last executing test programs: 5.573971697s ago: executing program 1 (id=2): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_INTERFACE(r0, 0x0, 0x0) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000002c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) 4.940549432s ago: executing program 0 (id=1): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./tracing\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./tracing/synthetic_events\x00', 0x2, 0x0) write(r0, &(0x7f0000000040)="e95f0797b91b4da6d6", 0x9) 3.078741867s ago: executing program 0 (id=3): r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x40, 0xcf2, 0x6250, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x0, 0x80, 0xfa, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x8, 0x6, 0x50, 0x0, [], [{{0x9, 0x5, 0x1, 0x2, 0x200}}, {{0x9, 0x5, 0x82, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, &(0x7f00000001c0)={0x14, &(0x7f0000000040)={0x40, 0x6, 0x2, {0x2, 0x22}}, &(0x7f00000000c0)={0x0, 0x3, 0x2, @string={0x2}}}, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x8044) syz_usb_ep_write(r0, 0x82, 0x0, 0x0) syz_emit_ethernet(0x2a, &(0x7f00000009c0)={@multicast, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, @val={@val={0x88a8, 0x2, 0x1, 0x3}, {0x8100, 0x2, 0x1, 0x2}}, {@ipv4={0x800, @generic={{0x5, 0x4, 0x2, 0x28, 0x14, 0x67, 0x0, 0xb8, 0x0, 0x0, @multicast2, @rand_addr=0x64010100}}}}}, 0x0) 1.523371848s ago: executing program 1 (id=4): r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000440)={0x900, 0x0, &(0x7f0000000400)={&(0x7f0000000b00)=ANY=[@ANYBLOB="0208fc020e00000027bd7000fedbdf2503001704"], 0x70}}, 0x40448c4) 663.341805ms ago: executing program 1 (id=5): r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r0) waitid(0x1, r0, 0x0, 0x2, 0x0) ptrace$peeksig(0x4209, r0, &(0x7f0000000e80)={0x8000, 0x1}, 0x0) 0s ago: executing program 1 (id=6): capset(&(0x7f00000000c0)={0x19980330}, &(0x7f0000000380)={0x7, 0x7, 0x4, 0x1ff, 0x101, 0x1}) syz_clone(0x1280, 0x0, 0x0, 0x0, 0x0, 0x0) kernel console output (not intermixed with test programs): [ 192.089882][ T30] audit: type=1400 audit(191.780:82): avc: denied { write } for pid=3364 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=932 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 192.890157][ T30] audit: type=1400 audit(192.590:83): avc: denied { write } for pid=3369 comm="rm" name="hook-state" dev="tmpfs" ino=932 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 Warning: Permanently added '[localhost]:42907' (ED25519) to the list of known hosts. [ 220.802827][ T30] audit: type=1400 audit(220.500:84): avc: denied { name_bind } for pid=3376 comm="sshd-session" src=30004 scontext=system_u:system_r:sshd_t tcontext=system_u:object_r:unreserved_port_t tclass=tcp_socket permissive=1 [ 221.174737][ T30] audit: type=1400 audit(220.870:85): avc: denied { execute } for pid=3377 comm="sh" name="syz-executor" dev="vda" ino=1867 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:etc_runtime_t tclass=file permissive=1 [ 221.182520][ T30] audit: type=1400 audit(220.880:86): avc: denied { execute_no_trans } for pid=3377 comm="sh" path="/syz-executor" dev="vda" ino=1867 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:etc_runtime_t tclass=file permissive=1 [ 229.709794][ T30] audit: type=1400 audit(229.400:87): avc: denied { mounton } for pid=3377 comm="syz-executor" path="/syzcgroup/unified" dev="vda" ino=1868 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 229.789758][ T30] audit: type=1400 audit(229.480:88): avc: denied { mount } for pid=3377 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 229.849953][ T3377] cgroup: Unknown subsys name 'net' [ 229.917574][ T30] audit: type=1400 audit(229.610:89): avc: denied { unmount } for pid=3377 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 230.275417][ T3377] cgroup: Unknown subsys name 'cpuset' [ 230.326496][ T3377] cgroup: Unknown subsys name 'rlimit' [ 230.612117][ T30] audit: type=1400 audit(230.310:90): avc: denied { setattr } for pid=3377 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=704 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 230.617585][ T30] audit: type=1400 audit(230.310:91): avc: denied { mounton } for pid=3377 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 230.627845][ T30] audit: type=1400 audit(230.320:92): avc: denied { mount } for pid=3377 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 231.182632][ T3379] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 231.189768][ T30] audit: type=1400 audit(230.880:93): avc: denied { relabelto } for pid=3379 comm="mkswap" name="swap-file" dev="vda" ino=1871 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 231.197259][ T30] audit: type=1400 audit(230.890:94): avc: denied { write } for pid=3379 comm="mkswap" path="/swap-file" dev="vda" ino=1871 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" Setting up swapspace version 1, size = 127995904 bytes [ 231.290903][ T30] audit: type=1400 audit(230.980:95): avc: denied { read } for pid=3377 comm="syz-executor" name="swap-file" dev="vda" ino=1871 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 231.294653][ T30] audit: type=1400 audit(230.990:96): avc: denied { open } for pid=3377 comm="syz-executor" path="/swap-file" dev="vda" ino=1871 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 231.323692][ T3377] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 254.637009][ T30] audit: type=1400 audit(254.330:97): avc: denied { write } for pid=3380 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=932 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 255.616840][ T30] audit: type=1400 audit(255.310:98): avc: denied { write } for pid=3383 comm="rm" name="hook-state" dev="tmpfs" ino=932 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 257.437494][ T30] audit: type=1400 audit(257.130:99): avc: denied { execmem } for pid=3385 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 257.514760][ T30] audit: type=1400 audit(257.210:100): avc: denied { read } for pid=3387 comm="syz-executor" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 257.523798][ T30] audit: type=1400 audit(257.220:101): avc: denied { open } for pid=3387 comm="syz-executor" path="net:[4026531833]" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 257.541409][ T30] audit: type=1400 audit(257.230:102): avc: denied { mounton } for pid=3388 comm="syz-executor" path="/" dev="vda" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 257.606853][ T30] audit: type=1400 audit(257.300:103): avc: denied { module_request } for pid=3388 comm="syz-executor" kmod="netdev-nr1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 257.615074][ T30] audit: type=1400 audit(257.300:104): avc: denied { module_request } for pid=3387 comm="syz-executor" kmod="netdev-nr0" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 257.836943][ T30] audit: type=1400 audit(257.530:105): avc: denied { sys_module } for pid=3387 comm="syz-executor" capability=16 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 264.415102][ T3387] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 264.472076][ T3387] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 264.739928][ T3388] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 264.843550][ T3388] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 266.779298][ T3387] hsr_slave_0: entered promiscuous mode [ 266.791878][ T3387] hsr_slave_1: entered promiscuous mode [ 268.180908][ T3388] hsr_slave_0: entered promiscuous mode [ 268.186421][ T3388] hsr_slave_1: entered promiscuous mode [ 268.193496][ T3388] debugfs: 'hsr0' already exists in 'hsr' [ 268.197420][ T3388] Cannot create hsr debugfs directory [ 270.140009][ T30] audit: type=1400 audit(269.830:106): avc: denied { create } for pid=3387 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 270.153790][ T30] audit: type=1400 audit(269.850:107): avc: denied { write } for pid=3387 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 270.172131][ T30] audit: type=1400 audit(269.850:108): avc: denied { read } for pid=3387 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 270.227919][ T3387] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 270.269938][ T3387] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 270.354233][ T3387] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 270.369998][ T3387] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 270.375358][ T3387] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 270.400159][ T3387] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 270.457066][ T3387] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 270.513675][ T3387] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 271.033505][ T3388] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 271.096956][ T3388] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 271.146414][ T3388] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 271.173331][ T3388] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 271.187681][ T3388] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 271.223578][ T3388] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 271.235470][ T3388] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 271.272634][ T3388] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 273.519229][ T3388] 8021q: adding VLAN 0 to HW filter on device bond0 [ 274.113972][ T3387] 8021q: adding VLAN 0 to HW filter on device bond0 [ 283.664232][ T3388] veth0_vlan: entered promiscuous mode [ 283.775300][ T3388] veth1_vlan: entered promiscuous mode [ 284.143400][ T3387] veth0_vlan: entered promiscuous mode [ 284.412967][ T3388] veth0_macvtap: entered promiscuous mode [ 284.495047][ T3387] veth1_vlan: entered promiscuous mode [ 284.548006][ T3388] veth1_macvtap: entered promiscuous mode [ 284.993612][ T3387] veth0_macvtap: entered promiscuous mode [ 285.127632][ T3387] veth1_macvtap: entered promiscuous mode [ 285.160125][ T574] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 285.166198][ T574] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 285.215222][ T1534] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 285.319561][ T1541] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 285.585498][ T30] audit: type=1400 audit(285.280:109): avc: denied { mounton } for pid=3388 comm="syz-executor" path="/syzkaller.9NbgSV/syz-tmp" dev="vda" ino=1876 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 285.616309][ T30] audit: type=1400 audit(285.310:110): avc: denied { mount } for pid=3388 comm="syz-executor" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 285.670385][ T30] audit: type=1400 audit(285.370:111): avc: denied { mounton } for pid=3388 comm="syz-executor" path="/syzkaller.9NbgSV/syz-tmp/newroot/dev" dev="tmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 285.693164][ T30] audit: type=1400 audit(285.390:112): avc: denied { mount } for pid=3388 comm="syz-executor" name="/" dev="proc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 285.734626][ T30] audit: type=1400 audit(285.430:113): avc: denied { mounton } for pid=3388 comm="syz-executor" path="/syzkaller.9NbgSV/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 285.747122][ T30] audit: type=1400 audit(285.440:114): avc: denied { mounton } for pid=3388 comm="syz-executor" path="/syzkaller.9NbgSV/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=4070 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1 [ 285.779887][ T30] audit: type=1400 audit(285.480:115): avc: denied { unmount } for pid=3388 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 285.812413][ T30] audit: type=1400 audit(285.510:116): avc: denied { mounton } for pid=3388 comm="syz-executor" path="/dev/gadgetfs" dev="devtmpfs" ino=1548 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=dir permissive=1 [ 285.844135][ T30] audit: type=1400 audit(285.540:117): avc: denied { mount } for pid=3388 comm="syz-executor" name="/" dev="gadgetfs" ino=2903 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=filesystem permissive=1 [ 285.911651][ T1388] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 285.941573][ T574] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 285.960440][ T30] audit: type=1400 audit(285.650:118): avc: denied { mount } for pid=3388 comm="syz-executor" name="/" dev="binder" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 285.995590][ T1388] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 286.113248][ T1388] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 286.252896][ T3388] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 286.426720][ T3388] arp_tables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon. [ 286.472576][ T3388] ip_tables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon. [ 286.600581][ T3388] ip6_tables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon. [ 290.451072][ T805] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 290.663973][ T805] usb 1-1: New USB device found, idVendor=0cf2, idProduct=6250, bcdDevice= 0.00 [ 290.770990][ T805] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 290.774223][ T805] usb 1-1: Product: syz [ 290.775934][ T805] usb 1-1: Manufacturer: syz [ 290.777395][ T805] usb 1-1: SerialNumber: syz [ 291.074056][ T805] ums_eneub6250 1-1:1.0: USB Mass Storage device detected [ 291.224119][ T805] scsi host0: usb-storage 1-1:1.0 [ 291.279943][ T30] kauditd_printk_skb: 12 callbacks suppressed [ 291.280812][ T30] audit: type=1400 audit(290.970:131): avc: denied { create } for pid=3549 comm="syz.1.4" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 291.286660][ T30] audit: type=1400 audit(290.980:132): avc: denied { write } for pid=3549 comm="syz.1.4" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 292.449878][ T3491] ------------[ cut here ]------------ [ 292.450649][ T3491] URB 000000009dac3b36 submitted while active [ 292.469854][ T3491] WARNING: drivers/usb/core/urb.c:379 at usb_submit_urb+0xe60/0x1200, CPU#1: kworker/1:4/3491 [ 292.470740][ T3491] Modules linked in: [ 292.471221][ T3491] CPU: 1 UID: 0 PID: 3491 Comm: kworker/1:4 Tainted: G W syzkaller #0 PREEMPT [ 292.471720][ T3491] Tainted: [W]=WARN [ 292.471967][ T3491] Hardware name: linux,dummy-virt (DT) [ 292.472564][ T3491] Workqueue: events_freezable usb_stor_scan_dwork [ 292.473375][ T3491] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 292.473825][ T3491] pc : usb_submit_urb+0xe60/0x1200 [ 292.474177][ T3491] lr : usb_submit_urb+0xe60/0x1200 [ 292.474537][ T3491] sp : ffff8000a22978b0 [ 292.474812][ T3491] x29: ffff8000a22978b0 x28: ffff0000170c5000 x27: ffffffffffffffff [ 292.475380][ T3491] x26: ffff000021790fe0 x25: 1fffe000042f21eb x24: 1fffe000042f21fc [ 292.475929][ T3491] x23: ffff000021790f58 x22: 00000000000003e8 x21: 1ffff00014452f2c [ 292.476505][ T3491] x20: ffff000013964800 x19: ffff000013964800 x18: ffff00006bfa3268 [ 292.477085][ T3491] x17: ffff7fffe483b000 x16: ffff80008dba0000 x15: 0000000000000000 [ 292.477717][ T3491] x14: 1fffe0000d7f464d x13: ffff800089ebbf80 x12: ffff60000d7f6a22 [ 292.478433][ T3491] x11: 1fffe0000d7f6a21 x10: ffff60000d7f6a21 x9 : dfff800000000000 [ 292.479091][ T3491] x8 : ffff8000a22973e0 x7 : ffff8000a2297560 x6 : ffff8000a2297500 [ 292.479700][ T3491] x5 : ffff8000a2297440 x4 : 0000000000000003 x3 : 1fffe0000d7f5b5d [ 292.480336][ T3491] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff000014855700 [ 292.480932][ T3491] Call trace: [ 292.481176][ T3491] usb_submit_urb+0xe60/0x1200 (P) [ 292.481621][ T3491] usb_stor_msg_common+0x1bc/0x454 [ 292.482004][ T3491] usb_stor_Bulk_max_lun+0x354/0x530 [ 292.482372][ T3491] usb_stor_scan_dwork+0x1a0/0x250 [ 292.482710][ T3491] process_one_work+0x830/0x1c00 [ 292.483073][ T3491] worker_thread+0x42c/0xc90 [ 292.483394][ T3491] kthread+0x2ec/0x384 [ 292.483702][ T3491] ret_from_fork+0x10/0x20 [ 292.484053][ T3491] irq event stamp: 964 [ 292.484355][ T3491] hardirqs last enabled at (963): [] finish_task_switch.isra.0+0x1e4/0x9f0 [ 292.484942][ T3491] hardirqs last disabled at (964): [] el1_brk64+0x20/0x54 [ 292.485433][ T3491] softirqs last enabled at (960): [] handle_softirqs+0xa98/0x1048 SYZFAIL: failed to recv rpc [ 292.485911][ T3491] softirqs last disabled at (951): [] __do_softirq+0x14/0x20 [ 292.486760][ T3491] ---[ end trace 0000000000000000 ]--- fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 292.960117][ T3557] capability: warning: `syz.1.6' uses 32-bit capabilities (legacy support in use) [ 294.282901][ C1] ------------[ cut here ]------------ [ 294.283079][ C1] DEBUG_LOCKS_WARN_ON(1) [ 294.283267][ C1] WARNING: kernel/locking/lockdep.c:238 at __lock_acquire+0xe28/0x1a5c, CPU#1: udevd/3197 [ 294.283967][ C1] Modules linked in: [ 294.284175][ C1] CPU: 1 UID: 0 PID: 3197 Comm: udevd Tainted: G W syzkaller #0 PREEMPT [ 294.284488][ C1] Tainted: [W]=WARN [ 294.284630][ C1] Hardware name: linux,dummy-virt (DT) [ 294.284837][ C1] pstate: 600000c5 (nZCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 294.285033][ C1] pc : __lock_acquire+0xe28/0x1a5c [ 294.285205][ C1] lr : __lock_acquire+0xe28/0x1a5c [ 294.285431][ C1] sp : ffff80008dba77f0 [ 294.285563][ C1] x29: ffff80008dba7870 x28: 0000000000000001 x27: 0000000000000000 [ 294.285863][ C1] x26: ffff8000a2487680 x25: ffff8000877ca000 x24: ffff800087763ed4 [ 294.286132][ C1] x23: ffff000010341d00 x22: ffff000010342870 x21: ffff800089e66080 [ 294.286408][ C1] x20: ffff80008934fb60 x19: 00000000000c2000 x18: ffff000013964800 [ 294.286680][ C1] x17: ffff7fffe483b000 x16: 00000000f1f1f1f1 x15: 00000000f3f3f3f3 [ 294.286963][ C1] x14: 0000000000000000 x13: 284e4f5f4e524157 x12: ffff60000d7f3e6b [ 294.287234][ C1] x11: 1fffe0000d7f3e6a x10: ffff60000d7f3e6a x9 : dfff800000000000 [ 294.287512][ C1] x8 : ffff00006bf9f353 x7 : 0000000000000001 x6 : ffff60000d7f3e6a [ 294.287787][ C1] x5 : ffff00006bf9f350 x4 : 1fffe000020683a1 x3 : dfff800000000000 [ 294.288056][ C1] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff000010341d00 [ 294.288493][ C1] Call trace: [ 294.288675][ C1] __lock_acquire+0xe28/0x1a5c (P) [ 294.288890][ C1] lock_acquire+0x3d0/0x44c [ 294.289052][ C1] _raw_spin_lock_irqsave+0x58/0x80 [ 294.289228][ C1] complete+0x24/0x1e8 [ 294.289451][ C1] usb_stor_blocking_completion+0x34/0x4c [ 294.289648][ C1] __usb_hcd_giveback_urb+0x1f8/0x3d0 [ 294.289912][ C1] usb_hcd_giveback_urb+0x2bc/0x36c [ 294.290088][ C1] dummy_timer+0xba0/0x3614 [ 294.290256][ C1] __hrtimer_run_queues+0x2a0/0xaa0 [ 294.290477][ C1] hrtimer_run_softirq+0x168/0x2ac [ 294.290689][ C1] handle_softirqs+0x2d8/0x1048 [ 294.290870][ C1] __do_softirq+0x14/0x20 [ 294.291024][ C1] ____do_softirq+0x10/0x20 [ 294.291185][ C1] call_on_irq_stack+0x30/0x48 [ 294.291344][ C1] do_softirq_own_stack+0x1c/0x40 [ 294.291511][ C1] __irq_exit_rcu+0x470/0x598 [ 294.291665][ C1] irq_exit_rcu+0x14/0x80 [ 294.291817][ C1] el1_interrupt+0x40/0x60 [ 294.291975][ C1] el1h_64_irq_handler+0x18/0x30 [ 294.292140][ C1] el1h_64_irq+0x6c/0x70 [ 294.292458][ C1] sock_poll+0x110/0x300 (P) [ 294.292651][ C1] ep_item_poll+0xfc/0x1c0 [ 294.292820][ C1] ep_send_events+0x220/0x864 [ 294.292979][ C1] do_epoll_wait+0xa8c/0x1028 [ 294.293146][ C1] do_compat_epoll_pwait.part.0+0x14/0xd4 [ 294.293412][ C1] __arm64_sys_epoll_pwait+0x160/0x250 [ 294.293592][ C1] invoke_syscall+0x74/0x240 [ 294.293760][ C1] el0_svc_common.constprop.0+0xac/0x230 [ 294.294033][ C1] do_el0_svc+0x40/0x58 [ 294.294192][ C1] el0_svc+0x58/0x2a4 [ 294.294344][ C1] el0t_64_sync_handler+0xa0/0xe4 [ 294.294564][ C1] el0t_64_sync+0x198/0x19c [ 294.294788][ C1] irq event stamp: 691049 [ 294.294926][ C1] hardirqs last enabled at (691048): [] _raw_spin_unlock_irqrestore+0x80/0xb4 [ 294.295150][ C1] hardirqs last disabled at (691049): [] _raw_spin_lock_irqsave+0x7c/0x80 [ 294.295357][ C1] softirqs last enabled at (691038): [] handle_softirqs+0xa98/0x1048 [ 294.295608][ C1] softirqs last disabled at (691045): [] __do_softirq+0x14/0x20 [ 294.295842][ C1] ---[ end trace 0000000000000000 ]--- [ 294.296758][ C1] Unable to handle kernel NULL pointer dereference at virtual address 00000000000000c4 [ 294.296846][ C1] Mem abort info: [ 294.296874][ C1] ESR = 0x0000000096000004 [ 294.296939][ C1] EC = 0x25: DABT (current EL), IL = 32 bits [ 294.296980][ C1] SET = 0, FnV = 0 [ 294.297011][ C1] EA = 0, S1PTW = 0 [ 294.297050][ C1] FSC = 0x04: level 0 translation fault [ 294.297091][ C1] Data abort info: [ 294.297120][ C1] ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 [ 294.297157][ C1] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [ 294.297190][ C1] GCS = 0, Overlay = 0, DirtyBit = 0 [ 294.297354][ C1] user pgtable: 4k pages, 48-bit VAs, pgdp=0000000056e9a000 [ 294.297452][ C1] [00000000000000c4] pgd=0000000000000000, p4d=0000000000000000 [ 294.297925][ C1] Internal error: Oops: 0000000096000004 [#1] SMP [ 294.300243][ C1] Modules linked in: [ 294.300574][ C1] CPU: 1 UID: 0 PID: 3197 Comm: udevd Tainted: G W syzkaller #0 PREEMPT [ 294.300855][ C1] Tainted: [W]=WARN [ 294.300972][ C1] Hardware name: linux,dummy-virt (DT) [ 294.301132][ C1] pstate: 600000c5 (nZCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 294.301391][ C1] pc : __lock_acquire+0x1f4/0x1a5c [ 294.301572][ C1] lr : __lock_acquire+0xe28/0x1a5c [ 294.301728][ C1] sp : ffff80008dba77f0 [ 294.301858][ C1] x29: ffff80008dba7870 x28: 0000000000000001 x27: 0000000000000000 [ 294.302140][ C1] x26: ffff8000a2487680 x25: ffff8000877ca000 x24: ffff800087763ed4 [ 294.302419][ C1] x23: ffff000010341d00 x22: ffff000010342870 x21: ffff800089e66080 [ 294.302688][ C1] x20: ffff80008934fb60 x19: 00000000000c2000 x18: ffff000013964800 [ 294.302974][ C1] x17: ffff7fffe483b000 x16: 00000000f1f1f1f1 x15: 00000000f3f3f3f3 [ 294.303247][ C1] x14: 0000000000000000 x13: 284e4f5f4e524157 x12: ffff60000d7f3e6b [ 294.303521][ C1] x11: 1fffe0000d7f3e6a x10: 0000000000000028 x9 : 147ae0a3d67491ee [ 294.303801][ C1] x8 : ffff00006bf9f353 x7 : 0000000000000001 x6 : ffff60000d7f3e6a [ 294.304074][ C1] x5 : ffff00006bf9f350 x4 : 0000000000000001 x3 : dfff800000000000 [ 294.304385][ C1] x2 : 0000000000000000 x1 : 0000000000000000 x0 : 00000000000c31ee [ 294.304712][ C1] Call trace: [ 294.304844][ C1] __lock_acquire+0x1f4/0x1a5c (P) [ 294.305025][ C1] lock_acquire+0x3d0/0x44c [ 294.305181][ C1] _raw_spin_lock_irqsave+0x58/0x80 [ 294.305399][ C1] complete+0x24/0x1e8 [ 294.305556][ C1] usb_stor_blocking_completion+0x34/0x4c [ 294.305734][ C1] __usb_hcd_giveback_urb+0x1f8/0x3d0 [ 294.305910][ C1] usb_hcd_giveback_urb+0x2bc/0x36c [ 294.306076][ C1] dummy_timer+0xba0/0x3614 [ 294.306229][ C1] __hrtimer_run_queues+0x2a0/0xaa0 [ 294.306400][ C1] hrtimer_run_softirq+0x168/0x2ac [ 294.306573][ C1] handle_softirqs+0x2d8/0x1048 [ 294.306736][ C1] __do_softirq+0x14/0x20 [ 294.306897][ C1] ____do_softirq+0x10/0x20 [ 294.307053][ C1] call_on_irq_stack+0x30/0x48 [ 294.307207][ C1] do_softirq_own_stack+0x1c/0x40 [ 294.307369][ C1] __irq_exit_rcu+0x470/0x598 [ 294.307526][ C1] irq_exit_rcu+0x14/0x80 [ 294.307670][ C1] el1_interrupt+0x40/0x60 [ 294.307827][ C1] el1h_64_irq_handler+0x18/0x30 [ 294.307985][ C1] el1h_64_irq+0x6c/0x70 [ 294.308169][ C1] sock_poll+0x110/0x300 (P) [ 294.308339][ C1] ep_item_poll+0xfc/0x1c0 [ 294.308501][ C1] ep_send_events+0x220/0x864 [ 294.308822][ C1] do_epoll_wait+0xa8c/0x1028 [ 294.309045][ C1] do_compat_epoll_pwait.part.0+0x14/0xd4 [ 294.309246][ C1] __arm64_sys_epoll_pwait+0x160/0x250 [ 294.309500][ C1] invoke_syscall+0x74/0x240 [ 294.309657][ C1] el0_svc_common.constprop.0+0xac/0x230 [ 294.309834][ C1] do_el0_svc+0x40/0x58 [ 294.309982][ C1] el0_svc+0x58/0x2a4 [ 294.310182][ C1] el0t_64_sync_handler+0xa0/0xe4 [ 294.310381][ C1] el0t_64_sync+0x198/0x19c [ 294.310899][ C1] Code: 52801900 9ba07c21 8b0102a1 f94012c0 (39431025) [ 294.311926][ C1] ---[ end trace 0000000000000000 ]--- [ 294.312605][ C1] Kernel panic - not syncing: Oops: Fatal exception in interrupt [ 294.313198][ C1] SMP: stopping secondary CPUs [ 294.314508][ C1] Kernel Offset: disabled [ 294.314737][ C1] CPU features: 0x0,40400002,00340020,00100000,0800821b [ 294.314994][ C1] Memory Limit: none [ 294.315835][ C1] Rebooting in 86400 seconds..