last executing test programs: 2.736629109s ago: executing program 2 (id=65): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x88406, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_X86_SETUP_MCE(r2, 0x4008ae9c, &(0x7f0000000480)={0xf, 0x0, 0x1}) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000180)={0x1, 0x0, [{0x17a, 0x0, 0x7fffffff}]}) ioctl$KVM_X86_SET_MCE(r2, 0x4040ae9e, &(0x7f0000000280)={0xed80000000000000, 0x70000, 0x9, 0x0, 0x2}) 2.68320464s ago: executing program 2 (id=66): r0 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r0, &(0x7f00000000c0)=@nameseq={0x1e, 0x1, 0x0, {0x42}}, 0x10) bind$tipc(r0, &(0x7f0000000040)=@name={0x1e, 0x2, 0x0, {{0x42, 0xfffffffe}}}, 0x10) bind$tipc(r0, &(0x7f0000000440)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x2, 0x3}}, 0x10) bind$tipc(r0, &(0x7f00000001c0)=@nameseq={0x1e, 0x1, 0x2, {0x42, 0x1, 0x5}}, 0x10) close(r0) 2.673877111s ago: executing program 2 (id=67): r0 = timerfd_create(0x0, 0x0) read(r0, &(0x7f0000000240)=""/123, 0x7b) clock_adjtime(0x5, &(0x7f0000000000)={0x3ff, 0x0, 0x0, 0x65, 0x0, 0x0, 0x0, 0x2, 0x0, 0x100, 0x0, 0x800, 0x9, 0x0, 0x100, 0xfffffffffffffffd, 0x0, 0x0, 0x1000, 0x100000001, 0x2, 0x1ff, 0x0, 0x3}) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) timer_settime(r1, 0x1, &(0x7f0000000040)={{0x77359400}}, 0x0) 1.763074924s ago: executing program 2 (id=77): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r2}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000080)={r2, 0x2000000, 0x1}) 1.713002046s ago: executing program 2 (id=78): r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) ioctl$UI_SET_ABSBIT(r0, 0x40045567, 0x0) write$uinput_user_dev(r0, &(0x7f0000000ec0)={'syz0\x00', {0x0, 0x0, 0xfffc, 0x4}, 0x0, [0x9faf, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x3, 0x0, 0x4, 0xfeffffff, 0x0, 0x0, 0xffff, 0x1, 0x0, 0x0, 0x20000000, 0x0, 0x4, 0x0, 0x6, 0x8, 0x7fff, 0x3, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28000000, 0xfffffffc, 0x0, 0x0, 0x80, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0xfffffffc, 0x3, 0x0, 0x401, 0x0, 0xffffffff, 0xdc, 0xa, 0x0, 0x2d52c0], [0x0, 0x801, 0x2, 0xb16, 0x0, 0xffffffcb, 0x0, 0x0, 0x0, 0x2000, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x4000000, 0x9, 0x0, 0x0, 0xfffffffd, 0xfffffffe, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x1000, 0x0, 0xf, 0xc559, 0x2000002, 0x0, 0x0, 0x0, 0xfffffffe, 0x20000100, 0x1, 0x0, 0x0, 0x66bd, 0x10001, 0xfefffffd, 0x1, 0x8, 0xd77, 0x0, 0x0, 0xfffff37a, 0x0, 0x0, 0x9bd, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0xf, 0x0, 0x2], [0x80000001, 0xa, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x9, 0x0, 0x7, 0x20000, 0xfffffffd, 0x2, 0xe, 0xffff, 0x0, 0x0, 0xffffff7f, 0x9, 0x0, 0x0, 0x0, 0x9, 0x0, 0x2, 0xf, 0x0, 0xd12, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x1000000, 0x8000000, 0x403, 0x0, 0x0, 0x0, 0x80, 0x8, 0x0, 0x7, 0xca, 0x0, 0xfffffffe, 0x4], [0x0, 0xfffffffc, 0xfffffffc, 0xc, 0x6, 0x0, 0x7, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x7e, 0x0, 0x3, 0x2, 0x0, 0xe, 0x4000000, 0x0, 0x0, 0x7, 0x0, 0x101, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0xfffeffff, 0x1fd, 0x10000, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0xfffffffd, 0x7fd, 0x0, 0x40002, 0x2, 0x0, 0x0, 0x6, 0x0, 0x401, 0x100000, 0x4, 0x10000, 0x0, 0x0, 0xfffffffd, 0x2, 0x0, 0x0, 0x0, 0x0, 0x5]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) write$uinput_user_dev(r0, &(0x7f0000000a40)={'syz0\x00', {0x0, 0x0, 0x0, 0xf}, 0x4d, [0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x4, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x4001, 0x0, 0x2, 0xfffffe00, 0x0, 0xa9, 0x0, 0x1, 0x0, 0x7ff, 0x80, 0x0, 0x4, 0xfffffffc, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x800, 0x3, 0x0, 0x0, 0x1, 0x0, 0x401, 0x0, 0x0, 0xfffffffe, 0xffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x2, 0x0, 0x2, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x4], [0xffffffff, 0x3, 0x10000002, 0x0, 0x0, 0x40000, 0x0, 0x4, 0xfffffffd, 0x800, 0x9262, 0x4, 0x0, 0x0, 0x0, 0x4, 0xffffffff, 0x400000, 0x1, 0x5, 0x0, 0x3, 0x0, 0x4, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000, 0x1000, 0x401f, 0x0, 0x0, 0x0, 0x4, 0xfffffffb, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xb, 0x0, 0x0, 0xfd5], [0x0, 0xfffffff6, 0x0, 0x20000004, 0x0, 0x5, 0x0, 0x0, 0x5, 0x0, 0xfffffffe, 0x800, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x8, 0x80000, 0x0, 0x0, 0x2, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x2, 0x8000000, 0x0, 0x0, 0x6, 0x0, 0x3, 0x6, 0x82, 0xffffffff, 0x0, 0x4, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x100, 0x0, 0x6, 0x6, 0x0, 0x5], [0x81, 0x5, 0x5d30, 0x1, 0x0, 0x100000, 0xdbc1, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x6, 0x0, 0x0, 0xfffffffe, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x8, 0xffffffff, 0x2, 0x0, 0xd, 0x0, 0x0, 0x0, 0x0, 0x2000, 0x4, 0x3, 0x0, 0xffffffdc, 0x2, 0x0, 0xff, 0x0, 0x0, 0x0, 0xe58b, 0xfffffff9, 0x0, 0x3, 0x0, 0x4, 0x1ff]}, 0x45c) 1.685595766s ago: executing program 2 (id=80): r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x2, 0x0, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x0, 0x0, 0x0, "", {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5}, {0xd, 0x24, 0xf, 0x1, 0xffffffff}, {0x6}}, {{0x9, 0x5, 0x81, 0x3, 0x200, 0x80}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200}}, {{0x9, 0x5, 0x3, 0x2, 0x40, 0x0, 0x0, 0x1}}}}}}}]}}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000340)={0x44, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x20, 0x80, 0x1c, {0x7ff, 0x10, 0x8, 0x4, 0xe, 0x7, 0x0, 0x1010, 0x12, 0x5, 0x10, 0x10}}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, &(0x7f0000000100)={0x14, 0x0, &(0x7f00000000c0)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) 1.133578371s ago: executing program 3 (id=97): syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000080)="67400f07c40249af4b8bb9800000c00f3235010200000f300f20a366450f769e00000100440f20c03588001d00445b66baf80cb88cf4b684ef66bafc0ced460f01c9c4827d24c366ba4cf0ff07ef87f345a57a43e16806a4", 0x58}], 0x1, 0x7c, 0x0, 0x0) mkdir(&(0x7f00000003c0)='./file0\x00', 0x25) mount$incfs(&(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='./file0\x00', &(0x7f0000000100), 0x82, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x8c) r1 = openat$incfs(r0, &(0x7f00000001c0)='.pending_reads\x00', 0x0, 0x130) ioctl$TIOCL_GETKMSGREDIRECT(r1, 0x40106726, &(0x7f00000000c0)) 1.117290611s ago: executing program 3 (id=98): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000004300), 0x1, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd2(0x5, 0x80800) ioctl$KVM_HYPERV_EVENTFD(r1, 0x4018aebd, &(0x7f0000000000)={0x0, r2}) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) close_range(r3, 0xffffffffffffffff, 0x0) 1.039373393s ago: executing program 3 (id=101): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, 0x0) ioctl$KVM_GET_LAPIC(r2, 0x8400ae8e, &(0x7f0000000880)) 967.683565ms ago: executing program 3 (id=105): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) write$tun(r0, &(0x7f0000000400)={@val={0x0, 0x891f}, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @multicast, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x67, 0x6000, 0x3, 0x2f, 0x0, @private=0x1fe1, @multicast1}, {0x4e22, 0x86dd, 0x8}}}}}}, 0x2e) 892.128307ms ago: executing program 3 (id=109): r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) r1 = socket$inet_udp(0x2, 0x2, 0x0) sendto$inet(r1, &(0x7f0000000080)='\x00\x00', 0x2, 0x0, &(0x7f00000000c0)={0x2, 0x4e20, @empty}, 0x10) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) recvfrom(r0, &(0x7f0000000100)=""/10, 0xa, 0x0, 0x0, 0x0) 869.901127ms ago: executing program 3 (id=111): r0 = syz_usb_connect$hid(0x1, 0x6e, &(0x7f00000000c0)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x1b1c, 0x1b3e, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x10, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0xfe, 0x3, 0x0, 0x1, 0x0, {0x9, 0x21, 0x1, 0xfc, 0x1, {0x22, 0x28}}, {{{0x9, 0x5, 0x81, 0x3, 0x420, 0x8, 0x81, 0x2}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) write$binfmt_script(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000040)={0x2c, &(0x7f00000005c0)={0x20, 0x2, 0x28, {0x28, 0x21, "83efb930f0187ff047a22a61a54607b71ea9e442359c479c37f525cde38bf4fd6ef4366b4800"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_LEAVE_OCB(0xffffffffffffffff, 0x0, 0x20004000) syz_usb_control_io(r0, &(0x7f00000001c0)={0x2c, 0x0, 0x0, 0x0, &(0x7f0000000140)={0x20, 0x29, 0xf, {0xf, 0x29, 0x27, 0x0, 0x7, 0xb, "2aa0d207", "42ee88a4"}}, 0x0}, 0x0) 798.621549ms ago: executing program 0 (id=114): r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r0, 0x107, 0xa, &(0x7f0000000080)=0x1, 0x4) setsockopt$packet_rx_ring(r0, 0x107, 0x5, &(0x7f0000000140)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x7ff, 0xf83, 0xaa}, 0x1c) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000480)={'veth0_virt_wifi\x00', 0x0}) sendto$packet(r1, &(0x7f00000000c0)="05030500d3fc030000004788800509", 0xf, 0x4, &(0x7f0000000140)={0x11, 0x5, r2}, 0x14) 787.58144ms ago: executing program 0 (id=115): symlink(&(0x7f0000000040)='.\x00', &(0x7f0000000100)='./file0\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdir(&(0x7f00000004c0)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000140)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@index_on}]}) chdir(&(0x7f0000000000)='./bus\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) 766.92727ms ago: executing program 0 (id=117): r0 = openat$kvm(0x0, &(0x7f00000002c0), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) ioctl$KVM_CAP_SPLIT_IRQCHIP(r1, 0x4068aea3, &(0x7f00000000c0)={0x79, 0x0, 0x1}) r2 = eventfd2(0x3, 0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000080)={r2, 0x4}) 704.093251ms ago: executing program 0 (id=120): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x101800, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x6) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f00009b3000/0x18000)=nil, &(0x7f00000000c0)=[@text32={0x20, &(0x7f0000000000)="0f3235004000000f300f01c8130f01d9300d76c4020a1bf7b805000000b90000c0feb805000000b9019000000f01c13cae0a41d941d9000f320f30660fc775022e0fba600c9864660ffc76002f3166b85766baa00066ed00d0", 0x59}], 0x1, 0x1, 0x0, 0x0) ioctl$KVM_SET_CPUID2(r2, 0x4008ae90, &(0x7f0000000380)={0x1, 0x0, [{0x7, 0x0, 0x1, 0xb8, 0x1000, 0x5, 0x6b89}]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 578.035475ms ago: executing program 0 (id=123): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$TUNSETLINK(r1, 0x400454cc, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000002c0)={'syzkaller0\x00', 0x7101}) ioctl$TUNSETOFFLOAD(r0, 0x400454d0, 0x1) 502.689816ms ago: executing program 0 (id=127): r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./file1\x00', 0x129942, 0x18) fcntl$setlease(r0, 0x400, 0x1) openat(0xffffffffffffff9c, &(0x7f0000000440)='./file1\x00', 0x400, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/locks\x00', 0x0, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x80000, 0x10) pread64(r1, &(0x7f00000000c0)=""/23, 0x17, 0x1) 295.725742ms ago: executing program 1 (id=131): r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000002040)='oom_score_adj\x00') write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000010c0)={0x30, 0x5, 0x0, {0x0, 0x2, 0x5, 0x6}}, 0x30) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) fstat(r1, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0}) setreuid(0x0, r2) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000040)={0x30, 0x5, 0x0, {0x0, 0x6, 0x4, 0x3}}, 0x30) 283.177162ms ago: executing program 1 (id=132): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r0, &(0x7f0000002080)={0x1f, 0x0, @any, 0x0, 0x1}, 0xe) write$binfmt_script(0xffffffffffffffff, 0x0, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) setsockopt$bt_BT_DEFER_SETUP(r0, 0x112, 0xf, &(0x7f0000000080)=0x4, 0x4) 268.774473ms ago: executing program 1 (id=133): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x41, &(0x7f0000000100)=0x2008, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000140)=0x2, 0x4) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) sendto$inet(r0, &(0x7f00000001c0)="40c3", 0x2, 0x20c1, 0x0, 0x0) 205.846804ms ago: executing program 1 (id=134): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x4008032, 0xffffffffffffffff, 0xcd0b3000) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x10, 0xffffffffffffffff, 0x0) openat$kvm(0xffffff9c, 0x0, 0x800, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/memory.limit_in_bytes\x00', 0x2, 0x0) write(r0, &(0x7f0000000080)='40', 0x2) mincore(&(0x7f000061b000/0x3000)=nil, 0x3000, &(0x7f0000000c40)=""/254) 40.830119ms ago: executing program 1 (id=135): r0 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000200)={[0x2, 0x9, 0xfffffffffffffffd, 0x2, 0x2, 0x0, 0x4002004c4, 0x1004, 0x8000000000000000, 0xc595, 0x0, 0x1, 0xffffffffffffffff, 0x2000000000000000, 0xb3, 0x8d], 0xeeee8000, 0x2010d3}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 0s ago: executing program 1 (id=136): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000180)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f000905", @ANYRES64], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(0xffffffffffffffff, &(0x7f0000000b00)={0x2c, &(0x7f0000000040)=ANY=[@ANYBLOB="00000f00000009003d140f3c36"], 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io(r0, &(0x7f0000000b00)={0x2c, &(0x7f0000000040)=ANY=[], 0x0, 0x0, 0x0, 0x0}, 0x0) r1 = syz_open_dev$hiddev(&(0x7f0000000100), 0x0, 0x0) ioctl$HIDIOCSREPORT(r1, 0x400c4808, &(0x7f00000001c0)={0x3, 0x100, 0xf7}) 0s ago: executing program 0 (id=137): r0 = syz_usb_connect$printer(0x0, 0x2d, &(0x7f0000000640)=ANY=[@ANYBLOB="12010000090000402505a8a440000102030109021b00010100000009040000020701010009050102"], 0x0) sendmmsg$inet(0xffffffffffffffff, 0x0, 0x0, 0x40) landlock_restrict_self(0xffffffffffffffff, 0x8) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000000000)={0x34, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)={0x20, 0x0, 0x1, 0x84}}) syz_open_dev$char_usb(0xc, 0xb4, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.118' (ED25519) to the list of known hosts. [ 22.127023][ T36] audit: type=1400 audit(1786027182.709:64): avc: denied { mounton } for pid=286 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 22.128141][ T286] cgroup: Unknown subsys name 'net' [ 22.149664][ T36] audit: type=1400 audit(1786027182.709:65): avc: denied { mount } for pid=286 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.176917][ T36] audit: type=1400 audit(1786027182.749:66): avc: denied { unmount } for pid=286 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.177109][ T286] cgroup: Unknown subsys name 'devices' [ 22.320288][ T286] cgroup: Unknown subsys name 'hugetlb' [ 22.325887][ T286] cgroup: Unknown subsys name 'rlimit' [ 22.417855][ T36] audit: type=1400 audit(1786027182.999:67): avc: denied { setattr } for pid=286 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 22.441026][ T36] audit: type=1400 audit(1786027182.999:68): avc: denied { mounton } for pid=286 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 22.448968][ T288] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 22.465975][ T36] audit: type=1400 audit(1786027182.999:69): avc: denied { mount } for pid=286 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 22.487874][ T286] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 22.497767][ T36] audit: type=1400 audit(1786027183.069:70): avc: denied { relabelto } for pid=288 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.531572][ T36] audit: type=1400 audit(1786027183.069:71): avc: denied { write } for pid=288 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.557150][ T36] audit: type=1400 audit(1786027183.079:72): avc: denied { read } for pid=286 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.582615][ T36] audit: type=1400 audit(1786027183.079:73): avc: denied { open } for pid=286 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.338809][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.345868][ T293] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.352933][ T293] bridge_slave_0: entered allmulticast mode [ 23.359103][ T293] bridge_slave_0: entered promiscuous mode [ 23.365341][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.372386][ T293] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.379451][ T293] bridge_slave_1: entered allmulticast mode [ 23.385541][ T293] bridge_slave_1: entered promiscuous mode [ 23.401733][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.408775][ T294] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.415808][ T294] bridge_slave_0: entered allmulticast mode [ 23.422084][ T294] bridge_slave_0: entered promiscuous mode [ 23.437694][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.444774][ T295] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.451892][ T295] bridge_slave_0: entered allmulticast mode [ 23.458013][ T295] bridge_slave_0: entered promiscuous mode [ 23.464166][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.471239][ T294] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.478275][ T294] bridge_slave_1: entered allmulticast mode [ 23.484587][ T294] bridge_slave_1: entered promiscuous mode [ 23.498873][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.505915][ T295] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.513001][ T295] bridge_slave_1: entered allmulticast mode [ 23.519134][ T295] bridge_slave_1: entered promiscuous mode [ 23.591229][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.598276][ T296] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.605388][ T296] bridge_slave_0: entered allmulticast mode [ 23.611583][ T296] bridge_slave_0: entered promiscuous mode [ 23.629671][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.636707][ T296] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.643772][ T296] bridge_slave_1: entered allmulticast mode [ 23.649950][ T296] bridge_slave_1: entered promiscuous mode [ 23.738516][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.745574][ T293] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.752866][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.759903][ T293] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.768190][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.775236][ T294] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.782513][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.789539][ T294] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.802867][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.809918][ T295] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.817164][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.824194][ T295] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.867858][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.874908][ T296] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.882181][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.889215][ T296] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.900050][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.907589][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.915023][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.922296][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.929513][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.936630][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.944320][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.951535][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.964174][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.971247][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.988223][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.995269][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.010268][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.017285][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.024909][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.031948][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.039571][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.046597][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.054200][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.061247][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.102242][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.109293][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.119628][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.126640][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.140482][ T294] veth0_vlan: entered promiscuous mode [ 24.155660][ T294] veth1_macvtap: entered promiscuous mode [ 24.166623][ T293] veth0_vlan: entered promiscuous mode [ 24.175028][ T295] veth0_vlan: entered promiscuous mode [ 24.202815][ T295] veth1_macvtap: entered promiscuous mode [ 24.213771][ T293] veth1_macvtap: entered promiscuous mode [ 24.226219][ T296] veth0_vlan: entered promiscuous mode [ 24.233307][ T294] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 24.237994][ T296] veth1_macvtap: entered promiscuous mode [ 24.581396][ T31] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 24.598362][ T341] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 24.739945][ T31] usb 4-1: unable to get BOS descriptor or descriptor too short [ 24.752253][ T31] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 24.762708][ T31] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 24.773373][ T31] usb 4-1: New USB device found, idVendor=1235, idProduct=0010, bcdDevice= 0.40 [ 24.782812][ T31] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 24.791253][ T31] usb 4-1: Product: syz [ 24.795422][ T31] usb 4-1: Manufacturer: syz [ 24.800447][ T31] usb 4-1: SerialNumber: syz [ 24.809149][ T31] usb 4-1: selecting invalid altsetting 1 [ 24.815148][ T31] usb 4-1: unit 6 not found! [ 25.817485][ T31] snd-usb-audio 4-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 25.827539][ T31] usb 4-1: USB disconnect, device number 2 [ 25.867107][ T313] udevd[313]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 25.932293][ T381] kvm: kvm [380]: vcpu0, guest rIP: 0x9114 Unhandled WRMSR(0xc2) = 0xf800 [ 25.941193][ T381] kvm: kvm [380]: vcpu0, guest rIP: 0x9114 Unhandled WRMSR(0xc1) = 0xf800 [ 26.146149][ T398] input: syz1 as /devices/virtual/input/input4 [ 26.218497][ T310] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 26.226123][ T314] rust_binder: 409: undelivered freeze notification, 0000000000000000 [ 26.368504][ T310] usb 2-1: Using ep0 maxpacket: 16 [ 26.374652][ T310] usb 2-1: config 0 has an invalid interface number: 105 but max is 0 [ 26.382880][ T310] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 26.393020][ T310] usb 2-1: config 0 has no interface number 0 [ 26.401164][ T310] usb 2-1: New USB device found, idVendor=046d, idProduct=08f3, bcdDevice= b.28 [ 26.416166][ T310] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 26.424298][ T310] usb 2-1: Product: syz [ 26.428645][ T310] usb 2-1: Manufacturer: syz [ 26.433241][ T310] usb 2-1: SerialNumber: syz [ 26.442179][ T310] usb 2-1: config 0 descriptor?? [ 26.538868][ T31] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 26.649474][ T310] usb 2-1: Found UVC 0.00 device syz (046d:08f3) [ 26.655907][ T310] usb 2-1: No valid video chain found. [ 26.662312][ T310] usb 2-1: USB disconnect, device number 2 [ 26.688506][ T31] usb 3-1: Using ep0 maxpacket: 16 [ 26.694635][ T31] usb 3-1: config 1 has an invalid interface number: 105 but max is 0 [ 26.702922][ T31] usb 3-1: config 1 has no interface number 0 [ 26.709148][ T31] usb 3-1: config 1 interface 105 altsetting 2 bulk endpoint 0x4 has invalid maxpacket 16 [ 26.719053][ T31] usb 3-1: config 1 interface 105 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 64 [ 26.729045][ T31] usb 3-1: config 1 interface 105 has no altsetting 0 [ 26.737174][ T31] usb 3-1: New USB device found, idVendor=20f4, idProduct=e05a, bcdDevice=6c.6d [ 26.746228][ T31] usb 3-1: New USB device strings: Mfr=1, Product=23, SerialNumber=3 [ 26.754387][ T31] usb 3-1: Product: syz [ 26.758851][ T31] usb 3-1: Manufacturer: syz [ 26.763429][ T31] usb 3-1: SerialNumber: syz [ 26.768487][ T53] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 26.768855][ T416] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 26.774926][ T314] usb 4-1: new full-speed USB device number 3 using dummy_hcd [ 26.783084][ T416] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 26.939576][ T314] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 26.956727][ T314] usb 4-1: New USB device found, idVendor=0458, idProduct=5005, bcdDevice= 0.00 [ 26.965844][ T314] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 26.974644][ T314] usb 4-1: config 0 descriptor?? [ 27.214938][ T416] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 27.222165][ T416] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 27.358496][ T310] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 27.388768][ T314] input: HID 0458:5005 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/0003:0458:5005.0001/input/input6 [ 27.401481][ T314] input: HID 0458:5005 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/0003:0458:5005.0001/input/input7 [ 27.423645][ T314] kye 0003:0458:5005.0001: input,hiddev96,hidraw0: USB HID v7f.fd Device [HID 0458:5005] on usb-dummy_hcd.3-1/input0 [ 27.518472][ T310] usb 1-1: Using ep0 maxpacket: 16 [ 27.524739][ T310] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 27.535800][ T310] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 27.545573][ T310] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 27.559029][ T310] usb 1-1: New USB device found, idVendor=045e, idProduct=10da, bcdDevice= 0.00 [ 27.568087][ T310] usb 1-1: New USB device strings: Mfr=0, Product=4, SerialNumber=0 [ 27.576087][ T310] usb 1-1: Product: syz [ 27.580991][ T310] usb 1-1: config 0 descriptor?? [ 27.591156][ T314] usb 4-1: USB disconnect, device number 3 [ 27.637808][ T31] aqc111 3-1:1.105 (unnamed net_device) (uninitialized): Failed to read(0x1) reg index 0x0001: -32 [ 27.849472][ T31] aqc111 3-1:1.105 (unnamed net_device) (uninitialized): Failed to read(0x1) reg index 0x0001: -71 [ 27.861687][ T31] aqc111 3-1:1.105 eth1: register 'aqc111' at usb-dummy_hcd.2-1, USB-C 3.1 to 5GBASE-T Ethernet Adapter, a6:a9:9d:07:e2:2d [ 27.876070][ T31] usb 3-1: USB disconnect, device number 3 [ 27.883778][ T31] aqc111 3-1:1.105 eth1: unregister 'aqc111' usb-dummy_hcd.2-1, USB-C 3.1 to 5GBASE-T Ethernet Adapter [ 27.895999][ T36] kauditd_printk_skb: 99 callbacks suppressed [ 27.896013][ T36] audit: type=1400 audit(1786027188.479:173): avc: denied { read } for pid=149 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=1 [ 27.923043][ T36] audit: type=1400 audit(1786027188.479:174): avc: denied { block_suspend } for pid=451 comm="syz.1.58" capability=36 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 27.947847][ T36] audit: type=1400 audit(1786027188.499:175): avc: denied { read } for pid=149 comm="dhcpcd" name="n15" dev="tmpfs" ino=718 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 27.972635][ T36] audit: type=1400 audit(1786027188.499:176): avc: denied { open } for pid=149 comm="dhcpcd" path="/run/udev/data/n15" dev="tmpfs" ino=718 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 27.999512][ T36] audit: type=1400 audit(1786027188.499:177): avc: denied { getattr } for pid=149 comm="dhcpcd" path="/run/udev/data/n15" dev="tmpfs" ino=718 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 28.026689][ T36] audit: type=1400 audit(1786027188.589:178): avc: denied { mount } for pid=454 comm="syz.1.59" name="/" dev="ramfs" ino=4665 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ramfs_t tclass=filesystem permissive=1 [ 28.049339][ T31] aqc111 3-1:1.105 eth1 (unregistered): Failed to write(0x1) reg index 0x0002: -19 [ 28.059544][ T310] hid-generic 0003:045E:10DA.0002: ignoring exceeding usage max [ 28.070087][ T31] aqc111 3-1:1.105 eth1 (unregistered): Failed to write(0x1) reg index 0x0002: -19 [ 28.081018][ T310] hid-generic 0003:045E:10DA.0002: ignoring exceeding usage max [ 28.090911][ T310] hid-generic 0003:045E:10DA.0002: unknown main item tag 0x0 [ 28.105984][ T31] aqc111 3-1:1.105 eth1 (unregistered): Failed to write(0x61) reg index 0x0000: -19 [ 28.118619][ T36] audit: type=1400 audit(1786027188.589:179): avc: denied { create } for pid=454 comm="syz.1.59" name="file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:ramfs_t tclass=chr_file permissive=1 [ 28.159720][ T310] hid-generic 0003:045E:10DA.0002: unknown main item tag 0x0 [ 28.160171][ T36] audit: type=1400 audit(1786027188.589:180): avc: denied { link } for pid=454 comm="syz.1.59" name="file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" dev="ramfs" ino=4666 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:ramfs_t tclass=chr_file permissive=1 [ 28.167136][ T310] hid-generic 0003:045E:10DA.0002: unbalanced collection at end of report description [ 28.167390][ T310] hid-generic 0003:045E:10DA.0002: probe with driver hid-generic failed with error -22 [ 28.210496][ T36] audit: type=1400 audit(1786027188.589:181): avc: denied { search } for pid=458 comm="dhcpcd-run-hook" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 28.273076][ T36] audit: type=1400 audit(1786027188.659:182): avc: denied { getattr } for pid=456 comm="dhcpcd-run-hook" path="/run/dhcpcd/hook-state/resolv.conf" dev="tmpfs" ino=425 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 28.299090][ T387] usb 1-1: USB disconnect, device number 2 [ 28.388488][ T314] usb 4-1: new full-speed USB device number 4 using dummy_hcd [ 28.508484][ T310] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 28.543013][ T314] usb 4-1: unable to get BOS descriptor or descriptor too short [ 28.553461][ T314] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 28.561314][ T314] usb 4-1: can't read configurations, error -71 [ 28.668477][ T310] usb 2-1: Using ep0 maxpacket: 16 [ 28.675793][ T310] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 28.687328][ T310] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 28.700504][ T310] usb 2-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 28.709735][ T310] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 28.718421][ T310] usb 2-1: config 0 descriptor?? [ 28.923486][ T505] process 'syz.0.70' launched './file1' with NULL argv: empty string added [ 28.949811][ T310] usbhid 2-1:0.0: can't add hid device: -71 [ 28.957910][ T310] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 28.977169][ T310] usb 2-1: USB disconnect, device number 3 [ 29.090104][ T513] netlink: 16 bytes leftover after parsing attributes in process `syz.3.74'. [ 29.458907][ T522] input: syz0 as /devices/virtual/input/input8 [ 29.719042][ T310] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 29.768381][ T540] ======================================================= [ 29.768381][ T540] WARNING: The mand mount option has been deprecated and [ 29.768381][ T540] and is ignored by this kernel. Remove the mand [ 29.768381][ T540] option from the mount to silence this warning. [ 29.768381][ T540] ======================================================= [ 29.880747][ T310] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 128, changing to 11 [ 29.891921][ T310] usb 3-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 64 [ 29.903029][ T310] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 29.912093][ T310] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 29.920123][ T310] usb 3-1: Product: syz [ 29.924285][ T310] usb 3-1: Manufacturer: syz [ 29.928914][ T310] usb 3-1: SerialNumber: syz [ 29.936344][ T554] syzkaller1: entered promiscuous mode [ 29.942011][ T554] syzkaller1: entered allmulticast mode [ 30.136743][ T526] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 30.216932][ T582] dummy_hcd dummy_hcd.0: remove, state 4 [ 30.224472][ T582] usb usb1: USB disconnect, device number 1 [ 30.235172][ T582] dummy_hcd dummy_hcd.0: stopped [ 30.240198][ T582] dummy_hcd dummy_hcd.0: USB bus 1 deregistered [ 30.412490][ T610] input: syz1 as /devices/virtual/input/input9 [ 30.462067][ T612] kvm: user requested TSC rate below hardware speed [ 30.469222][ T612] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=2961764976 (5923529952 ns) > initial count (2430913814 ns). Using initial count to start timer. [ 30.522906][ T614] kvm: kvm [613]: vcpu6, guest rIP: 0x9139 Unhandled WRMSR(0x11e) = 0xbe702111 [ 30.548470][ T10] usb 4-1: new low-speed USB device number 6 using dummy_hcd [ 30.612251][ T625] netlink: 'syz.1.125': attribute type 2 has an invalid length. [ 30.619936][ T625] netlink: 8 bytes leftover after parsing attributes in process `syz.1.125'. [ 30.646865][ T627] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 30.729572][ T10] usb 4-1: too many endpoints for config 0 interface 0 altsetting 0: 254, using maximum allowed: 30 [ 30.730100][ T634] kvm: vcpu 1: requested lapic timer restore with starting count register 0x390=4044617448 (258855516672 ns) > initial count (110676013376 ns). Using initial count to start timer. [ 30.740424][ T10] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1056, setting to 8 [ 30.769305][ T526] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 30.772686][ T634] kvm: apic: phys broadcast and lowest prio [ 30.777080][ T10] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 254 [ 30.795506][ T10] usb 4-1: New USB device found, idVendor=1b1c, idProduct=1b3e, bcdDevice= 0.00 [ 30.804605][ T10] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 30.813664][ T10] usb 4-1: config 0 descriptor?? [ 30.819075][ T595] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 30.990279][ T310] cdc_ncm 3-1:1.0: MAC-Address: 42:42:42:42:42:42 [ 30.996852][ T310] cdc_ncm 3-1:1.0: dwNtbInMaxSize=8 is too small. Using 2048 [ 31.004465][ T310] cdc_ncm 3-1:1.0: setting rx_max = 2048 [ 31.193100][ T310] cdc_ncm 3-1:1.0 usb0: register 'cdc_ncm' at usb-dummy_hcd.2-1, CDC NCM (NO ZLP), 42:42:42:42:42:42 [ 31.205783][ T310] usb 3-1: USB disconnect, device number 4 [ 31.212066][ T310] cdc_ncm 3-1:1.0 usb0: unregister 'cdc_ncm' usb-dummy_hcd.2-1, CDC NCM (NO ZLP) [ 31.230477][ T10] hid-generic 0003:1B1C:1B3E.0003: unknown main item tag 0x2 [ 31.237921][ T10] hid-generic 0003:1B1C:1B3E.0003: unknown main item tag 0x6 [ 31.246078][ T10] hid-generic 0003:1B1C:1B3E.0003: unknown main item tag 0x4 [ 31.253539][ T10] hid-generic 0003:1B1C:1B3E.0003: unknown main item tag 0x0 [ 31.261542][ T10] hid-generic 0003:1B1C:1B3E.0003: hidraw0: USB HID v0.01 Device [HID 1b1c:1b3e] on usb-dummy_hcd.3-1/input0 [ 31.428486][ T314] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 31.508320][ T655] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN PTI [ 31.520933][ T655] KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] [ 31.529346][ T655] CPU: 0 UID: 0 PID: 655 Comm: syz.0.137 Not tainted syzkaller #0 67f5df147bfe8fe71cdb2f404f013e40b3f12e05 [ 31.540708][ T655] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 31.550741][ T655] RIP: 0010:dummy_udc_start+0xd1/0x1f0 [ 31.556195][ T655] Code: 41 83 ff 03 74 18 41 83 ff 05 0f 85 94 00 00 00 e8 24 05 ce fd eb 0c e8 1d 05 ce fd eb 05 e8 16 05 ce fd 4c 89 f0 48 c1 e8 03 <42> 80 3c 20 00 74 08 4c 89 f7 e8 70 c9 26 fe 4d 8b 36 4c 89 f7 e8 [ 31.575781][ T655] RSP: 0018:ffffc9000e6b7818 EFLAGS: 00010246 [ 31.581855][ T655] RAX: 0000000000000000 RBX: ffff8881057da010 RCX: 0000000000080000 [ 31.589810][ T655] RDX: ffffc900016a1000 RSI: 0000000000000938 RDI: 0000000000000939 [ 31.597760][ T655] RBP: ffffc9000e6b7840 R08: ffff88810db48000 R09: 0000000000000004 [ 31.605710][ T655] R10: 0000000000000005 R11: 0000000000000002 R12: dffffc0000000000 [ 31.613658][ T655] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000003 [ 31.621607][ T655] FS: 00007f62536456c0(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 31.630519][ T655] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 31.637077][ T655] CR2: 00007f6252787240 CR3: 000000010bb42000 CR4: 00000000003526b0 [ 31.645031][ T655] Call Trace: [ 31.648289][ T655] [ 31.651202][ T655] ? __cfi_dummy_udc_start+0x10/0x10 [ 31.656472][ T655] gadget_bind_driver+0x3e1/0x9c0 [ 31.661494][ T655] ? __cfi_gadget_bind_driver+0x10/0x10 [ 31.667019][ T655] really_probe+0x2e1/0x8b0 [ 31.671519][ T655] __driver_probe_device+0x193/0x280 [ 31.676784][ T655] driver_probe_device+0x54/0x3f0 [ 31.681786][ T655] __driver_attach+0x422/0x5e0 [ 31.686529][ T655] bus_for_each_dev+0x249/0x2d0 [ 31.691356][ T655] ? __cfi___driver_attach+0x10/0x10 [ 31.696622][ T655] ? __cfi_bus_for_each_dev+0x10/0x10 [ 31.701977][ T655] ? __kasan_kmalloc+0x96/0xb0 [ 31.706761][ T655] ? _raw_spin_unlock+0x45/0x60 [ 31.711630][ T655] ? klist_add_tail+0x1dd/0x220 [ 31.716493][ T655] driver_attach+0x46/0x50 [ 31.720930][ T655] bus_add_driver+0x393/0x730 [ 31.725620][ T655] driver_register+0x2b7/0x3c0 [ 31.730378][ T655] usb_gadget_register_driver_owner+0xfc/0x270 [ 31.736513][ T655] raw_ioctl+0x144c/0x37a0 [ 31.740918][ T655] ? __cfi_raw_ioctl+0x10/0x10 [ 31.745682][ T655] ? selinux_file_ioctl+0x732/0x1480 [ 31.750949][ T655] ? __cfi_selinux_file_ioctl+0x10/0x10 [ 31.756479][ T655] ? bpf_lsm_file_ioctl+0xd/0x20 [ 31.761400][ T655] ? security_file_ioctl+0x3e/0x110 [ 31.766636][ T655] ? __cfi_raw_ioctl+0x10/0x10 [ 31.771395][ T655] __se_sys_ioctl+0x135/0x1b0 [ 31.776057][ T655] __x64_sys_ioctl+0x7f/0xa0 [ 31.780650][ T655] x64_sys_call+0x1878/0x2ee0 [ 31.785324][ T655] do_syscall_64+0x57/0xf0 [ 31.789723][ T655] ? clear_bhb_loop+0x50/0xa0 [ 31.794388][ T655] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 31.800264][ T655] RIP: 0033:0x7f625279dd6b [ 31.804669][ T655] Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00 [ 31.824261][ T655] RSP: 002b:00007f6253642f00 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 31.832670][ T655] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f625279dd6b [ 31.840641][ T655] RDX: 0000000000000000 RSI: 0000000000005501 RDI: 0000000000000003 [ 31.848602][ T655] RBP: 00007f6253643fd0 R08: 0000000000000001 R09: 00000000ffffffff [ 31.856562][ T655] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 31.864523][ T655] R13: 0000200000000640 R14: 0000000000000000 R15: 0000000000000000 [ 31.872492][ T655] [ 31.875500][ T655] Modules linked in: [ 31.879524][ T655] ---[ end trace 0000000000000000 ]--- [ 31.885302][ T655] RIP: 0010:dummy_udc_start+0xd1/0x1f0 [ 31.891209][ T655] Code: 41 83 ff 03 74 18 41 83 ff 05 0f 85 94 00 00 00 e8 24 05 ce fd eb 0c e8 1d 05 ce fd eb 05 e8 16 05 ce fd 4c 89 f0 48 c1 e8 03 <42> 80 3c 20 00 74 08 4c 89 f7 e8 70 c9 26 fe 4d 8b 36 4c 89 f7 e8 [ 31.911121][ T655] RSP: 0018:ffffc9000e6b7818 EFLAGS: 00010246 [ 31.917265][ T655] RAX: 0000000000000000 RBX: ffff8881057da010 RCX: 0000000000080000 [ 31.925612][ T655] RDX: ffffc900016a1000 RSI: 0000000000000938 RDI: 0000000000000939 [ 31.933779][ T655] RBP: ffffc9000e6b7840 R08: ffff88810db48000 R09: 0000000000000004 [ 31.941893][ T655] R10: 0000000000000005 R11: 0000000000000002 R12: dffffc0000000000 [ 31.949931][ T655] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000003 [ 31.957971][ T314] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 31.958019][ T655] FS: 00007f62536456c0(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 31.969447][ T314] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11 [ 31.969475][ T314] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 31.969502][ T314] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 31.978549][ T655] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 31.989544][ T314] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 32.001040][ T655] CR2: 00007f9f923eec38 CR3: 000000010bb42000 CR4: 00000000003526b0 [ 32.013445][ T314] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 32.014412][ T314] usb 2-1: config 0 descriptor?? [ 32.023053][ T655] Kernel panic - not syncing: Fatal exception [ 32.029275][ T655] Kernel Offset: disabled