_wdm 5-1:1.0: skipping garbage [ 354.022193][ T30] audit: type=1400 audit(1752792999.283:469): avc: denied { create } for pid=10187 comm="syz.1.1279" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 354.042187][T10188] syzkaller0: entered promiscuous mode [ 354.053999][ T3086] cdc_wdm 5-1:1.0: skipping garbage [ 354.064483][ T3086] cdc_wdm 5-1:1.0: cdc-wdm0: USB WDM device [ 354.071650][T10188] syzkaller0: entered allmulticast mode [ 354.077857][ T3086] cdc_wdm 5-1:1.0: Unknown control protocol [ 354.087668][ T5927] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 354.103816][ T5927] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 354.120387][ T5927] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.00 [ 354.129578][ T5927] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 354.139158][ T5927] usb 4-1: SerialNumber: syz [ 354.159341][ T5927] usb 4-1: 0:2 : does not exist [ 354.506383][ T30] audit: type=1400 audit(1752792999.773:470): avc: denied { read } for pid=10193 comm="syz.1.1281" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 354.673500][T10198] erofs (device nbd3): cannot find valid erofs superblock [ 354.944038][ T5947] usb 1-1: USB disconnect, device number 30 [ 356.225733][T10217] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1288'. [ 356.238772][T10216] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 356.363124][ T3086] usb 5-1: USB disconnect, device number 38 [ 356.674035][ T5927] usb 4-1: USB disconnect, device number 47 [ 356.888783][T10231] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1292'. [ 356.990893][T10231] netlink: 36 bytes leftover after parsing attributes in process `syz.4.1292'. [ 357.354463][ T5831] vhci_hcd: vhci_device speed not set [ 357.601057][T10242] dvmrp0: entered allmulticast mode [ 357.607720][T10242] syz_tun: entered allmulticast mode [ 357.613215][T10242] dvmrp0: left allmulticast mode [ 357.618210][T10242] syz_tun: left allmulticast mode [ 357.920862][T10243] SELinux: policydb magic number 0x2000 does not match expected magic number 0xf97cff8c [ 357.930875][T10243] SELinux: failed to load policy [ 358.741953][T10253] vlan2: entered allmulticast mode [ 358.748901][T10253] erspan0: entered allmulticast mode [ 359.049218][ T30] audit: type=1804 audit(1752793004.313:471): pid=10270 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz.0.1306" name="/newroot/259/file0" dev="tmpfs" ino=1391 res=1 errno=0 [ 359.074039][T10270] ref_ctr going negative. vaddr: 0x200000ffc002, curr val: -29824, delta: 1 [ 359.082743][T10270] ref_ctr increment failed for inode: 0x56f offset: 0x7 ref_ctr_offset: 0x2 of mm: 0xffff888035495a00 [ 359.167385][T10271] Option ' ' to dns_resolver key: bad/missing value [ 359.234189][ T5947] usb 4-1: new high-speed USB device number 48 using dummy_hcd [ 359.473994][T10286] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1308'. [ 359.676794][ T5947] usb 4-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 359.677143][T10285] ------------[ cut here ]------------ [ 359.690158][ T5947] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 359.693299][T10285] UBSAN: shift-out-of-bounds in drivers/comedi/drivers/pcl812.c:1152:10 [ 359.711334][T10285] shift exponent 524293 is too large for 32-bit type 'int' [ 359.718837][T10285] CPU: 1 UID: 0 PID: 10285 Comm: syz.4.1309 Not tainted 6.16.0-rc6-syzkaller-00037-ge2291551827f #0 PREEMPT(full) [ 359.718860][T10285] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 359.718870][T10285] Call Trace: [ 359.718875][T10285] [ 359.718882][T10285] dump_stack_lvl+0x16c/0x1f0 [ 359.718909][T10285] __ubsan_handle_shift_out_of_bounds+0x27f/0x420 [ 359.718941][T10285] pcl812_attach.cold+0x1a/0x1f [ 359.718961][T10285] comedi_device_attach+0x3b0/0x900 [ 359.718982][T10285] do_devconfig_ioctl+0x1a7/0x580 [ 359.718994][T10285] ? __pfx_do_devconfig_ioctl+0x10/0x10 [ 359.719014][T10285] ? find_held_lock+0x2b/0x80 [ 359.719031][T10285] comedi_unlocked_ioctl+0x15bb/0x2e90 [ 359.719046][T10285] ? do_raw_spin_unlock+0xb4/0x230 [ 359.719059][T10285] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 359.719071][T10285] ? __pfx_comedi_unlocked_ioctl+0x10/0x10 [ 359.719084][T10285] ? do_vfs_ioctl+0x523/0x1a60 [ 359.719099][T10285] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 359.719116][T10285] ? ioctl_has_perm.constprop.0.isra.0+0x379/0x540 [ 359.719134][T10285] ? ioctl_has_perm.constprop.0.isra.0+0x383/0x540 [ 359.719151][T10285] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 359.719173][T10285] ? hook_file_ioctl_common+0x145/0x410 [ 359.719189][T10285] ? selinux_file_ioctl+0x180/0x270 [ 359.719205][T10285] ? selinux_file_ioctl+0xb4/0x270 [ 359.719222][T10285] ? __pfx_comedi_unlocked_ioctl+0x10/0x10 [ 359.719236][T10285] __x64_sys_ioctl+0x18b/0x210 [ 359.719251][T10285] do_syscall_64+0xcd/0x4c0 [ 359.719262][T10285] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 359.719273][T10285] RIP: 0033:0x7f21fdf8e929 [ 359.719282][T10285] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 359.719292][T10285] RSP: 002b:00007f21fee8f038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 359.719303][T10285] RAX: ffffffffffffffda RBX: 00007f21fe1b5fa0 RCX: 00007f21fdf8e929 [ 359.719309][T10285] RDX: 0000200000000080 RSI: 0000000040946400 RDI: 0000000000000003 [ 359.719315][T10285] RBP: 00007f21fe010ca1 R08: 0000000000000000 R09: 0000000000000000 [ 359.719320][T10285] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 359.719326][T10285] R13: 0000000000000000 R14: 00007f21fe1b5fa0 R15: 00007ffd65650a48 [ 359.719339][T10285] [ 359.719437][T10285] ---[ end trace ]--- [ 359.953104][T10285] Kernel panic - not syncing: UBSAN: panic_on_warn set ... [ 359.960313][T10285] CPU: 1 UID: 0 PID: 10285 Comm: syz.4.1309 Not tainted 6.16.0-rc6-syzkaller-00037-ge2291551827f #0 PREEMPT(full) [ 359.972363][T10285] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 359.982402][T10285] Call Trace: [ 359.985668][T10285] [ 359.988589][T10285] dump_stack_lvl+0x3d/0x1f0 [ 359.993179][T10285] panic+0x71c/0x800 [ 359.997068][T10285] ? __pfx_panic+0x10/0x10 [ 360.001480][T10285] ? __pfx__printk+0x10/0x10 [ 360.006061][T10285] check_panic_on_warn+0xab/0xb0 [ 360.010982][T10285] __ubsan_handle_shift_out_of_bounds+0x2a6/0x420 [ 360.017410][T10285] pcl812_attach.cold+0x1a/0x1f [ 360.022268][T10285] comedi_device_attach+0x3b0/0x900 [ 360.027479][T10285] do_devconfig_ioctl+0x1a7/0x580 [ 360.032501][T10285] ? __pfx_do_devconfig_ioctl+0x10/0x10 [ 360.038052][T10285] ? find_held_lock+0x2b/0x80 [ 360.042723][T10285] comedi_unlocked_ioctl+0x15bb/0x2e90 [ 360.048174][T10285] ? do_raw_spin_unlock+0xb4/0x230 [ 360.053313][T10285] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 360.059211][T10285] ? __pfx_comedi_unlocked_ioctl+0x10/0x10 [ 360.065019][T10285] ? do_vfs_ioctl+0x523/0x1a60 [ 360.069781][T10285] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 360.074802][T10285] ? ioctl_has_perm.constprop.0.isra.0+0x379/0x540 [ 360.081297][T10285] ? ioctl_has_perm.constprop.0.isra.0+0x383/0x540 [ 360.087794][T10285] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 360.094645][T10285] ? hook_file_ioctl_common+0x145/0x410 [ 360.100182][T10285] ? selinux_file_ioctl+0x180/0x270 [ 360.105371][T10285] ? selinux_file_ioctl+0xb4/0x270 [ 360.110484][T10285] ? __pfx_comedi_unlocked_ioctl+0x10/0x10 [ 360.116279][T10285] __x64_sys_ioctl+0x18b/0x210 [ 360.121036][T10285] do_syscall_64+0xcd/0x4c0 [ 360.125524][T10285] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 360.131404][T10285] RIP: 0033:0x7f21fdf8e929 [ 360.135803][T10285] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 360.155399][T10285] RSP: 002b:00007f21fee8f038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 360.163797][T10285] RAX: ffffffffffffffda RBX: 00007f21fe1b5fa0 RCX: 00007f21fdf8e929 [ 360.171754][T10285] RDX: 0000200000000080 RSI: 0000000040946400 RDI: 0000000000000003 [ 360.179708][T10285] RBP: 00007f21fe010ca1 R08: 0000000000000000 R09: 0000000000000000 [ 360.187664][T10285] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 360.195620][T10285] R13: 0000000000000000 R14: 00007f21fe1b5fa0 R15: 00007ffd65650a48 [ 360.203585][T10285] [ 360.206806][T10285] Kernel Offset: disabled [ 360.211175][T10285] Rebooting in 86400 seconds..