last executing test programs: 1.276925291s ago: executing program 0 (id=1): mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file2\x00', 0x0) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f00000000c0)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file2'}}], [], 0x2c}) open$dir(&(0x7f00000001c0)='./file0\x00', 0x20800, 0xb) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cpu.stat\x00', 0x275a, 0x0) capset(&(0x7f0000000000)={0x20080522}, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x81, 0xfffffdff, 0x5}) ioctl$FS_IOC_RESVSP(r0, 0xc0189436, &(0x7f0000000740)={0x0, 0x0, 0x0, 0x5f, 0x3}) 1.209680894s ago: executing program 0 (id=6): close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x82, 0x0) ioctl$KVM_CHECK_EXTENSION(r0, 0xae03, 0xa) 1.176813005s ago: executing program 0 (id=7): r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_RX_RING(r0, 0x11b, 0x2, 0x0, 0x0) getsockopt$XDP_STATISTICS(r0, 0x11b, 0x7, &(0x7f0000000180), &(0x7f0000000240)=0x30) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x0) mount(0x0, &(0x7f0000000140)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/vlan/vlan0\x00') syz_open_procfs(0x0, &(0x7f0000000040)='net/vlan/vlan0\x00') socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) ioctl$sock_SIOCGIFVLAN_DEL_VLAN_CMD(r1, 0x8982, &(0x7f0000002800)={0x1, 'vlan0\x00'}) 1.116426528s ago: executing program 4 (id=5): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x20008044}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000240)='proc\x00', 0x4000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./proc/thread-self/fail-nth\x00', 0x2, 0x101) write(r0, &(0x7f0000000000)='3', 0x4e) r1 = socket$inet6(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x8994, 0x0) syz_ublk_setup_io_uring(0x20, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x4}, &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000140)) 1.106308699s ago: executing program 1 (id=2): socket$netlink(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./trace\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./trace\x00', &(0x7f0000000040)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./trace/events/sched/sched_switch/trigger\x00', 0x80b02, 0x0) write(r0, &(0x7f0000000200)="686973743a6b6579733d5b756e97d3b09d5d551c77fbc039bdbd691257616c30a1089074d6bec4221a917e880240954dc9b6c3ce51937c29de6374c6c1ad49b4c2a5cb5243b8207e2fa10c2d903ff23d97c79e149b3a75aaff9be5b1599c1ed217b3c8e05184fa7493a63d0a24653e8fc862facb257c591d2b", 0x79) 1.095456879s ago: executing program 2 (id=3): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./tracing\x00', &(0x7f0000000080)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./tracing/per_cpu/cpu0/trace_pipe_raw\x00', 0x40880, 0x0) r1 = dup(r0) readv(r1, &(0x7f0000000240)=[{&(0x7f0000000100)=""/60, 0x3c}], 0x1) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000080)=[{0x6, 0x4, 0x0, 0x7fff0000}]}) close_range(r2, 0xffffffffffffffff, 0x0) 780.289394ms ago: executing program 0 (id=8): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x42000, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'pim6reg1\x00', 0x2}) ioctl$TUNSETLINK(r0, 0x400454cd, 0x207) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000140)={'pim6reg1\x00', @multicast}) 780.062424ms ago: executing program 1 (id=9): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921000000012201000905810308"], 0x0) syz_usb_disconnect(r0) r1 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x46d, 0xc539, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x1, "", [{{0x9, 0x4, 0x0, 0x8, 0x2, 0x3, 0x0, 0x3, 0x0, {0x9, 0x21, 0x0, 0x4, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x400}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0022180000000501150091a60906a101090182008c0508950129309102c0"], 0x0}, 0x0) syz_usb_control_io(r1, &(0x7f00000002c0)={0x2c, &(0x7f0000000140)={0x40, 0x21, 0x2, {0x2, 0x24}}, 0x0, 0x0, 0x0, &(0x7f0000000280)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x3, 0x10, 0x0, 0x40, 0xc2, 0x2, 0x6}}}, &(0x7f00000007c0)={0x84, 0x0, &(0x7f0000000400)={0x0, 0xa, 0x1, 0x40}, &(0x7f0000000440)={0x0, 0x8, 0x1, 0xf1}, &(0x7f0000000480)={0x20, 0x0, 0x4, {0x0, 0x2}}, &(0x7f00000004c0)={0x20, 0x0, 0x4, {0xc0, 0x20}}, &(0x7f0000000500)={0x40, 0x7, 0x2, 0x5}, &(0x7f0000000540)={0x40, 0x9, 0x1, 0xb1}, &(0x7f0000000580)={0x40, 0xb, 0x2, "dda6"}, &(0x7f00000005c0)={0x40, 0xf, 0x2, 0x3}, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000740)={0x40, 0x1e, 0x1, 0xd}, &(0x7f0000000780)={0x40, 0x21, 0x1, 0x9}}) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000040)='@') 779.979404ms ago: executing program 3 (id=4): mkdir(&(0x7f0000000100)='./sys_mount\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./sys_mount\x00', &(0x7f00000001c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys_mount/block/loop0/queue/rotational\x00', 0x40402, 0x0) readv(r0, &(0x7f00000006c0)=[{&(0x7f0000000040)=""/58, 0x3a}], 0x1) 779.779864ms ago: executing program 3 (id=10): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe7000/0x18000)=nil, &(0x7f0000000080)=[@text64={0x40, &(0x7f0000000100)="f081550000a000000f0048180045000fbe252e8a094d36420f705626002e660f3a176a4b00b9800000c00f3267420f01c30f5966ba2c0cb8c087678eef66ba470f080ced45c1947166baf80cb817d27c8bef66bafc0cb02cee0000058a3bc4827dbcae009008f2", 0x67}], 0x1, 0x8, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000000)=[@textreal={0x8, 0x0}], 0x1, 0x0, &(0x7f00000000c0)=[@cr4={0x1, 0x9e2}], 0x1) ioctl$KVM_RUN(r2, 0xae80, 0x0) 779.650314ms ago: executing program 2 (id=11): r0 = syz_open_dev$usbfs(&(0x7f00000001c0), 0x76, 0x101301) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x66) ioctl$USBDEVFS_SUBMITURB(r0, 0x802c550a, 0x0) 779.519444ms ago: executing program 2 (id=12): ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000c80)={'lo\x00'}) socket$nl_generic(0x10, 0x3, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./tracing\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./tracing/synthetic_events\x00', 0x2, 0x0) write(r0, &(0x7f0000000300)='_oo int x', 0x9) 750.695765ms ago: executing program 2 (id=13): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000600), 0xffffffffffffffff) sendmsg$WG_CMD_SET_DEVICE(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000cc0)={0x30, r1, 0x1, 0x70bd2d, 0x25dfdbfb, {}, [@WGDEVICE_A_IFNAME={0x14, 0x2, 'wg2\x00'}, @WGDEVICE_A_FLAGS={0x8, 0x5, 0x1}]}, 0x30}, 0x1, 0x0, 0x0, 0x4}, 0x8000) 730.489546ms ago: executing program 4 (id=14): setns(0xc9, 0x0) r0 = fsopen(&(0x7f00000000c0)='sysfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f0000000180)={0x2020, 0x0, 0x0, 0x0}, 0x2020) setuid(r1) r2 = fsmount(r0, 0x0, 0x0) fsconfig$FSCONFIG_CMD_RECONFIGURE(r0, 0x7, 0x0, 0x0, 0x0) r3 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r3, &(0x7f0000000000)={0xa, 0x4e20, 0xade6, @mcast1}, 0x1c) connect$inet6(r3, 0x0, 0x0) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) 706.946287ms ago: executing program 2 (id=15): r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000540)=ANY=[@ANYBLOB="120141014813442024040075ee69010203010902240001000010000904b8070259d1ca000905060200020d0006090582020002"], 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000600)={0x44, &(0x7f0000000680)=ANY=[@ANYBLOB="4016760000004e54c163d89d55a66571238034e4822dd016efedd37ad4f6ed3a942a1735b70266d9b93cca9fc45d7a007f8bf1c86bfdb2752e79ac1df3fde8b26aca7852896e2a6949cc03a0da5292e4a439b2e078953366405d9318a188cbff5e1065a3d7682283ae"], &(0x7f0000000400)={0x0, 0xa, 0x1, 0x4}, &(0x7f0000000440)={0x0, 0x8, 0x1, 0xfb}, &(0x7f0000000480)={0x20, 0x81, 0x1, '$'}, &(0x7f00000004c0)={0x20, 0x82, 0x1, '4'}, &(0x7f0000000500)={0x20, 0x83, 0x2, "6590"}, &(0x7f0000000580)={0x20, 0x84, 0x1, "c6"}, &(0x7f00000005c0)={0x20, 0x85, 0x3, "e8ff2b"}}) 637.71992ms ago: executing program 0 (id=16): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x8, 0x56a, 0x5002, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x40, 0x79, "", [{{0x9, 0x4, 0x0, 0x5, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x5, 0xeb, 0x1, {0x22, 0x28}}, {{{0x9, 0x5, 0x81, 0x3, 0x0, 0x4, 0xc1}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f00000000c0)={0x2c, &(0x7f0000000000)=ANY=[@ANYBLOB='@\v('], 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$uac1(0xffffffffffffffff, &(0x7f0000000680)={0x14, 0x0, 0x0}, 0x0) 572.673453ms ago: executing program 3 (id=17): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x2500, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x8) ioctl$BTRFS_IOC_SNAP_CREATE(r0, 0x50009401, &(0x7f0000000240)={{r0}, "d432bf9eb32db01853b3e27bf53f97c1ad7ad72563d97788d3d62d99ec78d07ec0d0d899de30e80792b6b3853d46cd04fa2963a4546677d0ca4aa6f5aade046f7b6ecf4383922ebd2b8cd2dbc8deb78ee6b5d3db7420cff1e69e10e75b466acb2ea95dbd2bf497811d046f2b30727b22279476373b3efc3085b077d64857e8645a904c31637579e605685d5f63dac172aa80d8766e1196686f2400923d2d767786912261b7a38d68aa39253007854bf93d81a923f117457d25b919972a7d16e20565cdca7be296642e7101b6d7b235e639f972c4a2147ca657083e653e28f1c5033db2b7a6ded4b22cc9015a3489fedac085cbe8870f7c921a97b436e2beb6807671582848e1c9c08f2f5e5ff3df38aad4310b8cc172a8b0bcdc14eff877f84c075c16f24aade7e71ef01c2fd672643bff1785c859406459c3aede1b5826919128826437709164e7b05ef8363488a12991049e586d292396587b526504321cee6ded9667af95dca1455194082855cd3262407ca39f3650cb67e4b9049c61a42b38f6abd9642cc54ec72b8503a534185ac89511ab0d24ce9de64033c300aad8b88e5ec6d97525fbfc937cafadad749553504456fb8558e3df06bc25f9fe2e095f18ac988f10b57a06e88176cab4c4bf746ca9c3a760524fa81e1f90da14eea68779ad209c900b708d3f3365e9c3c5c9cb7fba8ba659efaaca00409f1a875dbce7b08242c56f504a0df00cc29c0e6cd98f0b61987683cd657572c79035bb64df5a55f46e3356d69d583c417bc4a45dc6bb3b7f18abeb143a9a0013a99517c083616d02530b246194da0270c36087def42df9c05475b01423840648a85469c903755c51a351861d42764a3af748a49bf4ca684512f940271eaf7872ea8180f9d38e023bda5bd4873ee2811b6af74a6a659f549b9aff3fdcfd8f986d2030e2a9a493c997d9953d3ce2f929b91bfca1b839be6d61393afa4517e19aa4640af4183fc3fdad0182ef1cd900e375e8566b795131f48ee4d4ce0ce5ffb75f57be219d291a05b9db271cd93955107b7ef4b5d660510751248fae2674e0b140c6a2163a3d505ca21b4249e65755042671a6a0d357fa6959a533dcb5ce70c60aa3ec1a254fdff5d82c14591a3193e6747e67e7f14b1854c7b81047d37cf4607aa7baed9623caf8ee37be89bfc76664016ede1f159b43e738ebdb1aa1f3af71b6a6a61f3e5e6a9f52e89c577ad4b2b465a89c33a274d8a768de64c32ecefe535f2aefbf9ce7fb267f375da7270e3ca095a1c1f4e434d2a58704339b39e001906036c21ddcfc8e21b9d30b91a4c3adee91a354b883d3359867f046bf61d33a757c1e1f2fbea6a7ac04c8e9cfd6e75c322fac8d5fc24aa2047a51a1b93fe841e59d7985b710a48928a0674801935bad2b3c63fdf33af8f1b01764e84ceb762095443f7f9f8d8eefb0cd2b9ab5a922075d61ee7317ab8d8d95b39da09b2cc65d12291f6fd5a9336fa701e9b5e956bbb6f13dd458b1d99abc88b97f8c66a9c24fb3774f92568e79c4c67564491cb860bc27c5636a7fb661a384839490ae348ac7a7031cf53cdbfd4bc629fd5a2b65aee3bc3352b513f9ce6acc37c96c69bcef4679449a640113fdc9cc159c353b61860a40cf24ce4d8557237b3f2a2371e2c10f4f4a2ab9817746a2d5f99329953013e37254c1bea1120af64e762f831fb429c9f697e60d1dbcf930873bb9766401d81e756cc4c2bb23880eecbefe0810ee865fce1db02c8633504ddeded52628f8226a5d4f94c4ef1db0f925c39fa724fe23f41a4b6c45a697cdc1898aaca2252ee5a0d9b140e037d84bfc50ea0826dfcc8bbdabc16ce28c576f8a3b97368dbd742daad3fa7f8ae926db27fd8bd5b7c2cf56731649fbf6f5daf4a07563e09c66a0fed3cb316b0468b6df8116ea04136f909812fcee687aa5bd07be45a0c6de77068a8eed19aabcc893d666a56b5dda0ffad575ee60206cdb62d8c442f84b23869b50d6bbf7ac81554c2c51908526e308b856e785e7891164704f5012b3fdb4e238482510bd2849cf1cbb2ddbc0d4adca88df859919fae0fdff7da948361286fef467dd2e9e3419af9194a09965a07da432002c7da05b845fa31faf8d241ba52f1f2a26f470dfa411bb06f6d5e312705f09fab2ca9411b2a1ebabd1b3f8ce314be7ac1286be9f25c97acd662979d16c03f8695a1df7d06f9fdd80f80018d4d8fcc628beec574ecba4d6f973058d38efcda6b613484d7f379a8db003c765d3d74b1e7c81b07a46ee30eecba5b7da4c2c87ddc094180ab00a91f7a6904f4284b9bc9198f574ea618025324b9c72e340610b3e649cb80c887f66fc027d678e214630cbb1c7b2c3b8d146751e607ec285b2cc49eb034d0a8a020fcf10f2c6f5ce429c69747eade85109c8c614d4d3a643ace96d00f0282db36425cc688157d91b0013796c9bb9eccf0dd9cc6949e112a27c42ed3ae021c802352cac5b60b6359bdbde2b3d40fba26ea909b6c79beeb8478d87f12e7a701f29601c575ddbf0680da7a173ec6c078b52b2c5abe1f948e27ceee674b1a2a96ccbbde1c2ab54a1e3f0356ddc17dfc6e2ba8c9328ec6cb6fe21e5c68225f7dc9c84d5fff523d852dab461e7ef101362dc126f554b87d5c6670cf8d56f1397cc1cbfed86feaf542f647c715b6d7e994558ebe8e3ddf4f67a57686385474e43b7e0cdedd795bd8733a870fed639e93797389771a6422300083d46e316873fc710adb9aeab3b1594c45f5fec52cb1cb734b90ef3b9ef5027dccb083ed3347c716c1662f6c7d08459749985bbb273fbed09d3ea7cf8fc320dedb4b32bfae8ee5afbd959aa6fb190ac422d35291892c4f6d8cd4a588159feebe6dc18a4933512c22785b4d3195906d94eec6d2ac6d0173f389969f87dd785389cc416d72f80f88686016b50b242552a305a687ae24d51df40dd867a4f756244ba426195686d08957f2266192fb2d87a91d2a45104f1a91a67bb41959005ebf8bc644b146be1a2daa8748fb35b001c3acd959958e0818199566c4289685364d9ce00d0806ac5c79b9016c88ac663d5f50f4e2f652aae053b9b05ac72c4d108c3156c983da48c4c3185167032ff5645eb65dc1492029309ef42579cea9c76e1cd6e108ce6c9135f34c2e5c39fea5f7f9f696184c4cf6b2af05cce968829126cf73cb4fb90fa160fb3fa92525078fa799a9c0efbe4f7abafa01db4aaa01f8e120e6fc7e002720395110063cf5a27914bc4e1b51fb40d08b3c0ab798f7d9a2d2dda8091985697c6c0406cebfe8ec5e559dd12b8c529509c1cb272550e451c1c8b363dd3d7ab681d2e73a84312b327aad61879551e40c0a5ad0437eecb70cff74dc633d9602b42336b1a39911b5dedede1dc60c90bec87574ea966fa27545e3cfa641d4a837fcd92242a062129244b13a706bdbe363e5d81a48e7d4aa35cb3b3d08cf33033f6e850a6e1d81fdaab67e8a95b9dc9ce7f2cb4a0af0e9786c57d872b0c5272d5ea01152bd50c024422e94ccb1131eb81e75447aca58dadcea67cdf55faf6d2c40a0c1eafe1d029bc6d1de799a09facb3d1c9e34ea6ec9103f8929bfb81d8e2f2126b3673c04ed76356db3523d66dceb333cd8fbacaca0e56894a77b9288fe9f3f3e98a791fd60d70564d1f87a174054d4bc993b4ca135767f68af7f24691c5e3c0113ef6188bcbff7ef6acc9ce6472fdef3d2c130740f39b930c2596bdf592f9b275d368d58aecc2e5c9d6d09bb3a00326fb5973a3b3a289983573267ea177a13b6c80ded5aad14ad996b4672bbf86c565cd1f7165088c9c799aad5762491e549fac651624b0e463d30e8b2d615f988138e8916a0e9c19b56bb153e066bfe8de3961ce8f48239d4be1c59ac1f9a1ebcbb66c82af81424e8bad764e269912026becac1be33dbc5638940a51d464492637efb8125a4ae77d9b803e26aaaf0d37ea575d1614d3bd5cc3024ed886605eed75f4a57425b517eac1ffccbd0291e6f9b57d462dc47cb08ead41e8ca16238914aec35e147ad6ed6c969968ba16c35670954761d947ae5c65a7dff104928e548da9da6cc1df14cc366c1f0d08bb389544746ff3d33e136a104dc22557ea7773154707ba2893134e19695c13f6b1502d4cf69bedbc99e08fb1314e7d8e50393666a0f1d88932502ab91666f622eba4ff97312d82fc931aa81b3fc42371c6d1b8675e14455a6a4e127c5433ca5c52603abfc3c46c53aca39fb877a258922f412fcbd46590b077f5434bf2aa1ec0fedf43246b984890adb5a36c72d6c01e55e3584840c96e51a961885fb2eb48dadec8957c1d1f3f5ff3326ac2290368e7814878dbb7160cfec5236b4421408a7ae5d9d333d77609d04a31b75c0dab4c98ce347c68e109c5f2d2512a7e352a203ec40df54e1ebbe20ef54b00a9d9b481025ab67009415f2baf80333f605e3a7bec866b71469f1510e0822dec2f8c475430df2806497842fead9e0821c19a983adf7f7a616709309134476921be6fb77b9b9726557b97c02fa187ac37f7a8bc4670d4e2fe1927b230cfa1be1c2a370d13bff04f17fc866f5a9503d40d43ae4beaba2ebc63b11ad3e8ad2ff43ad4621d0a9af805013ee6bf1edff760462850ad167f10d0b8d00741e66f8522c78e25885e85ebbe65098939b8b9f6b6423fe50c8418809e01ace8ec2e84755a45ec32c177753b3d6016b505b1a96d904c202dda56494d4130571419e59b47e9c0b625e6da4c7386c59ee944f9b9528d80430983f97231e136e8548e24a9308ea863133f7cf4a20d342c3dd6cd3c58ddc99b2a17db2cb268ee5a609f7540833e8f0263ad13024ce458e63b458a36969917ae2f590557c2c522bbc7be6fc32a4e97cf0282625102098e102a68450c0b35d5b758d871925fed96ebc3f99a764fe312dfd699c0d9ff296fa8f493730fe36ef5884a4516cef886948c6c7a4298a86ee45b06d4a3d432a1d2aab9d5fb7bc07d0da4317614bceb2652f8dad47cb7bf87127777ce3b66b8473759c2dfca19bfb0dbddf41bab492aea5696360b364bd49ed18203097e4be9380660c12d4698d388d69a1ffc1ec9d676fd23db21595e4d0c48c3c2866c868b7d0c05bca5ca5d908a34b26043a6d92bb7ab313631d5a76ef5f9f319caa14e568a2a77b1c2e0ce0ab8ee5b4f5b195abc378a514c7c36c16fc3a0f29f93ff5c742b43a6716c9d3b63ee82b143ed28f8db1f18305d4416d4684ef625597bf1d38b3e2e03c48db1411454cdccfa23c0265ef757adcb0d763a580bdfaf6cdadbcc48cff7d74aeea91ba98f43711952854644706f0fbe0573f53dcf9d81d09f75f5f6fed00ccf6b27e1a1ca2f7ef340b4234f9309dbdb4a0a43e5e23c7d5bad11abe241a1eab809750364f77eba33be3e1049b7615e0bf3ae6bd8dcdb13eb08db9c9842e7dd0591a1391fe2e180ceedc4ac084dea2033a9da768c0e5c39b72a9716ced7b5e4e3f90151be93359971d9057d56444e1446a314507f5718593bbfc9929890c0346beeebcb5db134df009ee222ed58361264e047552850a4201cc6d155981c4e3f57fe26a352bbe3cdccf5dc4d9ea58257bf5607e42423a5a8971e399b7fa1be017556fe6862e891ffa852ee23b5c2278292e936e1d0bdb8e10b7617633493249484994ace1821a709c747078d34372a5776c02f2c593991a61f2d54d22b9d57aa54483c0a8f547ecddbd5f637bb19ba98cb3e2e522f389a32015591b62cdea4344320561579bb999455cc3f7099792c65e3537fc5e777"}) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x15) 545.846265ms ago: executing program 4 (id=18): openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x80840, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev_mnt\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./dev_mnt\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0) r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000000407d1e5a2d00000000000109022400010000000009040000010301020009210000000122220009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x22, 0x22, {[@global=@item_012={0x2, 0x1, 0x9, "2313"}, @global=@item_012={0x2, 0x1, 0x0, "e53f"}, @global=@item_4={0x3, 0x1, 0x0, '\f\x00'}, @local=@item_012={0x2, 0x2, 0x2, "9000"}, @global=@item_4={0x3, 0x1, 0x0, "0900be00"}, @main=@item_4={0x3, 0x0, 0x8}, @local=@item_4={0x3, 0x2, 0x0, "09007a15"}, @local=@item_4={0x3, 0x2, 0x0, "5d8c3dda"}]}}, 0x0}, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='./dev_mnt/roccatsavu0\x00', 0x2, 0x0) close(0x4) 542.142275ms ago: executing program 3 (id=19): syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$usbfs(&(0x7f0000000080), 0x202, 0x82) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$USBDEVFS_CONTROL(r0, 0xc0185500, &(0x7f0000000380)={0x80, 0x6, 0x100, 0x7, 0xec, 0x0, 0x0}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) 0s ago: executing program 3 (id=20): r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f00000009c0)=ANY=[@ANYBLOB="12010000020000402505a1a440000102030109025c0002010000000904000001020d0000240f0100000000000000000006241a0000000905810300020040000904010000020d00000904010102020d0000090582"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) getuid() syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.93' (ED25519) to the list of known hosts. [ 22.614377][ T28] audit: type=1400 audit(1790102891.865:64): avc: denied { mounton } for pid=279 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 22.617976][ T279] cgroup: Unknown subsys name 'net' [ 22.638749][ T28] audit: type=1400 audit(1790102891.865:65): avc: denied { mount } for pid=279 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.666302][ T28] audit: type=1400 audit(1790102891.905:66): avc: denied { unmount } for pid=279 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.666745][ T279] cgroup: Unknown subsys name 'devices' [ 22.812220][ T279] cgroup: Unknown subsys name 'hugetlb' [ 22.817906][ T279] cgroup: Unknown subsys name 'rlimit' [ 22.923558][ T28] audit: type=1400 audit(1790102892.175:67): avc: denied { setattr } for pid=279 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=258 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 22.947216][ T28] audit: type=1400 audit(1790102892.175:68): avc: denied { mounton } for pid=279 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 22.972561][ T28] audit: type=1400 audit(1790102892.175:69): avc: denied { mount } for pid=279 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 23.007781][ T281] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 23.016725][ T28] audit: type=1400 audit(1790102892.265:70): avc: denied { relabelto } for pid=281 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.042609][ T28] audit: type=1400 audit(1790102892.265:71): avc: denied { write } for pid=281 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.057345][ T279] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 23.069471][ T28] audit: type=1400 audit(1790102892.305:72): avc: denied { read } for pid=279 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.107048][ T28] audit: type=1400 audit(1790102892.305:73): avc: denied { open } for pid=279 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.985059][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.992334][ T287] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.999859][ T287] device bridge_slave_0 entered promiscuous mode [ 24.008700][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.015876][ T287] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.023370][ T287] device bridge_slave_1 entered promiscuous mode [ 24.093956][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.101510][ T289] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.109191][ T289] device bridge_slave_0 entered promiscuous mode [ 24.119403][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.126687][ T289] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.134296][ T289] device bridge_slave_1 entered promiscuous mode [ 24.191741][ T291] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.199009][ T291] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.206769][ T291] device bridge_slave_0 entered promiscuous mode [ 24.217257][ T291] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.224387][ T291] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.231829][ T291] device bridge_slave_1 entered promiscuous mode [ 24.268286][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.276039][ T290] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.283729][ T290] device bridge_slave_0 entered promiscuous mode [ 24.291358][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.300800][ T290] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.309408][ T290] device bridge_slave_1 entered promiscuous mode [ 24.361913][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.370091][ T288] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.377900][ T288] device bridge_slave_0 entered promiscuous mode [ 24.385566][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.393437][ T288] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.401092][ T288] device bridge_slave_1 entered promiscuous mode [ 24.517722][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.524863][ T287] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.560723][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.567988][ T289] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.577059][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.584625][ T289] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.595533][ T291] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.602922][ T291] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.610686][ T291] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.620275][ T291] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.635933][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.643314][ T290] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.650909][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.657956][ T290] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.695265][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.702375][ T288] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.709717][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.716844][ T288] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.738784][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.746282][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.753741][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.761587][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.768779][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.776417][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.783750][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.791061][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.798264][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.806719][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 24.814337][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.835819][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.844632][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.853286][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.860735][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.868855][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.877815][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.885359][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.907447][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.916092][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 24.924549][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.933005][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.941504][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.949216][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.957685][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.964765][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.998221][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 25.007230][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.014541][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.023172][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 25.031846][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.038906][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.046476][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 25.054772][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 25.062890][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 25.070508][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 25.078656][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.085739][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.093193][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 25.101551][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.108605][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.116240][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 25.125437][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 25.134589][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 25.142953][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 25.159576][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 25.168246][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 25.177016][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 25.185539][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 25.194318][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 25.202158][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 25.213693][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 25.222260][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 25.230679][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.237739][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.245491][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 25.254429][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 25.262977][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.270056][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.303519][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 25.312082][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 25.320445][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 25.329326][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.338179][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 25.346925][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.356150][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 25.364367][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 25.372447][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 25.380788][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 25.395494][ T289] device veth0_vlan entered promiscuous mode [ 25.409311][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.418510][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 25.426760][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.435239][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 25.443497][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.452078][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.459580][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.467467][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.475332][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.484210][ T287] device veth0_vlan entered promiscuous mode [ 25.492506][ T288] device veth0_vlan entered promiscuous mode [ 25.503950][ T289] device veth1_macvtap entered promiscuous mode [ 25.512658][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.521259][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.529639][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.537981][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.545647][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.567253][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.575930][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 25.584656][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.597982][ T287] device veth1_macvtap entered promiscuous mode [ 25.608502][ T290] device veth0_vlan entered promiscuous mode [ 25.616337][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 25.624820][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.633285][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.641710][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.650296][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 25.657970][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 25.666137][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.674785][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.683705][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.694685][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.702411][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.710704][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.721334][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.730839][ T288] device veth1_macvtap entered promiscuous mode [ 25.740594][ T291] device veth0_vlan entered promiscuous mode [ 25.750360][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 25.758773][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.767354][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.776291][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.785284][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.794139][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.814553][ T291] device veth1_macvtap entered promiscuous mode [ 25.822044][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.831858][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.839624][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.855166][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.867473][ T289] request_module fs-gadgetfs succeeded, but still no fs? [ 25.897181][ T290] device veth1_macvtap entered promiscuous mode [ 25.905733][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.915667][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.925490][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.934241][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.943016][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.952412][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.986244][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 26.000976][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 26.021896][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 26.032843][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 26.087387][ T319] FAULT_INJECTION: forcing a failure. [ 26.087387][ T319] name failslab, interval 1, probability 0, space 0, times 1 [ 26.100470][ T319] CPU: 1 PID: 319 Comm: syz.4.5 Not tainted syzkaller #0 [ 26.107635][ T319] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 26.118029][ T319] Call Trace: [ 26.121348][ T319] [ 26.124354][ T319] __dump_stack+0x21/0x24 [ 26.128755][ T319] dump_stack_lvl+0x110/0x170 [ 26.133482][ T319] ? __cfi_dump_stack_lvl+0x8/0x8 [ 26.138606][ T319] ? kasan_set_track+0x60/0x70 [ 26.143423][ T319] ? kasan_save_alloc_info+0x1f/0x30 [ 26.149219][ T319] ? __kasan_kmalloc+0x95/0xb0 [ 26.154464][ T319] ? kmalloc_trace+0x40/0xb0 [ 26.159115][ T319] ? io_rsrc_node_switch_start+0xa4/0x1f0 [ 26.164886][ T319] ? io_uring_create+0x5f7/0xde1 [ 26.169996][ T319] dump_stack+0x15/0x24 [ 26.174212][ T319] should_fail_ex+0x3bf/0x510 [ 26.178937][ T319] __should_failslab+0xac/0xf0 [ 26.183758][ T319] should_failslab+0x9/0x20 [ 26.188304][ T319] slab_pre_alloc_hook+0x30/0x1d0 [ 26.193436][ T319] kmem_cache_alloc_lru+0x49/0x280 [ 26.198808][ T319] ? new_inode_pseudo+0x8f/0x1f0 [ 26.203974][ T319] new_inode_pseudo+0x8f/0x1f0 [ 26.209371][ T319] alloc_anon_inode+0x21/0x300 [ 26.214803][ T319] __anon_inode_getfile+0x141/0x350 [ 26.220270][ T319] ? anon_inode_getfile+0x180/0x180 [ 26.225534][ T319] ? __kasan_check_write+0x14/0x20 [ 26.230960][ T319] ? percpu_ref_init+0x23f/0x340 [ 26.235966][ T319] anon_inode_getfile_secure+0x3b/0x50 [ 26.241479][ T319] io_uring_create+0x91b/0xde1 [ 26.246733][ T319] __x64_sys_io_uring_setup+0x21b/0x230 [ 26.252436][ T319] ? __cfi___x64_sys_io_uring_setup+0x10/0x10 [ 26.258796][ T319] ? __kasan_check_write+0x14/0x20 [ 26.264046][ T319] ? fpregs_restore_userregs+0x128/0x260 [ 26.269992][ T319] ? switch_fpu_return+0xe/0x10 [ 26.274971][ T319] x64_sys_call+0x4ab/0x9a0 [ 26.279811][ T319] do_syscall_64+0x4c/0xa0 [ 26.284311][ T319] ? clear_bhb_loop+0x30/0x80 [ 26.290093][ T319] ? clear_bhb_loop+0x30/0x80 [ 26.295083][ T319] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 26.301201][ T319] RIP: 0033:0x7fad9a99e159 [ 26.305674][ T319] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 26.326097][ T319] RSP: 002b:00007fad9b855fb8 EFLAGS: 00000206 ORIG_RAX: 00000000000001a9 [ 26.334638][ T319] RAX: ffffffffffffffda RBX: 0000200000000040 RCX: 00007fad9a99e159 [ 26.343644][ T319] RDX: 0000200000000100 RSI: 0000200000000040 RDI: 0000000000000020 [ 26.351835][ T319] RBP: 00007fad9aa3506b R08: 0000000000000000 R09: 0000000000000000 [ 26.359933][ T319] R10: 0000200000000140 R11: 0000000000000206 R12: 0000200000000100 [ 26.368029][ T319] R13: 0000200000000140 R14: 00002000000000c0 R15: 00007fff99dddc38 [ 26.376478][ T319] [ 26.412611][ T336] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 26.449382][ T337] device pim6reg1 entered promiscuous mode [ 26.700021][ T6] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 26.750031][ T60] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 26.800059][ T39] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 26.881502][ T6] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 26.893015][ T6] usb 2-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 26.902427][ T6] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 26.910521][ T309] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 26.920967][ T6] usb 2-1: config 0 descriptor?? [ 26.940127][ T60] usb 3-1: Using ep0 maxpacket: 32 [ 26.946869][ T60] usb 3-1: config 0 has an invalid interface number: 184 but max is 0 [ 26.955313][ T60] usb 3-1: config 0 has no interface number 0 [ 26.961875][ T60] usb 3-1: config 0 interface 184 has no altsetting 0 [ 26.972935][ T60] usb 3-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 26.982525][ T60] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 26.990789][ T39] usb 1-1: Using ep0 maxpacket: 8 [ 26.995983][ T60] usb 3-1: Product: syz [ 27.000361][ T60] usb 3-1: Manufacturer: syz [ 27.005726][ T60] usb 3-1: SerialNumber: syz [ 27.012032][ T39] usb 1-1: config 0 interface 0 altsetting 5 endpoint 0x81 has invalid wMaxPacketSize 0 [ 27.022353][ T39] usb 1-1: config 0 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 27.035723][ T60] usb 3-1: config 0 descriptor?? [ 27.040941][ T39] usb 1-1: config 0 interface 0 has no altsetting 0 [ 27.047713][ T39] usb 1-1: New USB device found, idVendor=056a, idProduct=5002, bcdDevice= 0.00 [ 27.057274][ T60] smsc75xx v1.0.0 [ 27.061153][ T39] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 27.071964][ T39] usb 1-1: config 0 descriptor?? [ 27.101301][ T309] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 27.112384][ T309] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 27.122327][ T309] usb 5-1: New USB device found, idVendor=1e7d, idProduct=2d5a, bcdDevice= 0.00 [ 27.131554][ T309] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 27.140596][ T309] usb 5-1: config 0 descriptor?? [ 27.152598][ T6] usbhid 2-1:0.0: can't add hid device: -71 [ 27.162098][ T6] usbhid: probe of 2-1:0.0 failed with error -71 [ 27.179857][ T6] usb 2-1: USB disconnect, device number 2 [ 27.459980][ T355] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 27.482445][ T39] wacom 0003:056A:5002.0001: unknown main item tag 0x0 [ 27.489588][ T39] wacom 0003:056A:5002.0001: unknown main item tag 0x0 [ 27.496667][ T39] wacom 0003:056A:5002.0001: unknown main item tag 0x0 [ 27.503824][ T39] wacom 0003:056A:5002.0001: unknown main item tag 0x0 [ 27.510891][ T39] wacom 0003:056A:5002.0001: unknown main item tag 0x0 [ 27.517904][ T39] wacom 0003:056A:5002.0001: unknown main item tag 0x0 [ 27.525226][ T39] wacom 0003:056A:5002.0001: unknown main item tag 0x0 [ 27.532188][ T39] wacom 0003:056A:5002.0001: unknown main item tag 0x0 [ 27.539217][ T39] wacom 0003:056A:5002.0001: unknown main item tag 0x0 [ 27.546434][ T39] wacom 0003:056A:5002.0001: unknown main item tag 0x0 [ 27.554027][ T39] wacom 0003:056A:5002.0001: unknown main item tag 0x0 [ 27.562059][ T39] wacom 0003:056A:5002.0001: unknown main item tag 0x0 [ 27.562059][ T309] savu 0003:1E7D:2D5A.0002: hidraw0: USB HID v0.00 Device [HID 1e7d:2d5a] on usb-dummy_hcd.4-1/input0 [ 27.580626][ T39] wacom 0003:056A:5002.0001: unknown main item tag 0x0 [ 27.588195][ T39] wacom 0003:056A:5002.0001: unknown main item tag 0x0 [ 27.596533][ T39] wacom 0003:056A:5002.0001: unknown main item tag 0x0 [ 27.603547][ T39] wacom 0003:056A:5002.0001: unknown main item tag 0x0 [ 27.610568][ T39] wacom 0003:056A:5002.0001: unknown main item tag 0x0 [ 27.617641][ T39] wacom 0003:056A:5002.0001: unknown main item tag 0x0 [ 27.624819][ T39] wacom 0003:056A:5002.0001: unknown main item tag 0x0 [ 27.633021][ T39] wacom 0003:056A:5002.0001: unknown main item tag 0x0 [ 27.640334][ T39] wacom 0003:056A:5002.0001: unknown main item tag 0x0 [ 27.647894][ T39] wacom 0003:056A:5002.0001: unknown main item tag 0x0 [ 27.655939][ T39] wacom 0003:056A:5002.0001: unknown main item tag 0x0 [ 27.663572][ T355] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 27.673963][ T60] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -71 [ 27.685793][ T39] wacom 0003:056A:5002.0001: unknown main item tag 0x0 [ 27.692766][ T355] usb 4-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 27.705845][ T60] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -71 [ 27.715909][ T39] wacom 0003:056A:5002.0001: unknown main item tag 0x0 [ 27.723164][ T60] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_bind [ 27.733631][ T355] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x82 has invalid wMaxPacketSize 0 [ 27.744993][ T39] wacom 0003:056A:5002.0001: unknown main item tag 0x0 [ 27.752238][ T39] wacom 0003:056A:5002.0001: unknown main item tag 0x0 [ 27.759653][ T39] wacom 0003:056A:5002.0001: unknown main item tag 0x0 [ 27.767511][ T60] smsc75xx: probe of 3-1:0.184 failed with error -71 [ 27.772446][ T6] usb 2-1: new full-speed USB device number 3 using dummy_hcd [ 27.774411][ T355] usb 4-1: config 1 interface 1 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 27.797028][ T60] usb 3-1: USB disconnect, device number 2 [ 27.803783][ T39] wacom 0003:056A:5002.0001: unknown main item tag 0x0 [ 27.811668][ T39] wacom 0003:056A:5002.0001: unknown main item tag 0x0 [ 27.818801][ T39] wacom 0003:056A:5002.0001: unknown main item tag 0x0 [ 27.825926][ T355] usb 4-1: config 1 interface 1 has no altsetting 0 [ 27.832675][ T39] wacom 0003:056A:5002.0001: unknown main item tag 0x0 [ 27.839626][ T39] wacom 0003:056A:5002.0001: unknown main item tag 0x0 [ 27.847138][ T39] wacom 0003:056A:5002.0001: unknown main item tag 0x0 [ 27.855040][ T39] wacom 0003:056A:5002.0001: unknown main item tag 0x0 [ 27.861836][ T309] usb 5-1: USB disconnect, device number 2 [ 27.862871][ T39] wacom 0003:056A:5002.0001: unknown main item tag 0x0 [ 27.875032][ T39] wacom 0003:056A:5002.0001: unknown main item tag 0x0 [ 27.882018][ T355] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 27.891803][ T355] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 27.899313][ T309] ================================================================== [ 27.901120][ T39] wacom 0003:056A:5002.0001: unknown main item tag 0x0 [ 27.908241][ T309] BUG: KASAN: use-after-free in roccat_disconnect+0x22d/0x240 [ 27.916031][ T355] usb 4-1: Product: syz [ 27.922564][ T309] Read of size 4 at addr ffff8881361d6408 by task kworker/0:3/309 [ 27.922586][ T309] [ 27.922591][ T309] CPU: 0 PID: 309 Comm: kworker/0:3 Not tainted syzkaller #0 [ 27.922614][ T309] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 27.922628][ T309] Workqueue: usb_hub_wq hub_event [ 27.922660][ T309] Call Trace: [ 27.922667][ T309] [ 27.922675][ T309] __dump_stack+0x21/0x24 [ 27.922706][ T309] dump_stack_lvl+0x110/0x170 [ 27.922736][ T309] ? __cfi_dump_stack_lvl+0x8/0x8 [ 27.932448][ T355] usb 4-1: Manufacturer: syz [ 27.935247][ T309] ? __cfi__printk+0x8/0x8 [ 27.937596][ T355] usb 4-1: SerialNumber: syz [ 27.944967][ T309] ? kfree_const+0x39/0x40 [ 27.944992][ T309] ? roccat_disconnect+0x22d/0x240 [ 27.945013][ T309] print_address_description+0x71/0x200 [ 27.956387][ T39] wacom 0003:056A:5002.0001: unknown main item tag 0x0 [ 27.960143][ T309] print_report+0x4a/0x60 [ 27.960178][ T309] kasan_report+0x122/0x150 [ 27.964709][ T39] wacom 0003:056A:5002.0001: unknown main item tag 0x0 [ 27.966477][ T309] ? roccat_disconnect+0x22d/0x240 [ 27.986913][ T39] wacom 0003:056A:5002.0001: hidraw1: USB HID v0.05 Device [HID 056a:5002] on usb-dummy_hcd.0-1/input0 [ 27.989571][ T309] __asan_report_load4_noabort+0x14/0x20 [ 28.012491][ T39] usb 1-1: USB disconnect, device number 2 [ 28.016801][ T309] roccat_disconnect+0x22d/0x240 [ 28.016835][ T309] savu_remove+0xec/0x170 [ 28.070780][ T309] ? __cfi_savu_remove+0x10/0x10 [ 28.075893][ T309] hid_device_remove+0x292/0x3c0 [ 28.080975][ T309] ? __cfi_hid_device_remove+0x10/0x10 [ 28.086498][ T309] device_release_driver_internal+0x486/0x7e0 [ 28.092706][ T309] device_release_driver+0x19/0x20 [ 28.098043][ T309] bus_remove_device+0x2f0/0x350 [ 28.103015][ T309] device_del+0x63c/0xe50 [ 28.107381][ T309] ? __cfi_device_del+0x10/0x10 [ 28.112355][ T309] ? __kasan_check_write+0x14/0x20 [ 28.117493][ T309] ? _raw_spin_lock_irq+0x95/0xf0 [ 28.122552][ T309] ? __cfi__raw_spin_lock_irq+0x10/0x10 [ 28.128174][ T309] hid_destroy_device+0x6a/0x110 [ 28.133134][ T309] usbhid_disconnect+0x9f/0xc0 [ 28.137927][ T309] usb_unbind_interface+0x223/0x8b0 [ 28.143155][ T309] ? kernfs_remove_by_name_ns+0x120/0x160 [ 28.149396][ T309] ? __cfi_usb_unbind_interface+0x10/0x10 [ 28.155227][ T309] device_release_driver_internal+0x4e4/0x7e0 [ 28.161412][ T309] device_release_driver+0x19/0x20 [ 28.166628][ T309] bus_remove_device+0x2f0/0x350 [ 28.171582][ T309] device_del+0x63c/0xe50 [ 28.175935][ T309] ? __cfi_device_del+0x10/0x10 [ 28.180905][ T309] ? device_unregister+0x27/0x40 [ 28.186167][ T309] usb_disable_device+0x3a8/0x750 [ 28.191485][ T309] usb_disconnect+0x32d/0x880 [ 28.196181][ T309] hub_event+0x1a66/0x4310 [ 28.200636][ T309] ? kthread_data+0x50/0xc0 [ 28.205181][ T309] ? __cfi_hub_event+0x10/0x10 [ 28.210076][ T309] ? __schedule+0xcbb/0x1700 [ 28.214974][ T309] process_one_work+0x717/0xc30 [ 28.219851][ T309] worker_thread+0xa4d/0x11d0 [ 28.224576][ T309] kthread+0x281/0x320 [ 28.229273][ T309] ? __cfi_worker_thread+0x10/0x10 [ 28.234586][ T309] ? __cfi_kthread+0x10/0x10 [ 28.239215][ T309] ret_from_fork+0x1f/0x30 [ 28.244024][ T309] [ 28.247148][ T309] [ 28.249478][ T309] Allocated by task 309: [ 28.253735][ T309] kasan_set_track+0x4b/0x70 [ 28.258357][ T309] kasan_save_alloc_info+0x1f/0x30 [ 28.263581][ T309] __kasan_kmalloc+0x95/0xb0 [ 28.268216][ T309] kmalloc_trace+0x40/0xb0 [ 28.272689][ T309] roccat_connect+0x5c/0x4b0 [ 28.278092][ T309] savu_probe+0x1ba/0x360 [ 28.282463][ T309] hid_device_probe+0x267/0x3a0 [ 28.287340][ T309] really_probe+0x2d7/0x9a0 [ 28.291868][ T309] __driver_probe_device+0x193/0x270 [ 28.297186][ T309] driver_probe_device+0x54/0x3e0 [ 28.302587][ T309] __device_attach_driver+0x2e9/0x4a0 [ 28.308010][ T309] bus_for_each_drv+0x192/0x220 [ 28.312895][ T309] __device_attach+0x2b0/0x420 [ 28.318127][ T309] device_initial_probe+0x1a/0x20 [ 28.323184][ T309] bus_probe_device+0xc0/0x1f0 [ 28.328254][ T309] device_add+0xb0b/0xec0 [ 28.332781][ T309] hid_add_device+0x3b8/0x580 [ 28.337478][ T309] usbhid_probe+0xc12/0xff0 [ 28.342203][ T309] usb_probe_interface+0x621/0xb30 [ 28.347519][ T309] really_probe+0x2d7/0x9a0 [ 28.352066][ T309] __driver_probe_device+0x193/0x270 [ 28.357506][ T309] driver_probe_device+0x54/0x3e0 [ 28.362573][ T309] __device_attach_driver+0x2e9/0x4a0 [ 28.368073][ T309] bus_for_each_drv+0x192/0x220 [ 28.373090][ T309] __device_attach+0x2b0/0x420 [ 28.377890][ T309] device_initial_probe+0x1a/0x20 [ 28.383058][ T309] bus_probe_device+0xc0/0x1f0 [ 28.387948][ T309] device_add+0xb0b/0xec0 [ 28.392491][ T309] usb_set_configuration+0x1a01/0x1f70 [ 28.397975][ T309] usb_generic_driver_probe+0x91/0x150 [ 28.403594][ T309] usb_probe_device+0x154/0x260 [ 28.408679][ T309] really_probe+0x2d7/0x9a0 [ 28.413308][ T309] __driver_probe_device+0x193/0x270 [ 28.418705][ T309] driver_probe_device+0x54/0x3e0 [ 28.423857][ T309] __device_attach_driver+0x2e9/0x4a0 [ 28.430045][ T309] bus_for_each_drv+0x192/0x220 [ 28.434916][ T309] __device_attach+0x2b0/0x420 [ 28.439733][ T309] device_initial_probe+0x1a/0x20 [ 28.444862][ T309] bus_probe_device+0xc0/0x1f0 [ 28.449649][ T309] device_add+0xb0b/0xec0 [ 28.454367][ T309] usb_new_device+0x9f4/0x1500 [ 28.459179][ T309] hub_event+0x27fb/0x4310 [ 28.463654][ T309] process_one_work+0x717/0xc30 [ 28.468666][ T309] worker_thread+0xa4d/0x11d0 [ 28.474248][ T309] kthread+0x281/0x320 [ 28.478519][ T309] ret_from_fork+0x1f/0x30 [ 28.483489][ T309] [ 28.485824][ T309] Freed by task 352: [ 28.489815][ T309] kasan_set_track+0x4b/0x70 [ 28.495230][ T309] kasan_save_free_info+0x2b/0x40 [ 28.500299][ T309] ____kasan_slab_free+0x132/0x180 [ 28.505451][ T309] __kasan_slab_free+0x11/0x20 [ 28.510238][ T309] slab_free_freelist_hook+0xc2/0x190 [ 28.515722][ T309] __kmem_cache_free+0xb7/0x1b0 [ 28.520814][ T309] kfree+0x6f/0xf0 [ 28.524588][ T309] roccat_release+0x2bc/0x380 [ 28.529297][ T309] __fput+0x1fd/0x8f0 [ 28.533335][ T309] ____fput+0x15/0x20 [ 28.537376][ T309] task_work_run+0x1e1/0x250 [ 28.541993][ T309] exit_to_user_mode_loop+0x9b/0xb0 [ 28.547598][ T309] exit_to_user_mode_prepare+0x87/0xd0 [ 28.553077][ T309] syscall_exit_to_user_mode+0x1a/0x30 [ 28.558835][ T309] do_syscall_64+0x58/0xa0 [ 28.563986][ T309] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 28.570975][ T309] [ 28.574742][ T309] The buggy address belongs to the object at ffff8881361d6400 [ 28.574742][ T309] which belongs to the cache kmalloc-512 of size 512 [ 28.590998][ T309] The buggy address is located 8 bytes inside of [ 28.590998][ T309] 512-byte region [ffff8881361d6400, ffff8881361d6600) [ 28.604864][ T309] [ 28.607314][ T309] The buggy address belongs to the physical page: [ 28.613942][ T309] page:ffffea0004d87500 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1361d4 [ 28.624223][ T309] head:ffffea0004d87500 order:2 compound_mapcount:0 compound_pincount:0 [ 28.633102][ T309] flags: 0x4000000000010200(slab|head|zone=1) [ 28.639319][ T309] raw: 4000000000010200 0000000000000000 dead000000000122 ffff888100042f00 [ 28.647949][ T309] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 28.656818][ T309] page dumped because: kasan: bad access detected [ 28.663287][ T309] page_owner tracks the page as allocated [ 28.669054][ T309] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 92, tgid 92 (klogd), ts 27496980133, free_ts 0 [ 28.690275][ T309] post_alloc_hook+0x1f5/0x210 [ 28.695160][ T309] prep_new_page+0x1c/0x110 [ 28.699704][ T309] get_page_from_freelist+0x2ca9/0x2d20 [ 28.705453][ T309] __alloc_pages+0x1fa/0x610 [ 28.710686][ T309] alloc_slab_page+0x6e/0xf0 [ 28.715796][ T309] new_slab+0x98/0x3e0 [ 28.719906][ T309] ___slab_alloc+0x70f/0xb70 [ 28.724763][ T309] __slab_alloc+0x5e/0xa0 [ 28.729139][ T309] __kmem_cache_alloc_node+0x204/0x2d0 [ 28.734635][ T309] __kmalloc_node_track_caller+0xa1/0x1e0 [ 28.740497][ T309] __alloc_skb+0x226/0x4a0 [ 28.745116][ T309] alloc_skb_with_frags+0xa8/0x620 [ 28.750818][ T309] sock_alloc_send_pskb+0x87f/0x9a0 [ 28.756645][ T309] unix_dgram_sendmsg+0x5c1/0x1710 [ 28.761789][ T309] __sys_sendto+0x4ac/0x660 [ 28.766878][ T309] __x64_sys_sendto+0xe5/0x100 [ 28.772467][ T309] page_owner free stack trace missing [ 28.778226][ T309] [ 28.780714][ T309] Memory state around the buggy address: [ 28.786720][ T309] ffff8881361d6300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 28.794905][ T309] ffff8881361d6380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 28.803090][ T309] >ffff8881361d6400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 28.811788][ T309] ^ [ 28.816238][ T309] ffff8881361d6480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 28.824579][ T309] ffff8881361d6500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 28.832678][ T309] ================================================================== [ 28.850482][ T355] cdc_ncm 4-1:1.0: skipping garbage [ 28.855869][ T355] cdc_ncm 4-1:1.0: CDC Union missing and no IAD found [ 28.867835][ T28] kauditd_printk_skb: 49 callbacks suppressed [ 28.867859][ T28] audit: type=1400 audit(1790102898.125:123): avc: denied { read } for pid=85 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 28.869719][ T355] cdc_ncm 4-1:1.0: bind() failure [ 28.876906][ T6] usb 2-1: config 0 interface 0 altsetting 8 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 28.917882][ T367] fido_id[367]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.0/usb1/report_descriptor': No such file or directory [ 28.920361][ T28] audit: type=1400 audit(1790102898.165:124): avc: denied { search } for pid=85 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 28.961679][ T28] audit: type=1400 audit(1790102898.165:125): avc: denied { write } for pid=85 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 28.967880][ T6] usb 2-1: config 0 interface 0 altsetting 8 endpoint 0x81 has invalid maxpacket 1024, setting to 64 [ 28.985226][ T28] audit: type=1400 audit(1790102898.165:126): avc: denied { add_name } for pid=85 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 29.018835][ T28] audit: type=1400 audit(1790102898.165:127): avc: denied { create } for pid=85 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 29.023143][ T6] usb 2-1: config 0 interface 0 altsetting 8 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 29.052814][ T6] usb 2-1: config 0 interface 0 has no altsetting 0 [ 29.059599][ T6] usb 2-1: New USB device found, idVendor=046d, idProduct=c539, bcdDevice= 0.00 [ 29.077488][ T28] audit: type=1400 audit(1790102898.165:128): avc: denied { append open } for pid=85 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 29.093976][ T6] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 29.101590][ T28] audit: type=1400 audit(1790102898.165:129): avc: denied { getattr } for pid=85 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 29.110292][ T309] Disabling lock debugging due to kernel taint [ 29.138241][ T6] usb 2-1: config 0 descriptor?? [ 29.258912][ T28] audit: type=1400 audit(1790102898.505:130): avc: denied { unmount } for pid=291 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 29.292178][ T24] usb 4-1: USB disconnect, device number 2 [ 29.548192][ T6] logitech-djreceiver 0003:046D:C539.0003: hidraw0: USB HID v0.00 Keyboard [HID 046d:c539] on usb-dummy_hcd.1-1/input0 [ 30.116484][ T309] delayedwork_callback: delayedwork queued before hidpp interface was enumerated [ 31.333137][ T24] usb 2-1: USB disconnect, device number 3