last executing test programs: 17.580195153s ago: executing program 0 (id=22): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CAP_DIRTY_LOG_RING(r1, 0x4068aea3, &(0x7f0000000040)={0xc0, 0x0, 0x10000}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x0, 0x1, 0x0, 0x10000, 0xfffffffffffffffd}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) mmap(0x0, 0x10000, 0x3, 0x11, r2, 0x40000) r3 = eventfd2(0x2, 0x0) read$eventfd(r3, &(0x7f0000000100), 0x8) ioctl$KVM_RESET_DIRTY_RINGS(r1, 0xaec7) 17.579904832s ago: executing program 0 (id=23): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/module/gspca_m5602/parameters/force_sensor\x00', 0x1, 0x0) write(r0, &(0x7f0000000400)='4', 0x1) close(r0) r1 = syz_usb_connect(0x0, 0x2b, &(0x7f0000000700)=ANY=[@ANYBLOB="1201000200000040020402560001010203010902190001010080320904000001ffffff0007058102000200"], 0x0) syz_usb_control_io(r1, 0x0, &(0x7f0000000140)={0x84, &(0x7f0000000240)={0x40, 0x4, 0x2, "3a14"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r1, 0x0, &(0x7f0000000340)={0x84, &(0x7f0000000440)={0x40, 0x4, 0x2, "3a14"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r1, 0x0, &(0x7f0000000480)={0x84, &(0x7f0000000540)={0x40, 0x4, 0x2, "3a14"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r1, 0x0, &(0x7f0000000580)={0x84, &(0x7f0000000640)={0x40, 0x4, 0x2, "3a14"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r1, 0x0, &(0x7f0000000740)={0x84, &(0x7f0000000800)={0x40, 0x4, 0x2, "3a14"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 16.193984428s ago: executing program 3 (id=25): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sys\x00', 0x1ff) mount(&(0x7f0000000200)=@filename='sysfs\x00', &(0x7f0000000300)='./sys\x00', &(0x7f0000000400)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/power/pm_test\x00', 0x2, 0x0) write(r1, &(0x7f0000000600)='freezer\n', 0x8) r2 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/power/state\x00', 0x2, 0x0) write(r2, &(0x7f0000000800)='disk\n', 0x5) 16.136105669s ago: executing program 3 (id=26): r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002e00101408780250001000000000109022700010100c0320904000003e0010100070581034000010705820240000007050202400000"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r1, 0x400448c9, 0x0) syz_usb_ep_write(r0, 0x81, 0x8, &(0x7f0000000100)="ff06878003010100") 15.801680838s ago: executing program 2 (id=27): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_NEW_INTERFACE(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000400)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010000000000000000000700000008000100000000000a0004007770616e30000000000800050001000000"], 0x30}}, 0x0) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000100)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_GET_SEC_DEVKEY(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000700)={0x1c, r1, 0x301, 0x0, 0x0, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r2}]}, 0x1c}}, 0x0) 15.781346098s ago: executing program 2 (id=28): syz_usb_connect$midi(0x3, 0x31, &(0x7f0000000740)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x40, 0x2a39, 0x3fd4, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1f, 0x1, 0x1, 0x7, 0x80, 0x1, "", {{{0x9, 0x4, 0x0, 0x0, 0x1, 0x1, 0x3, 0x30, 0xa, [], [{{0x9, 0x5, 0x828f68345dc74cce, 0x8, 0x3e7, 0x3, 0x85, 0x3, {0x4}}}]}}}}}]}}, 0x0) syz_usb_connect(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040990434120001000000010902240001010080320904000001ff0000000b2403010102010102010007050102400000"], 0x0) 14.652333077s ago: executing program 1 (id=32): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x97, 0xff, 0x82, 0x8, 0x1234, 0x5678, 0xc19b, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x8f, 0x0, 0x0, 0xbf, 0x57, 0x5a}}]}}]}}, 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) r1 = syz_open_dev$usbfs(&(0x7f0000000100), 0x19, 0x2) r2 = syz_open_dev$usbfs(&(0x7f0000000200), 0x19, 0x2) ioctl$USBDEVFS_SETCONFIGURATION(r1, 0x80045505, &(0x7f0000000400)=0x1) ioctl$USBDEVFS_SETCONFIGURATION(r2, 0x80045505, &(0x7f0000000400)=0x1) syz_usb_disconnect(r0) 14.561789169s ago: executing program 0 (id=33): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0) syz_usb_connect(0x3, 0x32, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000200000040c30b01000100000000010902200001010080320904000002ffffff000705810200020007050202000200"], 0x0) nanosleep(&(0x7f0000000140)={0x1}, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000180)='./dev/ttyUSB0\x00', 0x802, 0x0) 14.108266431s ago: executing program 2 (id=34): syz_usb_connect(0x0, 0x55, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002020000402505a7a400010000000109024300020100c032090400000102020000052400100104240202052406000105240100010705810308000a09040100020a0000000705820240000007050302400000"], 0x0) nanosleep(&(0x7f0000000300)={0x1, 0xa}, 0x0) r0 = syz_open_dev$usbfs(&(0x7f0000000100), 0x15, 0x2) ioctl$USBDEVFS_RESET(r0, 0x5514) 13.958096194s ago: executing program 4 (id=36): syz_usb_connect(0x0, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x97, 0xff, 0x82, 0x8, 0x2058, 0x1005, 0xc19b, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x8f, 0x0, 0x0, 0xbf, 0x57, 0x5a}}]}}]}}, 0x0) r0 = openat(0xffffff9c, &(0x7f0000000040)='file0\x00', 0x42, 0x1ff) write(r0, &(0x7f0000000080)='/dev/raw-gadget\x00', 0x10) close(r0) r1 = openat(0xffffff9c, &(0x7f00000000c0)='file0\x00', 0x0, 0x0) read(r1, &(0x7f0000000000)=""/16, 0x10) r2 = syz_open_dev$hidraw(0xfffffffffffffffc, 0x0, 0x2) ioctl(r2, 0x41015500, &(0x7f0000000100)='cdnsp-gadget\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00P') 13.704282431s ago: executing program 3 (id=37): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000140)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/ecm.usb0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) symlinkat(&(0x7f0000000240)='./config/usb_gadget/g1/functions/ecm.usb0\x00', 0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/configs/c.1/ecm.usb0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r0, &(0x7f0000000380)='dummy_udc.0\n\x00', 0xc) nanosleep(&(0x7f0000000300)={0x1}, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./sys/bus/usb/devices/5-1/bConfigurationValue\x00', 0x1, 0x0) write(r1, &(0x7f0000000500)='1\n\x00', 0x2) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) write(r1, &(0x7f0000000500)='0\n\x00', 0x2) 12.890501382s ago: executing program 3 (id=38): syz_usb_connect(0x0, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x97, 0xff, 0x82, 0x8, 0x2058, 0x1005, 0xc19b, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x8f, 0x0, 0x0, 0xbf, 0x57, 0x5a}}]}}]}}, 0x0) syz_usb_connect(0x0, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x40, 0x10c4, 0xea60, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x20, 0x1, 0x1, 0x0, 0x80, 0xfa, "", [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x40}}]}}]}}]}}, 0x0) 12.387364404s ago: executing program 4 (id=39): mkdir(&(0x7f0000000100)='./config_test\x00', 0x1ff) mount(&(0x7f0000000200)=@filename='none\x00', &(0x7f0000000300)='./config_test\x00', &(0x7f0000000400)='configfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000500)='./config_test/usb_gadget/g3\x00', 0x1ff) rmdir(&(0x7f0000000600)='./config_test/usb_gadget/g3\x00') getuid() 12.308219307s ago: executing program 4 (id=40): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000001c0)=[@text32={0x20, &(0x7f0000000480)="f00fb196000001000fc7ad094800000f07b8003000000f23c80f21f835000040000f23f82666d99e00d0ffff8fc860ece7d80f01c3c4c279ad210f0d020f20d835080000000f22d8", 0x48}], 0x1, 0x4, 0x0, 0x0) mmap$KVM_VCPU(&(0x7f0000009000/0x1000)=nil, 0x1000, 0x3, 0x11, r2, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_PRE_FAULT_MEMORY(r2, 0xc040aed5, &(0x7f0000000180)={0x0, 0x2000}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x1, 0x0, 0x0, &(0x7f0000000000/0x1000)=nil}) ioctl$KVM_SET_NR_MMU_PAGES(r1, 0xae44, 0x100) 12.286388377s ago: executing program 4 (id=41): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./gadget\x00', &(0x7f0000000100)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000180)="000000000902200001010080320904000002ff00000007058102400000070502024000000902200001010080320904000002ff0000000705810200020007050202000200120100020000004099999999000100000001", 0x56) nanosleep(&(0x7f0000000300)={0x0, 0x1ad27480}, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./gadget/ep1in-bulk\x00', 0x2, 0x0) write(r1, &(0x7f0000000240)="010000000705810240000007058102000200", 0x12) write(r1, &(0x7f0000000280)='hello', 0x5) nanosleep(&(0x7f0000000400)={0x0, 0x1dcd6500}, 0x0) 12.105176741s ago: executing program 1 (id=42): r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/drivers/ohci-platform/bind\x00', 0x1, 0x0) write(r0, &(0x7f00000001c0)='pcspkr\x00', 0x6) 12.052213073s ago: executing program 1 (id=43): r0 = openat$kvm(0x0, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0x0, 0x0) r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f0000000100)={0x0, &(0x7f0000000200)=[@enable_nested={0x0}, @nested_create_vm={0x0}, @nested_load_code={0x0, 0x0, {0x0, "48c7c00100000048c7c300000100660f388003f4"}}, @nested_vmlaunch={0x0}]}) r4 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r0, 0x0) mmap$KVM_VCPU(&(0x7f0000009000/0x1000)=nil, r4, 0x3, 0x11, r3, 0x0) ioctl$KVM_RUN(r3, 0x0, 0x0) 12.052017663s ago: executing program 1 (id=44): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f0000000100)={0x0, &(0x7f0000000200)=[@wrmsr={0x65, 0x20, {0x830, 0x4020}}, @uexit={0x0, 0x18}], 0x38}) ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f0000000300)={0x2, 0x0, [{0x1b, 0x0, 0xfee00d00}, {0x4b564d04, 0x0, 0xdddd0001}]}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000400)={[], 0x0, 0x202}) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) 12.039050763s ago: executing program 1 (id=45): syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000400a1150120000010200010902200001010080320904000002000000000705810240000007050202400000"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000140)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/usb/devices/1-1.2/power/control\x00', 0x1, 0x0) write(r0, &(0x7f0000000300)='auto\x00', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/usb/devices/1-1.2/power/autosuspend_delay_ms\x00', 0x1, 0x0) write(r1, &(0x7f0000000300)='0\x00', 0x1) nanosleep(&(0x7f0000000300)={0x1}, 0x0) write(r0, &(0x7f0000000300)='on\x00', 0x2) 12.031276763s ago: executing program 0 (id=46): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f0000000100)={0x0, &(0x7f0000000200)=[@wrmsr={0x65, 0x20, {0x40000000, 0x80000000}}, @out_dx={0x6a, 0x28, {0x10, 0x1, 0x80000000}}, @uexit={0x0, 0x18}], 0x60}) mmap$KVM_VCPU(&(0x7f0000009000/0x1000)=nil, 0x1000, 0x3, 0x11, r3, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000300)={0x0, 0x1, 0x0, 0x400000, &(0x7f0000c00000/0x400000)=nil}) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_GET_DIRTY_LOG(r1, 0x4010ae42, &(0x7f0000000400)={0x0, 0x0, &(0x7f000000b000/0x1000)=nil}) 11.945022156s ago: executing program 0 (id=47): syz_usb_connect$uac3(0x3, 0x80, &(0x7f00000003c0)=ANY=[@ANYBLOB="12010002000000408205820540000102030109026e000301c0c310080b000201223061090400000001013000"], 0x0) r0 = syz_open_dev$usbfs(&(0x7f0000000180), 0x0, 0x8041) ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, &(0x7f0000000200)=@usbdevfs_connect) nanosleep(&(0x7f0000000300)={0x1}, 0x0) 11.724938801s ago: executing program 2 (id=48): r0 = openat$kvm(0x0, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_TSC_KHZ_vm(r1, 0xaea2, 0x1e8480) r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f0000000100)={0x0, &(0x7f0000000200)=[@in_dx={0x0, 0x0, {0x123, 0x2}}, @out_dx={0x0, 0x0, {0x456, 0x4, 0xffffffff}}]}) r4 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r0, 0xae04) mmap$KVM_VCPU(&(0x7f0000009000/0x1000)=nil, r4, 0x3, 0x11, r3, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) 11.712007731s ago: executing program 4 (id=49): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./sys\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/pci/devices/0000:00:02.0/config\x00', 0x2, 0x0) pwrite64(r0, &(0x7f0000000180)='\a\x00', 0x2, 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./sys/bus/pci/devices/0000:00:02.0/resource0\x00', 0x2, 0x0) mmap(&(0x7f0000800000/0x1000)=nil, 0x1000, 0x3, 0x11, r1, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='file0\x00', 0x42, 0x1ff) pwrite64(r2, &(0x7f0000000240)="0000ffff1000000000010000", 0xc, 0xb0) pwrite64(r2, &(0x7f0000000280)="4349535300000000060100000200000000000000000000000000000000000000200000000000000080000000000000000000000000000000000000000000000040000000000000000000000020000000", 0x50, 0x100) pwrite64(r2, &(0x7f0000000300)="1000000000000000", 0x8, 0x1b4) lseek(r2, 0x0, 0x0) read(r2, &(0x7f0000800000)=""/512, 0x200) r3 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./sys/bus/pci/devices/0000:00:02.0/driver/unbind\x00', 0x1, 0x0) write(r3, &(0x7f0000000380)='0000:00:02.0\x00', 0xd) r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./sys/bus/pci/devices/0000:00:02.0/driver_override\x00', 0x1, 0x0) write(r4, &(0x7f0000000400)='hpsa\x00', 0x5) r5 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./sys/bus/pci/drivers/hpsa/bind\x00', 0x1, 0x0) write(r5, &(0x7f0000000480)='0000:00:02.0\x00', 0xd) 11.656063643s ago: executing program 4 (id=50): r0 = syz_usb_connect(0x3, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040109710780001010200010902270001010080320904000003ff000000070581020002000705010200020007058203400001"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000001000)={0x84, &(0x7f0000001010)={0x40, 0xd, 0x1, '\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) nanosleep(&(0x7f0000000600)={0x1}, 0x0) mkdir(&(0x7f0000003300)='./mysys\x00', 0x1ff) mount(&(0x7f0000003400)=@filename='none\x00', &(0x7f0000003500)='./mysys\x00', &(0x7f0000003600)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000003700)='./mysys/power/state\x00', 0x1, 0x0) write(r1, &(0x7f0000003800)='freeze\n\x00', 0x8) 11.655941783s ago: executing program 2 (id=51): syz_usb_connect(0x3, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000401e0903000100000000010902270001010080fa0904000003ff000000070581020002000705020200020007058303400001"], 0x0) nanosleep(&(0x7f0000000300)={0x3}, 0x0) r0 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) write(r0, &(0x7f0000000400)="100100ff1003", 0x6) 11.435228249s ago: executing program 3 (id=52): r0 = syz_usb_connect$cdc_ecm(0x0, 0x4d, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x2, 0x0, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x0, 0x0, 0xffffffffffff8001, 0x1, [{{0x9, 0x2, 0x3b, 0x1, 0x1, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x12, 0x2, 0x6, 0x0, 0x0, {{0x5}, {0x5}, {0xd}}, {[], {{0x9, 0x5, 0x82, 0x2, 0x200}}, {{0x9, 0x5, 0x3, 0x2, 0x200}}}}}]}}]}}, &(0x7f0000001400)={0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, &(0x7f0000000080)={0x14, 0x0, &(0x7f0000000040)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) syz_usb_ep_write(r0, 0x82, 0x5, &(0x7f0000002340)='hello') mknod(&(0x7f0000000100)='file0\x00', 0x81ff, 0xbc00) openat(0xffffffffffffff9c, &(0x7f0000000100)='file0\x00', 0x2, 0x0) 48.325469ms ago: executing program 3 (id=53): r0 = syz_usb_connect(0x3, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x1163, 0x100, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x81, 0x3, 0x8, 0x1}}, {{0x9, 0x5, 0x2, 0x3, 0x8, 0x1}}]}}]}}]}}, 0x0) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000100)='A') (async) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000100)='A') (async) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000100)='A') (async) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000100)='A') (async) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000100)='A') (async) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) write$char_usb(r1, &(0x7f0000000200)='A', 0x1) r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) write$char_usb(r2, &(0x7f0000000200)='A', 0x1) r3 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) write$char_usb(r3, &(0x7f0000000200)='A', 0x1) 246.96µs ago: executing program 2 (id=54): mkdir(&(0x7f0000000000)='./mysys\x00', 0x1ff) mount(&(0x7f0000000000), &(0x7f0000000100)='./mysys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/pci/devices/0000:00:01.0/driver/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000340)='0000:00:01.0\x00', 0xd) r1 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./mysys/bus/pci/devices/0000:00:02.0/driver/unbind\x00', 0x1, 0x0) write(r1, &(0x7f00000003c0)='0000:00:02.0\x00', 0xd) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./mysys/bus/pci/devices/0000:00:03.0/driver/unbind\x00', 0x1, 0x0) write(r2, &(0x7f0000000440)='0000:00:03.0\x00', 0xd) r3 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./mysys/bus/pci/devices/0000:00:04.0/driver/unbind\x00', 0x1, 0x0) write(r3, &(0x7f00000004c0)='0000:00:04.0\x00', 0xd) r4 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./mysys/bus/pci/devices/0000:00:05.0/driver/unbind\x00', 0x1, 0x0) write(r4, &(0x7f0000000540)='0000:00:05.0\x00', 0xd) r5 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./mysys/bus/pci/devices/0000:00:1d.0/driver/unbind\x00', 0x1, 0x0) write(r5, &(0x7f0000000740)='0000:00:1d.0\x00', 0xd) r6 = openat(0xffffffffffffff9c, &(0x7f0000000c00)='./mysys/bus/pci/drivers/xhci_hcd/bind\x00', 0x1, 0x0) write(r6, &(0x7f0000000c40)='0000:00:01.0\x00', 0xd) write(r6, &(0x7f0000000c80)='0000:00:02.0\x00', 0xd) write(r6, &(0x7f0000000cc0)='0000:00:03.0\x00', 0xd) write(r6, &(0x7f0000000d00)='0000:00:04.0\x00', 0xd) write(r6, &(0x7f0000000d40)='0000:00:05.0\x00', 0xd) write(r6, &(0x7f0000000e40)='0000:00:1d.0\x00', 0xd) 92.29µs ago: executing program 0 (id=55): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil) ioctl$KVM_GET_SUPPORTED_CPUID(r0, 0xc008ae05, &(0x7f0000000200)={0x100, 0x0, [{}]}) r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f0000000300)={0x0, &(0x7f0000000400)=[@wrmsr={0x65, 0x20, {0x1b, 0xfee00c00}}, @wrmsr={0x65, 0x20, {0x832, 0x40000}}, @wrmsr={0x65, 0x20, {0x6e0, 0x100000}}, @code={0xa, 0x12, {"f4"}}], 0x72}) ioctl$KVM_SET_CPUID2(r3, 0x4008ae90, &(0x7f0000000200)) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) 0s ago: executing program 1 (id=56): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000018105e04da07000000000001090224000100000000090400000903000000092100000001222200090581030800000000"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x22, 0x22, {[@global=@item_012={0x2, 0x1, 0x9, "2313"}, @global=@item_012={0x2, 0x1, 0x0, "e53f"}, @global=@item_4={0x3, 0x1, 0x0, '\f\x00'}, @local=@item_012={0x2, 0x2, 0x2, "9000"}, @global=@item_4={0x3, 0x1, 0x0, "0900be00"}, @main=@item_4={0x3, 0x0, 0x8}, @local=@item_4={0x3, 0x2, 0x0, "09007a15"}, @local=@item_4={0x3, 0x2, 0x0, "5d8c3dda"}]}}, 0x0}, 0x0) syz_usb_ep_write(r0, 0x81, 0x7, &(0x7f0000000000)='BBBBBBB') syz_usb_ep_write(r0, 0x81, 0x7, &(0x7f0000000000)='BBBBBBB') syz_usb_ep_write(r0, 0x81, 0x7, &(0x7f0000000000)='BBBBBBB') syz_usb_connect$hid(0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000000018105e04da07000000000001090224000100000000090400000903000000092100000001222200090581030800000000"], 0x0) 0s ago: executing program 1 (id=66): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0) write(r0, &(0x7f0000000180)='0x1d6b\x00', 0x6) r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0) write(r1, &(0x7f0000000200)='0x0104\x00', 0x6) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0) write(r2, &(0x7f00000002c0)='1234567890\x00', 0xb) r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/strings/0x409/manufacturer\x00', 0x2, 0x0) write(r3, &(0x7f0000000340)='Linux Foundation\x00', 0x11) r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/strings/0x409/product\x00', 0x2, 0x0) write(r4, &(0x7f00000003c0)='Test Gadget\x00', 0xc) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/functions/midi.usb0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/configs/c.1/strings/0x409\x00', 0x1ff) r5 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./config/usb_gadget/g1/configs/c.1/strings/0x409/configuration\x00', 0x2, 0x0) write(r5, &(0x7f0000000500)='Conf 1\x00', 0x7) r6 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/usb_gadget/g1/configs/c.1\x00', 0x0, 0x0) symlinkat(&(0x7f0000000580)='./config/usb_gadget/g1/functions/midi.usb0\x00', r6, &(0x7f00000005c0)='midi.usb0\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g1/configs/c.2\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000640)='./config/usb_gadget/g1/configs/c.2/strings/0x409\x00', 0x1ff) r7 = openat(0xffffffffffffff9c, &(0x7f0000000680)='./config/usb_gadget/g1/configs/c.2/strings/0x409/configuration\x00', 0x2, 0x0) write(r7, &(0x7f00000006c0)='Conf 2\x00', 0x7) r8 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./config/usb_gadget/g1/configs/c.2\x00', 0x0, 0x0) symlinkat(&(0x7f0000000580)='./config/usb_gadget/g1/functions/midi.usb0\x00', r8, &(0x7f0000000740)='midi.usb0\x00') r9 = openat(0xffffffffffffff9c, &(0x7f0000000780)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0) write(r9, &(0x7f00000007c0)='dummy_udc.0\x00', 0xb) nanosleep(&(0x7f0000000800)={0x0, 0x17d78400}, 0x0) r10 = openat(0xffffffffffffff9c, &(0x7f0000000840)='./sys/devices/platform/dummy_hcd.0/usb5/5-1/bConfigurationValue\x00', 0x2, 0x0) write(r10, &(0x7f00000008c0)='2\x00', 0x2) kernel console output (not intermixed with test programs): syzkaller syzkaller login: [ 13.611751][ T24] kauditd_printk_skb: 31 callbacks suppressed [ 13.611765][ T24] audit: type=1400 audit(1786952518.230:59): avc: denied { transition } for pid=215 comm="sshd-session" path="/bin/sh" dev="sda1" ino=90 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 13.623818][ T24] audit: type=1400 audit(1786952518.230:60): avc: denied { noatsecure } for pid=215 comm="sshd-session" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 13.630916][ T24] audit: type=1400 audit(1786952518.240:61): avc: denied { write } for pid=215 comm="sh" path="pipe:[13040]" dev="pipefs" ino=13040 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 13.653271][ T24] audit: type=1400 audit(1786952518.240:62): avc: denied { rlimitinh } for pid=215 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 13.672336][ T24] audit: type=1400 audit(1786952518.240:63): avc: denied { siginh } for pid=215 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 Warning: Permanently added '10.128.0.134' (ED25519) to the list of known hosts. [ 21.084544][ T24] audit: type=1400 audit(1786952525.700:64): avc: denied { mounton } for pid=271 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 21.088135][ T271] cgroup: Unknown subsys name 'net' [ 21.107444][ T24] audit: type=1400 audit(1786952525.700:65): avc: denied { mount } for pid=271 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 21.136280][ T24] audit: type=1400 audit(1786952525.740:66): avc: denied { unmount } for pid=271 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 21.136792][ T271] cgroup: Unknown subsys name 'devices' [ 21.280810][ T271] cgroup: Unknown subsys name 'hugetlb' [ 21.286585][ T271] cgroup: Unknown subsys name 'rlimit' [ 21.426637][ T24] audit: type=1400 audit(1786952526.040:67): avc: denied { setattr } for pid=271 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=253 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 21.450061][ T24] audit: type=1400 audit(1786952526.040:68): avc: denied { mounton } for pid=271 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 21.474923][ T24] audit: type=1400 audit(1786952526.040:69): avc: denied { mount } for pid=271 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 21.501848][ T273] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 21.510835][ T24] audit: type=1400 audit(1786952526.130:70): avc: denied { relabelto } for pid=273 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.536577][ T24] audit: type=1400 audit(1786952526.130:71): avc: denied { write } for pid=273 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.570259][ T24] audit: type=1400 audit(1786952526.190:72): avc: denied { read } for pid=271 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.596044][ T24] audit: type=1400 audit(1786952526.190:73): avc: denied { open } for pid=271 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.622236][ T271] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 22.323685][ T279] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.330866][ T279] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.338513][ T279] device bridge_slave_0 entered promiscuous mode [ 22.348446][ T281] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.355702][ T281] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.363347][ T281] device bridge_slave_0 entered promiscuous mode [ 22.372105][ T279] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.379339][ T279] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.387009][ T279] device bridge_slave_1 entered promiscuous mode [ 22.395663][ T281] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.402760][ T281] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.410258][ T281] device bridge_slave_1 entered promiscuous mode [ 22.436052][ T280] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.443679][ T280] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.451224][ T280] device bridge_slave_0 entered promiscuous mode [ 22.469746][ T283] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.476995][ T283] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.484680][ T283] device bridge_slave_0 entered promiscuous mode [ 22.491632][ T280] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.498813][ T280] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.506415][ T280] device bridge_slave_1 entered promiscuous mode [ 22.527161][ T283] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.534704][ T283] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.542571][ T283] device bridge_slave_1 entered promiscuous mode [ 22.598842][ T282] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.605910][ T282] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.613417][ T282] device bridge_slave_0 entered promiscuous mode [ 22.633505][ T282] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.640689][ T282] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.648368][ T282] device bridge_slave_1 entered promiscuous mode [ 22.744746][ T279] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.751848][ T279] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.759197][ T279] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.766267][ T279] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.821811][ T281] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.828899][ T281] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.836229][ T281] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.843296][ T281] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.858993][ T280] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.866802][ T280] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.874105][ T280] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.881162][ T280] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.896511][ T283] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.903633][ T283] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.910964][ T283] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.917998][ T283] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.927716][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 22.935571][ T49] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.942960][ T49] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.950605][ T49] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.957786][ T49] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.965061][ T49] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.972373][ T49] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.979628][ T49] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.986992][ T49] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.015025][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.023505][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.030604][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.038047][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.047230][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.054433][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.062081][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 23.069555][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.077131][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.085793][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.092848][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.101103][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.116670][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.151037][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.160333][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.168610][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.175822][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.183797][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 23.191872][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.200787][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 23.217710][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.225417][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.233679][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.240751][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.248514][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.256701][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.263787][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.272837][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.281388][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.288449][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.304021][ T281] device veth0_vlan entered promiscuous mode [ 23.316577][ T279] device veth0_vlan entered promiscuous mode [ 23.328521][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 23.337159][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.345724][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.352852][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.361045][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 23.370015][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 23.378470][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 23.386753][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.395030][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.402078][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.409951][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 23.417953][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 23.426155][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 23.434906][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 23.444128][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 23.452401][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.460850][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 23.468886][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 23.477174][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 23.485438][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 23.493455][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 23.502486][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.510834][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.517996][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.525711][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 23.533943][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.542116][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 23.550370][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 23.560379][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 23.568275][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 23.575749][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 23.583568][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 23.592300][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 23.606866][ T281] device veth1_macvtap entered promiscuous mode [ 23.620277][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 23.628611][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 23.636891][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 23.645623][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.661543][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 23.670243][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 23.678911][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 23.687083][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 23.695508][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 23.704060][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 23.712352][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 23.719987][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 23.733004][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 23.741762][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 23.757483][ T280] device veth0_vlan entered promiscuous mode [ 23.766066][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 23.774775][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 23.784141][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 23.792979][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 23.801645][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 23.810395][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 23.824388][ T283] device veth0_vlan entered promiscuous mode [ 23.831523][ T279] device veth1_macvtap entered promiscuous mode [ 23.839784][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 23.849689][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 23.858742][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 23.859433][ T281] request_module fs-gadgetfs succeeded, but still no fs? [ 23.879652][ T281] cgroup: cgroup: disabling cgroup2 socket matching due to net_prio or net_cls activation [ 23.901229][ T280] device veth1_macvtap entered promiscuous mode [ 23.908492][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 23.916982][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 23.925846][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 23.936690][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 23.945581][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 23.954868][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 23.964843][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 23.973718][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 23.982332][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 23.991017][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 23.999528][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.010604][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.019335][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.028696][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.036272][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.046326][ T282] device veth0_vlan entered promiscuous mode [ 24.054780][ T283] device veth1_macvtap entered promiscuous mode [ 24.082442][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.090884][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.099475][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.107747][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.125203][ T282] device veth1_macvtap entered promiscuous mode [ 24.140771][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.149911][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.158905][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.167326][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.175882][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.197861][ T305] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.210432][ T305] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.218834][ T20] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 24.228805][ T305] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.239661][ T305] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.272538][ T311] ohci-platform pcspkr: IRQ index 0 not found [ 24.298572][ T315] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 24.340019][ T315] user requested TSC rate below hardware speed [ 24.341148][ T9] blk_update_request: I/O error, dev sda, sector 1114422 op 0x1:(WRITE) flags 0x0 phys_seg 1 prio class 0 [ 24.357303][ T315] user requested TSC rate below hardware speed [ 24.357778][ T9] EXT4-fs warning (device sda1): ext4_end_bio:351: I/O error 10 writing to inode 2022 starting block 139303) [ 24.376114][ T9] blk_update_request: I/O error, dev sda, sector 1114454 op 0x1:(WRITE) flags 0x0 phys_seg 2 prio class 0 [ 24.376252][ T305] Buffer I/O error on device sda1, logical block 139264 [ 24.388938][ T9] EXT4-fs warning (device sda1): ext4_end_bio:351: I/O error 10 writing to inode 2022 starting block 139313) [ 24.414862][ T9] blk_update_request: I/O error, dev sda, sector 1114518 op 0x1:(WRITE) flags 0x4000 phys_seg 5 prio class 0 [ 24.420046][ T305] Buffer I/O error on device sda1, logical block 139268 [ 24.434948][ T15] usb 2-1: new low-speed USB device number 2 using dummy_hcd [ 24.456552][ T325] tipc: Started in network mode [ 24.468445][ T325] tipc: Own node identity ac1414aa, cluster identity 4711 [ 24.477997][ T305] Buffer I/O error on device sda1, logical block 139269 [ 24.490900][ T305] Buffer I/O error on device sda1, logical block 139270 [ 24.498574][ T325] tipc: New replicast peer: 172.20.20.187 [ 24.508862][ T305] Buffer I/O error on device sda1, logical block 139271 [ 24.518910][ T325] tipc: Enabled bearer , priority 10 [ 24.528864][ T305] Buffer I/O error on device sda1, logical block 139272 [ 24.541368][ T305] Buffer I/O error on device sda1, logical block 139273 [ 24.554143][ T305] Buffer I/O error on device sda1, logical block 139274 [ 24.567007][ T9] blk_update_request: I/O error, dev sda, sector 1115024 op 0x1:(WRITE) flags 0x0 phys_seg 4 prio class 0 [ 24.578771][ T9] EXT4-fs warning (device sda1): ext4_end_bio:351: I/O error 10 writing to inode 2022 starting block 139435) [ 24.590797][ T49] Buffer I/O error on device sda1, logical block 139276 [ 24.597908][ T49] Buffer I/O error on device sda1, logical block 139277 [ 24.611722][ T9] blk_update_request: I/O error, dev sda, sector 1115502 op 0x1:(WRITE) flags 0x0 phys_seg 2 prio class 0 [ 24.623297][ T9] EXT4-fs warning (device sda1): ext4_end_bio:351: I/O error 10 writing to inode 2022 starting block 139444) [ 24.635053][ T9] blk_update_request: I/O error, dev sda, sector 1115574 op 0x1:(WRITE) flags 0x0 phys_seg 1 prio class 0 [ 24.646588][ T9] EXT4-fs warning (device sda1): ext4_end_bio:351: I/O error 10 writing to inode 2022 starting block 139452) [ 24.658513][ T9] blk_update_request: I/O error, dev sda, sector 1115630 op 0x1:(WRITE) flags 0x0 phys_seg 1 prio class 0 [ 24.668821][ T20] usb 1-1: config 1 has an invalid descriptor of length 131, skipping remainder of the config [ 24.670170][ T9] EXT4-fs warning (device sda1): ext4_end_bio:351: I/O error 10 writing to inode 2022 starting block 139455) [ 24.692320][ T9] blk_update_request: I/O error, dev sda, sector 1115662 op 0x1:(WRITE) flags 0x0 phys_seg 1 prio class 0 [ 24.697729][ T20] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid maxpacket 1792, setting to 1024 [ 24.704157][ T9] EXT4-fs warning (device sda1): ext4_end_bio:351: I/O error 10 writing to inode 2022 starting block 139463) [ 24.726501][ T9] blk_update_request: I/O error, dev sda, sector 1115718 op 0x1:(WRITE) flags 0x0 phys_seg 1 prio class 0 [ 24.737856][ T9] EXT4-fs warning (device sda1): ext4_end_bio:351: I/O error 10 writing to inode 2022 starting block 139467) [ 24.749521][ T9] blk_update_request: I/O error, dev sda, sector 1115750 op 0x1:(WRITE) flags 0x0 phys_seg 1 prio class 0 [ 24.753093][ T20] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 1024 [ 24.761041][ T9] EXT4-fs warning (device sda1): ext4_end_bio:351: I/O error 10 writing to inode 2022 starting block 139477) [ 24.761068][ T9] EXT4-fs warning (device sda1): ext4_end_bio:351: I/O error 10 writing to inode 2022 starting block 139480) [ 24.808326][ T15] usb 2-1: Invalid ep0 maxpacket: 64 [ 24.865192][ T20] usb 1-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 24.934642][ T319] Buffer I/O error on dev sda1, logical block 132, lost async page write [ 24.935746][ T58] Aborting journal on device sda1-8. [ 24.943380][ T319] Buffer I/O error on dev sda1, logical block 138, lost async page write [ 24.957219][ T319] Buffer I/O error on dev sda1, logical block 145, lost async page write [ 24.960954][ T37] Buffer I/O error on dev sda1, logical block 131072, lost sync page write [ 24.965866][ T319] Buffer I/O error on dev sda1, logical block 150, lost async page write [ 24.974463][ T15] usb 2-1: new low-speed USB device number 3 using dummy_hcd [ 24.983632][ T319] Buffer I/O error on dev sda1, logical block 157, lost async page write [ 24.990756][ T58] JBD2: Error -5 detected when updating journal superblock for sda1-8. [ 24.999440][ T319] Buffer I/O error on dev sda1, logical block 158, lost async page write [ 25.016494][ T319] Buffer I/O error on dev sda1, logical block 159, lost async page write [ 25.025255][ T319] Buffer I/O error on dev sda1, logical block 226, lost async page write [ 25.033895][ T319] Buffer I/O error on dev sda1, logical block 243, lost async page write [ 25.088336][ T20] usb 1-1: New USB device found, idVendor=07c4, idProduct=a103, bcdDevice= 0.00 [ 25.101937][ T20] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 25.117881][ T20] usb 1-1: Product: syz [ 25.127678][ T20] usb 1-1: Manufacturer: syz [ 25.132514][ T314] EXT4-fs (sda1): I/O error while writing superblock [ 25.144811][ T314] EXT4-fs error (device sda1): ext4_journal_check_start:83: Detected aborted journal [ 25.154837][ T328] EXT4-fs (sda1): I/O error while writing superblock [ 25.162728][ T303] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 25.165234][ T319] JBD2: Error while async write back metadata bh 132. [ 25.172215][ T318] EXT4-fs (sda1): previous I/O error to superblock detected [ 25.180574][ T20] ums-sddr55 1-1:1.0: USB Mass Storage device detected [ 25.188372][ T319] JBD2: Error while async write back metadata bh 138. [ 25.193430][ T319] JBD2: Error while async write back metadata bh 145. [ 25.194969][ T328] EXT4-fs error (device sda1): ext4_journal_check_start:83: Detected aborted journal [ 25.200963][ T318] EXT4-fs (sda1): I/O error while writing superblock [ 25.223654][ T319] JBD2: Error while async write back metadata bh 150. [ 25.223817][ T319] JBD2: Error while async write back metadata bh 157. [ 25.223948][ T328] EXT4-fs (sda1): Remounting filesystem read-only [ 25.230888][ T319] JBD2: Error while async write back metadata bh 158. [ 25.238134][ T314] EXT4-fs (sda1): Remounting filesystem read-only [ 25.257780][ T318] EXT4-fs error (device sda1): ext4_journal_check_start:83: Detected aborted journal [ 25.262711][ T20] ums-sddr55 1-1:1.0: Quirks match for vid 07c4 pid a103: 8 [ 25.270671][ T318] EXT4-fs (sda1): Remounting filesystem read-only [ 25.275356][ T20] ums-sddr55 1-1:1.0: This device (07c4,a103,0000 S 06 P 50) has an unneeded SubClass entry in unusual_devs.h (kernel syzkaller) [ 25.275356][ T20] Please send a copy of this message to and [ 25.288430][ T15] usb 2-1: Invalid ep0 maxpacket: 64 [ 25.307579][ T319] JBD2: Error while async write back metadata bh 159. [ 25.312497][ T319] JBD2: Error while async write back metadata bh 226. [ 25.319665][ T20] scsi host1: usb-storage 1-1:1.0 [ 25.332129][ T319] JBD2: Error while async write back metadata bh 243. [ 25.332506][ T319] JBD2: Error while async write back metadata bh 261. [ 25.343260][ T319] JBD2: Error while async write back metadata bh 270. [ 25.350378][ T319] JBD2: Error while async write back metadata bh 657. [ 25.357386][ T319] JBD2: Error while async write back metadata bh 4241. [ 25.364524][ T319] JBD2: Error while async write back metadata bh 5747. [ 25.372000][ T319] JBD2: Error while async write back metadata bh 5748. [ 25.379240][ T15] usb usb2-port1: attempt power cycle [ 25.379933][ T319] JBD2: Error while async write back metadata bh 5749. [ 25.393128][ T319] JBD2: Error while async write back metadata bh 5750. [ 25.400673][ T319] JBD2: Error while async write back metadata bh 5751. [ 25.408979][ T319] JBD2: Error while async write back metadata bh 33717. [ 25.420091][ T95] udevd[95]: worker [301] terminated by signal 7 (Bus error) [ 25.436461][ T319] sd 0:0:1:0: [sda] Synchronizing SCSI cache [ 25.458089][ T95] udevd[95]: worker [301] failed while handling '/devices/platform/dummy_hcd.0/usb1/1-1' [ 25.487986][ T271] ------------[ cut here ]------------ [ 25.495351][ T271] bdi-(unknown) not registered [ 25.500389][ T271] WARNING: CPU: 0 PID: 271 at fs/fs-writeback.c:2337 __mark_inode_dirty+0x650/0x960 [ 25.523312][ T271] Modules linked in: [ 25.527356][ T271] CPU: 0 PID: 271 Comm: syz-executor Not tainted syzkaller #0 [ 25.547510][ T271] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 25.577804][ T271] RIP: 0010:__mark_inode_dirty+0x650/0x960 [ 25.583856][ T271] Code: fc ff df 41 80 7c 05 00 00 74 08 4c 89 ff e8 a7 f4 ec ff 49 8b 3f e8 0f af de ff 48 c7 c7 e0 65 29 85 48 89 c6 e8 80 e5 c6 02 <0f> 0b e9 2f fe ff ff 44 89 f1 80 e1 07 fe c1 38 c1 0f 8c 8e fc ff [ 25.603810][ T271] RSP: 0000:ffffc90000ba77d8 EFLAGS: 00010246 [ 25.610197][ T271] RAX: 934bc464e1a61900 RBX: 1ffff11023823cd3 RCX: ffff88811df74f00 [ 25.618682][ T271] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000 [ 25.623665][ T95] udevd[95]: worker [316] terminated by signal 7 (Bus error) [ 25.626705][ T271] RBP: ffffc90000ba7820 R08: ffffc90000ba7167 R09: fffff52000174e60 [ 25.626741][ T271] R10: dffffc0000000000 R11: fffff52000174e2d R12: ffff888100bb7068 [ 25.635250][ T95] udevd[95]: worker [316] failed while handling '/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0' [ 25.642667][ T271] R13: 1ffff11020176e0c R14: 0000000000000000 R15: ffff888100bb7060 [ 25.642677][ T271] FS: 00005555776ef500(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 25.642685][ T271] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 25.642693][ T271] CR2: 00007f8578082020 CR3: 000000011df30000 CR4: 00000000003506b0 [ 25.642702][ T271] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 25.642708][ T271] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 25.642728][ T271] Call Trace: [ 25.642747][ T271] mark_buffer_dirty+0x21b/0x330 [ 25.642758][ T271] __block_commit_write+0x1ab/0x240 [ 25.642768][ T271] block_page_mkwrite+0x239/0x270 [ 25.642781][ T271] ? ext4_da_release_space+0x420/0x420 [ 25.642791][ T271] ext4_page_mkwrite+0xb02/0x12f0 [ 25.642801][ T271] ? sched_clock_cpu+0x1b/0x3d0 [ 25.642814][ T271] ? handle_fasteoi_nmi+0x360/0x360 [ 25.642825][ T271] ? ext4_change_inode_journal_flag+0x5e0/0x5e0 [ 25.642837][ T271] ? __this_cpu_preempt_check+0x13/0x20 [ 25.642850][ T271] wp_page_shared+0x45f/0x740 [ 25.642862][ T271] do_wp_page+0xb68/0xd00 [ 25.642876][ T271] handle_pte_fault+0xbc3/0x3910 [ 25.642889][ T271] handle_mm_fault+0xf86/0x1720 [ 25.642902][ T271] ? fsnotify_clear_child_dentry_flag+0xe0/0xe0 [ 25.642916][ T271] ? can_reuse_spf_vma+0xe0/0xe0 [ 25.642927][ T271] ? vfs_write+0xaeb/0xd70 [ 25.642973][ T271] ? __kasan_check_write+0x14/0x20 [ 25.701705][ T95] udevd[95]: worker [333] terminated by signal 7 (Bus error) [ 25.702717][ T271] ? down_read_trylock+0x106/0x160 [ 25.723382][ T95] udevd[95]: worker [333] failed while handling '/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0' [ 25.724971][ T271] ? __init_rwsem+0x1c0/0x1c0 [ 25.725015][ T271] ? vmacache_update+0xb7/0x120 [ 25.793420][ T95] udevd[95]: worker [335] terminated by signal 7 (Bus error) [ 25.794384][ T271] ? find_vma+0x13b/0x150 [ 25.794430][ T271] do_user_addr_fault+0x576/0xe20 [ 25.819233][ T95] udevd[95]: worker [335] failed while handling '/devices/platform/dummy_hcd.0/usb1/1-1' [ 25.822493][ T271] ? do_kern_addr_fault+0x80/0x80 [ 25.906170][ T271] ? debug_smp_processor_id+0x17/0x20 [ 25.911701][ T271] ? fpregs_assert_state_consistent+0xb1/0xe0 [ 25.918000][ T271] exc_page_fault+0x5a/0xc0 [ 25.923317][ T271] ? asm_exc_page_fault+0x8/0x30 [ 25.928459][ T271] asm_exc_page_fault+0x1e/0x30 [ 25.933518][ T271] RIP: 0033:0x7f857edef0c7 [ 25.938112][ T271] Code: ce 48 ff c7 48 01 fe 48 8d 54 11 80 0f 1f 80 00 00 00 00 c5 fe 6f 0e c5 fe 6f 56 20 c5 fe 6f 5e 40 c5 fe 6f 66 60 48 83 ee 80 fd 7f 0f c5 fd 7f 57 20 c5 fd 7f 5f 40 c5 fd 7f 67 60 48 83 ef [ 25.958696][ T271] RSP: 002b:00007ffd60229248 EFLAGS: 00010207 [ 25.965384][ T271] RAX: 00007f8578082000 RBX: 0000555577703230 RCX: 00007f8578082000 [ 25.973575][ T271] RDX: 00007f85780820c8 RSI: 0000555577705660 RDI: 00007f8578082020 [ 25.981924][ T271] RBP: 00007ffd60229260 R08: 0000000000000000 R09: 0000000000000000 [ 25.990037][ T271] R10: 0000000000000000 R11: 0000000000000202 R12: 0000555577704470 [ 25.998139][ T271] R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000001 [ 26.006730][ T271] ---[ end trace c629eca2a4ae6bf5 ]--- [ 26.012545][ T300] tipc: 32-bit node address hash set to aa1414ac [ 26.026605][ T271] ------------[ cut here ]------------ [ 26.033272][ T271] bdi-(unknown) not registered [ 26.038611][ T271] WARNING: CPU: 0 PID: 271 at fs/fs-writeback.c:2337 __mark_inode_dirty+0x650/0x960 [ 26.048272][ T271] Modules linked in: [ 26.052744][ T271] CPU: 0 PID: 271 Comm: syz-executor Tainted: G W syzkaller #0 [ 26.061991][ T271] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 26.072219][ T271] RIP: 0010:__mark_inode_dirty+0x650/0x960 [ 26.078128][ T271] Code: fc ff df 41 80 7c 05 00 00 74 08 4c 89 ff e8 a7 f4 ec ff 49 8b 3f e8 0f af de ff 48 c7 c7 e0 65 29 85 48 89 c6 e8 80 e5 c6 02 <0f> 0b e9 2f fe ff ff 44 89 f1 80 e1 07 fe c1 38 c1 0f 8c 8e fc ff [ 26.098359][ T271] RSP: 0000:ffffc90000ba77d8 EFLAGS: 00010246 [ 26.104455][ T271] RAX: 934bc464e1a61900 RBX: 1ffff1102207e922 RCX: ffff88811df74f00 [ 26.112784][ T271] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000 [ 26.121131][ T271] RBP: ffffc90000ba7820 R08: ffff8881f7052fbf R09: 1ffff1103ee0a5f7 [ 26.129405][ T271] R10: dffffc0000000000 R11: ffffed103ee0a5f8 R12: ffff888100bb7068 [ 26.137410][ T271] R13: 1ffff11020176e0c R14: 0000000000000000 R15: ffff888100bb7060 [ 26.145815][ T271] FS: 00005555776ef500(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 26.155105][ T271] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 26.161749][ T271] CR2: 00007f857a482020 CR3: 000000011df30000 CR4: 00000000003506b0 [ 26.169760][ T271] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 26.177822][ T271] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 26.185935][ T271] Call Trace: [ 26.189264][ T271] mark_buffer_dirty+0x21b/0x330 [ 26.194220][ T271] __block_commit_write+0x1ab/0x240 [ 26.199578][ T271] block_page_mkwrite+0x239/0x270 [ 26.204644][ T271] ? ext4_da_release_space+0x420/0x420 [ 26.211414][ T271] ext4_page_mkwrite+0xb02/0x12f0 [ 26.216554][ T271] ? ext4_change_inode_journal_flag+0x5e0/0x5e0 [ 26.222859][ T271] wp_page_shared+0x45f/0x740 [ 26.227561][ T271] do_wp_page+0xb68/0xd00 [ 26.231966][ T271] handle_pte_fault+0xbc3/0x3910 [ 26.237076][ T271] handle_mm_fault+0xf86/0x1720 [ 26.242011][ T271] ? fsnotify_clear_child_dentry_flag+0xe0/0xe0 [ 26.248320][ T271] ? can_reuse_spf_vma+0xe0/0xe0 [ 26.253265][ T271] ? vfs_write+0xaeb/0xd70 [ 26.257686][ T271] ? __kasan_check_write+0x14/0x20 [ 26.263024][ T271] ? down_read_trylock+0x106/0x160 [ 26.268184][ T271] ? __init_rwsem+0x1c0/0x1c0 [ 26.272952][ T271] ? vmacache_update+0xb7/0x120 [ 26.278063][ T271] ? find_vma+0x13b/0x150 [ 26.282595][ T271] do_user_addr_fault+0x576/0xe20 [ 26.287650][ T271] ? do_kern_addr_fault+0x80/0x80 [ 26.293006][ T271] ? debug_smp_processor_id+0x17/0x20 [ 26.298628][ T271] ? fpregs_assert_state_consistent+0xb1/0xe0 [ 26.304707][ T271] exc_page_fault+0x5a/0xc0 [ 26.308549][ T304] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 26.309521][ T271] ? asm_exc_page_fault+0x8/0x30 [ 26.322056][ T271] asm_exc_page_fault+0x1e/0x30 [ 26.326918][ T271] RIP: 0033:0x7f857edef0c7 [ 26.331473][ T271] Code: ce 48 ff c7 48 01 fe 48 8d 54 11 80 0f 1f 80 00 00 00 00 c5 fe 6f 0e c5 fe 6f 56 20 c5 fe 6f 5e 40 c5 fe 6f 66 60 48 83 ee 80 fd 7f 0f c5 fd 7f 57 20 c5 fd 7f 5f 40 c5 fd 7f 67 60 48 83 ef [ 26.355201][ T271] RSP: 002b:00007ffd60229248 EFLAGS: 00010207 [ 26.360157][ T51] scsi 1:0:0:0: Direct-Access Datafab MDSM-B reader 0000 PQ: 0 ANSI: 2 [ 26.361812][ T271] RAX: 00007f857a482000 RBX: 0000555577704f90 RCX: 00007f857a482000 [ 26.378611][ T271] RDX: 00007f857a4826e3 RSI: 00005555777057f0 RDI: 00007f857a482020 [ 26.383035][ T334] EXT4-fs error (device sda1): __ext4_find_entry:1657: inode #264: comm udevd: reading directory lblock 0 [ 26.386692][ T271] RBP: 00007ffd60229260 R08: 0000000000000000 R09: 0000000000000000 [ 26.386700][ T271] R10: 0000000000000000 R11: 0000000000000202 R12: 0000555577704190 [ 26.386706][ T271] R13: 0000000000000080 R14: 0000000000000001 R15: 0000000000000000 [ 26.386721][ T271] ---[ end trace c629eca2a4ae6bf6 ]--- [ 26.405412][ T334] EXT4-fs error (device sda1): __ext4_find_entry:1657: inode #264: comm udevd: reading directory lblock 0 [ 26.415271][ T271] ------------[ cut here ]------------ [ 26.451529][ T271] bdi-(unknown) not registered [ 26.456630][ T271] WARNING: CPU: 0 PID: 271 at fs/fs-writeback.c:2337 __mark_inode_dirty+0x650/0x960 [ 26.466274][ T271] Modules linked in: [ 26.470382][ T271] CPU: 0 PID: 271 Comm: syz-executor Tainted: G W syzkaller #0 [ 26.479350][ T271] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 26.484271][ T341] input: syz0 as /devices/virtual/input/input4 [ 26.489649][ T271] RIP: 0010:__mark_inode_dirty+0x650/0x960 [ 26.489697][ T271] Code: fc ff df 41 80 7c 05 00 00 74 08 4c 89 ff e8 a7 f4 ec ff 49 8b 3f e8 0f af de ff 48 c7 c7 e0 65 29 85 48 89 c6 e8 80 e5 c6 02 <0f> 0b e9 2f fe ff ff 44 89 f1 80 e1 07 fe c1 38 c1 0f 8c 8e fc ff [ 26.508411][ T24] kauditd_printk_skb: 51 callbacks suppressed [ 26.508451][ T24] audit: type=1400 audit(1786952531.090:125): avc: denied { read write } for pid=340 comm="syz.2.10" name="uinput" dev="devtmpfs" ino=257 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 26.522060][ T271] RSP: 0000:ffffc90000ba77d8 EFLAGS: 00010246 [ 26.522075][ T271] RAX: 934bc464e1a61900 RBX: 1ffff1102207e4b4 RCX: ffff88811df74f00 [ 26.522082][ T271] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000 [ 26.522090][ T271] RBP: ffffc90000ba7820 R08: ffff8881f7027453 R09: 1ffff1103ee04e8a [ 26.522098][ T271] R10: dffffc0000000000 R11: ffffed103ee04e8b R12: ffff888100bb7068 [ 26.522105][ T271] R13: 1ffff11020176e0c R14: 0000000000000000 R15: ffff888100bb7060 [ 26.522114][ T271] FS: 00005555776ef500(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 26.522121][ T271] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 26.522129][ T271] CR2: 00007f8579282020 CR3: 000000011df30000 CR4: 00000000003506b0 [ 26.522138][ T271] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 26.522145][ T271] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 26.522148][ T271] Call Trace: [ 26.522167][ T271] mark_buffer_dirty+0x21b/0x330 [ 26.522178][ T271] __block_commit_write+0x1ab/0x240 [ 26.522189][ T271] block_page_mkwrite+0x239/0x270 [ 26.522202][ T271] ? ext4_da_release_space+0x420/0x420 [ 26.522212][ T271] ext4_page_mkwrite+0xb02/0x12f0 [ 26.522224][ T271] ? ext4_change_inode_journal_flag+0x5e0/0x5e0 [ 26.522270][ T271] wp_page_shared+0x45f/0x740 [ 26.534050][ T9] sd 1:0:0:0: [sdb] Unit Not Ready [ 26.552504][ T271] do_wp_page+0xb68/0xd00 [ 26.563686][ T24] audit: type=1400 audit(1786952531.090:126): avc: denied { open } for pid=340 comm="syz.2.10" path="/dev/uinput" dev="devtmpfs" ino=257 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 26.566860][ T271] handle_pte_fault+0xbc3/0x3910 [ 26.566905][ T271] handle_mm_fault+0xf86/0x1720 [ 26.575985][ T9] sd 1:0:0:0: [sdb] Sense Key : 0x4 [current] [ 26.583234][ T271] ? fsnotify_clear_child_dentry_flag+0xe0/0xe0 [ 26.583249][ T271] ? can_reuse_spf_vma+0xe0/0xe0 [ 26.583260][ T271] ? vfs_write+0xaeb/0xd70 [ 26.583273][ T271] ? __kasan_check_write+0x14/0x20 [ 26.583285][ T271] ? down_read_trylock+0x106/0x160 [ 26.583295][ T271] ? __init_rwsem+0x1c0/0x1c0 [ 26.583304][ T271] ? vmacache_update+0xb7/0x120 [ 26.583313][ T271] ? find_vma+0x13b/0x150 [ 26.583356][ T271] do_user_addr_fault+0x576/0xe20 [ 26.593058][ T24] audit: type=1400 audit(1786952531.090:127): avc: denied { ioctl } for pid=340 comm="syz.2.10" path="/dev/uinput" dev="devtmpfs" ino=257 ioctlcmd=0x5564 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 26.599850][ T271] ? do_kern_addr_fault+0x80/0x80 [ 26.609673][ T9] sd 1:0:0:0: [sdb] ASC=0x0 ASCQ=0x0 [ 26.615383][ T271] ? debug_smp_processor_id+0x17/0x20 [ 26.615437][ T271] ? fpregs_assert_state_consistent+0xb1/0xe0 [ 26.624718][ T336] EXT4-fs error (device sda1): __ext4_find_entry:1657: inode #264: comm udevd: reading directory lblock 0 [ 26.631443][ T271] exc_page_fault+0x5a/0xc0 [ 26.631455][ T271] ? asm_exc_page_fault+0x8/0x30 [ 26.631464][ T271] asm_exc_page_fault+0x1e/0x30 [ 26.631473][ T271] RIP: 0033:0x7f857edef0c7 [ 26.631513][ T271] Code: ce 48 ff c7 48 01 fe 48 8d 54 11 80 0f 1f 80 00 00 00 00 c5 fe 6f 0e c5 fe 6f 56 20 c5 fe 6f 5e 40 c5 fe 6f 66 60 48 83 ee 80 fd 7f 0f c5 fd 7f 57 20 c5 fd 7f 5f 40 c5 fd 7f 67 60 48 83 ef [ 26.641474][ T334] EXT4-fs error (device sda1): __ext4_find_entry:1657: inode #264: comm udevd: reading directory lblock 0 [ 26.642807][ T271] RSP: 002b:00007ffd60229248 EFLAGS: 00010203 [ 26.657399][ T336] EXT4-fs error (device sda1): __ext4_find_entry:1657: inode #264: comm udevd: reading directory lblock 0 [ 26.658006][ T271] [ 26.670478][ T336] EXT4-fs error (device sda1): __ext4_find_entry:1657: inode #264: comm udevd: reading directory lblock 0 [ 26.674877][ T271] RAX: 00007f8579282000 RBX: 0000555577705580 RCX: 00007f8579282000 [ 26.674886][ T271] RDX: 00007f85792820ec RSI: 0000555577706140 RDI: 00007f8579282020 [ 26.674893][ T271] RBP: 00007ffd60229260 R08: 0000000000000000 R09: 0000000000000000 [ 26.674901][ T271] R10: 0000000000000000 R11: 0000000000000202 R12: 0000555577704300 [ 26.674931][ T271] R13: 0000000000000040 R14: 0000000000000001 R15: 0000000000000000 [ 26.718700][ T304] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 26.722343][ T271] ---[ end trace c629eca2a4ae6bf7 ]--- [ 26.732811][ T304] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 26.735140][ T15] usb 2-1: new low-speed USB device number 4 using dummy_hcd [ 26.749812][ T271] ------------[ cut here ]------------ [ 26.769621][ T344] PCI_CLASS=30000 [ 26.769621][ T344] PCI_ID=1AE0:A002 [ 26.769621][ T344] PCI_SUBSYS_ID=1AE0:0001 [ 26.769621][ T344] PCI_SLOT_NAME=0000:00:05.0 [ 26.769621][ T344] MODALIAS=pci:v00001AE0d0000A002sv00001AE0sd00000001bc03sc00i00 [ 26.776892][ T271] bdi-(unknown) not registered [ 26.802859][ T24] audit: type=1400 audit(1786952531.380:128): avc: denied { mount } for pid=343 comm="syz.3.11" name="/" dev="devtmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 26.807586][ T271] WARNING: CPU: 1 PID: 271 at fs/fs-writeback.c:2337 __mark_inode_dirty+0x650/0x960 [ 26.814014][ T24] audit: type=1400 audit(1786952531.380:129): avc: denied { write } for pid=343 comm="syz.3.11" name="kmsg" dev="devtmpfs" ino=9 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kmsg_device_t tclass=chr_file permissive=1 [ 26.818614][ T271] Modules linked in: [ 26.930011][ T15] usb 2-1: Invalid ep0 maxpacket: 64 [ 26.935263][ T271] [ 27.026542][ T5] usb 1-1: USB disconnect, device number 2 [ 27.048729][ T271] CPU: 1 PID: 271 Comm: syz-executor Tainted: G W syzkaller #0 [ 27.048736][ T271] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 27.048756][ T271] RIP: 0010:__mark_inode_dirty+0x650/0x960 [ 27.048794][ T271] Code: fc ff df 41 80 7c 05 00 00 74 08 4c 89 ff e8 a7 f4 ec ff 49 8b 3f e8 0f af de ff 48 c7 c7 e0 65 29 85 48 89 c6 e8 80 e5 c6 02 <0f> 0b e9 2f fe ff ff 44 89 f1 80 e1 07 fe c1 38 c1 0f 8c 8e fc ff [ 27.059072][ T95] EXT4-fs error (device sda1): __ext4_find_entry:1657: inode #259: comm udevd: reading directory lblock 0 [ 27.081010][ T271] RSP: 0000:ffffc90000ba77d8 EFLAGS: 00010246 [ 27.088755][ T95] EXT4-fs error (device sda1): __ext4_find_entry:1657: inode #264: comm udevd: reading directory lblock 0 [ 27.090270][ T271] [ 27.092955][ T95] EXT4-fs error (device sda1): __ext4_find_entry:1657: inode #264: comm udevd: reading directory lblock 0 [ 27.098447][ T271] RAX: 934bc464e1a61900 RBX: 1ffff11022072865 RCX: ffff88811df74f00 [ 27.098479][ T271] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000 [ 27.108986][ T95] EXT4-fs error (device sda1): __ext4_find_entry:1657: inode #264: comm udevd: reading directory lblock 0 [ 27.117671][ T271] RBP: ffffc90000ba7820 R08: ffff8881f7152fbf R09: 1ffff1103ee2a5f7 [ 27.158371][ T15] usb 2-1: new low-speed USB device number 5 using dummy_hcd [ 27.160764][ T271] R10: dffffc0000000000 R11: ffffed103ee2a5f8 R12: ffff888100bb7068 [ 27.238990][ T271] R13: 1ffff11020176e0c R14: 0000000000000000 R15: ffff888100bb7060 [ 27.239002][ T271] FS: 00005555776ef500(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 27.239011][ T271] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 27.239019][ T271] CR2: 00007f857cccbddc CR3: 000000011df30000 CR4: 00000000003506a0 [ 27.239030][ T271] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 27.239037][ T271] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 27.239041][ T271] Call Trace: [ 27.239064][ T271] mark_buffer_dirty+0x21b/0x330 [ 27.239073][ T271] __block_commit_write+0x1ab/0x240 [ 27.239081][ T271] block_page_mkwrite+0x239/0x270 [ 27.239091][ T271] ? ext4_da_release_space+0x420/0x420 [ 27.239098][ T271] ext4_page_mkwrite+0xb02/0x12f0 [ 27.239108][ T271] ? memcpy+0x56/0x70 [ 27.239116][ T271] ? ext4_change_inode_journal_flag+0x5e0/0x5e0 [ 27.239126][ T271] wp_page_shared+0x45f/0x740 [ 27.239135][ T271] do_wp_page+0xb68/0xd00 [ 27.239145][ T271] handle_pte_fault+0xbc3/0x3910 [ 27.239154][ T271] handle_mm_fault+0xf86/0x1720 [ 27.239163][ T271] ? kernel_sock_ip_overhead+0x240/0x240 [ 27.239173][ T271] ? can_reuse_spf_vma+0xe0/0xe0 [ 27.239191][ T271] ? __kasan_check_write+0x14/0x20 [ 27.239200][ T271] ? down_read_trylock+0x106/0x160 [ 27.239207][ T271] ? __init_rwsem+0x1c0/0x1c0 [ 27.239214][ T271] ? vmacache_update+0xb7/0x120 [ 27.239221][ T271] ? find_vma+0x13b/0x150 [ 27.239229][ T271] do_user_addr_fault+0x576/0xe20 [ 27.239238][ T271] ? do_kern_addr_fault+0x80/0x80 [ 27.239246][ T271] ? __kasan_check_read+0x11/0x20 [ 27.239255][ T271] exc_page_fault+0x5a/0xc0 [ 27.239263][ T271] ? asm_exc_page_fault+0x8/0x30 [ 27.239270][ T271] asm_exc_page_fault+0x1e/0x30 [ 27.239277][ T271] RIP: 0033:0x7f857ecfe662 [ 27.239286][ T271] Code: 48 83 e8 01 48 89 ca 48 c1 e0 0e 48 83 c6 08 48 c1 ea 06 48 c1 e9 03 48 01 f8 bf 01 00 00 00 81 e2 ff 3f 00 00 83 e1 07 d3 e7 <40> 08 bc 02 40 40 00 00 49 39 f0 0f 85 e7 fe ff ff 48 8b 44 24 10 [ 27.239291][ T271] RSP: 002b:00007ffd60229380 EFLAGS: 00010202 [ 27.239299][ T271] RAX: 00007f857ccc6000 RBX: 0000555577705580 RCX: 0000000000000002 [ 27.239304][ T271] RDX: 0000000000001d9c RSI: 00005555777055a8 RDI: 0000000000000004 [ 27.239310][ T271] RBP: 00007ffd60229880 R08: 00005555777055b8 R09: 0000000000000039 [ 27.239316][ T271] R10: 0000000000000000 R11: 0000000000000202 R12: 00007ffd602296c0 [ 27.239321][ T271] R13: 00007ffd602294b0 R14: 585858582e7a7973 R15: 00007ffd60229400 [ 27.239328][ T271] ---[ end trace c629eca2a4ae6bf8 ]--- [ 27.240500][ T271] ------------[ cut here ]------------ [ 27.258882][ T9] sd 1:0:0:0: [sdb] Read Capacity(10) failed: Result: hostbyte=0x07 driverbyte=0x00 [ 27.264903][ T271] bdi-(unknown) not registered [ 27.272237][ T9] sd 1:0:0:0: [sdb] Sense not available. [ 27.280498][ T271] WARNING: CPU: 0 PID: 271 at fs/fs-writeback.c:2337 __mark_inode_dirty+0x650/0x960 [ 27.288750][ T9] sd 1:0:0:0: [sdb] 0 512-byte logical blocks: (0 B/0 B) [ 27.291962][ T271] Modules linked in: [ 27.297109][ T9] sd 1:0:0:0: [sdb] 0-byte physical blocks [ 27.302441][ T271] [ 27.302489][ T271] CPU: 0 PID: 271 Comm: syz-executor Tainted: G W syzkaller #0 [ 27.307842][ T9] sd 1:0:0:0: [sdb] Write Protect is off [ 27.313106][ T271] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 27.322624][ T271] RIP: 0010:__mark_inode_dirty+0x650/0x960 [ 27.328605][ T9] sd 1:0:0:0: [sdb] Asking for cache data failed [ 27.333188][ T271] Code: fc ff df 41 80 7c 05 00 00 74 08 4c 89 ff e8 a7 f4 ec ff 49 8b 3f e8 0f af de ff 48 c7 c7 e0 65 29 85 48 89 c6 e8 80 e5 c6 02 <0f> 0b e9 2f fe ff ff 44 89 f1 80 e1 07 fe c1 38 c1 0f 8c 8e fc ff [ 27.337714][ T9] sd 1:0:0:0: [sdb] Assuming drive cache: write through [ 27.342773][ T271] RSP: 0000:ffffc90000ba77d8 EFLAGS: 00010246 [ 27.438628][ T304] usb 5-1: New USB device found, idVendor=0403, idProduct=6001, bcdDevice= 6.00 [ 27.443619][ T271] [ 27.452573][ T304] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 27.459777][ T271] RAX: 934bc464e1a61900 RBX: 1ffff1102207e3f7 RCX: ffff88811df74f00 [ 27.459807][ T271] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000 [ 27.468847][ T304] usb 5-1: Product: syz [ 27.475986][ T271] RBP: ffffc90000ba7820 R08: 0000000000000003 R09: fffff52000174e60 [ 27.485010][ T304] usb 5-1: Manufacturer: syz [ 27.489403][ T271] R10: dffffc0000000000 R11: fffff52000174e40 R12: ffff888100bb7068 [ 27.489432][ T271] R13: 1ffff11020176e0c R14: 0000000000000000 R15: ffff888100bb7060 [ 27.495587][ T304] usb 5-1: SerialNumber: syz [ 27.504511][ T271] FS: 00005555776ef500(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 27.504546][ T271] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 27.548565][ T339] raw-gadget.2 gadget: fail, usb_ep_enable returned -22 [ 27.556005][ T271] CR2: 00007f857c882020 CR3: 000000011df30000 CR4: 00000000003506b0 [ 27.575266][ T95] udevd[95]: worker [342] terminated by signal 7 (Bus error) [ 27.579612][ T271] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 27.579669][ T271] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 27.579684][ T271] Call Trace: [ 27.586550][ T95] udevd[95]: worker [342] failed while handling '/devices/platform/dummy_hcd.4/usb5/5-1' [ 27.608661][ T271] mark_buffer_dirty+0x21b/0x330 [ 27.608727][ T271] __block_commit_write+0x1ab/0x240 [ 27.623473][ T339] raw-gadget.2 gadget: fail, usb_ep_enable returned -22 [ 27.631913][ T271] block_page_mkwrite+0x239/0x270 [ 27.649891][ T304] ftdi_sio 5-1:1.0: FTDI USB Serial Device converter detected [ 27.650488][ T271] ? ext4_da_release_space+0x420/0x420 [ 27.660798][ T304] usb 5-1: Detected FT232RL [ 27.663659][ T271] ext4_page_mkwrite+0xb02/0x12f0 [ 27.826184][ T271] ? ext4_change_inode_journal_flag+0x5e0/0x5e0 [ 27.826228][ T271] wp_page_shared+0x45f/0x740 [ 27.837238][ T271] do_wp_page+0xb68/0xd00 [ 27.841651][ T271] handle_pte_fault+0xbc3/0x3910 [ 27.846618][ T271] handle_mm_fault+0xf86/0x1720 [ 27.851601][ T271] ? fsnotify_clear_child_dentry_flag+0xe0/0xe0 [ 27.857886][ T271] ? can_reuse_spf_vma+0xe0/0xe0 [ 27.862888][ T271] ? vfs_write+0xaeb/0xd70 [ 27.867343][ T271] ? __kasan_check_write+0x14/0x20 [ 27.872651][ T271] ? down_read_trylock+0x106/0x160 [ 27.878380][ T271] ? __init_rwsem+0x1c0/0x1c0 [ 27.883088][ T271] ? vmacache_update+0xb7/0x120 [ 27.887950][ T271] ? find_vma+0x13b/0x150 [ 27.892442][ T271] do_user_addr_fault+0x576/0xe20 [ 27.897495][ T271] ? do_kern_addr_fault+0x80/0x80 [ 27.902634][ T271] ? debug_smp_processor_id+0x17/0x20 [ 27.908054][ T271] ? fpregs_assert_state_consistent+0xb1/0xe0 [ 27.914426][ T271] exc_page_fault+0x5a/0xc0 [ 27.918990][ T271] ? asm_exc_page_fault+0x8/0x30 [ 27.924496][ T271] asm_exc_page_fault+0x1e/0x30 [ 27.929778][ T271] RIP: 0033:0x7f857edef0c7 [ 27.934447][ T271] Code: ce 48 ff c7 48 01 fe 48 8d 54 11 80 0f 1f 80 00 00 00 00 c5 fe 6f 0e c5 fe 6f 56 20 c5 fe 6f 5e 40 c5 fe 6f 66 60 48 83 ee 80 fd 7f 0f c5 fd 7f 57 20 c5 fd 7f 5f 40 c5 fd 7f 67 60 48 83 ef [ 27.954545][ T271] RSP: 002b:00007ffd60229248 EFLAGS: 00010207 [ 27.960890][ T271] RAX: 00007f857c882000 RBX: 0000555577703ae0 RCX: 00007f857c882000 [ 27.969098][ T271] RDX: 00007f857c8821de RSI: 0000555577706300 RDI: 00007f857c882020 [ 27.977214][ T271] RBP: 00007ffd60229260 R08: 0000000000000000 R09: 0000000000000000 [ 27.985835][ T271] R10: 0000000000000000 R11: 0000000000000202 R12: 00005555777032c0 [ 27.994108][ T271] R13: 0000000000000080 R14: 0000000000000001 R15: 0000000000000000 [ 28.002971][ T271] ---[ end trace c629eca2a4ae6bf9 ]--- [ 28.009394][ T24] audit: type=1400 audit(1786952532.630:130): avc: denied { unmount } for pid=280 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 28.020645][ T9] sd 1:0:0:0: [sdb] Read Capacity(10) failed: Result: hostbyte=0x07 driverbyte=0x00 [ 28.037938][ T271] ------------[ cut here ]------------ [ 28.044873][ T271] bdi-(unknown) not registered [ 28.050963][ T271] WARNING: CPU: 0 PID: 271 at fs/fs-writeback.c:2337 __mark_inode_dirty+0x650/0x960 [ 28.060593][ T271] Modules linked in: [ 28.064525][ T271] CPU: 0 PID: 271 Comm: syz-executor Tainted: G W syzkaller #0 [ 28.073522][ T271] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 28.083764][ T271] RIP: 0010:__mark_inode_dirty+0x650/0x960 [ 28.084298][ T9] sd 1:0:0:0: [sdb] Sense not available. [ 28.089917][ T271] Code: fc ff df 41 80 7c 05 00 00 74 08 4c 89 ff e8 a7 f4 ec ff 49 8b 3f e8 0f af de ff 48 c7 c7 e0 65 29 85 48 89 c6 e8 80 e5 c6 02 <0f> 0b e9 2f fe ff ff 44 89 f1 80 e1 07 fe c1 38 c1 0f 8c 8e fc ff [ 28.111890][ T9] sd 1:0:0:0: [sdb] Attached SCSI removable disk [ 28.116747][ T271] RSP: 0000:ffffc90000ba7758 EFLAGS: 00010246 [ 28.125375][ T24] audit: type=1400 audit(1786952532.680:131): avc: denied { mount } for pid=345 comm="syz.0.12" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 28.130291][ T271] RAX: 934bc464e1a61900 RBX: 1ffff1102207e1c0 RCX: ffff88811df74f00 [ 28.160283][ T24] audit: type=1400 audit(1786952532.680:132): avc: denied { mount } for pid=345 comm="syz.0.12" name="/" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=filesystem permissive=1 [ 28.160322][ T24] audit: type=1400 audit(1786952532.690:133): avc: denied { search } for pid=345 comm="syz.0.12" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 28.182573][ T271] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000 [ 28.212242][ T271] RBP: ffffc90000ba77a0 R08: ffffc90000ba70e7 R09: fffff52000174e50 [ 28.212561][ T24] audit: type=1400 audit(1786952532.690:134): avc: denied { write } for pid=345 comm="syz.0.12" name="enable" dev="tracefs" ino=263 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=file permissive=1 [ 28.220429][ T271] R10: dffffc0000000000 R11: fffff52000174e1d R12: ffff888100bb7068 [ 28.250655][ T271] R13: 1ffff11020176e0c R14: 0000000000000000 R15: ffff888100bb7060 [ 28.258885][ T271] FS: 00005555776ef500(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 28.268109][ T271] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 28.274819][ T271] CR2: 00007f857ae81ffc CR3: 000000011df30000 CR4: 00000000003506b0 [ 28.283306][ T271] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 28.291412][ T271] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 28.299472][ T271] Call Trace: [ 28.302783][ T271] mark_buffer_dirty+0x21b/0x330 [ 28.307741][ T271] __block_write_begin_int+0xc11/0x15a0 [ 28.313439][ T271] ? ktime_get_coarse_real_ts64+0xda/0xf0 [ 28.319366][ T271] ? ext4_da_release_space+0x420/0x420 [ 28.325064][ T271] ? page_zero_new_buffers+0x500/0x500 [ 28.330700][ T271] ? file_update_time+0x325/0x440 [ 28.335765][ T271] ? ext4_inline_data_truncate+0xb40/0xb40 [ 28.341837][ T271] block_page_mkwrite+0x200/0x270 [ 28.346896][ T271] ? ext4_da_release_space+0x420/0x420 [ 28.352405][ T271] ext4_page_mkwrite+0xb02/0x12f0 [ 28.357865][ T271] ? clear_zone_contiguous+0x50/0x50 [ 28.363617][ T271] ? ext4_change_inode_journal_flag+0x5e0/0x5e0 [ 28.370215][ T271] handle_pte_fault+0x1dde/0x3910 [ 28.375273][ T271] handle_mm_fault+0xf86/0x1720 [ 28.380197][ T271] ? can_reuse_spf_vma+0xe0/0xe0 [ 28.385157][ T271] ? __kasan_check_write+0x14/0x20 [ 28.390537][ T271] ? down_read_trylock+0x106/0x160 [ 28.395673][ T271] ? __init_rwsem+0x1c0/0x1c0 [ 28.400391][ T271] ? find_vma+0x30/0x150 [ 28.404677][ T271] do_user_addr_fault+0x576/0xe20 [ 28.410176][ T271] ? do_kern_addr_fault+0x80/0x80 [ 28.415328][ T271] ? debug_smp_processor_id+0x17/0x20 [ 28.420892][ T271] ? fpregs_assert_state_consistent+0xb1/0xe0 [ 28.426992][ T271] ? exit_to_user_mode_prepare+0x2f/0xa0 [ 28.432754][ T271] exc_page_fault+0x5a/0xc0 [ 28.437298][ T271] ? asm_exc_page_fault+0x8/0x30 [ 28.442365][ T271] asm_exc_page_fault+0x1e/0x30 [ 28.447317][ T271] RIP: 0033:0x7f857ecf2163 [ 28.451838][ T271] Code: 85 0e 01 00 00 be 04 00 00 00 48 89 df e8 c5 b8 fe ff 48 8b 43 40 83 43 30 04 48 89 df be 08 00 00 00 48 8d 50 fc 48 89 53 40 <89> 68 fc 8b 6b 30 e8 a2 b8 fe ff 48 8b 43 48 be 06 00 00 00 89 28 [ 28.471485][ T271] RSP: 002b:00007ffd60229080 EFLAGS: 00010202 [ 28.477592][ T271] RAX: 00007f857ae82000 RBX: 00007ffd602291b0 RCX: 00000000005ffde8 [ 28.485616][ T271] RDX: 00007f857ae81ffc RSI: 0000000000000008 RDI: 00007ffd602291b0 [ 28.494086][ T271] RBP: 00000000000003e6 R08: 0000000000000000 R09: 0000000000000000 [ 28.502240][ T271] R10: 00007ffd60229190 R11: 0000000000000000 R12: 0000000000000000 [ 28.510510][ T271] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 28.518709][ T271] ---[ end trace c629eca2a4ae6bfa ]--- [ 28.526095][ T271] ------------[ cut here ]------------ [ 28.531651][ T271] bdi-(unknown) not registered [ 28.536527][ T271] WARNING: CPU: 0 PID: 271 at fs/fs-writeback.c:2337 __mark_inode_dirty+0x650/0x960 [ 28.546158][ T271] Modules linked in: [ 28.551018][ T271] CPU: 0 PID: 271 Comm: syz-executor Tainted: G W syzkaller #0 [ 28.560389][ T271] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 28.571098][ T271] RIP: 0010:__mark_inode_dirty+0x650/0x960 [ 28.577123][ T271] Code: fc ff df 41 80 7c 05 00 00 74 08 4c 89 ff e8 a7 f4 ec ff 49 8b 3f e8 0f af de ff 48 c7 c7 e0 65 29 85 48 89 c6 e8 80 e5 c6 02 <0f> 0b e9 2f fe ff ff 44 89 f1 80 e1 07 fe c1 38 c1 0f 8c 8e fc ff [ 28.597195][ T271] RSP: 0000:ffffc90000ba77d8 EFLAGS: 00010246 [ 28.603435][ T271] RAX: 934bc464e1a61900 RBX: 1ffff1102207eb59 RCX: ffff88811df74f00 [ 28.611663][ T271] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000 [ 28.619822][ T271] RBP: ffffc90000ba7820 R08: ffff8881f7052fbf R09: 1ffff1103ee0a5f7 [ 28.628104][ T271] R10: dffffc0000000000 R11: ffffed103ee0a5f8 R12: ffff888100bb7068 [ 28.636245][ T271] R13: 1ffff11020176e0c R14: 0000000000000000 R15: ffff888100bb7060 [ 28.644599][ T271] FS: 00005555776ef500(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 28.653624][ T271] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 28.660270][ T271] CR2: 00007f857b682020 CR3: 000000011df30000 CR4: 00000000003506b0 [ 28.668293][ T271] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 28.676396][ T271] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 28.685054][ T271] Call Trace: [ 28.688477][ T271] mark_buffer_dirty+0x21b/0x330 [ 28.693450][ T271] __block_commit_write+0x1ab/0x240 [ 28.699234][ T271] block_page_mkwrite+0x239/0x270 [ 28.704295][ T271] ? ext4_da_release_space+0x420/0x420 [ 28.709931][ T271] ext4_page_mkwrite+0xb02/0x12f0 [ 28.715002][ T271] ? ext4_change_inode_journal_flag+0x5e0/0x5e0 [ 28.721288][ T271] wp_page_shared+0x45f/0x740 [ 28.726003][ T271] do_wp_page+0xb68/0xd00 [ 28.730382][ T271] handle_pte_fault+0xbc3/0x3910 [ 28.735356][ T271] handle_mm_fault+0xf86/0x1720 [ 28.740504][ T271] ? fsnotify_clear_child_dentry_flag+0xe0/0xe0 [ 28.746773][ T271] ? can_reuse_spf_vma+0xe0/0xe0 [ 28.752074][ T271] ? vfs_write+0xaeb/0xd70 [ 28.756610][ T271] ? __kasan_check_write+0x14/0x20 [ 28.762037][ T271] ? down_read_trylock+0x106/0x160 [ 28.767187][ T271] ? __init_rwsem+0x1c0/0x1c0 [ 28.772213][ T271] ? vmacache_update+0xb7/0x120 [ 28.777168][ T271] ? find_vma+0x13b/0x150 [ 28.781828][ T271] do_user_addr_fault+0x576/0xe20 [ 28.786892][ T271] ? do_kern_addr_fault+0x80/0x80 [ 28.791969][ T271] ? __kasan_check_read+0x11/0x20 [ 28.798150][ T271] exc_page_fault+0x5a/0xc0 [ 28.802760][ T271] ? asm_exc_page_fault+0x8/0x30 [ 28.808031][ T271] asm_exc_page_fault+0x1e/0x30 [ 28.813158][ T271] RIP: 0033:0x7f857edef0c7 [ 28.817775][ T271] Code: ce 48 ff c7 48 01 fe 48 8d 54 11 80 0f 1f 80 00 00 00 00 c5 fe 6f 0e c5 fe 6f 56 20 c5 fe 6f 5e 40 c5 fe 6f 66 60 48 83 ee 80 fd 7f 0f c5 fd 7f 57 20 c5 fd 7f 5f 40 c5 fd 7f 67 60 48 83 ef [ 28.837476][ T271] RSP: 002b:00007ffd60229248 EFLAGS: 00010203 [ 28.843954][ T271] RAX: 00007f857b682000 RBX: 0000555577704000 RCX: 00007f857b682000 [ 28.852370][ T271] RDX: 00007f857b6820b4 RSI: 00005555777065b0 RDI: 00007f857b682020 [ 28.860424][ T271] RBP: 00007ffd60229260 R08: 0000000000000000 R09: 0000000000000000 [ 28.869163][ T271] R10: 0000000000000000 R11: 0000000000000202 R12: 0000555577707b60 [ 28.877144][ T271] R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000001 [ 28.885268][ T271] ---[ end trace c629eca2a4ae6bfb ]--- [ 28.891859][ T15] usb 2-1: device not accepting address 5, error -71 [ 28.899685][ T15] usb usb2-port1: unable to enumerate USB device [ 28.917815][ T354] xhci_hcd 0000:00:01.0: init 0000:00:01.0 fail, -16 [ 28.931889][ T354] xhci_hcd: probe of 0000:00:01.0 failed with error -16 [ 28.975648][ T363] ohci-platform pcspkr: IRQ index 0 not found [ 29.098348][ T304] ftdi_sio ttyUSB0: Unable to write latency timer: -71 [ 29.118322][ T304] ftdi_sio 5-1:1.0: GPIO initialisation failed: -71 [ 29.125462][ T304] usb 5-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 29.148514][ T304] usb 5-1: USB disconnect, device number 2 [ 29.156050][ T304] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 29.168759][ T304] ftdi_sio 5-1:1.0: device disconnected [ 29.218466][ T300] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 29.258339][ T51] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 29.318723][ T15] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 29.458301][ T300] usb 3-1: Using ep0 maxpacket: 8 [ 29.478516][ T5] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 29.498267][ T51] usb 4-1: Using ep0 maxpacket: 8 [ 29.588318][ T300] usb 3-1: config 0 has an invalid interface number: 143 but max is 0 [ 29.597162][ T300] usb 3-1: config 0 has no interface number 0 [ 29.603523][ T300] usb 3-1: New USB device found, idVendor=2058, idProduct=1005, bcdDevice=c1.9b [ 29.612830][ T300] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 29.618575][ T51] usb 4-1: config 0 has an invalid interface number: 143 but max is 0 [ 29.634545][ T51] usb 4-1: config 0 has no interface number 0 [ 29.635479][ T300] usb 3-1: config 0 descriptor?? [ 29.643050][ T51] usb 4-1: New USB device found, idVendor=2058, idProduct=1005, bcdDevice=c1.9b [ 29.656770][ T51] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 29.665659][ T51] usb 4-1: config 0 descriptor?? [ 29.838403][ T15] usb 2-1: New USB device found, idVendor=03e8, idProduct=0008, bcdDevice= 0.00 [ 29.847692][ T15] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 29.856080][ T15] usb 2-1: Product: syz [ 29.860324][ T15] usb 2-1: Manufacturer: syz [ 29.865046][ T15] usb 2-1: SerialNumber: syz [ 29.882370][ T359] udc-core: couldn't find an available UDC or it's busy [ 29.889578][ T359] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 29.912313][ T365] udc-core: couldn't find an available UDC or it's busy [ 29.919419][ T309] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 29.924832][ T365] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 29.935066][ T51] usb 4-1: USB disconnect, device number 2 [ 30.008350][ T5] usb 1-1: New USB device found, idVendor=0402, idProduct=5602, bcdDevice= 1.00 [ 30.017554][ T5] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 30.026008][ T5] usb 1-1: Product: syz [ 30.030743][ T5] usb 1-1: Manufacturer: syz [ 30.035617][ T5] usb 1-1: SerialNumber: syz [ 30.278600][ T309] usb 5-1: New USB device found, idVendor=8086, idProduct=0b63, bcdDevice= 0.00 [ 30.288034][ T309] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 30.330699][ T51] usb 3-1: USB disconnect, device number 2 [ 30.738347][ T15] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 30.844421][ T406] netlink: 8 bytes leftover after parsing attributes in process `syz.2.27'. [ 31.098325][ T15] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 64 [ 31.108632][ T15] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 31.118743][ T15] usb 4-1: New USB device found, idVendor=8087, idProduct=0025, bcdDevice= 0.01 [ 31.128139][ T15] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 31.136515][ T5] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 31.158363][ T399] raw-gadget.1 gadget: fail, usb_ep_enable returned -22 [ 31.165657][ T399] raw-gadget.1 gadget: fail, usb_ep_enable returned -22 [ 31.498310][ T5] usb 3-1: config 1 interface 0 altsetting 0 has an invalid endpoint with address 0xCE, skipping [ 31.668399][ T5] usb 3-1: New USB device found, idVendor=2a39, idProduct=3fd4, bcdDevice= 0.40 [ 31.677645][ T5] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 31.685697][ T5] usb 3-1: Product: syz [ 31.690068][ T5] usb 3-1: Manufacturer: syz [ 31.694857][ T5] usb 3-1: SerialNumber: syz [ 31.907781][ T20] usb 2-1: USB disconnect, device number 6 [ 31.934898][ T24] kauditd_printk_skb: 10 callbacks suppressed [ 31.934911][ T24] audit: type=1400 audit(1786952536.550:145): avc: denied { sys_module } for pid=415 comm="syz.1.30" capability=16 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 31.963960][ T408] udc-core: couldn't find an available UDC or it's busy [ 31.971364][ T408] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 32.072835][ T300] usb 1-1: USB disconnect, device number 3 [ 32.138323][ T5] usb 3-1: MIDIStreaming interface descriptor not found [ 32.147402][ T5] usb 3-1: USB disconnect, device number 3 [ 32.157045][ T95] udevd[95]: worker [394] terminated by signal 7 (Bus error) [ 32.164825][ T95] udevd[95]: worker [394] failed while handling '/devices/platform/dummy_hcd.2/usb3/3-1' [ 32.179358][ T95] udevd[95]: worker [392] terminated by signal 7 (Bus error) [ 32.187192][ T95] udevd[95]: worker [392] failed while handling '/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0' [ 32.378345][ T20] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 32.387901][ T5] usb 4-1: USB disconnect, device number 3 [ 32.400397][ T424] udevd[424]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 32.420177][ T95] udevd[95]: worker [393] terminated by signal 7 (Bus error) [ 32.427802][ T95] udevd[95]: worker [393] failed while handling '/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0' [ 32.478290][ T300] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 32.618281][ T20] usb 2-1: Using ep0 maxpacket: 8 [ 32.664303][ T5] usb 5-1: USB disconnect, device number 3 [ 32.738358][ T20] usb 2-1: config 0 has an invalid interface number: 143 but max is 0 [ 32.746907][ T20] usb 2-1: config 0 has no interface number 0 [ 32.753198][ T20] usb 2-1: New USB device found, idVendor=1234, idProduct=5678, bcdDevice=c1.9b [ 32.762334][ T304] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 32.769834][ T20] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 32.779688][ T20] usb 2-1: config 0 descriptor?? [ 32.823010][ T95] udevd[95]: worker [423] terminated by signal 7 (Bus error) [ 32.830550][ T95] udevd[95]: worker [423] failed while handling '/devices/platform/dummy_hcd.1/usb2/2-1' [ 32.848353][ T300] usb 1-1: New USB device found, idVendor=0bc3, idProduct=0001, bcdDevice= 0.01 [ 32.857645][ T300] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 32.869837][ T95] udevd[95]: worker [427] terminated by signal 7 (Bus error) [ 32.906491][ T435] using random self ethernet address [ 32.913196][ T435] using random host ethernet address [ 32.919984][ T435] udc-core: couldn't find an available UDC or it's busy [ 33.071243][ T309] usb 2-1: USB disconnect, device number 7 [ 33.088253][ T5] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 33.128317][ T304] usb 3-1: config 1 interface 1 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 64 [ 33.138417][ T304] usb 3-1: config 1 interface 1 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 64 [ 33.148245][ T304] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a7, bcdDevice= 1.00 [ 33.157369][ T304] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 33.328277][ T5] usb 5-1: Using ep0 maxpacket: 8 [ 33.448281][ T5] usb 5-1: config 0 has an invalid interface number: 143 but max is 0 [ 33.456683][ T5] usb 5-1: config 0 has no interface number 0 [ 33.463164][ T5] usb 5-1: New USB device found, idVendor=2058, idProduct=1005, bcdDevice=c1.9b [ 33.473359][ T5] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 33.482098][ T95] EXT4-fs error: 17 callbacks suppressed [ 33.482109][ T95] EXT4-fs error (device sda1): __ext4_find_entry:1657: inode #259: comm udevd: reading directory lblock 0 [ 33.499475][ T5] usb 5-1: config 0 descriptor?? [ 33.499850][ T95] EXT4-fs error (device sda1): __ext4_find_entry:1657: inode #264: comm udevd: reading directory lblock 0 [ 33.516427][ T95] EXT4-fs error (device sda1): __ext4_find_entry:1657: inode #264: comm udevd: reading directory lblock 0 [ 33.528360][ T95] EXT4-fs error (device sda1): __ext4_find_entry:1657: inode #264: comm udevd: reading directory lblock 0 [ 33.540592][ T95] EXT4-fs error (device sda1): __ext4_find_entry:1657: inode #1642: comm udevd: reading directory lblock 0 [ 33.552506][ T95] EXT4-fs error (device sda1): __ext4_find_entry:1657: inode #1480: comm udevd: reading directory lblock 0 [ 33.743445][ T5] usb 5-1: USB disconnect, device number 4 [ 34.018247][ T309] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 34.100685][ T51] usb 1-1: USB disconnect, device number 4 [ 34.260359][ T24] audit: type=1400 audit(1786952538.880:146): avc: denied { rmdir } for pid=449 comm="syz.4.39" name="g3" dev="configfs" ino=16155 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 34.268342][ T309] usb 4-1: Using ep0 maxpacket: 8 [ 34.398377][ T309] usb 4-1: config 0 has an invalid interface number: 143 but max is 0 [ 34.406809][ T309] usb 4-1: config 0 has no interface number 0 [ 34.413016][ T309] usb 4-1: New USB device found, idVendor=2058, idProduct=1005, bcdDevice=c1.9b [ 34.422160][ T309] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 34.429903][ T304] cdc_acm 3-1:1.0: ttyACM0: USB ACM device [ 34.439231][ T309] usb 4-1: config 0 descriptor?? [ 34.446729][ T304] usb 3-1: USB disconnect, device number 4 [ 34.680585][ T446] udc-core: couldn't find an available UDC or it's busy [ 34.687624][ T446] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 34.695944][ T25] usb 4-1: USB disconnect, device number 4 [ 34.888239][ T51] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 34.918240][ T309] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 35.218306][ T25] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 35.238826][ T20] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 35.248376][ T51] usb 2-1: config index 0 descriptor too short (expected 32, got 18) [ 35.256768][ T51] usb 2-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 35.298297][ T309] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 35.308511][ T309] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 35.388424][ T51] usb 2-1: New USB device found, idVendor=110a, idProduct=1250, bcdDevice= 0.00 [ 35.397719][ T51] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 35.405853][ T51] usb 2-1: Product: syz [ 35.410106][ T51] usb 2-1: Manufacturer: syz [ 35.488296][ T300] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 35.498647][ T309] usb 1-1: New USB device found, idVendor=0582, idProduct=0582, bcdDevice= 0.40 [ 35.507751][ T309] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 35.515904][ T309] usb 1-1: Product: syz [ 35.520414][ T309] usb 1-1: Manufacturer: syz [ 35.525028][ T309] usb 1-1: SerialNumber: syz [ 35.608382][ T20] usb 3-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice= 0.01 [ 35.617719][ T20] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 35.708355][ T25] usb 5-1: New USB device found, idVendor=9710, idProduct=7810, bcdDevice= 1.00 [ 35.717779][ T25] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 35.728734][ T25] usb 5-1: Product: syz [ 35.733079][ T25] usb 5-1: Manufacturer: syz [ 35.787874][ T494] EXT4-fs error (device sda1): __ext4_find_entry:1657: inode #264: comm udevd: reading directory lblock 0 [ 35.799644][ T494] EXT4-fs error (device sda1): __ext4_find_entry:1657: inode #264: comm udevd: reading directory lblock 0 [ 35.811131][ T494] EXT4-fs error (device sda1): __ext4_find_entry:1657: inode #264: comm udevd: reading directory lblock 0 [ 35.868339][ T300] usb 4-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 35.958340][ T300] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 35.967503][ T300] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 35.975676][ T300] usb 4-1: SerialNumber: syz [ 36.384400][ T499] PM: suspend entry (s2idle) [ 36.389362][ T499] Filesystems sync: 0.000 seconds [ 36.394653][ T499] Freezing user space processes ... [ 40.908338][ T309] usb 1-1: 0:1 : does not exist [ 40.918702][ T309] usb 1-1: BAAD SPEAKER p_chmask mismatch [ 40.924669][ T309] snd-usb-audio: probe of 1-1:1.0 failed with error -22 [ 41.458433][ T300] cdc_ether: probe of 4-1:1.0 failed with error -32 [ 41.473189][ T499] (elapsed 5.078 seconds) done. [ 41.478301][ T499] OOM killer disabled. [ 41.482400][ T499] Freezing remaining freezable tasks ... (elapsed 0.001 seconds) done. [ 41.492063][ T499] PM: suspend debug: Waiting for 5 second(s). [ 46.506630][ T499] OOM killer enabled. [ 46.510712][ T499] Restarting tasks ... [ 46.511182][ T95] EXT4-fs error (device sda1): __ext4_find_entry:1657: inode #259: comm udevd: reading directory lblock 0 [ 46.526727][ T499] done. [ 46.529565][ T499] Resume cause unknown [ 46.533804][ T499] PM: suspend exit [ 46.537791][ T95] EXT4-fs error (device sda1): __ext4_find_entry:1657: inode #264: comm udevd: reading directory lblock 0 [ 46.549283][ T95] EXT4-fs error (device sda1): __ext4_find_entry:1657: inode #264: comm udevd: reading directory lblock 0 [ 46.560748][ T95] EXT4-fs error (device sda1): __ext4_find_entry:1657: inode #264: comm udevd: reading directory lblock 0 [ 46.575300][ T51] usb 4-1: USB disconnect, device number 5 [ 46.584965][ T309] usb 3-1: USB disconnect, device number 5 [ 46.594219][ T95] EXT4-fs error (device sda1): __ext4_find_entry:1657: inode #1642: comm udevd: reading directory lblock 0 [ 46.597863][ T25] usb 1-1: USB disconnect, device number 5 [ 46.611947][ T95] EXT4-fs error (device sda1): __ext4_find_entry:1657: inode #1480: comm udevd: reading directory lblock 0 [ 46.624268][ T15] usb 2-1: USB disconnect, device number 8 [ 46.640499][ T300] usb 5-1: USB disconnect, device number 5 [ 46.643061][ T95] udevd[95]: worker [489] terminated by signal 7 (Bus error) [ 46.656959][ T509] EXT4-fs error (device sda1): __ext4_find_entry:1657: inode #265: comm dhcpcd: reading directory lblock 0 [ 46.672282][ T95] udevd[95]: worker [489] failed while handling '/devices/platform/dummy_hcd.0/usb1/1-1' [ 46.683733][ T95] udevd[95]: worker [494] terminated by signal 7 (Bus error) [ 46.692513][ T95] udevd[95]: worker [494] failed while handling '/devices/platform/dummy_hcd.3/usb4/4-1' [ 46.723813][ T513] EXT4-fs error (device sda1): __ext4_find_entry:1657: inode #265: comm dhcpcd: reading directory lblock 0 [ 46.738615][ T512] xhci_hcd 0000:00:01.0: init 0000:00:01.0 fail, -16 [ 46.745373][ T512] xhci_hcd: probe of 0000:00:01.0 failed with error -16 [ 46.767629][ T95] udevd[95]: worker [515] terminated by signal 7 (Bus error) [ 46.781611][ T95] udevd[95]: worker [515] failed while handling '/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0' [ 46.800594][ T95] udevd[95]: worker [516] terminated by signal 7 (Bus error) [ 46.808359][ T95] udevd[95]: worker [516] failed while handling '/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0' [ 46.841118][ T24] audit: type=1400 audit(1786952551.460:147): avc: denied { read } for pid=134 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=1 [ 46.867151][ T523] EXT4-fs error (device sda1): __ext4_find_entry:1657: inode #265: comm dhcpcd: reading directory lblock 0 [ 47.008233][ T51] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 47.028232][ T15] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 47.048290][ T300] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 47.080898][ T24] audit: type=1400 audit(1786952551.700:148): avc: denied { read write } for pid=531 comm="syz.2.62" name="uhid" dev="devtmpfs" ino=261 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:uhid_device_t tclass=chr_file permissive=1 [ 47.087413][ T20] wiimote 0005:057E:0306.0001: unknown main item tag 0x0 [ 47.106006][ T24] audit: type=1400 audit(1786952551.700:149): avc: denied { open } for pid=531 comm="syz.2.62" path="/dev/uhid" dev="devtmpfs" ino=261 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:uhid_device_t tclass=chr_file permissive=1 [ 47.112588][ T20] wiimote 0005:057E:0306.0001: unknown main item tag 0x0 [ 47.142271][ T20] wiimote 0005:057E:0306.0001: unknown main item tag 0x0 [ 47.149367][ T20] wiimote 0005:057E:0306.0001: unknown main item tag 0x0 [ 47.156461][ T20] wiimote 0005:057E:0306.0001: unknown main item tag 0x7 [ 47.163887][ T20] wiimote 0005:057E:0306.0001: unknown main item tag 0x0 [ 47.171062][ T20] wiimote 0005:057E:0306.0001: unknown main item tag 0x0 [ 47.178195][ T20] wiimote 0005:057E:0306.0001: unknown main item tag 0x0 [ 47.185341][ T20] wiimote 0005:057E:0306.0001: unknown main item tag 0x0 [ 47.192726][ T20] wiimote 0005:057E:0306.0001: unknown main item tag 0x0 [ 47.200019][ T20] wiimote 0005:057E:0306.0001: unknown main item tag 0x0 [ 47.207262][ T20] wiimote 0005:057E:0306.0001: unknown main item tag 0x0 [ 47.214427][ T25] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 47.222151][ T20] wiimote 0005:057E:0306.0001: unknown main item tag 0x0 [ 47.229413][ T20] wiimote 0005:057E:0306.0001: unknown main item tag 0x0 [ 47.236578][ T20] wiimote 0005:057E:0306.0001: unknown main item tag 0x0 [ 47.243732][ T20] wiimote 0005:057E:0306.0001: unknown main item tag 0x0 [ 47.250851][ T20] wiimote 0005:057E:0306.0001: unknown main item tag 0x0 [ 47.258037][ T20] wiimote 0005:057E:0306.0001: unknown main item tag 0x0 [ 47.265207][ T20] wiimote 0005:057E:0306.0001: unknown main item tag 0x0 [ 47.272403][ T51] usb 4-1: Using ep0 maxpacket: 8 [ 47.277589][ T20] wiimote 0005:057E:0306.0001: unknown main item tag 0x0 [ 47.284787][ T20] wiimote 0005:057E:0306.0001: unknown main item tag 0x0 [ 47.291920][ T20] wiimote 0005:057E:0306.0001: unknown main item tag 0x0 [ 47.299155][ T20] wiimote 0005:057E:0306.0001: unknown main item tag 0x0 [ 47.306367][ T20] wiimote 0005:057E:0306.0001: unknown main item tag 0x0 [ 47.308500][ T15] usb 2-1: Using ep0 maxpacket: 16 [ 47.313885][ T20] wiimote 0005:057E:0306.0001: unknown main item tag 0x0 [ 47.325863][ T20] wiimote 0005:057E:0306.0001: unknown main item tag 0x0 [ 47.332987][ T20] wiimote 0005:057E:0306.0001: unknown main item tag 0x0 [ 47.340091][ T20] wiimote 0005:057E:0306.0001: unknown main item tag 0x0 [ 47.347265][ T20] wiimote 0005:057E:0306.0001: unknown main item tag 0x0 [ 47.354531][ T20] wiimote 0005:057E:0306.0001: unknown main item tag 0x0 [ 47.362107][ T20] wiimote 0005:057E:0306.0001: unknown main item tag 0x0 [ 47.369456][ T20] wiimote 0005:057E:0306.0001: unknown main item tag 0x0 [ 47.379033][ T20] wiimote 0005:057E:0306.0001: hidraw0: BLUETOOTH HID v0.00 Device [syz0] on syz0 [ 47.388493][ T51] usb 4-1: New USB device found, idVendor=1163, idProduct=0100, bcdDevice= 0.00 [ 47.397910][ T51] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 47.406598][ T20] wiimote 0005:057E:0306.0001: New device registered [ 47.414249][ T531] wiimote 0005:057E:0306.0001: Device removed [ 47.415526][ T519] EXT4-fs error (device sda1): __ext4_find_entry:1657: inode #264: comm udevd: reading directory lblock 0 [ 47.432152][ T300] usb 5-1: config index 0 descriptor too short (expected 71, got 53) [ 47.441402][ T534] udevd[534]: failed to execute '/lib/udev/fido_id' 'fido_id': Input/output error [ 47.463163][ T95] udevd[95]: worker [526] terminated by signal 7 (Bus error) [ 47.478504][ T15] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 47.489796][ T15] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 47.503488][ T15] usb 2-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 47.512678][ T15] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 47.521339][ T15] usb 2-1: config 0 descriptor?? [ 47.588381][ T25] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 47.597548][ T25] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 47.606812][ T25] usb 1-1: config 0 descriptor?? [ 47.618536][ T300] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 1.00 [ 47.627668][ T300] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 47.635746][ T300] usb 5-1: Product: syz [ 47.640112][ T300] usb 5-1: Manufacturer: syz [ 47.644711][ T300] usb 5-1: SerialNumber: syz [ 47.991130][ T300] usb 5-1: USB disconnect, device number 6 [ 47.999869][ T15] HID 045e:07da: Invalid code 65791 type 1 [ 48.010155][ T15] input: HID 045e:07da as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/0003:045E:07DA.0002/input/input5 [ 48.023055][ T15] microsoft 0003:045E:07DA.0002: input,hidraw1: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.1-1/input0 [ 48.079426][ T25] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 48.087106][ T25] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 48.094611][ T25] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 48.102118][ T25] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 48.109760][ T25] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 48.117445][ T25] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 48.124931][ T25] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 48.132447][ T25] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 48.140065][ T25] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 48.147479][ T25] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 48.154932][ T25] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 48.162368][ T25] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 48.170489][ T25] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 48.177937][ T25] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 48.185384][ T25] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 48.192922][ T25] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 48.200476][ T25] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 48.207903][ T25] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 48.215638][ T25] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 48.223303][ T25] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 48.230892][ T25] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 48.238341][ T25] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 48.245733][ T25] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 48.253198][ T25] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 48.260636][ T25] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 48.268301][ T25] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 48.275732][ T25] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 48.283190][ T25] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 48.290820][ T25] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 48.298556][ T25] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 48.306026][ T25] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 48.313476][ T25] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 48.321246][ T25] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 48.328787][ T25] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 48.336220][ T25] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 48.344043][ T25] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 48.351680][ T25] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 48.359452][ T25] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 48.367003][ T25] plantronics 0003:047F:FFFF.0003: No inputs registered, leaving [ 48.379778][ T25] plantronics 0003:047F:FFFF.0003: hiddev96,hidraw2: USB HID v0.00 Device [HID 047f:ffff] on usb-dummy_hcd.0-1/input0 [ 48.438365][ T20] wiimote 0005:057E:0306.0001: detected device: Nintendo Wii Remote (Gen 1) [ 48.454939][ T20] input: Nintendo Wii Remote Accelerometer as /devices/virtual/misc/uhid/0005:057E:0306.0001/input/input7 [ 48.467505][ T20] input: Nintendo Wii Remote IR as /devices/virtual/misc/uhid/0005:057E:0306.0001/input/input8 [ 48.480600][ T20] input: Nintendo Wii Remote as /devices/virtual/misc/uhid/0005:057E:0306.0001/input/input6 [ 48.814208][ T308] usb 2-1: USB disconnect, device number 9 [ 49.068282][ T51] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 49.327417][ T559] file system registered [ 49.333177][ T24] audit: type=1400 audit(1786952553.950:150): avc: denied { mount } for pid=558 comm="syz.1.64" name="/" dev="functionfs" ino=15341 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbfs_t tclass=filesystem permissive=1 [ 49.341598][ T559] read descriptors [ 49.366952][ T24] audit: type=1400 audit(1786952553.980:151): avc: denied { unmount } for pid=279 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbfs_t tclass=filesystem permissive=1 [ 49.387863][ T279] ffs_data_put(): freeing [ 49.415765][ T24] audit: type=1400 audit(1786952554.030:152): avc: denied { read write } for pid=562 comm="syz.1.66" name="idVendor" dev="configfs" ino=16420 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=file permissive=1 [ 49.425502][ T563] ================================================================== [ 49.440388][ T24] audit: type=1400 audit(1786952554.030:153): avc: denied { open } for pid=562 comm="syz.1.66" path="/13/config/usb_gadget/g1/idVendor" dev="configfs" ino=16420 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=file permissive=1 [ 49.448018][ T563] BUG: KASAN: use-after-free in kobject_get+0x113/0x120 [ 49.448032][ T563] Read of size 1 at addr ffff88810eca603c by task syz.1.66/563 [ 49.448047][ T563] [ 49.490163][ T563] CPU: 1 PID: 563 Comm: syz.1.66 Tainted: G W syzkaller #0 [ 49.498692][ T563] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 49.509779][ T563] Call Trace: [ 49.513138][ T563] __dump_stack+0x21/0x24 [ 49.517491][ T563] dump_stack_lvl+0x1a7/0x208 [ 49.522345][ T563] ? show_regs_print_info+0x18/0x18 [ 49.527599][ T563] ? thaw_kernel_threads+0x220/0x220 [ 49.532917][ T563] print_address_description+0x7f/0x2c0 [ 49.538939][ T563] ? kobject_get+0x113/0x120 [ 49.543615][ T563] kasan_report+0x100/0x140 [ 49.548142][ T563] ? kobject_get+0x113/0x120 [ 49.553395][ T563] __asan_report_load1_noabort+0x14/0x20 [ 49.559061][ T563] kobject_get+0x113/0x120 [ 49.563503][ T563] device_add+0x331/0xc00 [ 49.567854][ T563] ? kobject_set_name_vargs+0xca/0x110 [ 49.573445][ T563] device_create+0x26c/0x300 [ 49.578061][ T563] ? root_device_unregister+0x80/0x80 [ 49.583458][ T563] create_function_device+0x60/0x70 [ 49.588849][ T563] f_midi_alloc_inst+0x1a8/0x380 [ 49.593812][ T563] usb_get_function_instance+0xe2/0x2f0 [ 49.599462][ T563] function_make+0x118/0x350 [ 49.604075][ T563] ? gadget_dev_desc_max_speed_store+0x240/0x240 [ 49.610590][ T563] ? mutex_trylock+0xb0/0xb0 [ 49.615211][ T563] ? configfs_mkdir+0x504/0xd90 [ 49.620080][ T563] configfs_mkdir+0x5d2/0xd90 [ 49.624784][ T563] ? show_sid+0x1b0/0x1b0 [ 49.629131][ T563] ? configfs_lookup+0x500/0x500 [ 49.634294][ T563] ? __lookup_hash+0x122/0x250 [ 49.639088][ T563] ? security_inode_mkdir+0xbd/0x110 [ 49.644507][ T563] vfs_mkdir+0x42c/0x600 [ 49.648769][ T563] do_mkdirat+0x14c/0x340 [ 49.653118][ T563] __x64_sys_mkdirat+0x7b/0x90 [ 49.657900][ T563] do_syscall_64+0x31/0x40 [ 49.662338][ T563] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 49.668367][ T563] RIP: 0033:0x7f5aed6ce0d9 [ 49.672803][ T563] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 49.692420][ T563] RSP: 002b:00007f5aec127028 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 [ 49.700866][ T563] RAX: ffffffffffffffda RBX: 00007f5aed955fa0 RCX: 00007f5aed6ce0d9 [ 49.708915][ T563] RDX: 00000000000001ff RSI: 0000200000000400 RDI: ffffffffffffff9c [ 49.716935][ T563] RBP: 00007f5aed765024 R08: 0000000000000000 R09: 0000000000000000 [ 49.725074][ T563] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 49.733374][ T563] R13: 00007f5aed956038 R14: 00007f5aed955fa0 R15: 00007ffe21fb70c8 [ 49.741372][ T563] [ 49.743715][ T563] Allocated by task 313: [ 49.747980][ T563] __kasan_kmalloc+0xd4/0x100 [ 49.752908][ T563] kmem_cache_alloc_trace+0x179/0x2e0 [ 49.758300][ T563] device_create+0x13a/0x300 [ 49.762903][ T563] gadgets_make+0x816/0xa70 [ 49.767419][ T563] configfs_mkdir+0x5d2/0xd90 [ 49.772109][ T563] vfs_mkdir+0x42c/0x600 [ 49.776367][ T563] do_mkdirat+0x14c/0x340 [ 49.780709][ T563] __x64_sys_mkdirat+0x7b/0x90 [ 49.785485][ T563] do_syscall_64+0x31/0x40 [ 49.789913][ T563] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 49.795810][ T563] [ 49.798342][ T563] Freed by task 450: [ 49.802524][ T563] kasan_set_track+0x4a/0x70 [ 49.807149][ T563] kasan_set_free_info+0x23/0x40 [ 49.812578][ T563] ____kasan_slab_free+0x125/0x160 [ 49.817843][ T563] __kasan_slab_free+0x11/0x20 [ 49.822642][ T563] slab_free_freelist_hook+0xc5/0x190 [ 49.828029][ T563] kfree+0xc0/0x270 [ 49.831966][ T563] device_create_release+0x15/0x20 [ 49.837125][ T563] device_release+0x96/0x1c0 [ 49.841732][ T563] kobject_put+0x18a/0x270 [ 49.846167][ T563] device_destroy+0xb4/0xf0 [ 49.850734][ T563] gadgets_drop+0xa0/0xd0 [ 49.855330][ T563] configfs_rmdir+0x871/0x960 [ 49.860023][ T563] vfs_rmdir+0x1ab/0x3c0 [ 49.864362][ T563] do_rmdir+0x232/0x630 [ 49.869254][ T563] __x64_sys_rmdir+0x49/0x50 [ 49.873870][ T563] do_syscall_64+0x31/0x40 [ 49.878405][ T563] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 49.884762][ T563] [ 49.887127][ T563] The buggy address belongs to the object at ffff88810eca6000 [ 49.887127][ T563] which belongs to the cache kmalloc-1k of size 1024 [ 49.901920][ T563] The buggy address is located 60 bytes inside of [ 49.901920][ T563] 1024-byte region [ffff88810eca6000, ffff88810eca6400) [ 49.916162][ T563] The buggy address belongs to the page: [ 49.922064][ T563] page:ffffea00043b2800 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10eca0 [ 49.932674][ T563] head:ffffea00043b2800 order:3 compound_mapcount:0 compound_pincount:0 [ 49.941369][ T563] flags: 0x4000000000010200(slab|head) [ 49.947045][ T563] raw: 4000000000010200 dead000000000100 dead000000000122 ffff888100042f00 [ 49.955653][ T563] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 49.964329][ T563] page dumped because: kasan: bad access detected [ 49.970895][ T563] page_owner tracks the page as allocated [ 49.976653][ T563] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1d2a20(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 308, ts 24267892816, free_ts 24266609749 [ 49.996462][ T563] prep_new_page+0x176/0x190 [ 50.001245][ T563] get_page_from_freelist+0x225f/0x23f0 [ 50.006806][ T563] __alloc_pages_nodemask+0x29a/0x640 [ 50.012212][ T563] new_slab+0x84/0x3f0 [ 50.016297][ T563] ___slab_alloc+0x2f8/0x4c0 [ 50.020897][ T563] __slab_alloc+0x63/0xa0 [ 50.025234][ T563] __kmalloc_track_caller+0x1e4/0x310 [ 50.030791][ T563] __alloc_skb+0xdc/0x520 [ 50.035157][ T563] wg_socket_send_buffer_to_peer+0x37/0x170 [ 50.041238][ T563] wg_packet_send_handshake_response+0x1af/0x230 [ 50.048313][ T563] wg_packet_handshake_receive_worker+0x512/0x900 [ 50.055389][ T563] process_one_work+0x6fd/0xbc0 [ 50.060266][ T563] worker_thread+0xa8e/0x13c0 [ 50.065059][ T563] kthread+0x324/0x3b0 [ 50.069148][ T563] ret_from_fork+0x1f/0x30 [ 50.073787][ T563] page last free stack trace: [ 50.078510][ T563] __free_pages_ok+0x80b/0x830 [ 50.083297][ T563] __free_pages+0xd8/0x390 [ 50.089673][ T563] __free_slab+0xcf/0x190 [ 50.094053][ T563] unfreeze_partials+0x150/0x180 [ 50.099001][ T563] put_cpu_partial+0xc1/0x180 [ 50.103683][ T563] __slab_free+0x2c9/0x3a0 [ 50.108110][ T563] ___cache_free+0x10e/0x130 [ 50.112704][ T563] qlink_free+0x50/0x90 [ 50.116977][ T563] qlist_free_all+0x5f/0xb0 [ 50.121542][ T563] kasan_quarantine_reduce+0x14a/0x160 [ 50.127041][ T563] __kasan_slab_alloc+0x2f/0xe0 [ 50.131992][ T563] slab_post_alloc_hook+0x5d/0x2f0 [ 50.137116][ T563] kmem_cache_alloc_trace+0x155/0x2e0 [ 50.142497][ T563] alloc_fs_context+0x65/0x630 [ 50.147353][ T563] fs_context_for_mount+0x22/0x30 [ 50.152404][ T563] do_new_mount+0x122/0xa30 [ 50.156914][ T563] [ 50.159370][ T563] Memory state around the buggy address: [ 50.165014][ T563] ffff88810eca5f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 50.173190][ T563] ffff88810eca5f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 50.181267][ T563] >ffff88810eca6000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 50.189884][ T563] ^ [ 50.195786][ T563] ffff88810eca6080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 50.203855][ T563] ffff88810eca6100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 50.211930][ T563] ================================================================== [ 50.219997][ T563] Disabling lock debugging due to kernel taint [ 50.226839][ T563] ------------[ cut here ]------------ [ 50.232538][ T51] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 50.242981][ T24] audit: type=1400 audit(1786952554.870:154): avc: denied { read } for pid=80 comm="acpid" name="event5" dev="devtmpfs" ino=572 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 50.264044][ T308] usb 4-1: USB disconnect, device number 6 [ 50.268809][ T563] refcount_t: addition on 0; use-after-free. [ 50.277316][ T24] audit: type=1400 audit(1786952554.870:155): avc: denied { open } for pid=80 comm="acpid" path="/dev/input/event5" dev="devtmpfs" ino=572 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 50.277473][ T563] WARNING: CPU: 1 PID: 563 at lib/refcount.c:25 refcount_warn_saturate+0x104/0x1a0 [ 50.277477][ T563] Modules linked in: [ 50.277497][ T563] CPU: 1 PID: 563 Comm: syz.1.66 Tainted: G B W syzkaller #0 [ 50.277522][ T563] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Aug 17 07:42:34 [ 50.277539][ T563] RIP: 0010:refcount_warn_saturate+0x104/0x1a0 syzkaller kern.a[ 50.277551][ T563] Code: 04 01 48 c7 c7 00 4e 40 85 e8 08 0f 3b 02 0f 0b eb df e8 7f a8 26 ff c6 05 9c 8b 82 04 01 48 c7 c7 40 4d 40 85 e8 ec 0e 3b 02 <0f> 0b eb c3 e8 63 a8 26 ff c6 05 81 8b 82 04 01 48 c7 c7 a0 4d 40 lert kernel: [ [ 50.277560][ T563] RSP: 0018:ffffc90000dcf950 EFLAGS: 00010246 [ 50.277571][ T563] RAX: 8cac81b0cd894000 RBX: 0000000000000002 RCX: 0000000000080000 49.970895][ T5[ 50.277579][ T563] RDX: ffffc900018bc000 RSI: 000000000007ffff RDI: 0000000000080000 63] page_owner t[ 50.277588][ T563] RBP: ffffc90000dcf960 R08: ffffc90000dcf2e7 R09: fffff520001b9e90 racks the page a[ 50.277597][ T563] R10: dffffc0000000000 R11: fffff520001b9e5d R12: 0000000000000000 s allocated [ 50.277605][ T563] R13: ffff888112398868 R14: 0000000000000002 R15: 0000000000000000 [ 50.277616][ T563] FS: 00007f5aec1276c0(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 50.277624][ T563] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 50.277631][ T563] CR2: 00007f5aec105ff8 CR3: 000000011738f000 CR4: 00000000003506a0 [ 50.277644][ T563] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 50.277652][ T563] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 50.277656][ T563] Call Trace: [ 50.277671][ T563] kobject_get+0xfb/0x120 [ 50.277693][ T563] device_add+0x331/0xc00 [ 50.277706][ T563] ? kobject_set_name_vargs+0xca/0x110 [ 50.277718][ T563] device_create+0x26c/0x300 [ 50.277733][ T563] ? root_device_unregister+0x80/0x80 [ 50.277750][ T563] create_function_device+0x60/0x70 [ 50.277762][ T563] f_midi_alloc_inst+0x1a8/0x380 [ 50.277775][ T563] usb_get_function_instance+0xe2/0x2f0 [ 50.277788][ T563] function_make+0x118/0x350 [ 50.277802][ T563] ? gadget_dev_desc_max_speed_store+0x240/0x240 [ 50.277814][ T563] ? mutex_trylock+0xb0/0xb0 [ 50.277827][ T563] ? configfs_mkdir+0x504/0xd90 [ 50.277839][ T563] configfs_mkdir+0x5d2/0xd90 [ 50.277851][ T563] ? show_sid+0x1b0/0x1b0 [ 50.277863][ T563] ? configfs_lookup+0x500/0x500 [ 50.277875][ T563] ? __lookup_hash+0x122/0x250 [ 50.277889][ T563] ? security_inode_mkdir+0xbd/0x110 [ 50.277901][ T563] vfs_mkdir+0x42c/0x600 [ 50.277913][ T563] do_mkdirat+0x14c/0x340 [ 50.277926][ T563] __x64_sys_mkdirat+0x7b/0x90 [ 50.277939][ T563] do_syscall_64+0x31/0x40 [ 50.277949][ T563] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 50.277958][ T563] RIP: 0033:0x7f5aed6ce0d9 [ 50.277970][ T563] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 50.277977][ T563] RSP: 002b:00007f5aec127028 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 [ 50.277991][ T563] RAX: ffffffffffffffda RBX: 00007f5aed955fa0 RCX: 00007f5aed6ce0d9 [ 50.277999][ T563] RDX: 00000000000001ff RSI: 0000200000000400 RDI: ffffffffffffff9c [ 50.278006][ T563] RBP: 00007f5aed765024 R08: 0000000000000000 R09: 0000000000000000 [ 50.278013][ T563] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 50.278020][ T563] R13: 00007f5aed956038 R14: 00007f5aed955fa0 R15: 00007ffe21fb70c8 [ 50.278030][ T563] ---[ end trace c629eca2a4ae6bfc ]--- [ 50.278037][ T563] ------------[ cut here ]------------ [ 50.278040][ T563] refcount_t: saturated; leaking memory. [ 50.278163][ T563] WARNING: CPU: 1 PID: 563 at lib/refcount.c:22 refcount_warn_saturate+0x158/0x1a0 [ 50.278336][ T563] Modules linked in: [ 50.278352][ T563] CPU: 1 PID: 563 Comm: syz.1.66 Tainted: G B W syzkaller #0 [ 50.278359][ T563] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 50.278374][ T563] RIP: 0010:refcount_warn_saturate+0x158/0x1a0 [ 50.278385][ T563] Code: 04 01 48 c7 c7 c0 4c 40 85 e8 b4 0e 3b 02 0f 0b eb 8b e8 2b a8 26 ff c6 05 47 8b 82 04 01 48 c7 c7 c0 4c 40 85 e8 98 0e 3b 02 <0f> 0b e9 6c ff ff ff e8 0c a8 26 ff c6 05 2c 8b 82 04 01 48 c7 c7 [ 50.278393][ T563] RSP: 0018:ffffc90000dcf818 EFLAGS: 00010246 [ 50.278405][ T563] RAX: 8cac81b0cd894000 RBX: 0000000000000001 RCX: 0000000000080000 [ 50.278414][ T563] RDX: ffffc900018bc000 RSI: 000000000007ffff RDI: 0000000000080000 [ 50.278421][ T563] RBP: ffffc90000dcf828 R08: 0000000000000003 R09: 0000000000000004 [ 50.278431][ T563] R10: dffffc0000000000 R11: fffff520001b9ea4 R12: 00000000c0000000 [ 50.278439][ T563] R13: ffff888112398818 R14: 0000000000000001 R15: ffff88810eca6038 [ 50.278450][ T563] FS: 00007f5aec1276c0(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 50.278459][ T563] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 50.278467][ T563] CR2: 00007f5aec105ff8 CR3: 000000011738f000 CR4: 00000000003506a0 [ 50.278479][ T563] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 50.278487][ T563] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 50.278491][ T563] Call Trace: [ 50.278504][ T563] kobject_add_internal+0xc44/0xde0 [ 50.278517][ T563] ? kobject_set_name_vargs+0x4c/0x110 [ 50.278528][ T563] kobject_add+0x165/0x230 [ 50.278540][ T563] ? kobject_init+0x1d0/0x1d0 [ 50.278553][ T563] ? __asan_report_load8_noabort+0x14/0x20 [ 50.278564][ T563] ? get_device_parent+0x12e/0x410 [ 50.278576][ T563] device_add+0x3d8/0xc00 [ 50.278588][ T563] ? kobject_set_name_vargs+0xca/0x110 [ 50.278599][ T563] device_create+0x26c/0x300 [ 50.278612][ T563] ? root_device_unregister+0x80/0x80 [ 50.278627][ T563] create_function_device+0x60/0x70 [ 50.278640][ T563] f_midi_alloc_inst+0x1a8/0x380 [ 50.278653][ T563] usb_get_function_instance+0xe2/0x2f0 [ 50.278666][ T563] function_make+0x118/0x350 [ 50.278690][ T563] ? gadget_dev_desc_max_speed_store+0x240/0x240 [ 50.278703][ T563] ? mutex_trylock+0xb0/0xb0 [ 50.278715][ T563] ? configfs_mkdir+0x504/0xd90 [ 50.278727][ T563] configfs_mkdir+0x5d2/0xd90 [ 50.278741][ T563] ? show_sid+0x1b0/0x1b0 [ 50.278753][ T563] ? configfs_lookup+0x500/0x500 [ 50.278765][ T563] ? __lookup_hash+0x122/0x250 [ 50.278780][ T563] ? security_inode_mkdir+0xbd/0x110 [ 50.278792][ T563] vfs_mkdir+0x42c/0x600 [ 50.278804][ T563] do_mkdirat+0x14c/0x340 [ 50.278817][ T563] __x64_sys_mkdirat+0x7b/0x90 [ 50.278829][ T563] do_syscall_64+0x31/0x40 [ 50.278841][ T563] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 50.278850][ T563] RIP: 0033:0x7f5aed6ce0d9 [ 50.278862][ T563] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 50.278869][ T563] RSP: 002b:00007f5aec127028 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 [ 50.278883][ T563] RAX: ffffffffffffffda RBX: 00007f5aed955fa0 RCX: 00007f5aed6ce0d9 [ 50.278892][ T563] RDX: 00000000000001ff RSI: 0000200000000400 RDI: ffffffffffffff9c [ 50.278900][ T563] RBP: 00007f5aed765024 R08: 0000000000000000 R09: 0000000000000000 [ 50.278907][ T563] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 50.278916][ T563] R13: 00007f5aed956038 R14: 00007f5aed955fa0 R15: 00007ffe21fb70c8 [ 50.278925][ T563] ---[ end trace c629eca2a4ae6bfd ]--- [ 50.278933][ T563] ------------[ cut here ]------------ [ 50.278936][ T563] refcount_t: underflow; use-after-free. [ 50.279062][ T563] WARNING: CPU: 1 PID: 563 at lib/refcount.c:28 refcount_warn_saturate+0x120/0x1a0 [ 50.279065][ T563] Modules linked in: [ 50.279080][ T563] CPU: 1 PID: 563 Comm: syz.1.66 Tainted: G B W syzkaller #0 [ 50.279087][ T563] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 50.279101][ T563] RIP: 0010:refcount_warn_saturate+0x120/0x1a0 [ 50.279111][ T563] Code: 04 01 48 c7 c7 40 4d 40 85 e8 ec 0e 3b 02 0f 0b eb c3 e8 63 a8 26 ff c6 05 81 8b 82 04 01 48 c7 c7 a0 4d 40 85 e8 d0 0e 3b 02 <0f> 0b eb a7 e8 47 a8 26 ff c6 05 62 8b 82 04 01 48 c7 c7 c0 4c 40 [ 50.279119][ T563] RSP: 0018:ffffc90000dcf7e0 EFLAGS: 00010246 [ 50.279130][ T563] RAX: 8cac81b0cd894000 RBX: 0000000000000003 RCX: 0000000000080000 [ 50.279138][ T563] RDX: ffffc900018bc000 RSI: 000000000007ffff RDI: 0000000000080000 [ 50.279146][ T563] RBP: ffffc90000dcf7f0 R08: 0000000000000003 R09: 0000000000000004 [ 50.279156][ T563] R10: dffffc0000000000 R11: fffff520001b9e9c R12: 00000000c0000000 [ 50.279164][ T563] R13: ffff88810eca603c R14: 0000000000000003 R15: ffff88810eca6038 [ 50.279175][ T563] FS: 00007f5aec1276c0(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 50.279184][ T563] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 50.279192][ T563] CR2: 00007f5aec105ff8 CR3: 000000011738f000 CR4: 00000000003506a0 [ 50.279204][ T563] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 50.279211][ T563] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 50.279215][ T563] Call Trace: [ 50.279227][ T563] kobject_put+0x231/0x270 [ 50.279240][ T563] kobject_add_internal+0xb52/0xde0 [ 50.279253][ T563] kobject_add+0x165/0x230 [ 50.279265][ T563] ? kobject_init+0x1d0/0x1d0 [ 50.279279][ T563] ? __asan_report_load8_noabort+0x14/0x20 [ 50.279291][ T563] ? get_device_parent+0x12e/0x410 [ 50.279302][ T563] device_add+0x3d8/0xc00 [ 50.279313][ T563] ? kobject_set_name_vargs+0xca/0x110 [ 50.279325][ T563] device_create+0x26c/0x300 [ 50.279338][ T563] ? root_device_unregister+0x80/0x80 [ 50.279353][ T563] create_function_device+0x60/0x70 [ 50.279363][ T563] f_midi_alloc_inst+0x1a8/0x380 [ 50.279376][ T563] usb_get_function_instance+0xe2/0x2f0 [ 50.279389][ T563] function_make+0x118/0x350 [ 50.279402][ T563] ? gadget_dev_desc_max_speed_store+0x240/0x240 [ 50.279415][ T563] ? mutex_trylock+0xb0/0xb0 [ 50.279427][ T563] ? configfs_mkdir+0x504/0xd90 [ 50.279440][ T563] configfs_mkdir+0x5d2/0xd90 [ 50.279451][ T563] ? show_sid+0x1b0/0x1b0 [ 50.279464][ T563] ? configfs_lookup+0x500/0x500 [ 50.279476][ T563] ? __lookup_hash+0x122/0x250 [ 50.279491][ T563] ? security_inode_mkdir+0xbd/0x110 [ 50.279503][ T563] vfs_mkdir+0x42c/0x600 [ 50.279515][ T563] do_mkdirat+0x14c/0x340 [ 50.279529][ T563] __x64_sys_mkdirat+0x7b/0x90 [ 50.279540][ T563] do_syscall_64+0x31/0x40 [ 50.279551][ T563] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 50.279560][ T563] RIP: 0033:0x7f5aed6ce0d9 [ 50.279571][ T563] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 50.279579][ T563] RSP: 002b:00007f5aec127028 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 [ 50.279593][ T563] RAX: ffffffffffffffda RBX: 00007f5aed955fa0 RCX: 00007f5aed6ce0d9 [ 50.279601][ T563] RDX: 00000000000001ff RSI: 0000200000000400 RDI: ffffffffffffff9c [ 50.279609][ T563] RBP: 00007f5aed765024 R08: 0000000000000000 R09: 0000000000000000 [ 50.279618][ T563] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 50.279626][ T563] R13: 00007f5aed956038 R14: 00007f5aed955fa0 R15: 00007ffe21fb70c8 [ 50.279636][ T563] ---[ end trace c629eca2a4ae6bfe ]--- [ 50.279645][ T563] kobject_add_internal failed for f_midi (error: -2 parent: ) [ 50.312623][ T15] usb 1-1: USB disconnect, device number 6 [ 50.338130][ T24] audit: type=1400 audit(1786952554.950:156): avc: denied { read } for pid=562 comm="syz.1.66" name="c.1" dev="configfs" ino=15731 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 50.370484][ T563] Config c/2 of g1 needs at least one function. [ 50.428575][ T51] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.00 [ 50.436559][ T563] udc dummy_udc.0: failed to start g1: -22 [ 50.444618][ T51] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 Aug 17 07:42:34 syzkaller kern.a[ 51.512816][ T51] usb 5-1: Product: syz lert kernel: [ 49.976653][ T563] page last allocated via order 3, migratetype[ 51.524295][ T51] usb 5-1: Manufacturer: syz Unmovable, gfp_[ 51.529667][ T51] usb 5-1: SerialNumber: syz mask 0x1d2a20(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 308, ts 24267892816, free_ts 24266609749 Aug 17 07:42:36 syzkaller kern.alert kernel: [ 50.073787][ T563] page last free stack trace: [ 51.558553][ T556] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 51.806608][ T51] usb 5-1: USB disconnect, device number 7 [ 51.819575][ T95] udevd[95]: worker [552] terminated by signal 7 (Bus error) [ 51.827699][ T95] udevd[95]: worker [552] failed while handling '/devices/platform/dummy_hcd.4/usb5/5-1' [ 54.598537][ T95] EXT4-fs error: 38 callbacks suppressed [ 54.598552][ T95] EXT4-fs error (device sda1): __ext4_find_entry:1657: inode #259: comm udevd: reading directory lblock 0 [ 54.615735][ T95] EXT4-fs error (device sda1): __ext4_find_entry:1657: inode #264: comm udevd: reading directory lblock 0 [ 54.627345][ T95] EXT4-fs error (device sda1): __ext4_find_entry:1657: inode #264: comm udevd: reading directory lblock 0 [ 54.638781][ T95] EXT4-fs error (device sda1): __ext4_find_entry:1657: inode #264: comm udevd: reading directory lblock 0 [ 54.650180][ T95] EXT4-fs error (device sda1): __ext4_find_entry:1657: inode #1642: comm udevd: reading directory lblock 0 [ 54.661831][ T95] EXT4-fs error (device sda1): __ext4_find_entry:1657: inode #1480: comm udevd: reading directory lblock 0 [ 58.684865][ T95] EXT4-fs error (device sda1): __ext4_find_entry:1657: inode #259: comm udevd: reading directory lblock 0 [ 58.696790][ T95] EXT4-fs error (device sda1): __ext4_find_entry:1657: inode #264: comm udevd: reading directory lblock 0 [ 58.708474][ T95] EXT4-fs error (device sda1): __ext4_find_entry:1657: inode #264: comm udevd: reading directory lblock 0 [ 58.720317][ T95] EXT4-fs error (device sda1): __ext4_find_entry:1657: inode #264: comm udevd: reading directory lblock 0