last executing test programs: 339.478902ms ago: executing program 3 (id=4): r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000409911ff0f0000010203010902200001010080320904000002080650000705810200020007050202000200"], 0x0) syz_usb_control_io(r0, &(0x7f0000000400)={0x2c, &(0x7f0000000500)={0x0, 0x0, 0x2, {0x2}}, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000000200)={0x84, &(0x7f0000000100)={0x40, 0xa, 0x3c, "0100000000000000000021000100"/66}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) nanosleep(&(0x7f0000000300)={0x1}, 0x0) 323.228223ms ago: executing program 0 (id=1): r0 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_CPUID2(r1, 0x4008ae90, &(0x7f00000000c0)={0x1, 0x0, [{0x1}]}) r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f0000000100)={0x0, &(0x7f0000000140)=[@enable_nested={0x12c, 0x18}, @nested_create_vm={0x12d, 0x18}, @nested_load_code={0x12e, 0x19, {0x0, "f4"}}, @nested_vmlaunch={0x12f, 0x18}], 0x61}) r4 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r0, 0xae04) mmap$KVM_VCPU(&(0x7f0000009000/0x1000)=nil, r4, 0x3, 0x11, r3, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) 268.170664ms ago: executing program 2 (id=3): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0) write(r1, &(0x7f0000000200)='dummy_hcd.0\x00', 0xc) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/bus/pci/devices/0000:00:02.0/driver/unbind\x00', 0x1, 0x0) write(r2, &(0x7f00000002c0)='0000:00:02.0\x00', 0xc) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/pci/devices/0000:00:02.0/driver_override\x00', 0x1, 0x0) write(r3, &(0x7f0000000380)='amd5536udc-pci\x00', 0xe) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/pci/drivers/amd5536udc-pci/bind\x00', 0x1, 0x0) write(r4, &(0x7f0000000480)='0000:00:02.0\x00', 0xc) mkdirat(r0, &(0x7f0000000500)='usb_gadget/g1\x00', 0x1ff) mkdirat(r0, &(0x7f0000000540)='usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(r0, &(0x7f0000000580)='usb_gadget/g1/functions/Loopback.usb0\x00', 0x1ff) symlinkat(&(0x7f0000000600)='./config/usb_gadget/g1/functions/Loopback.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000680)='./config/usb_gadget/g1/configs/c.1/Loopback.usb0\x00') r5 = dup2(r0, r4) r6 = openat(r5, &(0x7f0000000700)='usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r6, &(0x7f0000000780)='amd5536_udc\n\x00', 0xc) write(r6, &(0x7f0000000800)='\n\x00', 0x1) close(r6) close(r5) close(r0) 135.467408ms ago: executing program 2 (id=6): syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100100000040a41520900001010203010902270001010080fa0904000003ff000000070581024000000705020240000007058402400000"], 0x0) write(0xffffffffffffffff, &(0x7f0000000040)="01010101", 0x4) 95.097189ms ago: executing program 4 (id=5): r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000040), 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000000100)={{0x1, 0x0, 0xffffffff}}) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r0, 0x40505412, &(0x7f0000000200)={0x1, 0x1, 0x40}) ioctl$SNDRV_TIMER_IOCTL_START(r0, 0x54a0) read(r0, &(0x7f0000000400)=""/64, 0x40) read(r0, &(0x7f0000000500)=""/64, 0x40) read(r0, &(0x7f0000000600)=""/64, 0x40) 63.578699ms ago: executing program 1 (id=2): syz_usb_connect(0x3, 0x60, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000403412785600010102030109024e00010100c032090400000208065000070501020002000705820200020009040001040806620007050102000200070502020002000325020705030200020003240307058402000200032404"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) syz_open_dev$usbfs(&(0x7f0000000100), 0xb, 0x2) syz_open_dev$usbfs(&(0x7f0000000100), 0x15, 0x2) syz_open_dev$usbfs(&(0x7f0000000100), 0xc, 0x2) syz_open_dev$usbfs(&(0x7f0000000100), 0x16, 0x2) syz_open_dev$usbfs(&(0x7f0000000100), 0x20, 0x2) syz_open_dev$usbfs(&(0x7f0000000100), 0x2a, 0x2) 21.09562ms ago: executing program 4 (id=7): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000140)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/ecm.usb0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) symlinkat(&(0x7f0000000240)='./config/usb_gadget/g1/functions/ecm.usb0\x00', 0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/configs/c.1/ecm.usb0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r0, &(0x7f0000000380)='dummy_udc.0\n\x00', 0xc) nanosleep(&(0x7f0000000300)={0x0, 0x1dcd6500}, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./sys/bus/usb/devices/5-1/bConfigurationValue\x00', 0x1, 0x0) write(r1, &(0x7f0000000500)='1\n\x00', 0x2) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) write(r1, &(0x7f0000000500)='0\n\x00', 0x2) 0s ago: executing program 0 (id=8): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/module/kvm/parameters/force_emulation_prefix\x00', 0x1, 0x0) write(r0, &(0x7f0000000180)='1\n\x00', 0x2) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_TSS_ADDR(r2, 0xae47, 0xfe1d0000) ioctl$KVM_SET_IDENTITY_MAP_ADDR(r2, 0x4008ae48, &(0x7f0000000000)=0xfe1dc000) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r2, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000200)="0f0b6b766d0f22c0f4", 0x9}], 0x1, 0x4, 0x0, 0x0) r4 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae59) mmap$KVM_VCPU(&(0x7f0000009000/0x1000)=nil, r4, 0x3, 0x11, r3, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.17' (ED25519) to the list of known hosts. [ 21.716605][ T28] audit: type=1400 audit(1786960080.398:64): avc: denied { mounton } for pid=279 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 21.720215][ T279] cgroup: Unknown subsys name 'net' [ 21.739309][ T28] audit: type=1400 audit(1786960080.398:65): avc: denied { mount } for pid=279 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 21.766731][ T28] audit: type=1400 audit(1786960080.438:66): avc: denied { unmount } for pid=279 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 21.767172][ T279] cgroup: Unknown subsys name 'devices' [ 21.912823][ T279] cgroup: Unknown subsys name 'hugetlb' [ 21.918471][ T279] cgroup: Unknown subsys name 'rlimit' [ 22.055051][ T28] audit: type=1400 audit(1786960080.738:67): avc: denied { setattr } for pid=279 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=258 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 22.078400][ T28] audit: type=1400 audit(1786960080.738:68): avc: denied { mounton } for pid=279 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 22.103197][ T28] audit: type=1400 audit(1786960080.738:69): avc: denied { mount } for pid=279 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 22.128355][ T281] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 22.137440][ T28] audit: type=1400 audit(1786960080.818:70): avc: denied { relabelto } for pid=281 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.162922][ T28] audit: type=1400 audit(1786960080.818:71): avc: denied { write } for pid=281 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.207840][ T28] audit: type=1400 audit(1786960080.888:72): avc: denied { read } for pid=279 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.209078][ T279] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 22.233576][ T28] audit: type=1400 audit(1786960080.888:73): avc: denied { open } for pid=279 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.910259][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.917531][ T288] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.925137][ T288] device bridge_slave_0 entered promiscuous mode [ 23.932762][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.939924][ T288] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.947516][ T288] device bridge_slave_1 entered promiscuous mode [ 23.963179][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.970251][ T289] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.977811][ T289] device bridge_slave_0 entered promiscuous mode [ 23.986771][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.993918][ T289] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.001390][ T289] device bridge_slave_1 entered promiscuous mode [ 24.035441][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.042535][ T287] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.050128][ T287] device bridge_slave_0 entered promiscuous mode [ 24.058393][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.065551][ T287] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.073149][ T287] device bridge_slave_1 entered promiscuous mode [ 24.149092][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.156234][ T290] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.163755][ T290] device bridge_slave_0 entered promiscuous mode [ 24.173900][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.181014][ T290] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.188486][ T290] device bridge_slave_1 entered promiscuous mode [ 24.211781][ T291] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.218864][ T291] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.226512][ T291] device bridge_slave_0 entered promiscuous mode [ 24.235819][ T291] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.243018][ T291] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.250446][ T291] device bridge_slave_1 entered promiscuous mode [ 24.403854][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.410982][ T288] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.418271][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.425367][ T288] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.444738][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.451843][ T287] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.459171][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.466250][ T287] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.491746][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.498825][ T289] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.506149][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.513232][ T289] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.528859][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.536122][ T290] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.543445][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.550496][ T290] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.579302][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.588353][ T44] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.595700][ T44] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.603218][ T44] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.610400][ T44] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.617794][ T44] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.625262][ T44] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.632613][ T44] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.640569][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 24.648375][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.677628][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.686011][ T44] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.693143][ T44] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.706155][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.726033][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.733757][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.741949][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.749942][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.764145][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.772441][ T44] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.779494][ T44] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.787171][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.795854][ T44] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.802957][ T44] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.833306][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.841563][ T44] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.848594][ T44] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.856163][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.864556][ T44] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.871655][ T44] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.879437][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.887545][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.895688][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.903787][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.912013][ T44] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.919038][ T44] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.926479][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.934775][ T44] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.941826][ T44] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.965275][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 24.975080][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.983620][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 24.992037][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 25.000053][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 25.008496][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 25.016713][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 25.024319][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 25.041912][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 25.050336][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.058812][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 25.067159][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.075619][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 25.084363][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.097174][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 25.105650][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 25.113904][ T44] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.120988][ T44] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.128488][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 25.137071][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 25.145384][ T44] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.152432][ T44] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.163631][ T288] device veth0_vlan entered promiscuous mode [ 25.174951][ T290] device veth0_vlan entered promiscuous mode [ 25.188462][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 25.196237][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 25.204232][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.212459][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 25.220321][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.228745][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 25.237143][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.245608][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.253186][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.260738][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.268799][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.281859][ T289] device veth0_vlan entered promiscuous mode [ 25.293858][ T290] device veth1_macvtap entered promiscuous mode [ 25.307210][ T288] device veth1_macvtap entered promiscuous mode [ 25.314635][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 25.322944][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.331226][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 25.339088][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.347286][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.355530][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.363883][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 25.372054][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 25.380025][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 25.388266][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 25.396537][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.404984][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.413260][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 25.421016][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.428588][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.436368][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.443939][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.454500][ T289] device veth1_macvtap entered promiscuous mode [ 25.470676][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.478975][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.487424][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 25.495411][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.503964][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.512681][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.521364][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.529740][ T287] device veth0_vlan entered promiscuous mode [ 25.546741][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.555209][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.563866][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 25.572539][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.581500][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.589752][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.598991][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 25.607038][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.626807][ T291] device veth0_vlan entered promiscuous mode [ 25.633697][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.641827][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.642423][ T289] request_module fs-gadgetfs succeeded, but still no fs? [ 25.650114][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.665667][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.674327][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.682726][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.709257][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.730838][ T287] device veth1_macvtap entered promiscuous mode [ 25.738901][ T291] device veth1_macvtap entered promiscuous mode [ 25.749424][ T313] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 25.767666][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.788021][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.798771][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 25.799308][ T318] dummy_hcd dummy_hcd.0: remove, state 4 [ 25.816669][ T318] usb usb1: USB disconnect, device number 1 [ 25.829690][ T318] dummy_hcd dummy_hcd.0: stopped [ 25.831935][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.840909][ T318] dummy_hcd dummy_hcd.0: USB bus 1 deregistered [ 25.846474][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.863765][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.872590][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.890959][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.900551][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.923424][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.934000][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 26.033910][ T330] using random self ethernet address [ 26.039243][ T330] using random host ethernet address [ 26.050742][ T40] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 26.058254][ T330] general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN [ 26.070351][ T330] KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] [ 26.078803][ T330] CPU: 0 PID: 330 Comm: syz.4.7 Not tainted syzkaller #0 [ 26.085869][ T330] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 26.096058][ T330] RIP: 0010:dummy_set_selfpowered+0xbc/0x150 [ 26.102102][ T330] Code: 94 c0 4d 8d b4 c6 e0 04 00 00 4c 89 f0 48 c1 e8 03 42 80 3c 20 00 74 08 4c 89 f7 e8 5e 8f 6a fe 4d 8b 3e 4c 89 f8 48 c1 e8 03 <42> 80 3c 20 00 74 08 4c 89 ff e8 45 8f 6a fe 41 be 68 11 00 00 4d [ 26.121733][ T330] RSP: 0018:ffffc9000e53f738 EFLAGS: 00010246 [ 26.127849][ T330] RAX: 0000000000000000 RBX: 0000000000000001 RCX: 0000000000000002 [ 26.135853][ T330] RDX: ffff8881102c5100 RSI: 0000000000000003 RDI: 0000000000000005 [ 26.143850][ T330] RBP: ffffc9000e53f758 R08: ffff8881001b0767 R09: 1ffff110200360ec [ 26.151926][ T330] R10: 0000000000000000 R11: ffffed10200360ed R12: dffffc0000000000 [ 26.159918][ T330] R13: ffff888113537468 R14: ffff88810d9f9170 R15: 0000000000000000 [ 26.167953][ T330] FS: 00007f598ab4a6c0(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 26.176907][ T330] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 26.183511][ T330] CR2: 0000001b2f01cff8 CR3: 0000000133fe3000 CR4: 00000000003506b0 [ 26.191597][ T330] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 26.199588][ T330] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 26.207605][ T330] Call Trace: [ 26.210906][ T330] [ 26.213866][ T330] ? __cfi_dummy_set_selfpowered+0x10/0x10 [ 26.219713][ T330] usb_gadget_set_selfpowered+0x7a/0x190 [ 26.225375][ T330] composite_dev_prepare+0x2e7/0x310 [ 26.230691][ T330] configfs_composite_bind+0xb4/0x13b0 [ 26.236174][ T330] ? mutex_unlock+0x8f/0x230 [ 26.240786][ T330] ? __cfi_mutex_unlock+0x10/0x10 [ 26.245832][ T330] ? __kasan_check_write+0x14/0x20 [ 26.250963][ T330] ? kernfs_put+0x44f/0x480 [ 26.255570][ T330] ? __cfi_configfs_composite_bind+0x10/0x10 [ 26.261576][ T330] gadget_bind_driver+0x2eb/0x990 [ 26.266662][ T330] ? sysfs_create_link+0x68/0x80 [ 26.271625][ T330] ? __cfi_gadget_bind_driver+0x10/0x10 [ 26.277203][ T330] really_probe+0x2d7/0x9a0 [ 26.281736][ T330] ? __kasan_check_write+0x14/0x20 [ 26.286870][ T330] __driver_probe_device+0x193/0x270 [ 26.292184][ T330] driver_probe_device+0x54/0x3e0 [ 26.297235][ T330] __driver_attach+0x41a/0x5d0 [ 26.302027][ T330] bus_for_each_dev+0x18c/0x200 [ 26.306909][ T330] ? __cfi__raw_spin_lock+0x10/0x10 [ 26.312133][ T330] ? __cfi___driver_attach+0x10/0x10 [ 26.317444][ T330] ? __cfi_bus_for_each_dev+0x10/0x10 [ 26.322839][ T330] ? _raw_spin_unlock+0x4c/0x70 [ 26.327821][ T330] ? klist_add_tail+0x1e5/0x220 [ 26.332701][ T330] driver_attach+0x42/0x50 [ 26.337141][ T330] bus_add_driver+0x322/0x560 [ 26.342029][ T330] driver_register+0x335/0x440 [ 26.346840][ T330] usb_gadget_register_driver_owner+0xf8/0x270 [ 26.353038][ T330] gadget_dev_desc_UDC_store+0x220/0x340 [ 26.358700][ T330] configfs_write_iter+0x323/0x410 [ 26.363842][ T330] ? __cfi_gadget_dev_desc_UDC_store+0x10/0x10 [ 26.370031][ T330] vfs_write+0x5ef/0xd00 [ 26.374306][ T330] ? __cfi_vfs_write+0x10/0x10 [ 26.379088][ T330] ? __cfi_mutex_lock+0x10/0x10 [ 26.383966][ T330] ? __fdget_pos+0x2cd/0x380 [ 26.388576][ T330] ? ksys_write+0x70/0x260 [ 26.393011][ T330] ksys_write+0x14a/0x260 [ 26.397358][ T330] ? __cfi_ksys_write+0x10/0x10 [ 26.402231][ T330] ? fpregs_restore_userregs+0x128/0x260 [ 26.407895][ T330] __x64_sys_write+0x7b/0x90 [ 26.412513][ T330] x64_sys_call+0x27b/0x9a0 [ 26.417054][ T330] do_syscall_64+0x4c/0xa0 [ 26.421583][ T330] ? clear_bhb_loop+0x30/0x80 [ 26.426277][ T330] ? clear_bhb_loop+0x30/0x80 [ 26.430981][ T330] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 26.436905][ T330] RIP: 0033:0x7f5989b9e0d9 [ 26.441351][ T330] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 26.460975][ T330] RSP: 002b:00007f598ab4a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 26.469414][ T330] RAX: ffffffffffffffda RBX: 00007f5989e25fa0 RCX: 00007f5989b9e0d9 [ 26.477405][ T330] RDX: 000000000000000c RSI: 0000200000000380 RDI: 0000000000000003 [ 26.485393][ T330] RBP: 00007f5989c35024 R08: 0000000000000000 R09: 0000000000000000 [ 26.493380][ T330] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 26.501369][ T330] R13: 00007f5989e26038 R14: 00007f5989e25fa0 R15: 00007fffb955f958 [ 26.509370][ T330] [ 26.512406][ T330] Modules linked in: [ 26.526721][ T330] ---[ end trace 0000000000000000 ]--- [ 26.533557][ T330] RIP: 0010:dummy_set_selfpowered+0xbc/0x150 [ 26.540137][ T330] Code: 94 c0 4d 8d b4 c6 e0 04 00 00 4c 89 f0 48 c1 e8 03 42 80 3c 20 00 74 08 4c 89 f7 e8 5e 8f 6a fe 4d 8b 3e 4c 89 f8 48 c1 e8 03 <42> 80 3c 20 00 74 08 4c 89 ff e8 45 8f 6a fe 41 be 68 11 00 00 4d [ 26.562011][ T330] RSP: 0018:ffffc9000e53f738 EFLAGS: 00010246 [ 26.568952][ T330] RAX: 0000000000000000 RBX: 0000000000000001 RCX: 0000000000000002 [ 26.581068][ T330] RDX: ffff8881102c5100 RSI: 0000000000000003 RDI: 0000000000000005 [ 26.589341][ T330] RBP: ffffc9000e53f758 R08: ffff8881001b0767 R09: 1ffff110200360ec [ 26.598054][ T330] R10: 0000000000000000 R11: ffffed10200360ed R12: dffffc0000000000 [ 26.606824][ T330] R13: ffff888113537468 R14: ffff88810d9f9170 R15: 0000000000000000 [ 26.616377][ T330] FS: 00007f598ab4a6c0(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 26.627282][ T330] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 26.627386][ T40] usb 4-1: New USB device found, idVendor=1199, idProduct=0fff, bcdDevice= 0.00 [ 26.643423][ T330] CR2: 00007f598ab08d58 CR3: 0000000133fe3000 CR4: 00000000003526a0 [ 26.651754][ T330] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 26.659945][ T40] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 26.668241][ T330] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 26.676622][ T40] usb 4-1: Product: syz [ 26.680982][ T40] usb 4-1: Manufacturer: syz [ 26.685605][ T40] usb 4-1: SerialNumber: syz [ 26.689617][ T330] Kernel panic - not syncing: Fatal exception [ 26.690354][ T330] Kernel Offset: disabled [ 26.700738][ T330] Rebooting in 86400 seconds..