last executing test programs: 786.983831ms ago: executing program 4 (id=5): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./dev\x00', &(0x7f0000000080)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000140)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/msr/parameters/allow_writes\x00', 0x2, 0x0) write(r0, &(0x7f0000000200)='on\n\x00', 0x3) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./dev/cpu/0/msr\x00', 0x2, 0x0) r2 = openat$kvm(0x0, &(0x7f0000000280), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = syz_kvm_setup_syzos_vm$x86(r3, &(0x7f0000c00000/0x400000)=nil) r5 = syz_kvm_add_vcpu$x86(r4, &(0x7f00000001c0)={0x0, &(0x7f00000002c0)=[@code={0xa, 0x13, {"ebfe", 0x2}}], 0x13}) r6 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r2, 0xae04) mmap$KVM_VCPU(&(0x7f0000009000/0x1000)=nil, r6, 0x3, 0x11, r5, 0x0) pwrite64(r1, &(0x7f0000000400)="f400000000000000", 0x8, 0x83f) pwrite64(r1, &(0x7f0000000480)="00000300000000f4", 0x8, 0x830) ioctl$KVM_RUN(r5, 0xae80, 0x0) pwrite64(r1, &(0x7f0000000500)="f400000000000000", 0x8, 0x83f) pwrite64(r1, &(0x7f0000000580)="00000300000000f4", 0x8, 0x830) ioctl$KVM_RUN(r5, 0xae80, 0x0) 767.350161ms ago: executing program 2 (id=3): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0) write(r0, &(0x7f0000000180)='0x1d6b\x00', 0x6) r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0) write(r1, &(0x7f0000000200)='0x0104\x00', 0x6) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0) write(r2, &(0x7f00000002c0)='1234567890\x00', 0xb) r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/strings/0x409/manufacturer\x00', 0x2, 0x0) write(r3, &(0x7f0000000340)='Linux Foundation\x00', 0x11) r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/strings/0x409/product\x00', 0x2, 0x0) write(r4, &(0x7f00000003c0)='Test Gadget\x00', 0xc) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/functions/midi.usb0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/configs/c.1/strings/0x409\x00', 0x1ff) r5 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./config/usb_gadget/g1/configs/c.1/strings/0x409/configuration\x00', 0x2, 0x0) write(r5, &(0x7f0000000500)='Conf 1\x00', 0x7) r6 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/usb_gadget/g1/configs/c.1\x00', 0x0, 0x0) symlinkat(&(0x7f0000000580)='./config/usb_gadget/g1/functions/midi.usb0\x00', r6, &(0x7f00000005c0)='midi.usb0\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g1/configs/c.2\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000640)='./config/usb_gadget/g1/configs/c.2/strings/0x409\x00', 0x1ff) r7 = openat(0xffffffffffffff9c, &(0x7f0000000680)='./config/usb_gadget/g1/configs/c.2/strings/0x409/configuration\x00', 0x2, 0x0) write(r7, &(0x7f00000006c0)='Conf 2\x00', 0x7) r8 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./config/usb_gadget/g1/configs/c.2\x00', 0x0, 0x0) symlinkat(&(0x7f0000000580)='./config/usb_gadget/g1/functions/midi.usb0\x00', r8, &(0x7f0000000740)='midi.usb0\x00') r9 = openat(0xffffffffffffff9c, &(0x7f0000000780)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0) write(r9, &(0x7f00000007c0)='dummy_udc.0\x00', 0xb) nanosleep(&(0x7f0000000800)={0x0, 0x23c34600}, 0x0) r10 = openat(0xffffffffffffff9c, &(0x7f0000000840)='./sys/bus/usb/devices/5-1/bConfigurationValue\x00', 0x2, 0x0) write(r10, &(0x7f00000008c0)='2\x00', 0x2) write(r10, &(0x7f0000000900)='0\x00', 0x2) 701.370793ms ago: executing program 3 (id=4): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='configfs\x00', &(0x7f0000000000)='./config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./sys\x00', 0x1ff) mount(&(0x7f0000000400)=@filename='sysfs\x00', &(0x7f0000000300)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config/usb_gadget/g_uac2\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g_uac2/idVendor\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='0x1234\n', 0x7) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g_uac2/idProduct\x00', 0x1, 0x0) write(r1, &(0x7f0000000400)='0x5678\n', 0x7) close(r1) mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/usb_gadget/g_uac2/functions/uac2.usb0\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g_uac2/functions/uac2.usb0/c_chmask\x00', 0x1, 0x0) write(r2, &(0x7f0000000700)='0\n', 0x2) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/usb_gadget/g_uac2/functions/uac2.usb0/p_chmask\x00', 0x1, 0x0) write(r3, &(0x7f0000000900)='0\n', 0x2) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/usb_gadget/g_uac2/functions/uac2.usb0/c_mute_present\x00', 0x1, 0x0) write(r4, &(0x7f0000000b00)='0\n', 0x2) close(r4) r5 = openat(0xffffffffffffff9c, &(0x7f0000000c00)='./config/usb_gadget/g_uac2/functions/uac2.usb0/c_volume_present\x00', 0x1, 0x0) write(r5, &(0x7f0000000d00)='0\n', 0x2) close(r5) r6 = openat(0xffffffffffffff9c, &(0x7f0000000e00)='./config/usb_gadget/g_uac2/functions/uac2.usb0/p_mute_present\x00', 0x1, 0x0) write(r6, &(0x7f0000000f00)='0\n', 0x2) close(r6) r7 = openat(0xffffffffffffff9c, &(0x7f0000001000)='./config/usb_gadget/g_uac2/functions/uac2.usb0/p_volume_present\x00', 0x1, 0x0) write(r7, &(0x7f0000001100)='0\n', 0x2) close(r7) mkdirat(0xffffffffffffff9c, &(0x7f0000001200)='./config/usb_gadget/g_uac2/configs/c.1\x00', 0x1ff) symlinkat(&(0x7f0000001300)='./config/usb_gadget/g_uac2/functions/uac2.usb0\x00', 0xffffffffffffff9c, &(0x7f0000001400)='./config/usb_gadget/g_uac2/configs/c.1/uac2.usb0\x00') r8 = openat(0xffffffffffffff9c, &(0x7f0000001500)='./config/usb_gadget/g_uac2/UDC\x00', 0x1, 0x0) write(r8, &(0x7f0000001600)='usbip-vudc.0\n', 0xd) 688.122043ms ago: executing program 1 (id=2): r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r1 = syz_kvm_setup_syzos_vm$x86(r0, &(0x7f0000c00000/0x400000)=nil) r2 = syz_kvm_add_vcpu$x86(r1, &(0x7f00000001c0)={0x0, &(0x7f0000000200)=[@code={0xa, 0x18, {"0f0b6b766ddbe3"}}], 0x18}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 611.571085ms ago: executing program 1 (id=6): syz_usb_connect(0x0, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x97, 0xff, 0x82, 0x8, 0x2058, 0x1005, 0xc19b, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x8f, 0x0, 0x0, 0xbf, 0x57, 0x5a}}]}}]}}, 0x0) nanosleep(&(0x7f0000000000)={0x5}, 0x0) r0 = syz_usb_connect(0x3, 0x4e, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000401107500500010102030109023c0001010080320904000006ffffff0007058e0200020007050e02000200070501020002000705030200020007058d0200020007050d02000200"], &(0x7f00000000c0)) syz_usb_control_io(r0, &(0x7f0000000100), &(0x7f0000000140)) syz_usb_control_io(r0, &(0x7f0000000200), &(0x7f0000000240)) syz_usb_control_io(r0, &(0x7f0000000300), &(0x7f0000000340)) syz_usb_control_io(r0, &(0x7f0000000400), &(0x7f0000000440)) syz_usb_control_io(r0, &(0x7f0000000500), &(0x7f0000000540)) 611.255825ms ago: executing program 3 (id=7): mkdir(&(0x7f0000000000)='./sys\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='sysfs\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/pci/devices/0000:00:03.0/driver/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='0000:00:03.0\x00', 0xd) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/pci/drivers/dwc2-pci/new_id\x00', 0x1, 0x0) write(r1, &(0x7f0000000700)='8086 100e\x00', 0xa) r2 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./sys/bus/pci/drivers/dwc2-pci/bind\x00', 0x1, 0x0) write(r2, &(0x7f0000000900)='0000:00:03.0\x00', 0xd) openat(0xffffffffffffff9c, &(0x7f0000000a00)='./sys/bus/pci/drivers/dwc2-pci/0000:00:03.0\x00', 0x0, 0x0) 507.021758ms ago: executing program 0 (id=1): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/strings/0x409/s1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409/s2\x00', 0x1ff) rmdir(&(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/s1\x00') rmdir(&(0x7f0000000240)='./config/usb_gadget/g1/strings/0x409/s2\x00') rmdir(&(0x7f0000000280)='./config/usb_gadget/g1/strings/0x409\x00') rmdir(&(0x7f00000002c0)='./config/usb_gadget/g1\x00') umount2(&(0x7f0000000300)='./config\x00', 0x0) rmdir(&(0x7f0000000340)='./config\x00') 443.877619ms ago: executing program 0 (id=8): r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040b810bc1e0000010203010902200001010080500904000002ff0000000705810240000007050202400000"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0xc0, 0x15, 0x10, "0000010200"/16}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) nanosleep(&(0x7f0000000300)={0x1}, 0x0) 422.93405ms ago: executing program 4 (id=9): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tmp_dir\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000000040)='./tmp_dir/file1\x00', 0x42, 0x1ff) setxattr(&(0x7f0000000040)='./tmp_dir/file1\x00', &(0x7f0000000080)=@random={'user.', 'a0\x00'}, &(0x7f0000000100)='v\x00', 0x2, 0x0) setxattr(&(0x7f0000000040)='./tmp_dir/file1\x00', &(0x7f0000000080)=@random={'user.', 'a1\x00'}, &(0x7f0000000100)='v\x00', 0x2, 0x0) setxattr(&(0x7f0000000040)='./tmp_dir/file1\x00', &(0x7f0000000080)=@random={'user.', 'a2\x00'}, &(0x7f0000000100)='v\x00', 0x2, 0x0) setxattr(&(0x7f0000000040)='./tmp_dir/file1\x00', &(0x7f0000000080)=@random={'user.', 'a3\x00'}, &(0x7f0000000100)='v\x00', 0x2, 0x0) setxattr(&(0x7f0000000040)='./tmp_dir/file1\x00', &(0x7f0000000080)=@random={'user.', 'a4\x00'}, &(0x7f0000000100)='v\x00', 0x2, 0x0) setxattr(&(0x7f0000000040)='./tmp_dir/file1\x00', &(0x7f0000000080)=@random={'user.', 'a5\x00'}, &(0x7f0000000100)='v\x00', 0x2, 0x0) setxattr(&(0x7f0000000040)='./tmp_dir/file1\x00', &(0x7f0000000080)=@random={'user.', 'a6\x00'}, &(0x7f0000000100)='v\x00', 0x2, 0x0) setxattr(&(0x7f0000000040)='./tmp_dir/file1\x00', &(0x7f0000000080)=@random={'user.', 'a7\x00'}, &(0x7f0000000100)='v\x00', 0x2, 0x0) setxattr(&(0x7f0000000040)='./tmp_dir/file1\x00', &(0x7f0000000080)=@random={'user.', 'a8\x00'}, &(0x7f0000000100)='v\x00', 0x2, 0x0) setxattr(&(0x7f0000000040)='./tmp_dir/file1\x00', &(0x7f0000000080)=@random={'user.', 'a9\x00'}, &(0x7f0000000100)='v\x00', 0x2, 0x0) setxattr(&(0x7f0000000040)='./tmp_dir/file1\x00', &(0x7f0000000080)=@random={'user.', 'b0\x00'}, &(0x7f0000000100)='v\x00', 0x2, 0x0) setxattr(&(0x7f0000000040)='./tmp_dir/file1\x00', &(0x7f0000000080)=@random={'user.', 'b1\x00'}, &(0x7f0000000100)='v\x00', 0x2, 0x0) setxattr(&(0x7f0000000040)='./tmp_dir/file1\x00', &(0x7f0000000080)=@random={'user.', 'b2\x00'}, &(0x7f0000000100)='v\x00', 0x2, 0x0) setxattr(&(0x7f0000000040)='./tmp_dir/file1\x00', &(0x7f0000000080)=@random={'user.', 'b3\x00'}, &(0x7f0000000100)='v\x00', 0x2, 0x0) setxattr(&(0x7f0000000040)='./tmp_dir/file1\x00', &(0x7f0000000080)=@random={'user.', 'b4\x00'}, &(0x7f0000000100)='v\x00', 0x2, 0x0) setxattr(&(0x7f0000000040)='./tmp_dir/file1\x00', &(0x7f0000000080)=@random={'user.', 'b5\x00'}, &(0x7f0000000100)='v\x00', 0x2, 0x0) setxattr(&(0x7f0000000040)='./tmp_dir/file1\x00', &(0x7f0000000080)=@random={'user.', 'b6\x00'}, &(0x7f0000000100)='v\x00', 0x2, 0x0) setxattr(&(0x7f0000000040)='./tmp_dir/file1\x00', &(0x7f0000000080)=@random={'user.', 'b7\x00'}, &(0x7f0000000100)='v\x00', 0x2, 0x0) removexattr(&(0x7f0000000040)='./tmp_dir/file1\x00', &(0x7f0000000080)=@random={'user.', 'a0\x00'}) removexattr(&(0x7f0000000040)='./tmp_dir/file1\x00', &(0x7f0000000080)=@random={'user.', 'a1\x00'}) removexattr(&(0x7f0000000040)='./tmp_dir/file1\x00', &(0x7f0000000080)=@random={'user.', 'a2\x00'}) removexattr(&(0x7f0000000040)='./tmp_dir/file1\x00', &(0x7f0000000080)=@random={'user.', 'a3\x00'}) removexattr(&(0x7f0000000040)='./tmp_dir/file1\x00', &(0x7f0000000080)=@random={'user.', 'a4\x00'}) removexattr(&(0x7f0000000040)='./tmp_dir/file1\x00', &(0x7f0000000080)=@random={'user.', 'a5\x00'}) 322.170303ms ago: executing program 4 (id=10): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/self/fail-nth\x00', 0x2, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_REGISTER_COALESCED_MMIO(r2, 0x4010ae67, &(0x7f0000000200)={0x1000, 0x1000}) write(r0, &(0x7f0000000100)='1\x00', 0x2) ioctl$KVM_UNREGISTER_COALESCED_MMIO(r2, 0x4010ae68, &(0x7f0000000240)={0x1000, 0x1000}) 0s ago: executing program 2 (id=11): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) mount(&(0x7f0000000000)=@filename='none\x00', &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r0, &(0x7f0000000140)='\n\x00', 0x2) close(r0) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/functions/acm.usb0\x00', 0x1ff) symlinkat(&(0x7f0000000280)='./config/usb_gadget/g1/functions/acm.usb0\x00', 0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/configs/c.1/acm.usb0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/idVendor\x00', 0x1, 0x0) write(r1, &(0x7f0000000340)='0x1d6b', 0x6) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/idProduct\x00', 0x1, 0x0) write(r2, &(0x7f00000003c0)='0x0104', 0x6) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/bmAttributes\x00', 0x1, 0x0) write(r3, &(0x7f0000000440)='0x80', 0x4) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/configs/c.1/MaxPower\x00', 0x1, 0x0) write(r4, &(0x7f00000004c0)='500', 0x3) close(r4) r5 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r5, &(0x7f0000000540)='dummy_udc.0', 0xb) close(r5) nanosleep(&(0x7f0000000200)={0x0, 0x1dcd6500}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000580)='./sys\x00', 0x1ff) mount(&(0x7f0000000000)=@filename='none\x00', &(0x7f00000005c0)='./sys\x00', &(0x7f0000000600)='sysfs\x00', 0x0, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./sys/bus/usb/devices/5-1/dev\x00', 0x0, 0x0) close(r6) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.51' (ED25519) to the list of known hosts. [ 21.208000][ T28] audit: type=1400 audit(1786961830.885:64): avc: denied { mounton } for pid=279 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 21.209082][ T279] cgroup: Unknown subsys name 'net' [ 21.230644][ T28] audit: type=1400 audit(1786961830.885:65): avc: denied { mount } for pid=279 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 21.257893][ T28] audit: type=1400 audit(1786961830.925:66): avc: denied { unmount } for pid=279 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 21.258032][ T279] cgroup: Unknown subsys name 'devices' [ 21.374572][ T279] cgroup: Unknown subsys name 'hugetlb' [ 21.380196][ T279] cgroup: Unknown subsys name 'rlimit' [ 21.511898][ T28] audit: type=1400 audit(1786961831.185:67): avc: denied { setattr } for pid=279 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=258 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 21.535074][ T28] audit: type=1400 audit(1786961831.185:68): avc: denied { mounton } for pid=279 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 21.559850][ T28] audit: type=1400 audit(1786961831.185:69): avc: denied { mount } for pid=279 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 21.568190][ T281] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 21.591805][ T28] audit: type=1400 audit(1786961831.265:70): avc: denied { relabelto } for pid=281 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.617208][ T28] audit: type=1400 audit(1786961831.265:71): avc: denied { write } for pid=281 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.617997][ T279] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 21.643336][ T28] audit: type=1400 audit(1786961831.295:72): avc: denied { read } for pid=279 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.676929][ T28] audit: type=1400 audit(1786961831.295:73): avc: denied { open } for pid=279 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.514789][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.521845][ T288] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.529499][ T288] device bridge_slave_0 entered promiscuous mode [ 22.537359][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.544429][ T288] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.551795][ T288] device bridge_slave_1 entered promiscuous mode [ 22.598592][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.605701][ T287] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.613342][ T287] device bridge_slave_0 entered promiscuous mode [ 22.620361][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.627545][ T287] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.634921][ T287] device bridge_slave_1 entered promiscuous mode [ 22.677126][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.684253][ T289] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.691639][ T289] device bridge_slave_0 entered promiscuous mode [ 22.699487][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.706565][ T289] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.713979][ T289] device bridge_slave_1 entered promiscuous mode [ 22.733616][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.740657][ T290] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.748026][ T290] device bridge_slave_0 entered promiscuous mode [ 22.757756][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.764853][ T290] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.772132][ T290] device bridge_slave_1 entered promiscuous mode [ 22.819768][ T291] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.826900][ T291] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.834244][ T291] device bridge_slave_0 entered promiscuous mode [ 22.843774][ T291] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.850804][ T291] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.858184][ T291] device bridge_slave_1 entered promiscuous mode [ 22.998077][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.005149][ T288] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.012402][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.019430][ T288] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.028383][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.035431][ T289] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.042669][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.049698][ T289] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.064711][ T291] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.071745][ T291] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.079084][ T291] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.086112][ T291] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.108592][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.115643][ T287] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.122898][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.129914][ T287] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.138858][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.145908][ T290] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.153170][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.160180][ T290] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.199932][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.207410][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.214662][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.221790][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.229523][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.236666][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.243859][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.250954][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.258512][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.265741][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.273429][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 23.280831][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.293171][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.301257][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.308279][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.315576][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.323750][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.330748][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.348436][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.355980][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.363680][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.371770][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.378794][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.386730][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.395012][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.402026][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.409427][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.416818][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.424992][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.431997][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.442692][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.451504][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.459753][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.466782][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.487576][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.495731][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.502757][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.510264][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.518887][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.525918][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.533244][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.541121][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 23.549061][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.556946][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 23.578679][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 23.586693][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.594775][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 23.603879][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 23.611756][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 23.620083][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.628679][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.635713][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.643141][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 23.651512][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.659826][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.666883][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.674291][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 23.682589][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 23.694707][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 23.702902][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.725505][ T291] device veth0_vlan entered promiscuous mode [ 23.734470][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 23.742629][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.750528][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 23.758792][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 23.766938][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 23.775379][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 23.783753][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 23.791533][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 23.799525][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 23.807453][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 23.815603][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 23.823144][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 23.830529][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 23.838180][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 23.846547][ T289] device veth0_vlan entered promiscuous mode [ 23.860771][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 23.868962][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 23.876983][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 23.885470][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 23.899884][ T288] device veth0_vlan entered promiscuous mode [ 23.910665][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 23.918877][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 23.927447][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 23.935977][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 23.943996][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 23.951907][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 23.959649][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 23.968222][ T291] device veth1_macvtap entered promiscuous mode [ 23.979924][ T288] device veth1_macvtap entered promiscuous mode [ 23.986770][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 23.994838][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.003220][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 24.011310][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.019644][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 24.027907][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.036154][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 24.043852][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.051261][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.058891][ T287] device veth0_vlan entered promiscuous mode [ 24.067642][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.076144][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.084481][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.092603][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.104089][ T289] device veth1_macvtap entered promiscuous mode [ 24.120154][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 24.128096][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.136642][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.146513][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.154822][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.166416][ T287] device veth1_macvtap entered promiscuous mode [ 24.175991][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.184274][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.192480][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.200657][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.209024][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.217481][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.225784][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.241001][ T291] request_module fs-gadgetfs succeeded, but still no fs? [ 24.255176][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.263562][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.271803][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.280309][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.294628][ T290] device veth0_vlan entered promiscuous mode [ 24.312513][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.334591][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.341378][ T312] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 24.350324][ T290] device veth1_macvtap entered promiscuous mode [ 24.369842][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.405358][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.413191][ T320] UDC core: g_uac2: couldn't find an available UDC or it's busy [ 24.437137][ C0] Spurious interrupt (vector 0xf4) on CPU#0. Acked [ 24.438308][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 24.443917][ C0] Spurious interrupt (vector 0xf4) on CPU#0. Acked [ 24.456136][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.480364][ T314] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.487824][ T10] device offline error, dev sda, sector 274742 op 0x1:(WRITE) flags 0x4000 phys_seg 23 prio class 2 [ 24.490960][ T314] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.499375][ T10] device offline error, dev sda, sector 275248 op 0x1:(WRITE) flags 0x4000 phys_seg 41 prio class 2 [ 24.521218][ T314] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.529940][ T10] device offline error, dev sda, sector 275760 op 0x1:(WRITE) flags 0x4000 phys_seg 37 prio class 2 [ 24.531193][ T314] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.541257][ T10] device offline error, dev sda, sector 276272 op 0x1:(WRITE) flags 0x4000 phys_seg 35 prio class 2 [ 24.581604][ T10] device offline error, dev sda, sector 276784 op 0x1:(WRITE) flags 0x4000 phys_seg 43 prio class 2 [ 24.593186][ T10] device offline error, dev sda, sector 277296 op 0x1:(WRITE) flags 0x4000 phys_seg 45 prio class 2 [ 24.605748][ T10] device offline error, dev sda, sector 277808 op 0x1:(WRITE) flags 0x0 phys_seg 39 prio class 2 [ 24.617729][ T10] EXT4-fs warning (device sda1): ext4_end_bio:347: I/O error 17 writing to inode 2021 starting block 34726) [ 24.630446][ T10] device offline error, dev sda, sector 278134 op 0x1:(WRITE) flags 0x4000 phys_seg 54 prio class 2 [ 24.646690][ T336] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 24.648082][ T10] device offline error, dev sda, sector 278640 op 0x1:(WRITE) flags 0x4000 phys_seg 61 prio class 2 [ 24.657374][ T336] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 24.666851][ T10] device offline error, dev sda, sector 279152 op 0x1:(WRITE) flags 0x4000 phys_seg 53 prio class 2 [ 24.684653][ T304] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 24.692441][ T310] android_work: sent uevent USB_STATE=CONNECTED [ 24.700180][ T10] EXT4-fs warning (device sda1): ext4_end_bio:347: I/O error 17 writing to inode 2021 starting block 35022) [ 24.716598][ T339] FAULT_INJECTION: forcing a failure. [ 24.716598][ T339] name fail_futex, interval 1, probability 0, space 0, times 1 [ 24.720043][ T10] EXT4-fs warning (device sda1): ext4_end_bio:347: I/O error 17 writing to inode 2021 starting block 35374) [ 24.736056][ T339] CPU: 0 PID: 339 Comm: syz.4.10 Tainted: G S syzkaller #0 [ 24.741052][ T315] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 24.749404][ T339] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 24.749434][ T339] Call Trace: [ 24.749440][ T339] [ 24.749446][ T339] __dump_stack+0x21/0x24 [ 24.757942][ T10] EXT4-fs warning (device sda1): ext4_end_bio:347: I/O error 17 writing to inode 2021 starting block 35454) [ 24.766915][ T339] dump_stack_lvl+0x110/0x170 [ 24.766939][ T339] ? __cfi_dump_stack_lvl+0x8/0x8 [ 24.766958][ T339] dump_stack+0x15/0x24 [ 24.771847][ T10] EXT4-fs warning (device sda1): ext4_end_bio:347: I/O error 17 writing to inode 2022 starting block 139302) [ 24.773135][ T339] should_fail_ex+0x3bf/0x510 [ 24.773155][ T339] should_fail+0xb/0x10 [ 24.777501][ T10] EXT4-fs warning (device sda1): ext4_end_bio:347: I/O error 17 writing to inode 2022 starting block 139306) [ 24.788883][ T339] get_futex_key+0x143/0xb10 [ 24.788908][ T339] ? hrtimer_try_to_cancel+0x30f/0x330 [ 24.788929][ T339] ? __cfi_get_futex_key+0x10/0x10 [ 24.788949][ T339] ? hrtimer_cancel+0x2d/0x60 [ 24.788969][ T339] futex_wake+0x150/0x8e0 [ 24.788984][ T339] ? __cfi_futex_wait+0x10/0x10 [ 24.788997][ T339] ? do_fault+0x1b23/0x1e30 [ 24.789011][ T339] ? __cfi_hrtimer_wakeup+0x10/0x10 [ 24.789026][ T339] ? __cfi_futex_wake+0x10/0x10 [ 24.789041][ T339] ? handle_mm_fault+0x18d8/0x26b0 [ 24.789056][ T339] do_futex+0x2bf/0x430 [ 24.794146][ T10] EXT4-fs warning (device sda1): ext4_end_bio:347: I/O error 17 writing to inode 2022 starting block 139334) [ 24.798703][ T339] ? _copy_from_user+0x8f/0xc0 [ 24.798728][ T339] ? __cfi_do_futex+0x10/0x10 [ 24.804728][ T10] EXT4-fs warning (device sda1): ext4_end_bio:347: I/O error 17 writing to inode 2022 starting block 139371) [ 24.814374][ T339] __se_sys_futex+0x136/0x310 [ 24.814396][ T339] ? __x64_sys_futex+0x100/0x100 [ 24.814411][ T339] ? xfd_validate_state+0x70/0x150 [ 24.820110][ T10] EXT4-fs warning (device sda1): ext4_end_bio:347: I/O error 17 writing to inode 2022 starting block 139448) [ 24.823199][ T339] ? __kasan_check_write+0x14/0x20 [ 24.823220][ T339] __x64_sys_futex+0xe5/0x100 [ 24.823236][ T339] x64_sys_call+0x7ec/0x9a0 [ 24.835909][ T10] EXT4-fs warning (device sda1): ext4_end_bio:347: I/O error 17 writing to inode 2022 starting block 139474) [ 24.839339][ T339] do_syscall_64+0x4c/0xa0 [ 24.839363][ T339] ? clear_bhb_loop+0x30/0x80 [ 24.980586][ T339] ? clear_bhb_loop+0x30/0x80 [ 24.985293][ T339] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 24.991190][ T339] RIP: 0033:0x7f5b22f9e0d9 [ 24.995611][ T339] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 25.015204][ T339] RSP: 002b:00007ffd4c46a9e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 25.023617][ T339] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f5b22f9e0d9 [ 25.031571][ T339] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f5b23225fa8 [ 25.039783][ T339] RBP: 000000000000085d R08: 0000000000000009 R09: 0000000000000000 [ 25.047736][ T339] R10: 00007f5b23225fa0 R11: 0000000000000246 R12: 0000000000000000 [ 25.055686][ T339] R13: 00007f5b23225fac R14: 00007f5b23225fa8 R15: 00007f5b23225fa0 [ 25.063643][ T339] [ 25.067531][ T314] Buffer I/O error on device sda1, logical block 35352 [ 25.081132][ T314] Buffer I/O error on device sda1, logical block 35353 [ 25.088445][ T314] Buffer I/O error on device sda1, logical block 35354 [ 25.095928][ T314] Buffer I/O error on device sda1, logical block 35355 [ 25.102833][ T315] usb 2-1: Using ep0 maxpacket: 8 [ 25.102928][ T314] Buffer I/O error on device sda1, logical block 35356 [ 25.109624][ T315] usb 2-1: config 0 has an invalid interface number: 143 but max is 0 [ 25.116769][ T314] Buffer I/O error on device sda1, logical block 35357 [ 25.123148][ T315] usb 2-1: config 0 has no interface number 0 [ 25.130088][ T314] Buffer I/O error on device sda1, logical block 35358 [ 25.136144][ T315] usb 2-1: New USB device found, idVendor=2058, idProduct=1005, bcdDevice=c1.9b [ 25.143010][ T314] Buffer I/O error on device sda1, logical block 35359 [ 25.152922][ T315] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 25.159172][ T314] Buffer I/O error on device sda1, logical block 35360 [ 25.174154][ T315] usb 2-1: config 0 descriptor?? [ 25.179173][ T314] Buffer I/O error on device sda1, logical block 35361 [ 25.179665][ T103] udevd[103]: worker [311] terminated by signal 7 (Bus error) [ 25.187669][ C0] ================================================================== [ 25.196581][ T103] udevd[103]: worker [311] failed while handling '/devices/platform/dummy_hcd.1/usb2/2-1' [ 25.201559][ C0] BUG: KASAN: use-after-free in strlen+0x57/0x70 [ 25.201585][ C0] Read of size 1 at addr ffff88810e5d4400 by task kworker/u4:4/314 [ 25.220298][ T103] udevd[103]: worker [321] terminated by signal 7 (Bus error) [ 25.225621][ C0] [ 25.225628][ C0] CPU: 0 PID: 314 Comm: kworker/u4:4 Tainted: G S syzkaller #0 [ 25.225647][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 25.225658][ C0] Workqueue: ext4-rsv-conversion ext4_end_io_rsv_work [ 25.233217][ T103] udevd[103]: worker [321] failed while handling '/devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.143' [ 25.235434][ C0] [ 25.235441][ C0] Call Trace: [ 25.277446][ C0] [ 25.280275][ C0] __dump_stack+0x21/0x24 [ 25.284591][ C0] dump_stack_lvl+0x110/0x170 [ 25.289250][ C0] ? __cfi_dump_stack_lvl+0x8/0x8 [ 25.294263][ C0] ? __cfi__printk+0x8/0x8 [ 25.298674][ C0] ? strlen+0x57/0x70 [ 25.302634][ C0] print_address_description+0x71/0x200 [ 25.308158][ C0] print_report+0x4a/0x60 [ 25.312639][ C0] kasan_report+0x122/0x150 [ 25.317122][ C0] ? strlen+0x57/0x70 [ 25.321082][ C0] __asan_report_load1_noabort+0x14/0x20 [ 25.326691][ C0] strlen+0x57/0x70 [ 25.330478][ C0] usb_gadget_get_string+0x1a9/0x310 [ 25.335753][ C0] get_string+0x467/0x1560 [ 25.340152][ C0] ? try_to_wake_up+0x622/0x1250 [ 25.345072][ C0] ? __cfi__raw_spin_lock+0x10/0x10 [ 25.350251][ C0] composite_setup+0x17ac/0x2950 [ 25.355193][ C0] android_setup+0x257/0x3a0 [ 25.359765][ C0] dummy_timer+0x1310/0x3270 [ 25.364341][ C0] ? __cfi_dummy_timer+0x10/0x10 [ 25.369261][ C0] ? timerqueue_del+0xd3/0x120 [ 25.374022][ C0] ? __cfi_dummy_timer+0x10/0x10 [ 25.378938][ C0] __hrtimer_run_queues+0x398/0x890 [ 25.384124][ C0] ? hrtimer_interrupt+0x8c0/0x8c0 [ 25.389215][ C0] hrtimer_run_softirq+0x19b/0x260 [ 25.394310][ C0] handle_softirqs+0x1d7/0x600 [ 25.399072][ C0] __irq_exit_rcu+0x52/0xf0 [ 25.403555][ C0] irq_exit_rcu+0x9/0x10 [ 25.407782][ C0] sysvec_apic_timer_interrupt+0xa9/0xc0 [ 25.413398][ C0] [ 25.416328][ C0] [ 25.419255][ C0] asm_sysvec_apic_timer_interrupt+0x1b/0x20 [ 25.425251][ C0] RIP: 0010:_raw_spin_unlock_irqrestore+0x55/0x80 [ 25.431678][ C0] Code: 80 db 0d 87 e8 7c f1 b5 fc 4c 89 f7 48 83 3d 01 dc 0c 02 00 74 30 e8 9e 0d 00 00 90 f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 d6 96 4b fc 65 8b 05 27 6e 01 7b 85 c0 74 05 5b 41 5e 5d c3 e8 [ 25.451289][ C0] RSP: 0018:ffffc9000dc3fb18 EFLAGS: 00000206 [ 25.457354][ C0] RAX: 0000000000000001 RBX: 0000000000000a06 RCX: dffffc0000000000 [ 25.465305][ C0] RDX: 0000000000000000 RSI: 0000000000000a06 RDI: 0000000000000001 [ 25.473254][ C0] RBP: ffffc9000dc3fb28 R08: 0000000000000003 R09: 0000000000000004 [ 25.481204][ C0] R10: dffffc0000000000 R11: fffff52001b87f3c R12: 0000000000000000 [ 25.489147][ C0] R13: dffffc0000000000 R14: 0000000000000000 R15: 0000000000000000 [ 25.497099][ C0] ? _raw_spin_unlock_irqrestore+0x46/0x80 [ 25.502890][ C0] ext4_finish_bio+0x637/0x750 [ 25.507642][ C0] ext4_release_io_end+0xf2/0x2c0 [ 25.512143][ T103] udevd[103]: worker [324] terminated by signal 7 (Bus error) [ 25.512668][ C0] ext4_end_io_rsv_work+0x50d/0x620 [ 25.520293][ T345] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 25.525288][ C0] ? finish_task_switch+0x16b/0x7c0 [ 25.525316][ C0] ? switch_mm_irqs_off+0x730/0x960 [ 25.533768][ T103] udevd[103]: worker [324] failed while handling '/devices/platform/dummy_hcd.1/usb2/2-1' [ 25.538783][ C0] ? __cfi_ext4_end_io_rsv_work+0x10/0x10 [ 25.547056][ T345] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 25.553818][ C0] ? __schedule+0xbea/0x14b0 [ 25.571772][ C0] process_one_work+0x717/0xc30 [ 25.576632][ C0] worker_thread+0xa4d/0x11d0 [ 25.581311][ C0] kthread+0x281/0x320 [ 25.585360][ C0] ? __cfi_worker_thread+0x10/0x10 [ 25.590451][ C0] ? __cfi_kthread+0x10/0x10 [ 25.595024][ C0] ret_from_fork+0x1f/0x30 [ 25.599451][ C0] [ 25.602467][ C0] [ 25.604801][ C0] Allocated by task 316: [ 25.609013][ C0] kasan_set_track+0x4b/0x70 [ 25.613580][ C0] kasan_save_alloc_info+0x1f/0x30 [ 25.618674][ C0] __kasan_kmalloc+0x95/0xb0 [ 25.623281][ C0] kmalloc_trace+0x40/0xb0 [ 25.627676][ C0] gadget_strings_product_store+0xeb/0x1f0 [ 25.633467][ C0] configfs_write_iter+0x323/0x410 [ 25.638563][ C0] vfs_write+0x5ef/0xd00 [ 25.642786][ C0] ksys_write+0x14a/0x260 [ 25.647126][ C0] __x64_sys_write+0x7b/0x90 [ 25.651695][ C0] x64_sys_call+0x27b/0x9a0 [ 25.656178][ C0] do_syscall_64+0x4c/0xa0 [ 25.660581][ C0] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 25.666482][ C0] [ 25.668803][ C0] Freed by task 334: [ 25.672696][ C0] kasan_set_track+0x4b/0x70 [ 25.677293][ C0] kasan_save_free_info+0x2b/0x40 [ 25.682304][ C0] ____kasan_slab_free+0x132/0x180 [ 25.687413][ C0] __kasan_slab_free+0x11/0x20 [ 25.692162][ C0] slab_free_freelist_hook+0xc2/0x190 [ 25.697523][ C0] __kmem_cache_free+0xb7/0x1b0 [ 25.702379][ C0] kfree+0x6f/0xf0 [ 25.706080][ C0] gadget_strings_attr_release+0x5f/0x190 [ 25.711777][ C0] config_item_put+0x166/0x210 [ 25.716522][ C0] configfs_rmdir+0x8c9/0x980 [ 25.721266][ C0] vfs_rmdir+0x381/0x4f0 [ 25.725507][ C0] do_rmdir+0x261/0x6b0 [ 25.729648][ C0] __x64_sys_rmdir+0x49/0x50 [ 25.734219][ C0] x64_sys_call+0x68e/0x9a0 [ 25.738714][ C0] do_syscall_64+0x4c/0xa0 [ 25.743130][ C0] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 25.749017][ C0] [ 25.751323][ C0] The buggy address belongs to the object at ffff88810e5d4400 [ 25.751323][ C0] which belongs to the cache kmalloc-128 of size 128 [ 25.765348][ C0] The buggy address is located 0 bytes inside of [ 25.765348][ C0] 128-byte region [ffff88810e5d4400, ffff88810e5d4480) [ 25.778422][ C0] [ 25.780724][ C0] The buggy address belongs to the physical page: [ 25.787123][ C0] page:ffffea0004397500 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10e5d4 [ 25.797345][ C0] flags: 0x4000000000000200(slab|zone=1) [ 25.802972][ C0] raw: 4000000000000200 0000000000000000 dead000000000001 ffff888100042a80 [ 25.811527][ C0] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 25.820096][ C0] page dumped because: kasan: bad access detected [ 25.826481][ C0] page_owner tracks the page as allocated [ 25.832184][ C0] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 1, tgid 1 (swapper/0), ts 2699551204, free_ts 0 [ 25.848763][ C0] post_alloc_hook+0x1f5/0x210 [ 25.853510][ C0] prep_new_page+0x1c/0x110 [ 25.857995][ C0] get_page_from_freelist+0x2ca9/0x2d20 [ 25.863523][ C0] __alloc_pages+0x1fa/0x610 [ 25.868092][ C0] alloc_slab_page+0x6e/0xf0 [ 25.872681][ C0] new_slab+0x98/0x3e0 [ 25.876738][ C0] ___slab_alloc+0x70f/0xb70 [ 25.881306][ C0] __slab_alloc+0x5e/0xa0 [ 25.885705][ C0] __kmem_cache_alloc_node+0x204/0x2d0 [ 25.891143][ C0] kmalloc_trace+0x29/0xb0 [ 25.895534][ C0] call_usermodehelper_setup+0x8e/0x210 [ 25.901061][ C0] kobject_uevent_env+0x650/0x720 [ 25.906066][ C0] kobject_uevent+0x1d/0x30 [ 25.910578][ C0] device_add+0xa1a/0xec0 [ 25.914909][ C0] usb_add_gadget+0x330/0x620 [ 25.919565][ C0] usb_add_gadget_udc+0x11a/0x150 [ 25.924570][ C0] page_owner free stack trace missing [ 25.930027][ C0] [ 25.932329][ C0] Memory state around the buggy address: [ 25.937933][ C0] ffff88810e5d4300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 25.945973][ C0] ffff88810e5d4380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 25.954198][ C0] >ffff88810e5d4400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 25.962245][ C0] ^ [ 25.966295][ C0] ffff88810e5d4480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 25.974962][ C0] ffff88810e5d4500: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 25.983000][ C0] ================================================================== [ 25.991040][ C0] Disabling lock debugging due to kernel taint [ 26.009709][ T304] usb 1-1: Dual-Role OTG device on HNP port [ 26.012633][ T331] Buffer I/O error on dev sda1, logical block 132, lost async page write [ 26.016455][ T66] Aborting journal on device sda1-8. [ 26.029530][ T66] Buffer I/O error on dev sda1, logical block 131072, lost sync page write [ 26.031044][ T331] Buffer I/O error on dev sda1, logical block 138, lost async page write [ 26.038202][ T304] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0104, bcdDevice= 6.01 [ 26.046965][ T331] Buffer I/O error on dev sda1, logical block 145, lost async page write [ 26.055701][ T66] JBD2: I/O error when updating journal superblock for sda1-8. [ 26.064528][ T331] Buffer I/O error on dev sda1, logical block 157, lost async page write [ 26.071647][ T304] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 26.082156][ T331] Buffer I/O error on dev sda1, logical block 158, lost async page write [ 26.090389][ T19] android_work: sent uevent USB_STATE=CONFIGURED [ 26.097057][ T331] Buffer I/O error on dev sda1, logical block 159, lost async page write [ 26.111454][ T331] Buffer I/O error on dev sda1, logical block 226, lost async page write [ 26.116260][ T103] udevd[103]: worker [317] terminated by signal 7 (Bus error) [ 26.120084][ T331] Buffer I/O error on dev sda1, logical block 243, lost async page write [ 26.127532][ T103] udevd[103]: worker [317] failed while handling '/devices/platform/dummy_hcd.0/usb1/1-1' [ 26.136102][ T331] Buffer I/O error on dev sda1, logical block 261, lost async page write [ 26.154699][ T43] EXT4-fs error (device sda1): ext4_journal_check_start:83: comm kworker/u4:2: Detected aborted journal [ 26.166060][ T43] EXT4-fs (sda1): I/O error while writing superblock [ 26.173409][ T43] EXT4-fs (sda1): Remounting filesystem read-only [ 26.179906][ T43] EXT4-fs (sda1): ext4_writepages: jbd2_start: 9223372036854775806 pages, ino 2030; err -30 [ 26.190401][ T103] udevd[103]: worker [325] terminated by signal 7 (Bus error) [ 26.197926][ T103] udevd[103]: worker [325] failed while handling '/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0' [ 26.254677][ T331] sd 0:0:1:0: [sda] Synchronizing SCSI cache [ 27.446341][ T60] usb 2-1: USB disconnect, device number 2 [ 27.448639][ T103] EXT4-fs error (device sda1): __ext4_find_entry:1685: inode #259: comm udevd: reading directory lblock 0 [ 27.463590][ T103] EXT4-fs error (device sda1): __ext4_find_entry:1685: inode #264: comm udevd: reading directory lblock 0 [ 27.475097][ T103] EXT4-fs error (device sda1): __ext4_find_entry:1685: inode #264: comm udevd: reading directory lblock 0 [ 27.486481][ T103] EXT4-fs error (device sda1): __ext4_find_entry:1685: inode #264: comm udevd: reading directory lblock 0 [ 27.498074][ T103] EXT4-fs error (device sda1): __ext4_find_entry:1685: inode #1642: comm udevd: reading directory lblock 0 [ 27.509582][ T103] EXT4-fs error (device sda1): __ext4_find_entry:1685: inode #1480: comm udevd: reading directory lblock 0 [ 30.529580][ T103] EXT4-fs error (device sda1): __ext4_find_entry:1685: inode #259: comm udevd: reading directory lblock 0 [ 30.541039][ T103] EXT4-fs error (device sda1): __ext4_find_entry:1685: inode #264: comm udevd: reading directory lblock 0 [ 30.552515][ T103] EXT4-fs error (device sda1): __ext4_find_entry:1685: inode #264: comm udevd: reading directory lblock 0