last executing test programs: 6.2948982s ago: executing program 2 (id=3): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000bab000/0x400000)=nil) r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f00000000c0)={0x0, 0x0}) ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f0000000240)={0x1, 0x0, [{0x490, 0x0, 0xffffffff}]}) 6.021645697s ago: executing program 2 (id=14): mkdirat(0xffffffffffffff9c, &(0x7f0000001000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000001040)='./sys\x00', &(0x7f0000001080)='sysfs\x00', 0x0, 0x0) pipe2(0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000001300)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0) write(r0, &(0x7f0000001400)='- - -', 0x5) 1.978689553s ago: executing program 3 (id=78): close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) 1.893020975s ago: executing program 3 (id=79): r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000010c0)=ANY=[@ANYBLOB="200000001600010a00000000000000000a", @ANYRES16=r0], 0x20}, 0x1, 0x0, 0x0, 0x200c0801}, 0x0) 1.803545097s ago: executing program 3 (id=81): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x4, 0x1, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_BOOT_CPU_ID(r1, 0xae78, &(0x7f0000000000)=0x1) ioctl$KVM_SET_SREGS(r2, 0x4138ae84, &(0x7f0000000100)={{0xeeee8000, 0xeeee0000, 0xc, 0x1, 0x81, 0xc, 0x0, 0x7}, {0xf000, 0xdddd1000, 0xc, 0xfc, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x5, 0xfb}, {0x2, 0x8080000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x1, 0x4}, {0x80a0000, 0xffff1000, 0x3, 0x0, 0x0, 0x8, 0x0, 0x7}, {0x5000, 0x0, 0xf, 0x6, 0xfe, 0x10, 0x3, 0xc, 0x58, 0x9, 0x4}, {0x4000, 0x1000, 0xb, 0xfc, 0x0, 0xfd, 0xfc, 0x0, 0x0, 0x5, 0xc0}, {0x2fff, 0x100000, 0x10, 0x8, 0x7, 0xfb, 0x0, 0x7, 0x1a, 0x2, 0x0, 0x2}, {0x5000, 0x3000, 0xe, 0x2, 0x2, 0x54, 0x7, 0xfd, 0x0, 0x9, 0x7, 0x5}, {0x9000, 0x1}, {}, 0x9df9ffdf, 0x0, 0x0, 0x220, 0x8, 0x8000, 0x2000, [0xdd41, 0x0, 0x2]}) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/address_bits', 0x800940, 0x41) ioctl$KVM_TRANSLATE(r2, 0xc018ae85, &(0x7f0000001280)={0x0, 0xdddd0000, 0x2, 0x1c, 0x50}) 1.713955549s ago: executing program 3 (id=84): r0 = socket$packet(0x11, 0x3, 0x300) getsockopt$packet_int(r0, 0x107, 0x3c, 0x0, &(0x7f0000000100)) 1.643401121s ago: executing program 3 (id=86): lseek(0xffffffffffffffff, 0xf800100000000000, 0x4) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_clone3(&(0x7f0000000080)={0x180801600, &(0x7f0000000000), 0x0, 0x0, {0x3d}, 0x0, 0x0, 0x0, 0x0}, 0x58) 995.840446ms ago: executing program 0 (id=99): r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000440)={'sit0\x00', &(0x7f00000000c0)={'syztnl0\x00', 0x0, 0x7800, 0x8000, 0x1, 0x5, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x3, 0x0, 0x1, 0x4, 0x0, @local, @private=0x10000}}}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f3, 0x0) 995.733086ms ago: executing program 0 (id=100): syslog(0x2, &(0x7f0000001640)=""/172, 0xac) 827.66611ms ago: executing program 1 (id=104): r0 = socket$netlink(0x10, 0x3, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000040), &(0x7f0000000080)=0xc) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x9) ioctl$KVM_REGISTER_COALESCED_MMIO(r2, 0x4010ae67, &(0x7f0000000100)={0x8000000, 0x10000}) ioctl$KVM_UNREGISTER_COALESCED_MMIO(r2, 0x4010ae68, &(0x7f0000000040)={0xdddd0000}) 827.58025ms ago: executing program 3 (id=105): prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0xffffffffffffffff}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioprio_get$uid(0x3, 0x0) 799.227811ms ago: executing program 1 (id=106): syz_create_resource$binfmt(0x0) r0 = syz_open_dev$loop(&(0x7f0000000240), 0x75f, 0xa8182) r1 = memfd_create(&(0x7f0000000880)='C\x13\xfc2\x95WD\xaa\xba^\x90\xfd\x8d\xc2\xb1[\x81\xda\xda\xd6\x8c\xc99\xec\x0e*||\xe4\xb3\xc4\xb6\v\xaa\x15\x86,\xac\x8d\x89cu\x10\xdc\x93\x9b\xb4\x93\xafE*:\xe4\xdd\xa5\xa75\xb8\x1e;7\xb7.V\xdcrw[\r\x98\x93j\x9c\xf6\xf8\x99\xefF_\xcd\xdf!b\xc5\xec\ntb\xff\b\xaaF?!\x9f\a\x1a\x03\f\xe94\x1deU\x06zS\xc90\xb9voI\xa5/\xb4\xa7@\xa1\\B\xc2@\r_b\x9a\xeb\b\x81\x00V\xd6/N\xc5\xc6f\xb1\x95Z\xe5w^\xd8\xe7J\x80\xf7\xae\xafuv\x84\x9eG\xd1\xe7\x9b\xf0_9\xc2\x9b\xfd\xc3\xf3\xe4\x95P\xf1m\xcf\xc2\xe1\xe6\xa6\x8c\x11\xfb\xb8S\x8b\x92\\\asW-Ee\x02\x00\x00\x00\xd0;Q\xc1~\x89\xec\xc8\x9b\x88\a\xf2\x93\x82(\x8b\x00\xd8\xb4T\x80\x95\x93\x9c5\xcf\t\x04\x00\x00\x00\x00\x00\x00v\xef\xee+\xab\x9c\x00^R\xb2n?i=\xbe\x16\x8a\xbf\xe3\xcdB\xed\xe14\xe8\xd0\xb7\xff\xfeQ\x1c\x85n8\x1b\xc1\b\x00\x00\x00\x00\x00\x00\x00\x17\x94\xdfW\x92z\xbe\xb2R)\xf1K\xd7\xaf\x99\xf6d\xe8\xec\xb7\xbd+T3\xa6\xa9\xfaY-1qs\x82\xefn*\x96\xc9\x1e\xf4\xd1\x02Dt\xc0\x19\xf7\x89\x96.D [F\xeeYW\x95\x13\xc7;\x94\x13^\x13\xaf\xf0C\x9c\xabf\x1daCS2\x02\xb0\xef\xc7\x8c\x9e\xed\a\n0xffffffffffffffff}) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) vmsplice(r0, &(0x7f0000000380)=[{&(0x7f0000013580)='\r', 0x1}], 0x1, 0x0) write(0xffffffffffffffff, 0x0, 0x0) 138.590717ms ago: executing program 1 (id=111): r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000240)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1a}}, 0x10) sendmmsg$inet(r0, &(0x7f00000036c0)=[{{&(0x7f0000000200)={0x2, 0x4e25, @multicast1}, 0x10, 0x0}}, {{0x0, 0x0, 0x0}}], 0x2, 0x4a080) 79.798478ms ago: executing program 0 (id=112): r0 = userfaultfd(0x80001) r1 = epoll_create(0x6) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000040)={0x90000010}) 47.644439ms ago: executing program 1 (id=113): r0 = socket(0x2, 0x3, 0xff) bind$inet(r0, &(0x7f0000000080)={0x2, 0x404, @empty}, 0x10) 0s ago: executing program 0 (id=114): r0 = add_key$keyring(&(0x7f0000000040), &(0x7f0000000240)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffe) add_key(&(0x7f0000000040)='asymmetric\x00', 0x0, &(0x7f0000000780)="308205553082033da00302010202147398ea982dd02ea8b1cf57c7f297b3e61afc8c0a300d06092a864886f70d01010b050030343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b65793020170d3232303531383232333234315a180f32313232303432343232333234315a30343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b657a30820222300d06092a864886f70d01010105000382020f003082020a0282020100ccac49dd3bcab0157e846ab20a695f1c0a61823b4f2ca3952c08584bb15d99e0c3c179c2b3ebc01e6d3e541dbdb7927b4db59558b2522ec6244b7163803277a7385edb72ae6e0decfbb66d017fe95566dfbf1d76780231e8e507f8b7825c0dd4bbfba2590d2e3a78953a8b4606474446d7cd066a4113e319f6bb6e38f48301a3bf4a394fd70ae938b3f594144eddf743fd24b2493ca5f77a7cd4453d977568f1ed4c420b70ca85f3dee5882cc5beb69734ba2402cd8b869fa973ca73cf9281ee7555bb18675cff3fb5dd331b0ce978db5ccfaa5c4342df5ea96decd7d7ffe6a13a921adaaef68c6f7bd5b46e06e98fe8de093189ed0e11a1fa8ae9e964596253dad170be11d4999711cf99de0b9d947eaab852ea37db907e35bdd9fe6d0a487028ddd50d7f03809314238fb922cd7c29fef172b55c0b12cf9c15f6114c7a45258c450a34ac2d9a81ca0b1322cdeb1a38881897960881aacc8f0f8a327b7668036843bf11ba5560fd801c0d9b69b60972bc0f412f0782c6e3b21391c46d149531be19bdbcede14c74a2e0780bbb94ec4c533aa2b5841d4b657edcf7db367dbe9e3b366642667635bfbef0c13c7ce9425c24ba0305a86724500275ff24463b358976e670dac5518c9ae505b00bd02dd47d5775946bf90aad0e410015d04fc07f902d18488f28fe5da7cd999ebd026c8a31f31cc74be693cd42a2e46810479dfc210203010001a35d305b300c0603551d130101ff04023000300b0603551d0f040403020780301d0603551d0e04160414f58703bb33ce1b730000eccdee5b8817518fe3db301f0603551d23041830168014f58703bb33ce1b73ee02eccdee5b8817518fe3db300d06092a864886f70d01010b05000382020100c02e12417b738516c8db8679e8f5cd44f4c6e281235e47cbab25f11e583e317f78ad85ebfe148860f77fd226a2f4982afdba050c203312cc4d1461648193d333edc8fff178cc5f519f09d7be0d5c74fd9bdf524ac9a871253304106736d0b30bc9a14072ae417b68e6e47bd028f76de73f50fc917c9156d4df0010000000000000fac119eb112f248b7cc5a98626aa6eb79bd5f806fb02527b9c9ea1e0078b5ee4b85529f648521c1b542d46d8e571b960d145b592898a63582ab3c6b276e23c825904ae5ac4997b2e4b4657b82924b2fdee2c0da483fa652a07358b97cfbd962ed17e6cc21e87b66c7665b5b262da8be973e3db33dd133a17636a76de8d8fe04761283a83ff8fe7c7e04aa3bd00cfe98c35352ee7806631bf91580ae1253d38d3a4f059344707620fbe30dd818858f028b096e582f805b71301bcfac61f8672ccf9ee8ed9d6048c246cbf0f5d3739cf45c1933ad2ed5c5879748662307e8ebbdd7aa9edca40cb6247f4b49f527f7263a8f02baf452a48196de3fbf9196669c8cc62876c532b2d6e906c543a822541cb186aa422a8a1c447d781001c15510f1aafef9fa6618cbd6b8bede6ac0eb63a4c92e60f910a0f71c7a0b90d3a175a6f35c8e7504f46e870604806828b6658e673919c123d358e46ad5af5b3db692104fdd31cdf949d56b00ad195768dec9edd0b159764ade5f26202fc9e5f56423905b3", 0x559, r0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.68' (ED25519) to the list of known hosts. [ 29.657437][ T36] audit: type=1400 audit(1787329340.010:64): avc: denied { mounton } for pid=285 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 29.661180][ T285] cgroup: Unknown subsys name 'net' [ 29.680347][ T36] audit: type=1400 audit(1787329340.010:65): avc: denied { mount } for pid=285 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 29.707666][ T36] audit: type=1400 audit(1787329340.040:66): avc: denied { unmount } for pid=285 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 29.708220][ T285] cgroup: Unknown subsys name 'devices' [ 29.828184][ T285] cgroup: Unknown subsys name 'hugetlb' [ 29.833835][ T285] cgroup: Unknown subsys name 'rlimit' [ 29.951465][ T36] audit: type=1400 audit(1787329340.300:67): avc: denied { setattr } for pid=285 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 29.974749][ T36] audit: type=1400 audit(1787329340.300:68): avc: denied { mounton } for pid=285 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 29.999541][ T36] audit: type=1400 audit(1787329340.300:69): avc: denied { mount } for pid=285 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 30.058702][ T287] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 30.067698][ T36] audit: type=1400 audit(1787329340.430:70): avc: denied { relabelto } for pid=287 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" Setting up swapspace version 1, size = 127995904 bytes [ 30.093128][ T36] audit: type=1400 audit(1787329340.430:71): avc: denied { write } for pid=287 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 30.125493][ T36] audit: type=1400 audit(1787329340.480:72): avc: denied { read } for pid=285 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 30.127198][ T285] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 30.151021][ T36] audit: type=1400 audit(1787329340.480:73): avc: denied { open } for pid=285 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 31.275324][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.282521][ T294] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.289635][ T294] bridge_slave_0: entered allmulticast mode [ 31.296091][ T294] bridge_slave_0: entered promiscuous mode [ 31.311437][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.318518][ T294] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.325599][ T294] bridge_slave_1: entered allmulticast mode [ 31.331901][ T294] bridge_slave_1: entered promiscuous mode [ 31.338006][ T292] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.345050][ T292] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.352317][ T292] bridge_slave_0: entered allmulticast mode [ 31.358815][ T292] bridge_slave_0: entered promiscuous mode [ 31.376822][ T292] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.383922][ T292] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.391026][ T292] bridge_slave_1: entered allmulticast mode [ 31.397371][ T292] bridge_slave_1: entered promiscuous mode [ 31.417965][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.425042][ T295] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.432202][ T295] bridge_slave_0: entered allmulticast mode [ 31.438521][ T295] bridge_slave_0: entered promiscuous mode [ 31.448397][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.455451][ T293] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.462986][ T293] bridge_slave_0: entered allmulticast mode [ 31.469459][ T293] bridge_slave_0: entered promiscuous mode [ 31.475898][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.482950][ T295] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.490065][ T295] bridge_slave_1: entered allmulticast mode [ 31.496411][ T295] bridge_slave_1: entered promiscuous mode [ 31.517986][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.525139][ T293] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.532268][ T293] bridge_slave_1: entered allmulticast mode [ 31.538734][ T293] bridge_slave_1: entered promiscuous mode [ 31.723609][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.730731][ T294] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.738122][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.745170][ T294] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.754510][ T292] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.761593][ T292] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.768901][ T292] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.775958][ T292] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.793293][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.800413][ T295] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.807712][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.814749][ T295] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.830350][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.837521][ T293] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.844794][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.851885][ T293] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.901651][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.909278][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.917486][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.924766][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.932269][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.939899][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.947320][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.954753][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.970433][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.977593][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.999354][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.006507][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 32.014197][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.021285][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 32.029188][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.036327][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 32.057999][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.065062][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 32.072799][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.079851][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 32.088540][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.095578][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 32.107161][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.114219][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 32.158311][ T295] veth0_vlan: entered promiscuous mode [ 32.187447][ T295] veth1_macvtap: entered promiscuous mode [ 32.200775][ T294] veth0_vlan: entered promiscuous mode [ 32.211199][ T293] veth0_vlan: entered promiscuous mode [ 32.230071][ T292] veth0_vlan: entered promiscuous mode [ 32.247551][ T294] veth1_macvtap: entered promiscuous mode [ 32.253905][ T293] veth1_macvtap: entered promiscuous mode [ 32.267832][ T292] veth1_macvtap: entered promiscuous mode [ 32.318925][ T293] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 32.381881][ T318] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 32.495048][ T330] ======================================================= [ 32.495048][ T330] WARNING: The mand mount option has been deprecated and [ 32.495048][ T330] and is ignored by this kernel. Remove the mand [ 32.495048][ T330] option from the mount to silence this warning. [ 32.495048][ T330] ======================================================= [ 33.758295][ T371] tipc: Started in network mode [ 33.763241][ T371] tipc: Node identity ae2afa513c3c, cluster identity 4711 [ 33.771053][ T371] tipc: Enabled bearer , priority 0 [ 33.816285][ T371] syzkaller0: entered promiscuous mode [ 33.821789][ T371] syzkaller0: entered allmulticast mode [ 33.827972][ T371] tipc: Resetting bearer [ 33.907156][ T370] tipc: Resetting bearer [ 33.921001][ T370] tipc: Disabling bearer [ 34.025422][ T380] netlink: 8 bytes leftover after parsing attributes in process `syz.0.25'. [ 34.035124][ T380] netlink: 'syz.0.25': attribute type 11 has an invalid length. [ 34.286527][ T386] FAULT_INJECTION: forcing a failure. [ 34.286527][ T386] name failslab, interval 1, probability 0, space 0, times 1 [ 34.299243][ T386] CPU: 1 UID: 0 PID: 386 Comm: syz.3.27 Not tainted syzkaller #0 1b627ac51616646c2b03e03cc27ccf1d06a70c9d [ 34.299277][ T386] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 34.299306][ T386] Call Trace: [ 34.299319][ T386] [ 34.299333][ T386] __dump_stack+0x21/0x30 [ 34.299390][ T386] dump_stack_lvl+0x140/0x1c0 [ 34.299411][ T386] ? __cfi_dump_stack_lvl+0x10/0x10 [ 34.299438][ T386] dump_stack+0x19/0x20 [ 34.299462][ T386] should_fail_ex+0x3c2/0x510 [ 34.299481][ T386] should_failslab+0xac/0x100 [ 34.299502][ T386] kmem_cache_alloc_noprof+0x42/0x410 [ 34.299519][ T386] ? __kvm_mmu_topup_memory_cache+0x1dd/0x7e0 [ 34.299547][ T386] __kvm_mmu_topup_memory_cache+0x1dd/0x7e0 [ 34.299571][ T386] ? mutex_unlock+0x90/0x240 [ 34.299588][ T386] kvm_mmu_topup_memory_cache+0x24/0x30 [ 34.299611][ T386] kvm_mmu_load+0xa1/0x2900 [ 34.299634][ T386] ? kvm_hv_setup_tsc_page+0x5f6/0xa80 [ 34.299665][ T386] ? vmx_flush_tlb_guest+0x1d3/0x3b0 [ 34.299684][ T386] ? kvm_apic_has_interrupt+0x77a/0x790 [ 34.299705][ T386] ? kvm_vcpu_flush_tlb_guest+0xfe/0x220 [ 34.299722][ T386] vcpu_run+0x4d72/0x7830 [ 34.299745][ T386] ? kvm_sched_clock_read+0x15/0x30 [ 34.299771][ T386] ? signal_pending+0xc0/0xc0 [ 34.299791][ T386] ? __kasan_check_write+0x18/0x20 [ 34.299806][ T386] ? xfd_validate_state+0x68/0x140 [ 34.299828][ T386] ? fpu_swap_kvm_fpstate+0x92/0x5e0 [ 34.299846][ T386] ? __kasan_check_write+0x18/0x20 [ 34.299861][ T386] ? fpregs_mark_activate+0x68/0x160 [ 34.299879][ T386] ? fpu_swap_kvm_fpstate+0x44c/0x5e0 [ 34.299898][ T386] ? fpu_swap_kvm_fpstate+0x92/0x5e0 [ 34.299916][ T386] kvm_arch_vcpu_ioctl_run+0x114c/0x1bc0 [ 34.299938][ T386] ? _parse_integer_limit+0x195/0x1e0 [ 34.299956][ T386] ? __cfi_kvm_arch_vcpu_ioctl_run+0x10/0x10 [ 34.299977][ T386] ? kstrtoull+0x13b/0x1e0 [ 34.299993][ T386] ? kstrtouint+0x78/0xf0 [ 34.300009][ T386] ? ioctl_has_perm+0x1bc/0x500 [ 34.300024][ T386] ? __asan_memcpy+0x5a/0x80 [ 34.300040][ T386] ? ioctl_has_perm+0x408/0x500 [ 34.300055][ T386] ? has_cap_mac_admin+0xd0/0xd0 [ 34.300070][ T386] ? __kasan_check_write+0x18/0x20 [ 34.300085][ T386] ? mutex_lock_killable+0x97/0x1d0 [ 34.300101][ T386] ? __cfi_mutex_lock_killable+0x10/0x10 [ 34.300117][ T386] ? proc_fail_nth_write+0x184/0x220 [ 34.300142][ T386] kvm_vcpu_ioctl+0xa43/0x1000 [ 34.300157][ T386] ? __cfi_kvm_vcpu_ioctl+0x10/0x10 [ 34.300172][ T386] ? __cfi_vfs_write+0x10/0x10 [ 34.300188][ T386] ? __kasan_check_write+0x18/0x20 [ 34.300204][ T386] ? mutex_unlock+0x90/0x240 [ 34.300218][ T386] ? __cfi_mutex_unlock+0x10/0x10 [ 34.300236][ T386] ? bpf_lsm_file_ioctl+0xd/0x20 [ 34.300256][ T386] ? security_file_ioctl+0x3e/0x110 [ 34.300270][ T386] ? __cfi_kvm_vcpu_ioctl+0x10/0x10 [ 34.300285][ T386] __se_sys_ioctl+0x135/0x1b0 [ 34.300305][ T386] __x64_sys_ioctl+0x7f/0xa0 [ 34.300327][ T386] x64_sys_call+0x1878/0x2ee0 [ 34.300342][ T386] do_syscall_64+0x57/0xf0 [ 34.300362][ T386] ? clear_bhb_loop+0x50/0xa0 [ 34.300378][ T386] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 34.300404][ T386] RIP: 0033:0x7f3504f9e0d9 [ 34.300437][ T386] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 34.300452][ T386] RSP: 002b:00007f35039f7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 34.300477][ T386] RAX: ffffffffffffffda RBX: 00007f3505225fa0 RCX: 00007f3504f9e0d9 [ 34.300488][ T386] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005 [ 34.300498][ T386] RBP: 00007f35039f7090 R08: 0000000000000000 R09: 0000000000000000 [ 34.300507][ T386] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 34.300516][ T386] R13: 00007f3505226038 R14: 00007f3505225fa0 R15: 00007ffcf31ef518 [ 34.300529][ T386] [ 34.690788][ T36] kauditd_printk_skb: 63 callbacks suppressed [ 34.690807][ T36] audit: type=1400 audit(1787329345.040:137): avc: denied { read write } for pid=388 comm="getty" name="utmp" dev="tmpfs" ino=2 scontext=system_u:system_r:getty_t tcontext=system_u:object_r:init_tmpfs_t tclass=file permissive=1 [ 34.700373][ T45] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 34.720666][ T36] audit: type=1400 audit(1787329345.040:138): avc: denied { open } for pid=388 comm="getty" path="/run/utmp" dev="tmpfs" ino=2 scontext=system_u:system_r:getty_t tcontext=system_u:object_r:init_tmpfs_t tclass=file permissive=1 [ 34.749254][ T36] audit: type=1400 audit(1787329345.040:139): avc: denied { lock } for pid=388 comm="getty" path="/run/utmp" dev="tmpfs" ino=2 scontext=system_u:system_r:getty_t tcontext=system_u:object_r:init_tmpfs_t tclass=file permissive=1 syzkaller syzkaller login: [ 34.905681][ T45] usb 1-1: Using ep0 maxpacket: 8 [ 34.911891][ T45] usb 1-1: config 1 interface 2 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 34.924822][ T45] usb 1-1: config 1 interface 1 has no altsetting 1 [ 34.933392][ T45] usb 1-1: New USB device found, idVendor=1a86, idProduct=752d, bcdDevice= 0.40 [ 34.942652][ T45] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 34.950729][ T45] usb 1-1: Product: syz [ 34.954982][ T45] usb 1-1: Manufacturer: syz [ 34.959658][ T45] usb 1-1: SerialNumber: syz [ 35.085918][ T10] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 35.171063][ T45] snd-usb-audio 1-1:1.1: probe with driver snd-usb-audio failed with error -2 [ 35.181878][ T45] usb 1-1: USB disconnect, device number 2 [ 35.216701][ T36] audit: type=1400 audit(1787329345.570:140): avc: denied { read } for pid=396 comm="syz.1.30" dev="nsfs" ino=4026532335 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 35.239058][ T36] audit: type=1400 audit(1787329345.600:141): avc: denied { open } for pid=396 comm="syz.1.30" path="net:[4026532335]" dev="nsfs" ino=4026532335 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 35.262236][ T10] usb 4-1: Using ep0 maxpacket: 32 [ 35.270719][ T397] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=1411 sclass=netlink_xfrm_socket pid=397 comm=syz.1.30 [ 35.275413][ T36] audit: type=1400 audit(1787329345.600:142): avc: denied { create } for pid=396 comm="syz.1.30" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 35.285162][ T10] usb 4-1: unable to get BOS descriptor or descriptor too short [ 35.307140][ T36] audit: type=1400 audit(1787329345.630:143): avc: denied { getopt } for pid=396 comm="syz.1.30" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 35.310859][ T397] netlink: 36 bytes leftover after parsing attributes in process `syz.1.30'. [ 35.332576][ T36] audit: type=1400 audit(1787329345.630:144): avc: denied { bind } for pid=396 comm="syz.1.30" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 35.340000][ T10] usb 4-1: config 1 interface 2 altsetting 1 endpoint 0x82 has invalid maxpacket 2015, setting to 1024 [ 35.359694][ T36] audit: type=1400 audit(1787329345.630:145): avc: denied { setopt } for pid=396 comm="syz.1.30" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 35.385446][ T10] usb 4-1: New USB device found, idVendor=0582, idProduct=00e6, bcdDevice= 0.40 [ 35.398426][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 35.406500][ T10] usb 4-1: Product: syz [ 35.413169][ T10] usb 4-1: Manufacturer: syz [ 35.417929][ T10] usb 4-1: SerialNumber: syz [ 35.452200][ T36] audit: type=1400 audit(1787329345.800:146): avc: denied { execute } for pid=398 comm="syz.1.31" name="file0" dev="tmpfs" ino=49 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 35.452250][ T399] process 'syz.1.31' launched './file0' with NULL argv: empty string added [ 35.630428][ T10] usb 4-1: unit 163 not found! [ 35.639115][ T10] usb 4-1: USB disconnect, device number 2 [ 35.678456][ T410] syz.1.36 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 35.806555][ T321] udevd[321]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 36.395390][ T478] device-mapper: ioctl: ioctl interface mismatch: kernel(4.48.0), user(0.0.0), cmd(9) [ 36.422918][ T482] netlink: 12 bytes leftover after parsing attributes in process `syz.0.69'. [ 36.465533][ T486] device-mapper: ioctl: Invalid ioctl structure: name my, dev fc01 [ 36.491840][ T489] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 36.528384][ T493] capability: warning: `syz.3.73' uses 32-bit capabilities (legacy support in use) [ 37.164347][ T527] netlink: 260 bytes leftover after parsing attributes in process `syz.1.88'. [ 37.185799][ T527] netlink: 124 bytes leftover after parsing attributes in process `syz.1.88'. [ 37.856933][ T568] loop7: detected capacity change from 0 to 16384 [ 38.101662][ T570] loop7: detected capacity change from 16384 to 0 [ 38.109510][ C0] I/O error, dev loop7, sector 8200 op 0x0:(READ) flags 0x80700 phys_seg 30 prio class 2 [ 38.627839][ T342] ------------[ cut here ]------------ [ 38.633453][ T342] kobject: '(null)' (ffff88811cdec548): is not initialized, yet kobject_put() is being called. [ 38.678563][ T342] WARNING: CPU: 0 PID: 342 at lib/kobject.c:736 kobject_put+0x8e/0x2a0 [ 38.687073][ T342] Modules linked in: [ 38.691011][ T342] CPU: 0 UID: 0 PID: 342 Comm: syz.2.14 Not tainted syzkaller #0 1b627ac51616646c2b03e03cc27ccf1d06a70c9d [ 38.702414][ T342] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 38.712538][ T342] RIP: 0010:kobject_put+0x8e/0x2a0 [ 38.717805][ T342] Code: 48 b9 00 00 00 00 00 fc ff df 80 3c 08 00 74 08 48 89 df e8 44 e1 44 fc 48 8b 33 48 c7 c7 a0 07 9b 86 48 89 da e8 22 dd 68 fb <0f> 0b eb 0f e8 e9 04 ec fb e9 9c 01 00 00 e8 df 04 ec fb 4c 8d 7b [ 38.737481][ T342] RSP: 0018:ffffc9000b7cf1f8 EFLAGS: 00010246 [ 38.743594][ T342] RAX: ec6931483aae9200 RBX: ffff88811cdec548 RCX: 0000000000080000 [ 38.751669][ T342] RDX: ffffc90002254000 RSI: 0000000000047455 RDI: 0000000000047456 [ 38.759770][ T342] RBP: ffffc9000b7cf220 R08: 0000000000000003 R09: 0000000000000004 [ 38.767806][ T342] R10: dffffc0000000000 R11: fffffbfff0e9f34c R12: 00000000fffffff4 [ 38.775846][ T342] R13: ffff88811cdec584 R14: 1ffff110239bd8b0 R15: 0000000000000000 [ 38.783852][ T342] FS: 00007f4ed13c56c0(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 38.792843][ T342] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 38.799499][ T342] CR2: 00007fcc8ff58060 CR3: 000000010fb20000 CR4: 00000000003526b0 [ 38.807551][ T342] Call Trace: [ 38.810864][ T342] [ 38.813823][ T342] put_device+0x23/0x40 [ 38.818049][ T342] __scsi_remove_device+0xc4/0x3c0 [ 38.823205][ T342] scsi_alloc_sdev+0x970/0xcc0 [ 38.828050][ T342] ? scsi_target_destroy+0x300/0x300 [ 38.833390][ T342] ? vsnprintf+0x19ef/0x1ad0 [ 38.838069][ T342] ? _raw_spin_unlock_irqrestore+0x4a/0x70 [ 38.843928][ T342] scsi_probe_and_add_lun+0x1e9/0x3e60 [ 38.849491][ T342] ? __cfi_preempt_schedule_irq+0x10/0x10 [ 38.855285][ T342] ? __cfi_kvasprintf+0x10/0x10 [ 38.860208][ T342] ? irqentry_exit+0x4a/0x60 [ 38.864841][ T342] ? sysvec_reschedule_ipi+0x72/0x80 [ 38.870192][ T342] ? scsi_alloc_target+0xc50/0xc50 [ 38.875440][ T342] ? __kasan_check_write+0x18/0x20 [ 38.880617][ T342] ? mutex_unlock+0x90/0x240 [ 38.885242][ T342] ? __cfi_mutex_unlock+0x10/0x10 [ 38.890310][ T342] ? rpm_resume+0xb92/0x1670 [ 38.894961][ T342] ? __cfi_transport_setup_classdev+0x10/0x10 [ 38.901134][ T342] ? __pm_runtime_resume+0xa0/0xa0 [ 38.906328][ T342] ? _raw_spin_lock_irqsave+0xc1/0x160 [ 38.911860][ T342] ? __cfi__raw_spin_lock_irqsave+0x10/0x10 [ 38.917825][ T342] ? _raw_spin_unlock_irqrestore+0x4a/0x70 [ 38.923711][ T342] ? __pm_runtime_resume+0x7a/0xa0 [ 38.928922][ T342] __scsi_scan_target+0x1f1/0xc20 [ 38.934035][ T342] ? scsi_scan_target+0x270/0x270 [ 38.939184][ T342] ? __pm_runtime_resume+0xa0/0xa0 [ 38.944333][ T342] ? _raw_spin_lock_irqsave+0xc1/0x160 [ 38.949855][ T342] ? __kasan_check_write+0x18/0x20 [ 38.955018][ T342] ? _raw_spin_unlock_irqrestore+0x4a/0x70 [ 38.960925][ T342] ? __pm_runtime_resume+0x7a/0xa0 [ 38.966157][ T342] scsi_scan_host_selected+0x352/0x610 [ 38.971678][ T342] store_scan+0x4ba/0x550 [ 38.976117][ T342] ? __cfi_store_scan+0x10/0x10 [ 38.981026][ T342] ? _copy_from_iter+0x215/0x1520 [ 38.986164][ T342] ? __virt_addr_valid+0x2a1/0x370 [ 38.991334][ T342] ? __kasan_check_write+0x18/0x20 [ 38.996533][ T342] ? __cfi_store_scan+0x10/0x10 [ 39.001429][ T342] dev_attr_store+0x76/0xa0 [ 39.006007][ T342] ? __cfi_dev_attr_store+0x10/0x10 [ 39.011248][ T342] sysfs_kf_write+0x13e/0x160 [ 39.016069][ T342] ? __cfi_sysfs_kf_write+0x10/0x10 [ 39.021313][ T342] kernfs_fop_write_iter+0x316/0x510 [ 39.026731][ T342] vfs_write+0x75f/0xfd0 [ 39.031084][ T342] ? __cfi_vfs_write+0x10/0x10 [ 39.035944][ T342] ? __cfi_mutex_lock+0x10/0x10 [ 39.040846][ T342] ksys_write+0x145/0x260 [ 39.045219][ T342] ? xfd_validate_state+0x68/0x140 [ 39.050404][ T342] ? __cfi_ksys_write+0x10/0x10 [ 39.055303][ T342] ? __kasan_check_write+0x18/0x20 [ 39.060507][ T342] ? fpregs_restore_userregs+0x11c/0x260 [ 39.066218][ T342] __x64_sys_write+0x7f/0x90 [ 39.070855][ T342] x64_sys_call+0x271c/0x2ee0 [ 39.075570][ T342] do_syscall_64+0x57/0xf0 [ 39.080091][ T342] ? clear_bhb_loop+0x50/0xa0 [ 39.084793][ T342] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 39.090783][ T342] RIP: 0033:0x7f4ed059e0d9 [ 39.095246][ T342] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 39.114928][ T342] RSP: 002b:00007f4ed13c5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 39.123410][ T342] RAX: ffffffffffffffda RBX: 00007f4ed0825fa0 RCX: 00007f4ed059e0d9 [ 39.131501][ T342] RDX: 0000000000000005 RSI: 0000200000001400 RDI: 0000000000000003 [ 39.139540][ T342] RBP: 00007f4ed0635024 R08: 0000000000000000 R09: 0000000000000000 [ 39.147602][ T342] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 39.155640][ T342] R13: 00007f4ed0826038 R14: 00007f4ed0825fa0 R15: 00007fff2acabcf8 [ 39.163668][ T342] [ 39.166764][ T342] ---[ end trace 0000000000000000 ]--- [ 39.172290][ T342] ------------[ cut here ]------------ [ 39.177821][ T342] refcount_t: underflow; use-after-free. [ 39.184051][ T342] WARNING: CPU: 1 PID: 342 at lib/refcount.c:28 refcount_warn_saturate+0x119/0x1c0 [ 39.193464][ T342] Modules linked in: [ 39.197426][ T342] CPU: 1 UID: 0 PID: 342 Comm: syz.2.14 Tainted: G W syzkaller #0 1b627ac51616646c2b03e03cc27ccf1d06a70c9d [ 39.210270][ T342] Tainted: [W]=WARN [ 39.214095][ T342] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 39.224211][ T342] RIP: 0010:refcount_warn_saturate+0x119/0x1c0 [ 39.230488][ T342] Code: 05 01 48 c7 c7 c0 f0 51 86 e8 23 44 55 fe 0f 0b eb da e8 ea 6b d8 fe c6 05 68 49 36 05 01 48 c7 c7 20 f1 51 86 e8 07 44 55 fe <0f> 0b eb be e8 ce 6b d8 fe c6 05 49 49 36 05 01 48 c7 c7 60 f0 51 [ 39.250201][ T342] RSP: 0018:ffffc9000b7cf1d8 EFLAGS: 00010246 [ 39.256353][ T342] RAX: ec6931483aae9200 RBX: 0000000000000003 RCX: 0000000000080000 [ 39.264352][ T342] RDX: ffffc90002254000 RSI: 000000000007ffff RDI: 0000000000080000 [ 39.272376][ T342] RBP: ffffc9000b7cf1e8 R08: 0000000000000003 R09: 0000000000000004 [ 39.280421][ T342] R10: dffffc0000000000 R11: fffffbfff0e9f34c R12: 0000000000000000 [ 39.288462][ T342] R13: ffff88811cdec584 R14: ffff88811cdec580 R15: ffff88811cdec580 [ 39.296483][ T342] FS: 00007f4ed13c56c0(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 39.305455][ T342] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 39.312117][ T342] CR2: 00007fcc8f3ef2f8 CR3: 000000010fb20000 CR4: 00000000003526b0 [ 39.320176][ T342] Call Trace: [ 39.323470][ T342] [ 39.326443][ T342] kobject_put+0x25a/0x2a0 [ 39.330896][ T342] put_device+0x23/0x40 [ 39.335068][ T342] __scsi_remove_device+0xc4/0x3c0 [ 39.340256][ T342] scsi_alloc_sdev+0x970/0xcc0 [ 39.345061][ T342] ? scsi_target_destroy+0x300/0x300 [ 39.350408][ T342] ? vsnprintf+0x19ef/0x1ad0 [ 39.355036][ T342] ? _raw_spin_unlock_irqrestore+0x4a/0x70 [ 39.360906][ T342] scsi_probe_and_add_lun+0x1e9/0x3e60 [ 39.366463][ T342] ? __cfi_preempt_schedule_irq+0x10/0x10 [ 39.372206][ T342] ? __cfi_kvasprintf+0x10/0x10 [ 39.377115][ T342] ? irqentry_exit+0x4a/0x60 [ 39.381744][ T342] ? sysvec_reschedule_ipi+0x72/0x80 [ 39.387091][ T342] ? scsi_alloc_target+0xc50/0xc50 [ 39.392240][ T342] ? __kasan_check_write+0x18/0x20 [ 39.397431][ T342] ? mutex_unlock+0x90/0x240 [ 39.402064][ T342] ? __cfi_mutex_unlock+0x10/0x10 [ 39.407146][ T342] ? rpm_resume+0xb92/0x1670 [ 39.411769][ T342] ? __cfi_transport_setup_classdev+0x10/0x10 [ 39.417922][ T342] ? __pm_runtime_resume+0xa0/0xa0 [ 39.423085][ T342] ? _raw_spin_lock_irqsave+0xc1/0x160 [ 39.428628][ T342] ? __cfi__raw_spin_lock_irqsave+0x10/0x10 [ 39.434588][ T342] ? _raw_spin_unlock_irqrestore+0x4a/0x70 [ 39.440470][ T342] ? __pm_runtime_resume+0x7a/0xa0 [ 39.445674][ T342] __scsi_scan_target+0x1f1/0xc20 [ 39.450733][ T342] ? scsi_scan_target+0x270/0x270 [ 39.455815][ T342] ? __pm_runtime_resume+0xa0/0xa0 [ 39.460962][ T342] ? _raw_spin_lock_irqsave+0xc1/0x160 [ 39.466524][ T342] ? __kasan_check_write+0x18/0x20 [ 39.471715][ T342] ? _raw_spin_unlock_irqrestore+0x4a/0x70 [ 39.477596][ T342] ? __pm_runtime_resume+0x7a/0xa0 [ 39.482767][ T342] scsi_scan_host_selected+0x352/0x610 [ 39.488297][ T342] store_scan+0x4ba/0x550 [ 39.492672][ T342] ? __cfi_store_scan+0x10/0x10 [ 39.497604][ T342] ? _copy_from_iter+0x215/0x1520 [ 39.502689][ T342] ? __virt_addr_valid+0x2a1/0x370 [ 39.507895][ T342] ? __kasan_check_write+0x18/0x20 [ 39.513049][ T342] ? __cfi_store_scan+0x10/0x10 [ 39.517984][ T342] dev_attr_store+0x76/0xa0 [ 39.522524][ T342] ? __cfi_dev_attr_store+0x10/0x10 [ 39.527825][ T342] sysfs_kf_write+0x13e/0x160 [ 39.532535][ T342] ? __cfi_sysfs_kf_write+0x10/0x10 [ 39.537793][ T342] kernfs_fop_write_iter+0x316/0x510 [ 39.543125][ T342] vfs_write+0x75f/0xfd0 [ 39.547500][ T342] ? __cfi_vfs_write+0x10/0x10 [ 39.552297][ T342] ? __cfi_mutex_lock+0x10/0x10 [ 39.557212][ T342] ksys_write+0x145/0x260 [ 39.561591][ T342] ? xfd_validate_state+0x68/0x140 [ 39.566772][ T342] ? __cfi_ksys_write+0x10/0x10 [ 39.571674][ T342] ? __kasan_check_write+0x18/0x20 [ 39.576851][ T342] ? fpregs_restore_userregs+0x11c/0x260 [ 39.582522][ T342] __x64_sys_write+0x7f/0x90 [ 39.587175][ T342] x64_sys_call+0x271c/0x2ee0 [ 39.591898][ T342] do_syscall_64+0x57/0xf0 [ 39.596377][ T342] ? clear_bhb_loop+0x50/0xa0 [ 39.601086][ T342] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 39.607061][ T342] RIP: 0033:0x7f4ed059e0d9 [ 39.611513][ T342] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 39.631175][ T342] RSP: 002b:00007f4ed13c5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 39.639664][ T342] RAX: ffffffffffffffda RBX: 00007f4ed0825fa0 RCX: 00007f4ed059e0d9 [ 39.647741][ T342] RDX: 0000000000000005 RSI: 0000200000001400 RDI: 0000000000000003 [ 39.655793][ T342] RBP: 00007f4ed0635024 R08: 0000000000000000 R09: 0000000000000000 [ 39.663788][ T342] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 39.671820][ T342] R13: 00007f4ed0826038 R14: 00007f4ed0825fa0 R15: 00007fff2acabcf8 [ 39.679872][ T342] [ 39.682916][ T342] ---[ end trace 0000000000000000 ]--- [ 39.706438][ T342] ------------[ cut here ]------------ [ 39.712005][ T342] kobject: '(null)' (ffff88811cdec1d0): is not initialized, yet kobject_put() is being called. [ 39.722699][ T342] WARNING: CPU: 0 PID: 342 at lib/kobject.c:736 kobject_put+0x8e/0x2a0 [ 39.731002][ T342] Modules linked in: [ 39.734915][ T342] CPU: 0 UID: 0 PID: 342 Comm: syz.2.14 Tainted: G W syzkaller #0 1b627ac51616646c2b03e03cc27ccf1d06a70c9d [ 39.747735][ T342] Tainted: [W]=WARN [ 39.751564][ T342] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 39.761685][ T342] RIP: 0010:kobject_put+0x8e/0x2a0 [ 39.766903][ T342] Code: 48 b9 00 00 00 00 00 fc ff df 80 3c 08 00 74 08 48 89 df e8 44 e1 44 fc 48 8b 33 48 c7 c7 a0 07 9b 86 48 89 da e8 22 dd 68 fb <0f> 0b eb 0f e8 e9 04 ec fb e9 9c 01 00 00 e8 df 04 ec fb 4c 8d 7b [ 39.786594][ T342] RSP: 0018:ffffc9000b7cf1f8 EFLAGS: 00010246 [ 39.792689][ T342] RAX: ec6931483aae9200 RBX: ffff88811cdec1d0 RCX: 0000000000080000 [ 39.800734][ T342] RDX: ffffc90002254000 RSI: 000000000007ffff RDI: 0000000000080000 [ 39.808763][ T342] RBP: ffffc9000b7cf220 R08: 0000000000000003 R09: 0000000000000004 [ 39.816811][ T342] R10: dffffc0000000000 R11: fffffbfff0e9f34c R12: ffffffff86630e90 [ 39.824827][ T342] R13: ffff88811cdec20c R14: 1ffff110239bd841 R15: 0000000000000000 [ 39.832853][ T342] FS: 00007f4ed13c56c0(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 39.841840][ T342] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 39.848488][ T342] CR2: 00007fcc8ff58060 CR3: 000000010fb20000 CR4: 00000000003526b0 [ 39.856529][ T342] Call Trace: [ 39.859837][ T342] [ 39.862778][ T342] put_device+0x23/0x40 [ 39.867035][ T342] __scsi_remove_device+0x32d/0x3c0 [ 39.872291][ T342] scsi_alloc_sdev+0x970/0xcc0 [ 39.877121][ T342] ? scsi_target_destroy+0x300/0x300 [ 39.882462][ T342] ? vsnprintf+0x19ef/0x1ad0 [ 39.887137][ T342] ? _raw_spin_unlock_irqrestore+0x4a/0x70 [ 39.892986][ T342] scsi_probe_and_add_lun+0x1e9/0x3e60 [ 39.898536][ T342] ? __cfi_preempt_schedule_irq+0x10/0x10 [ 39.904298][ T342] ? __cfi_kvasprintf+0x10/0x10 [ 39.909224][ T342] ? irqentry_exit+0x4a/0x60 [ 39.913849][ T342] ? sysvec_reschedule_ipi+0x72/0x80 [ 39.919203][ T342] ? scsi_alloc_target+0xc50/0xc50 [ 39.924353][ T342] ? __kasan_check_write+0x18/0x20 [ 39.929526][ T342] ? mutex_unlock+0x90/0x240 [ 39.934146][ T342] ? __cfi_mutex_unlock+0x10/0x10 [ 39.939259][ T342] ? rpm_resume+0xb92/0x1670 [ 39.943899][ T342] ? __cfi_transport_setup_classdev+0x10/0x10 [ 39.950031][ T342] ? __pm_runtime_resume+0xa0/0xa0 [ 39.955204][ T342] ? _raw_spin_lock_irqsave+0xc1/0x160 [ 39.960728][ T342] ? __cfi__raw_spin_lock_irqsave+0x10/0x10 [ 39.966700][ T342] ? _raw_spin_unlock_irqrestore+0x4a/0x70 [ 39.972539][ T342] ? __pm_runtime_resume+0x7a/0xa0 [ 39.977705][ T342] __scsi_scan_target+0x1f1/0xc20 [ 39.982766][ T342] ? scsi_scan_target+0x270/0x270 [ 39.987859][ T342] ? __pm_runtime_resume+0xa0/0xa0 [ 39.993000][ T342] ? _raw_spin_lock_irqsave+0xc1/0x160 [ 39.998519][ T342] ? __kasan_check_write+0x18/0x20 [ 40.003673][ T342] ? _raw_spin_unlock_irqrestore+0x4a/0x70 [ 40.009580][ T342] ? __pm_runtime_resume+0x7a/0xa0 [ 40.014731][ T342] scsi_scan_host_selected+0x352/0x610 [ 40.020285][ T342] store_scan+0x4ba/0x550 [ 40.024661][ T342] ? __cfi_store_scan+0x10/0x10 [ 40.029585][ T342] ? _copy_from_iter+0x215/0x1520 [ 40.034733][ T342] ? __virt_addr_valid+0x2a1/0x370 [ 40.039924][ T342] ? __kasan_check_write+0x18/0x20 [ 40.045094][ T342] ? __cfi_store_scan+0x10/0x10 [ 40.050034][ T342] dev_attr_store+0x76/0xa0 [ 40.054576][ T342] ? __cfi_dev_attr_store+0x10/0x10 [ 40.059836][ T342] sysfs_kf_write+0x13e/0x160 [ 40.064552][ T342] ? __cfi_sysfs_kf_write+0x10/0x10 [ 40.069808][ T342] kernfs_fop_write_iter+0x316/0x510 [ 40.075137][ T342] vfs_write+0x75f/0xfd0 [ 40.079706][ T342] ? __cfi_vfs_write+0x10/0x10 [ 40.084500][ T342] ? __cfi_mutex_lock+0x10/0x10 [ 40.089419][ T342] ksys_write+0x145/0x260 [ 40.093782][ T342] ? xfd_validate_state+0x68/0x140 [ 40.098959][ T342] ? __cfi_ksys_write+0x10/0x10 [ 40.103839][ T342] ? __kasan_check_write+0x18/0x20 [ 40.109011][ T342] ? fpregs_restore_userregs+0x11c/0x260 [ 40.114680][ T342] __x64_sys_write+0x7f/0x90 [ 40.119324][ T342] x64_sys_call+0x271c/0x2ee0 [ 40.124032][ T342] do_syscall_64+0x57/0xf0 [ 40.128529][ T342] ? clear_bhb_loop+0x50/0xa0 [ 40.133236][ T342] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 40.139211][ T342] RIP: 0033:0x7f4ed059e0d9 [ 40.143655][ T342] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 40.163327][ T342] RSP: 002b:00007f4ed13c5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 40.171846][ T342] RAX: ffffffffffffffda RBX: 00007f4ed0825fa0 RCX: 00007f4ed059e0d9 [ 40.179869][ T342] RDX: 0000000000000005 RSI: 0000200000001400 RDI: 0000000000000003 [ 40.187992][ T342] RBP: 00007f4ed0635024 R08: 0000000000000000 R09: 0000000000000000 [ 40.196033][ T342] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 40.204030][ T342] R13: 00007f4ed0826038 R14: 00007f4ed0825fa0 R15: 00007fff2acabcf8 [ 40.212086][ T342] [ 40.215126][ T342] ---[ end trace 0000000000000000 ]--- [ 40.220875][ T342] scsi_alloc_sdev: Allocation failure during SCSI scanning, some SCSI devices might not be configured [ 40.232155][ T342] ------------[ cut here ]------------ [ 40.237703][ T342] kernel BUG at drivers/scsi/scsi_scan.c:594! [ 40.244168][ T342] Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI [ 40.251149][ T342] CPU: 1 UID: 0 PID: 342 Comm: syz.2.14 Tainted: G W syzkaller #0 1b627ac51616646c2b03e03cc27ccf1d06a70c9d [ 40.263930][ T342] Tainted: [W]=WARN [ 40.267758][ T342] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 40.277825][ T342] RIP: 0010:scsi_target_reap+0x172/0x180 [ 40.283482][ T342] Code: 81 fe e9 ef fe ff ff 44 89 e9 80 e1 07 80 c1 03 38 c1 0f 8c 46 ff ff ff 4c 89 ef e8 18 9b 81 fe e9 39 ff ff ff e8 fe be 28 fe <0f> 0b 66 2e 0f 1f 84 00 00 00 00 00 66 90 b8 3f d2 b0 f6 90 90 90 [ 40.303101][ T342] RSP: 0018:ffffc9000b7cf7a8 EFLAGS: 00010246 [ 40.309199][ T342] RAX: ffffffff835eb2c2 RBX: ffff888132523800 RCX: 0000000000080000 [ 40.317193][ T342] RDX: ffffc90002254000 RSI: 000000000007ffff RDI: 0000000000080000 [ 40.325175][ T342] RBP: ffffc9000b7cf7d0 R08: 0000000000000003 R09: 0000000000000004 [ 40.333209][ T342] R10: dffffc0000000000 R11: fffff520016f9ee0 R12: ffff888132523800 [ 40.341211][ T342] R13: ffff888132523bc4 R14: 1ffff110264a4778 R15: 0000000000000005 [ 40.349206][ T342] FS: 00007f4ed13c56c0(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 40.358161][ T342] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 40.364790][ T342] CR2: 00007fcc8f3ef2f8 CR3: 000000010fb20000 CR4: 00000000003526b0 [ 40.372802][ T342] Call Trace: [ 40.376124][ T342] [ 40.379220][ T342] __scsi_scan_target+0x62c/0xc20 [ 40.384471][ T342] ? scsi_scan_target+0x270/0x270 [ 40.389528][ T342] ? __pm_runtime_resume+0xa0/0xa0 [ 40.394665][ T342] ? _raw_spin_lock_irqsave+0xc1/0x160 [ 40.400162][ T342] ? __kasan_check_write+0x18/0x20 [ 40.405304][ T342] ? _raw_spin_unlock_irqrestore+0x4a/0x70 [ 40.411151][ T342] ? __pm_runtime_resume+0x7a/0xa0 [ 40.416281][ T342] scsi_scan_host_selected+0x352/0x610 [ 40.421772][ T342] store_scan+0x4ba/0x550 [ 40.426141][ T342] ? __cfi_store_scan+0x10/0x10 [ 40.431109][ T342] ? _copy_from_iter+0x215/0x1520 [ 40.436181][ T342] ? __virt_addr_valid+0x2a1/0x370 [ 40.441320][ T342] ? __kasan_check_write+0x18/0x20 [ 40.446476][ T342] ? __cfi_store_scan+0x10/0x10 [ 40.451383][ T342] dev_attr_store+0x76/0xa0 [ 40.456012][ T342] ? __cfi_dev_attr_store+0x10/0x10 [ 40.461235][ T342] sysfs_kf_write+0x13e/0x160 [ 40.465944][ T342] ? __cfi_sysfs_kf_write+0x10/0x10 [ 40.471334][ T342] kernfs_fop_write_iter+0x316/0x510 [ 40.476677][ T342] vfs_write+0x75f/0xfd0 [ 40.480948][ T342] ? __cfi_vfs_write+0x10/0x10 [ 40.485728][ T342] ? __cfi_mutex_lock+0x10/0x10 [ 40.490609][ T342] ksys_write+0x145/0x260 [ 40.494953][ T342] ? xfd_validate_state+0x68/0x140 [ 40.500108][ T342] ? __cfi_ksys_write+0x10/0x10 [ 40.505002][ T342] ? __kasan_check_write+0x18/0x20 [ 40.510150][ T342] ? fpregs_restore_userregs+0x11c/0x260 [ 40.515829][ T342] __x64_sys_write+0x7f/0x90 [ 40.520436][ T342] x64_sys_call+0x271c/0x2ee0 [ 40.525161][ T342] do_syscall_64+0x57/0xf0 [ 40.529623][ T342] ? clear_bhb_loop+0x50/0xa0 [ 40.534355][ T342] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 40.540294][ T342] RIP: 0033:0x7f4ed059e0d9 [ 40.544814][ T342] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 40.564716][ T342] RSP: 002b:00007f4ed13c5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 40.573184][ T342] RAX: ffffffffffffffda RBX: 00007f4ed0825fa0 RCX: 00007f4ed059e0d9 [ 40.581181][ T342] RDX: 0000000000000005 RSI: 0000200000001400 RDI: 0000000000000003 [ 40.589260][ T342] RBP: 00007f4ed0635024 R08: 0000000000000000 R09: 0000000000000000 [ 40.597282][ T342] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 40.605290][ T342] R13: 00007f4ed0826038 R14: 00007f4ed0825fa0 R15: 00007fff2acabcf8 [ 40.613410][ T342] [ 40.616470][ T342] Modules linked in: [ 40.620508][ T342] ---[ end trace 0000000000000000 ]--- [ 40.626868][ T342] RIP: 0010:scsi_target_reap+0x172/0x180 [ 40.632578][ T342] Code: 81 fe e9 ef fe ff ff 44 89 e9 80 e1 07 80 c1 03 38 c1 0f 8c 46 ff ff ff 4c 89 ef e8 18 9b 81 fe e9 39 ff ff ff e8 fe be 28 fe <0f> 0b 66 2e 0f 1f 84 00 00 00 00 00 66 90 b8 3f d2 b0 f6 90 90 90 [ 40.652337][ T342] RSP: 0018:ffffc9000b7cf7a8 EFLAGS: 00010246 [ 40.658483][ T342] RAX: ffffffff835eb2c2 RBX: ffff888132523800 RCX: 0000000000080000 [ 40.666559][ T342] RDX: ffffc90002254000 RSI: 000000000007ffff RDI: 0000000000080000 [ 40.674581][ T342] RBP: ffffc9000b7cf7d0 R08: 0000000000000003 R09: 0000000000000004 [ 40.682650][ T342] R10: dffffc0000000000 R11: fffff520016f9ee0 R12: ffff888132523800 [ 40.690687][ T342] R13: ffff888132523bc4 R14: 1ffff110264a4778 R15: 0000000000000005 [ 40.698762][ T342] FS: 00007f4ed13c56c0(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 40.708003][ T342] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 40.714629][ T342] CR2: 00007fcc8f3ef2f8 CR3: 000000010fb20000 CR4: 00000000003526b0 [ 40.722673][ T342] Kernel panic - not syncing: Fatal exception [ 40.729367][ T342] Kernel Offset: disabled [ 40.733704][ T342] Rebooting in 86400 seconds..