last executing test programs: 15.525616032s ago: executing program 3 (id=18): fsopen(&(0x7f00000002c0)='cgroup2\x00', 0x1) r0 = syz_open_dev$evdev(&(0x7f0000000ac0), 0xc397, 0x2000) prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) ioctl$EVIOCGMTSLOTS(r0, 0x8040450a, 0x0) 15.510705123s ago: executing program 3 (id=19): r0 = openat$kvm(0x0, &(0x7f0000000400), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f0000000480)={0x0, &(0x7f0000000540)=[@enable_nested={0x12c, 0x18}, @nested_create_vm={0x12d, 0x18}, @nested_load_code={0x12e, 0x1e, {0x0, "66ba3412eef4"}}, @nested_vmlaunch={0x12f, 0x18}], 0x66}) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = syz_create_resource$kvm_nested_state(&(0x7f0000002140)=@vmx={0x0, 0x0, 0x2080}) ioctl$KVM_GET_NESTED_STATE_res(r3, 0xc080aebe, r4) 15.415551072s ago: executing program 3 (id=20): r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000680), 0x2, 0x0) write$uinput_user_dev(r0, &(0x7f0000000980)={'syz0\x00', {0xd, 0x8, 0x5, 0x2}, 0x3b, [0x4, 0x6, 0x8, 0x6, 0x7, 0x1, 0x6, 0x10000, 0x726, 0x4, 0x8, 0x5, 0x8d, 0x6, 0x8000, 0x200, 0x7ff, 0x9, 0x5, 0x7, 0xab47, 0x81, 0x2e, 0x3, 0x7, 0x6, 0x4, 0x1000, 0x9, 0x5, 0x83, 0xde, 0x5, 0x74, 0x3ff, 0x1, 0xd, 0x0, 0x1741, 0x800, 0x0, 0x80000000, 0x3ff, 0x5, 0x3932, 0x63, 0x2, 0x5, 0x1, 0x24, 0xfff, 0x8, 0xffff, 0x2, 0x9, 0x5, 0x0, 0x5, 0x4, 0x5b1, 0xffffffff, 0x2, 0x2, 0x10], [0xcd, 0x2, 0x0, 0x8ed, 0xffffff70, 0x401, 0x3, 0x0, 0xa, 0x9, 0xe08d, 0x743, 0x5, 0x5, 0x3, 0x2, 0xf5, 0x3, 0x7, 0x2, 0x0, 0x4, 0x1, 0x4, 0x6, 0x2, 0x16, 0x546b433e, 0x9, 0x6, 0xe, 0x8, 0xe, 0x6, 0x2, 0x9, 0x1, 0x5, 0x5, 0x3, 0x6, 0x2, 0x40, 0x0, 0x3b50, 0xc89b, 0xd, 0xfffffff7, 0x8, 0x1, 0x5, 0x2, 0x7, 0x89, 0x2, 0xfffffffd, 0x0, 0xfbf, 0x5, 0xfffffffd, 0x2, 0x7fffffff, 0x8add, 0x8], [0xd8a, 0x8, 0x1000, 0x2, 0xf06, 0x5, 0x1, 0xfffffffd, 0xe, 0xdbc5, 0x4, 0x3, 0xb, 0xffff, 0x6, 0x3, 0xffffbeef, 0x2, 0x5, 0x7, 0x7f, 0x6, 0x3, 0x3, 0x8, 0xc2c, 0x3, 0xb, 0x0, 0x6, 0x80, 0x800, 0x3c80, 0x68, 0x8, 0x6, 0x1, 0x9, 0x10, 0xc, 0x3, 0x1, 0x3, 0x400, 0x7, 0x20, 0x1, 0x8, 0x3, 0x8000, 0x9, 0x7, 0x2, 0x3, 0x80000000, 0x2, 0x40000, 0x4, 0xfff, 0x5, 0x10, 0x0, 0x7, 0x9], [0x6, 0x7, 0x1, 0x5, 0x0, 0x0, 0x29b, 0x4, 0x7f, 0x6, 0x704e, 0x3, 0x9, 0x4, 0xffffffff, 0x9, 0x77, 0x8001, 0x5, 0xcb0, 0x9, 0x0, 0x6, 0x5, 0x81, 0x8, 0x2, 0x5, 0xbcb, 0xfffeffff, 0xffff0001, 0xffff, 0x5, 0x9, 0x741, 0x6, 0xe4c5, 0xfffffff7, 0x9, 0x4, 0x0, 0x1000, 0x1ba3, 0x4, 0x0, 0x0, 0x7, 0x7fff, 0x7f, 0x4, 0x80, 0x8, 0xffff, 0x7, 0x8, 0x0, 0x4e, 0x60, 0xffff3c69, 0x7fffffff, 0x19, 0x6, 0x5, 0x8]}, 0x45c) ioctl$UI_SET_PHYS(r0, 0x4008556c, 0x0) 15.395224655s ago: executing program 3 (id=21): mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./proc\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f0000000200)='./bus\x00', &(0x7f0000000240), 0x8, &(0x7f0000000280)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) chdir(&(0x7f00000002c0)='./bus\x00') mount(0x0, &(0x7f0000000300)='./proc\x00', &(0x7f0000000340)='proc\x00', 0x4000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f00000003c0)='27', 0x2) ioctl$FIBMAP(0xffffffffffffffff, 0x1, 0x0) mount_setattr(0xffffffffffffffff, 0x0, 0x100, &(0x7f00000004c0)={0x100028, 0x100000, 0x100000, {r0}}, 0x20) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x210c, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./tracing\x00', 0x1ff) 15.097619525s ago: executing program 3 (id=22): r0 = socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) setns(0xc9, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r1, &(0x7f0000000140)={0x2, 0x0, @multicast1}, 0x10) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000001, 0x401d132, 0xffffffffffffffff, 0x0) sendmmsg(r1, &(0x7f0000000180), 0x800001d, 0x0) fstat(r0, &(0x7f0000000200)) sendmsg$inet6(r0, &(0x7f0000000000)={&(0x7f0000000040)={0xa, 0x4e20, 0x3a, @private2}, 0x1c, 0x0, 0x0, &(0x7f0000000280)=[@hopopts={{0x18, 0x29, 0x36, {0xc}}}, @rthdr_2292={{0x28, 0x29, 0x5, {0x2b, 0x2, 0x2, 0x1, 0x0, [@remote]}}}], 0x40}, 0x0) 14.962283169s ago: executing program 3 (id=23): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x181403, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe5000/0x18000)=nil, &(0x7f0000000200)=[@text64={0x40, 0x0}], 0x1, 0x41, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe7000/0x18000)=nil, &(0x7f00000000c0)=[@text32={0x20, &(0x7f0000000000)="0f20d835080000000f22d866b8a4008ee0dbe19f0faeab5fa4ef0000160000162781ef66bafc0cec0f08c7442400fbffffffc74424028000c0fec7442406000000002e0f01ca0f009e005000009a000000001e008b465cb99e020000b8d2f90000ba000000000f30", 0x68}], 0x1, 0xc, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 14.934515372s ago: executing program 32 (id=23): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x181403, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe5000/0x18000)=nil, &(0x7f0000000200)=[@text64={0x40, 0x0}], 0x1, 0x41, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe7000/0x18000)=nil, &(0x7f00000000c0)=[@text32={0x20, &(0x7f0000000000)="0f20d835080000000f22d866b8a4008ee0dbe19f0faeab5fa4ef0000160000162781ef66bafc0cec0f08c7442400fbffffffc74424028000c0fec7442406000000002e0f01ca0f009e005000009a000000001e008b465cb99e020000b8d2f90000ba000000000f30", 0x68}], 0x1, 0xc, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 3.6209169s ago: executing program 2 (id=199): r0 = syz_usb_connect$hid(0x5, 0x3f, &(0x7f0000000000)=ANY=[@ANYBLOB="12011001000000106d043ac500000000000109022d0001000070060904000504030002000921fcff400122180009058103"], 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0x8000, 0x2, 0x2172, 0xffffffffffffffff, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="002218000000050c150825ff0904a1010901a1007508950109308102c0c0"], 0x0}, 0x0) r1 = syz_open_dev$hiddev(&(0x7f00000000c0), 0xa, 0x62080) ioctl$HIDIOCGREPORT(r1, 0x400c4807, 0x0) 2.758069328s ago: executing program 1 (id=231): r0 = syz_usb_connect$cdc_ncm(0x2, 0x6e, &(0x7f0000000680)=ANY=[@ANYBLOB="12010000020000402505a1a440000102030109025c00f1010000000904000001020d0000052406000105240000000d240f0101010000050000000006241a0000000905810308003602000904010000020d160b0904010102020d000009058202080000000009050302000200"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f00000000c0)={0x84, &(0x7f0000000400)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, &(0x7f0000000200)={0x14, 0x0, &(0x7f0000000240)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) 1.498302317s ago: executing program 2 (id=249): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = open(&(0x7f00000005c0)='./file0\x00', 0x149040, 0x40) fcntl$setsig(r0, 0xa, 0x13) fcntl$setlease(r0, 0x400, 0x0) timer_create(0x0, &(0x7f0000000600)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000640)) timer_settime(0x0, 0x0, &(0x7f0000000680)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) truncate(&(0x7f00000006c0)='./file0\x00', 0x4) fcntl$setlease(r0, 0x400, 0x2) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCGSOFTCAR(r1, 0x4b46, 0x0) ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY(0xffffffffffffffff, 0xc0406618, 0x0) 1.164042991s ago: executing program 2 (id=255): r0 = socket$pptp(0x18, 0x1, 0x2) bind$pptp(r0, &(0x7f0000000440)={0x18, 0x2, {0x0, @loopback}}, 0x1e) connect$pptp(r0, &(0x7f00000019c0)={0x18, 0x2, {0x1234, @loopback}}, 0x1e) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000001a00), 0x2, 0x0) ioctl$PPPIOCATTCHAN(r1, 0x40047438, &(0x7f0000001a40)=0x1) ioctl$PPPIOCBRIDGECHAN(r1, 0x40047435, &(0x7f0000001b40)=0x2) 1.069372421s ago: executing program 2 (id=257): socket$inet_tcp(0x2, 0x1, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) prlimit64(0x0, 0x7, 0x0, 0x0) r0 = fsopen(&(0x7f00000000c0)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) fsmount(r0, 0x0, 0xa) 1.069209301s ago: executing program 2 (id=258): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000800)=@newsa={0x140, 0x10, 0x1, 0x0, 0x0, {{@in6=@private1={0xfc, 0x1, '\x00', 0x1}, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x4e20, 0x0, 0x4e20, 0x0, 0xa, 0x80, 0x80}, {@in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x4d2, 0x6c}, @in6=@local, {0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, {0x0, 0x0, 0xfffffffffffffffd}, {}, 0x4, 0xfffffffa, 0xa, 0x1, 0x0, 0x2}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}, @extra_flags={0x8, 0x18, 0x1}]}, 0x140}, 0x1, 0x0, 0x0, 0x20000080}, 0x0) 1.014267526s ago: executing program 2 (id=259): waitid(0x0, 0x0, 0x0, 0x2, 0xfffffffffffffffe) r0 = syz_usb_connect$cdc_ncm(0x2, 0x6e, &(0x7f0000000680)=ANY=[@ANYBLOB="12010000020000402505a1a440000102030109025c00f1010000000904000001020d0000052406000105240000000d240f0101010000050000000006241a0000000905810308003602000904010000020d160b0904010102020d000009058202080000000009050302000200"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f00000000c0)={0x84, &(0x7f0000000400)=ANY=[@ANYBLOB="201519000000c3db3f84cfe6867165d9da4d663269d2a486a88d86"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, &(0x7f0000000200)={0x14, 0x0, &(0x7f0000000240)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) 350.039935ms ago: executing program 4 (id=271): r0 = syz_open_dev$usbfs(&(0x7f0000000d80), 0x205, 0x2581) r1 = fcntl$dupfd(r0, 0x406, r0) ioctl$USBDEVFS_SUBMITURB(r1, 0x8038550a, &(0x7f0000000dc0)=@urb_type_control={0x2, {}, 0x0, 0x0, &(0x7f0000000e00)={0x1, 0xa, 0x2}, 0x8, 0x2, 0x0, 0x48000000, 0x0, 0x0, 0x0}) 348.067385ms ago: executing program 4 (id=272): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x40, 0x7, &(0x7f0000000040)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x89f9b000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) madvise(&(0x7f0000c00000/0x400000)=nil, 0x400000, 0xe) 166.811944ms ago: executing program 4 (id=273): r0 = socket(0x2, 0x3, 0x100) setsockopt$inet_int(r0, 0x0, 0x5, 0x0, 0x0) 148.308255ms ago: executing program 4 (id=274): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)={0x40, r1, 0x1, 0x0, 0x25dfdbfe, {}, [@ETHTOOL_A_FEATURES_WANTED={0x14, 0x3, 0x0, 0x1, [@ETHTOOL_A_BITSET_VALUE={0x4}, @ETHTOOL_A_BITSET_SIZE={0x8, 0x2, 0x7ffd}, @ETHTOOL_A_BITSET_MASK={0x4}]}, @ETHTOOL_A_FEATURES_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_bond\x00'}]}]}, 0x40}}, 0x0) 113.758129ms ago: executing program 1 (id=275): mmap$IORING_OFF_SQES(0x0, 0x1000, 0x2, 0x4199831, 0xffffffffffffffff, 0x10000000) r0 = add_key(&(0x7f0000000380)='keyring\x00', &(0x7f00000003c0)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffc) add_key$keyring(&(0x7f00000004c0), &(0x7f0000000440)={'syz', 0x0}, 0x0, 0x0, r0) keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f0000002bc0)={0x0, 0x79}, 0x0, &(0x7f0000002c00)="cb4403fa0c2c2a2b515694b3636cdb40a409af8de9000000c11a536275a1d846d65ea988ef1a4992f9a2675b3253d82c107d0fd00990b531004a27f0395fdb7d3b545b60ff7b4d10b0612763631dd3db62ddf7f7995b0500000000000000b9647102254e6e9e7a9c19da1095090000000000000039b2c121f1", 0x0) 113.364579ms ago: executing program 1 (id=276): socketpair$unix(0x1, 0x5, 0x0, 0x0) r0 = socket$pptp(0x18, 0x1, 0x2) bind$pptp(r0, 0x0, 0x0) connect$pptp(r0, &(0x7f00000019c0)={0x18, 0x2, {0x1234, @loopback}}, 0x1e) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000001a00), 0x2, 0x0) ioctl$PPPIOCATTCHAN(r1, 0x40047438, &(0x7f0000001a40)=0x1) ioctl$PPPIOCBRIDGECHAN(r1, 0x40047435, &(0x7f0000001b40)=0x2) 85.942961ms ago: executing program 4 (id=277): socket$inet_tcp(0x2, 0x1, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) prlimit64(0x0, 0x7, &(0x7f0000000380)={0x6, 0x7fff}, 0x0) r0 = fsopen(0x0, 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) fsmount(r0, 0x0, 0xa) 85.685572ms ago: executing program 1 (id=278): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newsa={0x138, 0x10, 0x1, 0x0, 0x0, {{@in6=@private1={0xfc, 0x1, '\x00', 0x1}, @in6=@private2={0xfc, 0x2, '\x00', 0x1}, 0x4e20, 0x0, 0x4e20, 0x0, 0xa, 0x80, 0x80}, {@in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x4d2, 0x6c}, @in6=@loopback, {}, {0x0, 0x0, 0xfffffffffffffffd}, {}, 0x0, 0x0, 0xa, 0x1, 0x0, 0x2}, [@algo_comp={0x48, 0x3, {{'lzs\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x20000080}, 0x0) 85.533692ms ago: executing program 4 (id=279): pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) io_setup(0x3ff, &(0x7f0000000500)=0x0) read$FUSE(r0, &(0x7f0000003780)={0x2020}, 0x2020) io_submit(r2, 0xf000, &(0x7f0000000300)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x5, 0x0, r1, 0x0}, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f00000001c0)='m', 0xffffff4c}]) 26.360058ms ago: executing program 0 (id=280): r0 = openat$binderfs_ctrl(0xffffff9c, 0x0, 0x0, 0x0) ioctl$FS_IOC_FSSETXATTR(r0, 0xc1086201, 0x0) 26.150658ms ago: executing program 1 (id=281): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0xa2f01, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000140)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) write$tun(r0, &(0x7f0000000040)={@val={0xa, 0x8035}, @void, @eth={@local, @broadcast, @val={@val={0x88a8, 0x0, 0x0, 0x1}, {0x8100, 0x5, 0x1, 0x3}}, {@can={0xc, {{0x3, 0x1, 0x1}, 0x4, 0x3, 0x0, 0x0, "57ce425dbe3511b3"}}}}}, 0x2a) 26.042268ms ago: executing program 0 (id=282): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000012c0)={&(0x7f0000001300)=@migrate={0xa0, 0x21, 0x1, 0x0, 0xfffffffe, {{@in6=@empty, @in6=@loopback, 0x4e21, 0x80, 0x1, 0x0, 0xa, 0xe0, 0x80, 0x67}, 0x2}, [@migrate={0x50, 0x11, [{@in=@broadcast, @in=@multicast2, @in=@empty, @in=@rand_addr=0x64010100, 0x3c, 0x0, 0x0, 0x50030000, 0x2, 0xa}]}]}, 0xa0}, 0x1, 0x0, 0x0, 0x800}, 0x0) 25.922028ms ago: executing program 0 (id=283): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/sys/net/ipv4/conf/default/rp_filter\x00', 0x1, 0x0) write$P9_RREADDIR(r0, &(0x7f0000000100)={0xb, 0x29, 0x2, {0x8}}, 0xb) 25.829998ms ago: executing program 0 (id=284): mkdirat(0xffffffffffffff9c, &(0x7f0000000f40)='./proc_mnt\x00', 0x1cc) mount(0x0, &(0x7f0000000f80)='./proc_mnt\x00', &(0x7f0000000fc0)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000001000)='./proc_mnt/irq/1/smp_affinity\x00', 0x1, 0x0) write$binfmt_script(r0, &(0x7f0000001040)={'#! ', './proc_mnt/irq/1/smp_affinity', [{0x20, '\x15@\x10\xe8P\x91@,000000\x00'}]}, 0x31) 14.919599ms ago: executing program 0 (id=285): mmap$IORING_OFF_SQES(0x0, 0x1000, 0x2, 0x4199831, 0xffffffffffffffff, 0x10000000) r0 = add_key(&(0x7f0000000380)='keyring\x00', &(0x7f00000003c0)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffc) add_key$keyring(&(0x7f00000004c0), &(0x7f0000000440)={'syz', 0x0}, 0x0, 0x0, r0) keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f0000002bc0)={0x0, 0x79}, 0x0, &(0x7f0000002c00)="cb4403fa0c2c2a2b515694b3636cdb40a409af8de9000000c11a536275a1d846d65ea988ef1a4992f9a2675b3253d82c107d0fd00990b531004a27f0395fdb7d3b545b60ff7b4d10b0612763631dd3db62ddf7f7995b0500000000000000b9647102254e6e9e7a9c19da1095090000000000000039b2c121f1", 0x0) 422.79µs ago: executing program 1 (id=286): r0 = openat$dm_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$DM_DEV_CREATE(r0, 0xc138fd03, &(0x7f0000000080)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x88001, 0x0, 0x0, {0x0, {'syz', 0x0, '0\x00'}}}) ioctl$DM_TABLE_LOAD(r0, 0xc138fd09, &(0x7f0000002d80)={0x4, 0x0, 0x0, 0x178, 0x138, 0x1, 0x0, 0x8400, 0x0, 0x0, @by_dev={r1}, [@snapshot={0x0, 0x1008, 0x0, 0x40, 'snapshot-merge\x00', {@ram={'/dev/ram', 0x1}, 0x20, @ram={'/dev/ram', 0x1}, 0x20, 'P', 0x20, '0'}}]}) 0s ago: executing program 0 (id=287): r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f00000002c0)={0x500, 0x0, &(0x7f0000000300)={&(0x7f0000000340)={0x2, 0x400000000000003, 0x0, 0x0, 0x2, 0x900}, 0x10}}, 0x0) kernel console output (not intermixed with test programs): syzkaller syzkaller login: [ 14.196060][ T36] kauditd_printk_skb: 31 callbacks suppressed [ 14.196079][ T36] audit: type=1400 audit(1793251927.330:59): avc: denied { transition } for pid=234 comm="sshd-session" path="/bin/sh" dev="sda1" ino=90 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 14.200722][ T36] audit: type=1400 audit(1793251927.330:60): avc: denied { noatsecure } for pid=234 comm="sshd-session" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 14.205550][ T36] audit: type=1400 audit(1793251927.340:61): avc: denied { write } for pid=234 comm="sh" path="pipe:[2923]" dev="pipefs" ino=2923 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 14.209339][ T36] audit: type=1400 audit(1793251927.340:62): avc: denied { rlimitinh } for pid=234 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 14.212497][ T36] audit: type=1400 audit(1793251927.340:63): avc: denied { siginh } for pid=234 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 Warning: Permanently added '10.128.1.8' (ED25519) to the list of known hosts. [ 21.928708][ T36] audit: type=1400 audit(1793251935.060:64): avc: denied { mounton } for pid=288 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 21.932152][ T288] cgroup: Unknown subsys name 'net' [ 21.951501][ T36] audit: type=1400 audit(1793251935.060:65): avc: denied { mount } for pid=288 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 21.978986][ T36] audit: type=1400 audit(1793251935.090:66): avc: denied { unmount } for pid=288 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 21.979320][ T288] cgroup: Unknown subsys name 'devices' [ 22.106470][ T288] cgroup: Unknown subsys name 'hugetlb' [ 22.112106][ T288] cgroup: Unknown subsys name 'rlimit' [ 22.247243][ T36] audit: type=1400 audit(1793251935.380:67): avc: denied { setattr } for pid=288 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 22.270465][ T36] audit: type=1400 audit(1793251935.380:68): avc: denied { mounton } for pid=288 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 22.295380][ T36] audit: type=1400 audit(1793251935.380:69): avc: denied { mount } for pid=288 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 22.299463][ T290] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 22.327347][ T36] audit: type=1400 audit(1793251935.460:70): avc: denied { relabelto } for pid=290 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.344658][ T288] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 22.352877][ T36] audit: type=1400 audit(1793251935.460:71): avc: denied { write } for pid=290 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.387226][ T36] audit: type=1400 audit(1793251935.470:72): avc: denied { read } for pid=288 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.412795][ T36] audit: type=1400 audit(1793251935.470:73): avc: denied { open } for pid=288 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.693071][ T297] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.700286][ T297] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.707478][ T297] bridge_slave_0: entered allmulticast mode [ 23.713927][ T297] bridge_slave_0: entered promiscuous mode [ 23.720499][ T297] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.727636][ T297] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.734850][ T297] bridge_slave_1: entered allmulticast mode [ 23.741214][ T297] bridge_slave_1: entered promiscuous mode [ 23.804390][ T298] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.811565][ T298] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.818742][ T298] bridge_slave_0: entered allmulticast mode [ 23.825169][ T298] bridge_slave_0: entered promiscuous mode [ 23.831766][ T298] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.839027][ T298] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.846189][ T298] bridge_slave_1: entered allmulticast mode [ 23.852422][ T298] bridge_slave_1: entered promiscuous mode [ 23.879936][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.887082][ T295] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.894251][ T295] bridge_slave_0: entered allmulticast mode [ 23.900526][ T295] bridge_slave_0: entered promiscuous mode [ 23.909882][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.916973][ T295] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.924109][ T295] bridge_slave_1: entered allmulticast mode [ 23.930452][ T295] bridge_slave_1: entered promiscuous mode [ 24.000799][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.007965][ T296] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.015163][ T296] bridge_slave_0: entered allmulticast mode [ 24.021453][ T296] bridge_slave_0: entered promiscuous mode [ 24.028303][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.035401][ T296] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.042528][ T296] bridge_slave_1: entered allmulticast mode [ 24.048891][ T296] bridge_slave_1: entered promiscuous mode [ 24.109010][ T297] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.116154][ T297] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.175521][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.182693][ T295] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.190027][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.197100][ T295] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.206280][ T298] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.213443][ T298] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.220946][ T298] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.228004][ T298] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.256918][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.264929][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.272128][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.279973][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.287748][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.302017][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.309106][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.326485][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.333590][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.341452][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.348522][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.363470][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.370571][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.404002][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.411070][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.419118][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.426185][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.460410][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.467527][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.487939][ T298] veth0_vlan: entered promiscuous mode [ 24.498968][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.506045][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.517278][ T297] veth0_vlan: entered promiscuous mode [ 24.531512][ T298] veth1_macvtap: entered promiscuous mode [ 24.559053][ T295] veth0_vlan: entered promiscuous mode [ 24.579530][ T297] veth1_macvtap: entered promiscuous mode [ 24.590311][ T296] veth0_vlan: entered promiscuous mode [ 24.599890][ T298] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 24.627872][ T295] veth1_macvtap: entered promiscuous mode [ 24.640641][ T296] veth1_macvtap: entered promiscuous mode [ 24.702957][ T317] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 25.008048][ T336] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6'. [ 25.030087][ T336] pci 0000:00:00.0: [8086:1237] type 00 class 0x060000 conventional PCI endpoint [ 25.223587][ T340] rust_binder: 339:340 got reply transaction with no transaction stack [ 25.233089][ T340] rust_binder: 339:340 transaction reply to 0:0 failed EINVAL, code 0 size 0-0 line thread.rs:1560 [ 25.251817][ T318] rust_binder: 339: undelivered TRANSACTION_ERROR: 29201 [ 25.313798][ T92] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 25.407086][ T348] kvm_intel: kvm [347]: vcpu1, guest rIP: 0x9114 Unhandled WRMSR(0x1d9) = 0x1a13 [ 25.418077][ T348] kvm: kvm [347]: vcpu1, guest rIP: 0x9114 Unhandled WRMSR(0x186) = 0x760e [ 25.464993][ T92] usb 1-1: config 0 interface 0 altsetting 8 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 25.476047][ T92] usb 1-1: config 0 interface 0 altsetting 8 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 25.497281][ T92] usb 1-1: config 0 interface 0 has no altsetting 0 [ 25.504712][ T92] usb 1-1: New USB device found, idVendor=054c, idProduct=0268, bcdDevice= 0.00 [ 25.515003][ T92] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 25.527935][ T92] usb 1-1: config 0 descriptor?? [ 25.766728][ T366] FAULT_INJECTION: forcing a failure. [ 25.766728][ T366] name failslab, interval 1, probability 0, space 0, times 1 [ 25.779495][ T366] CPU: 0 UID: 0 PID: 366 Comm: syz.3.21 Not tainted syzkaller #0 5cdf496c3980d18a0efbb3b3e73d13bf69df874e [ 25.779521][ T366] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 25.779559][ T366] Call Trace: [ 25.779565][ T366] [ 25.779571][ T366] __dump_stack+0x21/0x30 [ 25.779601][ T366] dump_stack_lvl+0x140/0x1c0 [ 25.779625][ T366] ? __cfi_dump_stack_lvl+0x10/0x10 [ 25.779651][ T366] dump_stack+0x19/0x20 [ 25.779674][ T366] should_fail_ex+0x3c2/0x510 [ 25.779690][ T366] should_failslab+0xac/0x100 [ 25.779705][ T366] kmem_cache_alloc_noprof+0x42/0x410 [ 25.779727][ T366] ? security_inode_alloc+0x51/0x230 [ 25.779744][ T366] ? __cfi_make_kgid+0x10/0x10 [ 25.779780][ T366] security_inode_alloc+0x51/0x230 [ 25.779796][ T366] inode_init_always_gfp+0x756/0x9e0 [ 25.779810][ T366] ? __cfi_ovl_alloc_inode+0x10/0x10 [ 25.779825][ T366] alloc_inode+0xc5/0x270 [ 25.779840][ T366] new_inode+0x25/0x1e0 [ 25.779854][ T366] ? mnt_want_write+0x321/0x510 [ 25.779871][ T366] ovl_new_inode+0x28/0x2b0 [ 25.779886][ T366] ovl_create_object+0x163/0x330 [ 25.779905][ T366] ? ovl_get_acl+0x70/0x70 [ 25.779940][ T366] ? make_vfsgid+0x4d/0xa0 [ 25.779960][ T366] ? __cfi_ovl_permission+0x10/0x10 [ 25.779974][ T366] ? selinux_inode_mkdir+0x26/0x30 [ 25.780000][ T366] ovl_mkdir+0x2f/0x40 [ 25.780019][ T366] vfs_mkdir+0x58e/0x810 [ 25.780038][ T366] do_mkdirat+0x240/0x530 [ 25.780055][ T366] ? __cfi_do_mkdirat+0x10/0x10 [ 25.780073][ T366] ? __kasan_check_write+0x18/0x20 [ 25.780094][ T366] ? getname_flags+0x203/0x6b0 [ 25.780117][ T366] ? __kasan_check_write+0x18/0x20 [ 25.780139][ T366] __x64_sys_mkdirat+0x8b/0xa0 [ 25.780157][ T366] x64_sys_call+0x2ba8/0x2ee0 [ 25.780173][ T366] do_syscall_64+0x57/0xf0 [ 25.780189][ T366] ? clear_bhb_loop+0x50/0xa0 [ 25.780211][ T366] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 25.780232][ T366] RIP: 0033:0x7f9cd819f559 [ 25.780249][ T366] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 25.780262][ T366] RSP: 002b:00007f9cd6be3028 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 [ 25.780281][ T366] RAX: ffffffffffffffda RBX: 00007f9cd8425fa0 RCX: 00007f9cd819f559 [ 25.780294][ T366] RDX: 00000000000001ff RSI: 0000200000000400 RDI: ffffffffffffff9c [ 25.780306][ T366] RBP: 00007f9cd8236b20 R08: 0000000000000000 R09: 0000000000000000 [ 25.780316][ T366] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 25.780326][ T366] R13: 00007f9cd8426038 R14: 00007f9cd8425fa0 R15: 00007ffd36401df8 [ 25.780340][ T366] [ 26.052782][ T92] sony 0003:054C:0268.0001: unbalanced delimiter at end of report description [ 26.062042][ T92] sony 0003:054C:0268.0001: parse failed [ 26.067911][ T92] sony 0003:054C:0268.0001: probe with driver sony failed with error -22 [ 26.133853][ T354] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 26.143317][ T51] bridge_slave_1: left allmulticast mode [ 26.149084][ T51] bridge_slave_1: left promiscuous mode [ 26.155335][ T51] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.163096][ T51] bridge_slave_0: left allmulticast mode [ 26.169010][ T51] bridge_slave_0: left promiscuous mode [ 26.175039][ T51] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.287637][ T92] usb 1-1: USB disconnect, device number 2 [ 26.302130][ T354] usb 3-1: config 0 has too many interfaces: 223, using maximum allowed: 32 [ 26.310966][ T354] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 26.321317][ T354] usb 3-1: config 0 has 2 interfaces, different from the descriptor's value: 223 [ 26.321443][ T51] veth1_macvtap: left promiscuous mode [ 26.330514][ T354] usb 3-1: New USB device found, idVendor=046d, idProduct=0825, bcdDevice= 1.00 [ 26.336851][ T51] veth0_vlan: left promiscuous mode [ 26.345872][ T354] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 26.359655][ T354] usb 3-1: config 0 descriptor?? [ 26.367648][ T354] usb 3-1: Found UVC 9.00 device (046d:0825) [ 26.497761][ T368] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.513847][ T368] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.520977][ T368] bridge_slave_0: entered allmulticast mode [ 26.527654][ T368] bridge_slave_0: entered promiscuous mode [ 26.534907][ T368] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.541974][ T368] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.553904][ T368] bridge_slave_1: entered allmulticast mode [ 26.560528][ T368] bridge_slave_1: entered promiscuous mode [ 26.641420][ T368] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.648576][ T368] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.655921][ T368] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.662976][ T368] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.961890][ T354] usb 3-1: UVC non compliance - GET_DEF(PROBE) not supported. Enabling workaround. [ 27.013652][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.021057][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.030949][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.038034][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.058914][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.066033][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.099595][ T368] veth0_vlan: entered promiscuous mode [ 27.113187][ T368] veth1_macvtap: entered promiscuous mode [ 27.130386][ T36] kauditd_printk_skb: 71 callbacks suppressed [ 27.130403][ T36] audit: type=1400 audit(1793251940.260:145): avc: denied { create } for pid=384 comm="syz.0.28" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 27.158892][ T36] audit: type=1400 audit(1793251940.280:146): avc: denied { setopt } for pid=384 comm="syz.0.28" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 27.180551][ T36] audit: type=1400 audit(1793251940.290:147): avc: denied { mmap_zero } for pid=384 comm="syz.0.28" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=memprotect permissive=1 [ 27.200622][ T36] audit: type=1400 audit(1793251940.290:148): avc: denied { create } for pid=384 comm="syz.0.28" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 27.219902][ T36] audit: type=1400 audit(1793251940.290:149): avc: denied { getopt } for pid=384 comm="syz.0.28" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 27.225009][ T354] usb 3-1: USB disconnect, device number 2 [ 27.262953][ T36] audit: type=1400 audit(1793251940.390:150): avc: denied { create } for pid=386 comm="syz.4.24" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 27.284108][ T36] audit: type=1400 audit(1793251940.390:151): avc: denied { write } for pid=386 comm="syz.4.24" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 27.304519][ T36] audit: type=1400 audit(1793251940.390:152): avc: denied { nlmsg_write } for pid=386 comm="syz.4.24" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 27.374349][ T36] audit: type=1400 audit(1793251940.500:153): avc: denied { write } for pid=389 comm="syz.4.30" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=key permissive=1 [ 27.430271][ T36] audit: type=1400 audit(1793251940.560:154): avc: denied { read write } for pid=396 comm="syz.4.33" name="control" dev="devtmpfs" ino=198 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 27.743786][ T354] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 27.743786][ T67] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 27.893827][ T354] usb 5-1: Using ep0 maxpacket: 32 [ 27.900229][ T354] usb 5-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 27.911186][ T354] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 27.915550][ T67] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 27.922565][ T354] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 27.933753][ T67] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 27.946493][ T354] usb 5-1: New USB device found, idVendor=0fc5, idProduct=b080, bcdDevice= 0.00 [ 27.957927][ T67] usb 2-1: New USB device found, idVendor=054c, idProduct=0df2, bcdDevice=d6.af [ 27.965712][ T354] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 27.975257][ T67] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 27.989677][ T354] usb 5-1: config 0 descriptor?? [ 28.000379][ T67] usb 2-1: config 0 descriptor?? [ 28.023790][ T92] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 28.193745][ T92] usb 3-1: Using ep0 maxpacket: 32 [ 28.200039][ T92] usb 3-1: config 0 has an invalid interface number: 188 but max is 0 [ 28.208385][ T92] usb 3-1: config 0 has no interface number 0 [ 28.214828][ T92] usb 3-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 28.226515][ T92] usb 3-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 28.235931][ T92] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 28.244215][ T92] usb 3-1: Product: syz [ 28.248452][ T92] usb 3-1: Manufacturer: syz [ 28.253089][ T92] usb 3-1: SerialNumber: syz [ 28.264027][ T92] usb 3-1: config 0 descriptor?? [ 28.269348][ T413] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 28.413433][ T67] playstation 0003:054C:0DF2.0003: unknown main item tag 0x0 [ 28.421023][ T67] playstation 0003:054C:0DF2.0003: unknown main item tag 0x0 [ 28.428627][ T67] playstation 0003:054C:0DF2.0003: unknown main item tag 0x0 [ 28.435721][ T354] hid-led 0003:0FC5:B080.0002: unknown main item tag 0x0 [ 28.437399][ T67] playstation 0003:054C:0DF2.0003: unknown main item tag 0x0 [ 28.451064][ T354] hid-led 0003:0FC5:B080.0002: unknown main item tag 0x4 [ 28.454524][ T67] playstation 0003:054C:0DF2.0003: unknown main item tag 0x0 [ 28.470739][ T67] playstation 0003:054C:0DF2.0003: hidraw0: USB HID v1.01 Device [HID 054c:0df2] on usb-dummy_hcd.1-1/input0 [ 28.483666][ T413] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 28.895359][ T92] asix 3-1:0.188 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 28.907079][ T92] asix 3-1:0.188: probe with driver asix failed with error -71 [ 28.916010][ T92] usb 3-1: USB disconnect, device number 3 [ 29.022449][ T67] playstation 0003:054C:0DF2.0003: Invalid gyro calibration data for axis (3), disabling calibration. [ 29.033557][ T67] playstation 0003:054C:0DF2.0003: Invalid gyro calibration data for axis (4), disabling calibration. [ 29.044844][ T67] playstation 0003:054C:0DF2.0003: Invalid gyro calibration data for axis (5), disabling calibration. [ 29.055866][ T67] playstation 0003:054C:0DF2.0003: Invalid accelerometer calibration data for axis (0), disabling calibration. [ 29.067676][ T67] playstation 0003:054C:0DF2.0003: Invalid accelerometer calibration data for axis (1), disabling calibration. [ 29.077446][ T422] usb 5-1: USB disconnect, device number 2 [ 29.079663][ T67] playstation 0003:054C:0DF2.0003: Invalid accelerometer calibration data for axis (2), disabling calibration. [ 29.100163][ T67] input: HID 054c:0df2 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/0003:054C:0DF2.0003/input/input5 [ 29.114411][ T67] input: HID 054c:0df2 Motion Sensors as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/0003:054C:0DF2.0003/input/input6 [ 29.131319][ T67] input: HID 054c:0df2 Touchpad as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/0003:054C:0DF2.0003/input/input7 [ 29.166988][ T67] playstation 0003:054C:0DF2.0003: Registered DualSense controller hw_version=0x00000000 fw_version=0x00000000 [ 29.230318][ T407] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 29.238997][ T407] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 29.248176][ T407] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 29.256898][ T407] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 29.266055][ T422] usb 2-1: USB disconnect, device number 2 [ 29.432007][ T427] pci 0000:00:00.0: [8086:1237] type 00 class 0x060000 conventional PCI endpoint [ 29.963763][ T92] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 29.987529][ T452] usb usb1: usbfs: process 452 (syz.1.54) did not claim interface 0 before use [ 30.123736][ T92] usb 5-1: Using ep0 maxpacket: 32 [ 30.134417][ T92] usb 5-1: config 0 has an invalid interface number: 184 but max is 0 [ 30.151036][ T92] usb 5-1: config 0 has no interface number 0 [ 30.160366][ T92] usb 5-1: config 0 interface 184 has no altsetting 0 [ 30.168916][ T92] usb 5-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 30.178311][ T92] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 30.188367][ T92] usb 5-1: Product: syz [ 30.192568][ T92] usb 5-1: Manufacturer: syz [ 30.203929][ T92] usb 5-1: SerialNumber: syz [ 30.218497][ T92] usb 5-1: config 0 descriptor?? [ 30.228754][ T92] smsc75xx v1.0.0 [ 30.273488][ T485] netlink: 32 bytes leftover after parsing attributes in process `syz.2.71'. [ 30.598045][ T519] futex_wake_op: syz.0.85 tries to shift op by -1; fix this program [ 30.705776][ T538] SELinux: policydb table sizes (0,0) do not match mine (6,7) [ 30.713590][ T538] SELinux: failed to load policy [ 30.780109][ T545] device-mapper: ioctl: Invalid ioctl structure: uuid LVM-syzc2, name , dev 6161616161616161 [ 30.914745][ T67] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 31.115918][ T67] usb 1-1: New USB device found, idVendor=9710, idProduct=7730, bcdDevice=96.33 [ 31.151602][ T67] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 31.784571][ T92] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000040: -32 [ 31.803726][ T92] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 31.922819][ T92] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -32 [ 31.933736][ T92] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -32 [ 31.943412][ T92] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_reset [ 31.953765][ T92] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -32 [ 31.963283][ T92] smsc75xx 5-1:0.184: probe with driver smsc75xx failed with error -32 [ 31.963868][ T45] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 31.987146][ T92] usb 5-1: USB disconnect, device number 3 [ 32.033975][ T574] event trace: Could not enable event p1 [ 32.144992][ T45] usb 3-1: unable to get BOS descriptor or descriptor too short [ 32.153538][ T45] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 32.163784][ T45] usb 3-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 32.172812][ T45] usb 3-1: too many endpoints for config 1 interface 1 altsetting 76: 188, using maximum allowed: 30 [ 32.183915][ T45] usb 3-1: config 1 interface 1 altsetting 76 has 0 endpoint descriptors, different from the interface descriptor's value: 188 [ 32.197332][ T45] usb 3-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 32.208278][ T45] usb 3-1: config 1 interface 1 has no altsetting 0 [ 32.434928][ T67] usb 1-1: Cannot set autoneg [ 32.446854][ T67] MOSCHIP usb-ethernet driver 1-1:7.0: probe with driver MOSCHIP usb-ethernet driver failed with error -71 [ 32.498289][ T67] usb 1-1: USB disconnect, device number 3 [ 32.507339][ T45] usb 3-1: string descriptor 0 read error: -22 [ 32.550538][ T45] usb 3-1: New USB device found, idVendor=21b4, idProduct=0081, bcdDevice= 0.40 [ 32.566117][ T45] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 33.016656][ T45] usb 3-1: 2:0: cannot get min/max values for control 2 (id 2) [ 33.053830][ T45] usb 3-1: USB disconnect, device number 4 [ 33.162920][ T36] kauditd_printk_skb: 32 callbacks suppressed [ 33.162939][ T36] audit: type=1400 audit(1793251946.290:187): avc: denied { write } for pid=596 comm="syz.0.120" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 33.240316][ T36] audit: type=1400 audit(1793251946.370:188): avc: denied { read write } for pid=600 comm="syz.0.122" name="vhost-vsock" dev="devtmpfs" ino=200 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 33.264977][ T36] audit: type=1400 audit(1793251946.370:189): avc: denied { open } for pid=600 comm="syz.0.122" path="/dev/vhost-vsock" dev="devtmpfs" ino=200 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 33.301255][ T36] audit: type=1400 audit(1793251946.370:190): avc: denied { ioctl } for pid=600 comm="syz.0.122" path="/dev/vhost-vsock" dev="devtmpfs" ino=200 ioctlcmd=0xaf60 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 33.382026][ T36] audit: type=1400 audit(1793251946.510:191): avc: denied { mount } for pid=616 comm="syz.1.128" name="/" dev="devtmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 33.406236][ T36] audit: type=1400 audit(1793251946.540:192): avc: denied { mount } for pid=616 comm="syz.1.128" name="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 33.517174][ T36] audit: type=1400 audit(1793251946.650:193): avc: denied { setopt } for pid=618 comm="syz.4.129" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 33.590903][ T36] audit: type=1400 audit(1793251946.720:194): avc: denied { unmount } for pid=297 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 33.653738][ T36] audit: type=1400 audit(1793251946.720:195): avc: denied { unmount } for pid=297 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 34.803743][ T422] usb 5-1: new low-speed USB device number 4 using dummy_hcd [ 34.862664][ T36] audit: type=1400 audit(1793251947.990:196): avc: denied { create } for pid=654 comm="syz.1.145" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 34.892335][ T657] netlink: 20 bytes leftover after parsing attributes in process `syz.0.146'. [ 34.921678][ T661] netlink: 80 bytes leftover after parsing attributes in process `syz.0.148'. [ 34.964874][ T422] usb 5-1: config 0 interface 0 altsetting 8 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 34.975954][ T422] usb 5-1: config 0 interface 0 altsetting 8 endpoint 0x81 has invalid wMaxPacketSize 0 [ 34.985973][ T422] usb 5-1: config 0 interface 0 altsetting 8 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 34.998985][ T422] usb 5-1: config 0 interface 0 has no altsetting 0 [ 35.006191][ T422] usb 5-1: New USB device found, idVendor=0810, idProduct=0201, bcdDevice= 0.00 [ 35.015529][ T422] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 35.033852][ T422] usb 5-1: config 0 descriptor?? [ 35.050102][ T676] netlink: 32 bytes leftover after parsing attributes in process `syz.0.155'. [ 35.059159][ T676] netlink: 20 bytes leftover after parsing attributes in process `syz.0.155'. [ 35.426505][ T703] netlink: 12 bytes leftover after parsing attributes in process `syz.0.167'. [ 35.445263][ T422] hid-generic 0003:0810:0201.0004: unknown main item tag 0x5 [ 35.452749][ T422] hid-generic 0003:0810:0201.0004: unknown main item tag 0x0 [ 35.460861][ T422] hid-generic 0003:0810:0201.0004: No inputs registered, leaving [ 35.469311][ T422] hid-generic 0003:0810:0201.0004: hidraw0: USB HID vff.ff Keyboard [HID 0810:0201] on usb-dummy_hcd.4-1/input0 [ 35.660257][ T422] usb 5-1: USB disconnect, device number 4 [ 35.684480][ T738] syz.1.182 uses obsolete (PF_INET,SOCK_PACKET) [ 35.774559][ T741] netlink: 8 bytes leftover after parsing attributes in process `syz.0.178'. [ 35.787825][ T741] pci 0000:00:00.0: [8086:1237] type 00 class 0x060000 conventional PCI endpoint [ 37.308290][ T761] netlink: 104 bytes leftover after parsing attributes in process `syz.0.190'. [ 37.361548][ T758] netlink: 104 bytes leftover after parsing attributes in process `syz.0.190'. [ 37.538644][ T785] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 37.912569][ T800] Source file dentry negative [ 37.994529][ T809] device-mapper: table: 252:0: crypt: Error allocating crypto tfm (-EINVAL) [ 38.003382][ T809] device-mapper: ioctl: error adding target to table [ 38.033753][ T92] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 38.184548][ T36] kauditd_printk_skb: 36 callbacks suppressed [ 38.184566][ T36] audit: type=1400 audit(1793251951.320:233): avc: denied { ioctl } for pid=832 comm="syz.4.222" path="socket:[6029]" dev="sockfs" ino=6029 ioctlcmd=0x48de scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 38.193827][ T92] usb 3-1: Using ep0 maxpacket: 16 [ 38.226020][ T92] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 38.236485][ T92] usb 3-1: config 0 interface 0 altsetting 5 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 38.247487][ T92] usb 3-1: config 0 interface 0 altsetting 5 endpoint 0x81 has invalid wMaxPacketSize 0 [ 38.257386][ T92] usb 3-1: config 0 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 4 [ 38.270283][ T92] usb 3-1: config 0 interface 0 has no altsetting 0 [ 38.277064][ T92] usb 3-1: New USB device found, idVendor=046d, idProduct=c53a, bcdDevice= 0.00 [ 38.286299][ T92] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 38.304740][ T92] usb 3-1: config 0 descriptor?? [ 38.403537][ T854] ======================================================= [ 38.403537][ T854] WARNING: The mand mount option has been deprecated and [ 38.403537][ T854] and is ignored by this kernel. Remove the mand [ 38.403537][ T854] option from the mount to silence this warning. [ 38.403537][ T854] ======================================================= [ 38.458294][ T858] netlink: 104 bytes leftover after parsing attributes in process `syz.0.234'. [ 38.513658][ T36] audit: type=1400 audit(1793251951.620:234): avc: denied { setopt } for pid=859 comm="syz.0.235" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 38.554480][ T36] audit: type=1400 audit(1793251951.690:235): avc: denied { connect } for pid=866 comm="syz.0.238" lport=58 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 38.649546][ T870] netlink: 8 bytes leftover after parsing attributes in process `syz.4.233'. [ 38.662100][ T870] pci 0000:00:00.0: [8086:1237] type 00 class 0x060000 conventional PCI endpoint [ 38.698066][ T45] usb 2-1: new full-speed USB device number 3 using dummy_hcd [ 38.913511][ T92] logitech-djreceiver 0003:046D:C53A.0005: hiddev96,hidraw0: USB HID vff.fc Device [HID 046d:c53a] on usb-dummy_hcd.2-1/input0 [ 38.954806][ T45] usb 2-1: config 1 has too many interfaces: 241, using maximum allowed: 32 [ 38.969213][ T45] usb 2-1: config 1 has 2 interfaces, different from the descriptor's value: 241 [ 38.979189][ T45] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid maxpacket 512, setting to 64 [ 38.993777][ T45] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 39.003084][ T45] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 39.011271][ T45] usb 2-1: Product: syz [ 39.015573][ T45] usb 2-1: Manufacturer: syz [ 39.034410][ T45] usb 2-1: SerialNumber: syz [ 39.046592][ T92] usb 3-1: USB disconnect, device number 5 [ 39.316141][ T852] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 39.340746][ T875] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 39.655268][ T36] audit: type=1400 audit(1793251952.790:236): avc: denied { listen } for pid=899 comm="syz.4.251" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 39.805224][ T907] FAULT_INJECTION: forcing a failure. [ 39.805224][ T907] name failslab, interval 1, probability 0, space 0, times 0 [ 39.818059][ T907] CPU: 1 UID: 0 PID: 907 Comm: syz.0.254 Not tainted syzkaller #0 5cdf496c3980d18a0efbb3b3e73d13bf69df874e [ 39.818101][ T907] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 39.818117][ T907] Call Trace: [ 39.818125][ T907] [ 39.818133][ T907] __dump_stack+0x21/0x30 [ 39.818174][ T907] dump_stack_lvl+0x140/0x1c0 [ 39.818208][ T907] ? __cfi_dump_stack_lvl+0x10/0x10 [ 39.818245][ T907] dump_stack+0x19/0x20 [ 39.818278][ T907] should_fail_ex+0x3c2/0x510 [ 39.818301][ T907] ? sk_prot_alloc+0x104/0x3a0 [ 39.818344][ T907] should_failslab+0xac/0x100 [ 39.818373][ T907] __kmalloc_noprof+0x69/0x510 [ 39.818406][ T907] ? __cfi__raw_spin_lock_irqsave+0x10/0x10 [ 39.818431][ T907] ? sk_prot_alloc+0x104/0x3a0 [ 39.818478][ T907] ? irqentry_exit+0x4a/0x60 [ 39.818513][ T907] sk_prot_alloc+0x104/0x3a0 [ 39.818541][ T907] sk_alloc+0x40/0x590 [ 39.818569][ T907] netlink_create+0x3d0/0x630 [ 39.818604][ T907] ? __cfi_audit_multicast_bind+0x10/0x10 [ 39.818634][ T907] ? __cfi_audit_multicast_unbind+0x10/0x10 [ 39.818667][ T907] __sock_create+0x3a5/0x810 [ 39.818693][ T907] __sys_socket+0xe1/0x1c0 [ 39.818719][ T907] __x64_sys_socket+0x7e/0x90 [ 39.818753][ T907] x64_sys_call+0x2608/0x2ee0 [ 39.818778][ T907] do_syscall_64+0x57/0xf0 [ 39.818802][ T907] ? clear_bhb_loop+0x50/0xa0 [ 39.818833][ T907] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 39.818865][ T907] RIP: 0033:0x7fd27b39f559 [ 39.818885][ T907] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 39.818904][ T907] RSP: 002b:00007fd27c315028 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 39.818929][ T907] RAX: ffffffffffffffda RBX: 00007fd27b625fa0 RCX: 00007fd27b39f559 [ 39.818947][ T907] RDX: 0000000000000009 RSI: 0000000000000003 RDI: 0000000000000010 [ 39.818961][ T907] RBP: 00007fd27b436b20 R08: 0000000000000000 R09: 0000000000000000 [ 39.818976][ T907] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 39.818989][ T907] R13: 00007fd27b626038 R14: 00007fd27b625fa0 R15: 00007ffde1ea0f68 [ 39.819009][ T907] [ 40.040134][ T852] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 40.248028][ T45] cdc_ncm 2-1:1.0: MAC-Address: 42:42:42:42:42:42 [ 40.254627][ T45] cdc_ncm 2-1:1.0: dwNtbInMaxSize=0 is too small. Using 2048 [ 40.262067][ T45] cdc_ncm 2-1:1.0: setting rx_max = 2048 [ 40.333745][ T92] usb 3-1: new full-speed USB device number 6 using dummy_hcd [ 40.468673][ T45] cdc_ncm 2-1:1.0: setting tx_max = 184 [ 40.476756][ T45] cdc_ncm 2-1:1.0 usb0: register 'cdc_ncm' at usb-dummy_hcd.1-1, CDC NCM (NO ZLP), 42:42:42:42:42:42 [ 40.495010][ T92] usb 3-1: config 1 has too many interfaces: 241, using maximum allowed: 32 [ 40.514860][ T45] usb 2-1: USB disconnect, device number 3 [ 40.521057][ T92] usb 3-1: config 1 has 2 interfaces, different from the descriptor's value: 241 [ 40.534479][ T45] cdc_ncm 2-1:1.0 usb0: unregister 'cdc_ncm' usb-dummy_hcd.1-1, CDC NCM (NO ZLP) [ 40.545981][ T92] usb 3-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid maxpacket 512, setting to 64 [ 40.560845][ T36] audit: type=1400 audit(1793251953.690:237): avc: denied { read } for pid=151 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=1 [ 40.584541][ T92] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 40.597021][ T92] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 40.614299][ T92] usb 3-1: Product: syz [ 40.619719][ T92] usb 3-1: Manufacturer: syz [ 40.633706][ T92] usb 3-1: SerialNumber: syz [ 40.664314][ T36] audit: type=1400 audit(1793251953.800:238): avc: denied { map } for pid=931 comm="syz.4.266" path="/dev/bus/usb/006/001" dev="devtmpfs" ino=111 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 40.780122][ T943] usb usb7: usbfs: process 943 (syz.4.271) did not claim interface 0 before use [ 40.851774][ T917] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 41.153886][ T975] ================================================================== [ 41.155885][ T36] audit: type=1400 audit(1793251954.290:239): avc: denied { create } for pid=976 comm="syz.0.287" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 41.162117][ T975] BUG: KASAN: slab-use-after-free in snapshot_ctr+0x586/0x1350 [ 41.186557][ T36] audit: type=1400 audit(1793251954.290:240): avc: denied { write } for pid=976 comm="syz.0.287" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 41.188785][ T975] Read of size 8 at addr ffff88811c327a18 by task syz.1.286/975 [ 41.188810][ T975] [ 41.188820][ T975] CPU: 1 UID: 0 PID: 975 Comm: syz.1.286 Not tainted syzkaller #0 5cdf496c3980d18a0efbb3b3e73d13bf69df874e [ 41.188921][ T975] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 41.188976][ T975] Call Trace: [ 41.188997][ T975] [ 41.189032][ T975] __dump_stack+0x21/0x30 [ 41.189136][ T975] dump_stack_lvl+0x140/0x1c0 [ 41.189230][ T975] ? __cfi_dump_stack_lvl+0x10/0x10 [ 41.189331][ T975] ? __cfi__printk+0x10/0x10 [ 41.189452][ T975] print_address_description+0x71/0x210 [ 41.189539][ T975] print_report+0x4a/0x70 [ 41.189622][ T975] kasan_report+0x162/0x1a0 [ 41.189683][ T975] ? snapshot_ctr+0x586/0x1350 [ 41.189773][ T975] ? snapshot_ctr+0x586/0x1350 [ 41.189838][ T975] __asan_report_load8_noabort+0x18/0x20 [ 41.189919][ T975] snapshot_ctr+0x586/0x1350 [ 41.189991][ T975] ? dm_split_args+0xa1/0x740 [ 41.190051][ T975] ? irqentry_exit+0x4a/0x60 [ 41.190126][ T975] ? __cfi_snapshot_ctr+0x10/0x10 [ 41.190199][ T975] ? asm_sysvec_apic_timer_interrupt+0x1f/0x30 [ 41.190293][ T975] ? __cfi_snapshot_ctr+0x10/0x10 [ 41.190400][ T975] dm_table_add_target+0x59f/0xcb0 [ 41.190471][ T975] table_load+0x2eb/0x7d0 [ 41.190555][ T975] ? __check_object_size+0x99/0x870 [ 41.190646][ T975] ? __cfi_table_load+0x10/0x10 [ 41.190732][ T975] ? __kasan_check_write+0x18/0x20 [ 41.190814][ T975] ? __cfi_table_load+0x10/0x10 [ 41.190896][ T975] dm_ctl_ioctl+0x8f0/0xde0 [ 41.190987][ T975] ? __cfi_dm_ctl_ioctl+0x10/0x10 [ 41.191080][ T975] ? __fget_files+0x2bc/0x330 [ 41.191135][ T975] ? bpf_lsm_file_ioctl+0xd/0x20 [ 41.191195][ T975] ? security_file_ioctl+0x3e/0x110 [ 41.191264][ T975] ? __cfi_dm_ctl_ioctl+0x10/0x10 [ 41.191340][ T975] __se_sys_ioctl+0x123/0x1b0 [ 41.191393][ T975] __x64_sys_ioctl+0x7f/0xa0 [ 41.191446][ T975] x64_sys_call+0x1878/0x2ee0 [ 41.191508][ T975] do_syscall_64+0x57/0xf0 [ 41.191561][ T975] ? clear_bhb_loop+0x50/0xa0 [ 41.191668][ T975] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 41.191773][ T975] RIP: 0033:0x7fe7b599f559 [ 41.191847][ T975] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 41.191899][ T975] RSP: 002b:00007fe7b67e5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 41.191983][ T975] RAX: ffffffffffffffda RBX: 00007fe7b5c25fa0 RCX: 00007fe7b599f559 [ 41.192027][ T975] RDX: 0000200000002d80 RSI: 00000000c138fd09 RDI: 0000000000000003 [ 41.192068][ T975] RBP: 00007fe7b5a36b20 R08: 0000000000000000 R09: 0000000000000000 [ 41.192108][ T975] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 41.192143][ T975] R13: 00007fe7b5c26038 R14: 00007fe7b5c25fa0 R15: 00007ffe7673ef78 [ 41.192195][ T975] [ 41.192216][ T975] [ 41.489921][ T975] Allocated by task 975: [ 41.494168][ T975] kasan_save_track+0x3e/0x80 [ 41.498908][ T975] kasan_save_alloc_info+0x3a/0x50 [ 41.504055][ T975] __kasan_kmalloc+0x96/0xb0 [ 41.508667][ T975] __kmalloc_cache_node_noprof+0x225/0x430 [ 41.514536][ T975] dm_get_table_device+0x1e3/0x6c0 [ 41.519702][ T975] dm_get_device+0x32b/0x7f0 [ 41.524339][ T975] snapshot_ctr+0x292/0x1350 [ 41.528966][ T975] dm_table_add_target+0x59f/0xcb0 [ 41.534100][ T975] table_load+0x2eb/0x7d0 [ 41.538474][ T975] dm_ctl_ioctl+0x8f0/0xde0 [ 41.543025][ T975] __se_sys_ioctl+0x123/0x1b0 [ 41.547733][ T975] __x64_sys_ioctl+0x7f/0xa0 [ 41.552370][ T975] x64_sys_call+0x1878/0x2ee0 [ 41.557093][ T975] do_syscall_64+0x57/0xf0 [ 41.561549][ T975] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 41.567482][ T975] [ 41.569832][ T975] Freed by task 975: [ 41.573750][ T975] kasan_save_track+0x3e/0x80 [ 41.578468][ T975] kasan_save_free_info+0x44/0x50 [ 41.583531][ T975] __kasan_slab_free+0x5f/0x80 [ 41.588328][ T975] kfree+0x158/0x440 [ 41.592253][ T975] dm_put_table_device+0x298/0x2e0 [ 41.597419][ T975] dm_get_device+0x571/0x7f0 [ 41.602047][ T975] snapshot_ctr+0x435/0x1350 [ 41.606690][ T975] dm_table_add_target+0x59f/0xcb0 [ 41.611840][ T975] table_load+0x2eb/0x7d0 [ 41.616204][ T975] dm_ctl_ioctl+0x8f0/0xde0 [ 41.620749][ T975] __se_sys_ioctl+0x123/0x1b0 [ 41.625465][ T975] __x64_sys_ioctl+0x7f/0xa0 [ 41.630082][ T975] x64_sys_call+0x1878/0x2ee0 [ 41.634787][ T975] do_syscall_64+0x57/0xf0 [ 41.639239][ T975] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 41.645345][ T975] [ 41.647679][ T975] The buggy address belongs to the object at ffff88811c327a00 [ 41.647679][ T975] which belongs to the cache kmalloc-96 of size 96 [ 41.661591][ T975] The buggy address is located 24 bytes inside of [ 41.661591][ T975] freed 96-byte region [ffff88811c327a00, ffff88811c327a60) [ 41.675270][ T975] [ 41.676615][ T917] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 41.677626][ T975] The buggy address belongs to the physical page: [ 41.677659][ T975] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11c327 [ 41.700014][ T975] flags: 0x4000000000000000(zone=1) [ 41.705463][ T975] page_type: f5(slab) [ 41.709514][ T975] raw: 4000000000000000 ffff888100041280 dead000000000122 0000000000000000 [ 41.718134][ T975] raw: 0000000000000000 0000000080200020 00000001f5000000 0000000000000000 [ 41.726730][ T975] page dumped because: kasan: bad access detected [ 41.733184][ T975] page_owner tracks the page as allocated [ 41.738920][ T975] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x152cc0(GFP_USER|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 969, tgid 969 (syz-executor), ts 41124065712, free_ts 41117863333 [ 41.757960][ T975] post_alloc_hook+0x37d/0x3b0 [ 41.762763][ T975] prep_new_page+0x2d/0x180 [ 41.767301][ T975] get_page_from_freelist+0x4aea/0x4ba0 [ 41.772889][ T975] __alloc_pages_noprof+0x35a/0x7e0 [ 41.778160][ T975] alloc_slab_page+0x6b/0x1e0 [ 41.782865][ T975] allocate_slab+0x69/0x430 [ 41.787417][ T975] ___slab_alloc+0x591/0x8c0 [ 41.792054][ T975] __kmalloc_node_noprof+0x2e7/0x500 [ 41.797383][ T975] __kvmalloc_node_noprof+0x128/0x300 [ 41.802784][ T975] simple_xattr_alloc+0x67/0x140 [ 41.807855][ T975] shmem_initxattrs+0x24f/0x530 [ 41.812736][ T975] security_inode_init_security+0x434/0x600 [ 41.818666][ T975] shmem_symlink+0xe4/0x4e0 [ 41.823220][ T975] vfs_symlink+0x3f7/0x620 [ 41.827668][ T975] do_symlinkat+0x1ba/0x400 [ 41.832206][ T975] __x64_sys_symlinkat+0x99/0xb0 [ 41.837176][ T975] page last free pid 967 tgid 967 stack trace: [ 41.843345][ T975] free_unref_page+0xb99/0xf50 [ 41.848166][ T975] __free_pages+0x6b/0x3b0 [ 41.852696][ T975] free_pages+0x86/0x90 [ 41.856896][ T975] tlb_finish_mmu+0x117/0x1d0 [ 41.861599][ T975] exit_mmap+0x458/0xc20 [ 41.865883][ T975] __mmput+0x92/0x330 [ 41.869904][ T975] mmput+0x55/0x170 [ 41.873755][ T975] do_exit+0x9a5/0x2850 [ 41.877949][ T975] do_group_exit+0x21f/0x2f0 [ 41.882569][ T975] __x64_sys_exit_group+0x43/0x50 [ 41.887649][ T975] x64_sys_call+0x2ed2/0x2ee0 [ 41.892357][ T975] do_syscall_64+0x57/0xf0 [ 41.894353][ T92] cdc_ncm 3-1:1.0: MAC-Address: 42:42:42:42:42:42 [ 41.896798][ T975] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 41.903635][ T92] cdc_ncm 3-1:1.0: setting rx_max = 16384 [ 41.907709][ T36] audit: type=1400 audit(1793251955.020:241): avc: denied { read } for pid=94 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 41.909142][ T975] [ 41.936654][ T975] Memory state around the buggy address: [ 41.936675][ T975] ffff88811c327900: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc [ 41.936690][ T975] ffff88811c327980: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc [ 41.936705][ T975] >ffff88811c327a00: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc [ 41.936716][ T975] ^ [ 41.936728][ T975] ffff88811c327a80: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc [ 41.946749][ T36] audit: type=1400 audit(1793251955.020:242): avc: denied { search } for pid=94 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 41.952782][ T975] ffff88811c327b00: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc [ 41.952796][ T975] ================================================================== [ 41.956629][ T975] Disabling lock debugging due to kernel taint [ 42.025818][ T975] device-mapper: table: 252:3: device 1:3 not in table devices list [ 42.034237][ T975] device-mapper: table: 252:3: snapshot-merge: COW device cannot be the same as origin device (-EINVAL) [ 42.045785][ T975] device-mapper: ioctl: error adding target to table [ 42.052597][ T975] device-mapper: table: 252:3: dm_table_destroy: dm_put_device call missing for 1:3 [ 42.103780][ T92] cdc_ncm 3-1:1.0: setting tx_max = 16384 [ 42.112704][ T92] cdc_ncm 3-1:1.0 usb0: register 'cdc_ncm' at usb-dummy_hcd.2-1, CDC NCM (NO ZLP), 42:42:42:42:42:42 [ 42.125987][ T92] usb 3-1: USB disconnect, device number 6 [ 42.137837][ T92] cdc_ncm 3-1:1.0 usb0: unregister 'cdc_ncm' usb-dummy_hcd.2-1, CDC NCM (NO ZLP)