last executing test programs: 111.937271ms ago: executing program 3 (id=4): r0 = socket$packet(0x11, 0x3, 0x300) getsockopt$packet_buf(r0, 0x107, 0x6, &(0x7f0000000000)=""/122, &(0x7f00000000c0)=0x7a) setsockopt$packet_rx_ring(r0, 0x107, 0xd, &(0x7f0000000080)=@req3={0x0, 0x11dd, 0xb, 0xfffffffb, 0x7, 0xfff, 0x3}, 0x1c) socket$packet(0x11, 0x3, 0x300) (async) getsockopt$packet_buf(r0, 0x107, 0x6, &(0x7f0000000000)=""/122, &(0x7f00000000c0)=0x7a) (async) setsockopt$packet_rx_ring(r0, 0x107, 0xd, &(0x7f0000000080)=@req3={0x0, 0x11dd, 0xb, 0xfffffffb, 0x7, 0xfff, 0x3}, 0x1c) (async) 83.859506ms ago: executing program 3 (id=5): r0 = socket$inet6(0x10, 0x3, 0x0) (async) r1 = syz_open_procfs(0x0, &(0x7f0000000200)='task\x00') lseek(r1, 0xfffffffffffffffc, 0x2) r2 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_CONN_TIMEOUT(r2, 0x10f, 0x82, &(0x7f0000000080)=0x6, 0x4) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./file0\x00', 0x0) (async, rerun: 32) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002040), 0x2, 0x0) (rerun: 32) mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', &(0x7f00000020c0), 0x200000, &(0x7f0000000140)={{'fd', 0x3d, r3}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {}, 0x2c, {[{@allow_other}]}}) (async) openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x20000, 0x40) (async) syz_fuse_handle_req(r3, &(0x7f00000021c0), 0x2000, &(0x7f00000041c0)={&(0x7f0000004280)={0x50}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) syz_fuse_handle_req(r3, &(0x7f0000004300), 0x2000, &(0x7f0000006300)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000063c0)={0x20}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async, rerun: 64) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000040)={0x42}, 0x10) (async, rerun: 64) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000480)=ANY=[@ANYBLOB="280000001c00210000000000000000000700000016000000020000000a0002"], 0x28}, 0x1, 0x0, 0x0, 0x4000000}, 0x50) (async) setsockopt$TIPC_GROUP_LEAVE(r2, 0x10f, 0x88) sendmsg$tipc(r2, &(0x7f0000000c80)={&(0x7f0000000980)=@id, 0x10, 0x0}, 0x0) (async, rerun: 32) r5 = syz_open_procfs$pagemap(0x0, &(0x7f0000001080)) (async, rerun: 32) add_key$user(0x0, 0x0, &(0x7f0000000140)="f8200b6e93f6ae3e0cbddda78b7488da38db61948220bffe4729f7b4b5715b788a1e76a2774a4e0bc0183d4ed22818952f178da81e3eee65177ce2391ba6f4d5e6b25b0abdeff083223b5f090f4d02f5e31f9659a2e024969c83a11da3561c6c50a72bb62cc825903d9a67661bfe0c5555b57db4988c962edbef8866c4e9694fff3245b75fc34b6d90ba04d5971e267cdf5f34bcfbe3e516a98e24ed65a377e72f8e3237deaa9bfef275c7ce3996393eecc05e45323d69e8725700b78bf48003c4b9f1a4104b0152", 0xc8, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="1c0000006600"], 0x1c}}, 0x0) (async) ioctl$PAGEMAP_SCAN(r5, 0xc0606610, &(0x7f0000000140)={0x60, 0x0, &(0x7f0000001000/0x3000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x4, &(0x7f0000000000)=[{0x800010000, 0x0, 0xffffffffffffffff}, {0x0, 0x2, 0x800}], 0x2, 0xbff, 0x1e, 0x0, 0x48, 0x6e}) (async, rerun: 32) connect$tipc(r2, &(0x7f00000000c0)=@name, 0x10) (async, rerun: 32) unshare(0x62040200) (async) sendto$inet6(r0, &(0x7f0000000040)="1ba0000016001d0d89fdc5cbdd045798707bed4d4a141a780f0f8e", 0x1b, 0x4004810, 0x0, 0x0) (async) recvfrom$inet6(r0, &(0x7f0000000000)=""/45, 0x44, 0x0, 0x0, 0xffffffffffffffc3) (async, rerun: 64) writev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000000)="48050000150019", 0x7}], 0x1) (async, rerun: 64) r7 = socket$inet6(0x10, 0x3, 0x0) sendto$inet6(r7, &(0x7f0000000000)='s', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)) 60.337911ms ago: executing program 0 (id=1): pipe(&(0x7f0000001300)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$selinux_relabel(0xffffffffffffff9c, &(0x7f0000001540), 0x2, 0x0) splice(r1, 0x0, r2, &(0x7f0000001580)=0x3, 0x9611, 0x0) r3 = syz_usb_connect$hid(0x0, 0x3f, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000107e05192000000000000109022d0001000000000904000005030015000921050000012205000905810320"], 0x0) syz_usb_control_io(r3, 0x0, 0x0) r4 = syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000030020f003176c400000000001090224725100000000090400001207010300090501020000000000090582020002"], 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) r6 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) setsockopt$bt_BT_DEFER_SETUP(r6, 0x112, 0xf, 0x0, 0x0) sendmsg$nl_generic(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000880)={0x28, 0x18, 0x229, 0x0, 0x25dfdbff, {0x2}, [@typed={0x8, 0x800, 0x0, 0x0, @u32=0x4}, @nested={0x4, 0x8}, @typed={0x8, 0x1e, 0x0, 0x0, @fd=r5}]}, 0x28}}, 0x0) r7 = syz_usb_connect$midi(0x4, 0x30, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x10, 0x582, 0x33, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1e, 0x1, 0x1, 0x5, 0x60, 0x3, "", {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x3, 0x20, 0x4, [@midi_in_jack={0x6, 0x24, 0x2, 0x3, 0x7, 0xa}, @midi_in_jack={0x6, 0x24, 0x2, 0x1, 0xe, 0x8}]}}}}}]}}, 0x0) syz_usb_control_io(r3, &(0x7f0000000b00)={0x2c, 0x0, &(0x7f0000000280)=ANY=[@ANYRES64=r7, @ANYRES16, @ANYRES32=r7, @ANYRES8=r0, @ANYBLOB="0e32c1333fd4162929a6d82c8529093e85b784b7cd839d981ed6fb2a29d238a0484818d83451d9077cf443e4df8fea97a54fb568ae4d2151d49feba6fefb9ecb836b061817f9aa4474f53887484b0e604661bfe12201b68557ff1af595e4da0c5e3924c83d6f4e2854c7b3ca59132f995b1c2434e60189a51a3129593b4b5b4c27bfd5d232a9912e3314a8f522377337d56e3f685fde51a5ddd5797e39bcb2ec427551", @ANYRESDEC=r4], 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io(r7, &(0x7f0000000380)={0x47, 0x0, &(0x7f0000000240)={0x0, 0x3, 0x2, @string={0x2}}, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$lan78xx(r7, 0x0, 0x0) syz_usb_control_io$lan78xx(r7, 0x0, 0x0) syz_usb_control_io$printer(r7, 0x0, 0x0) syz_usb_control_io$uac2(r7, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r7, 0x0, 0x0) syz_usb_control_io(r7, 0x0, 0x0) syz_usb_disconnect(r3) r8 = syz_usb_connect(0x0, 0x24, &(0x7f0000000040)=ANY=[], 0x0) syz_usb_control_io$hid(r8, 0x0, 0x0) r9 = socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$tipc2(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ADD(r9, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000400)={0x18, r10, 0x4c1dad3e3d6a7499, 0x70bd2d, 0x25dfdbfb, {}, [@TIPC_NLA_BEARER={0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x4000080}, 0x2400c000) syz_usb_disconnect(0xffffffffffffffff) r11 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) gettimeofday(0x0, 0x0) read$char_usb(r11, 0x0, 0x0) syz_usb_control_io(r3, &(0x7f0000000040)={0x2c, &(0x7f0000000580)=ANY=[@ANYRES16=r0], 0x0, 0x0, 0x0, 0x0}, 0x0) 38.943787ms ago: executing program 2 (id=3): r0 = socket(0x1e, 0x4, 0x0) r1 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r1, 0x10f, 0x87, &(0x7f0000000440)=@req={0x3fc}, 0x10) setsockopt$packet_tx_ring(r0, 0x10f, 0x87, &(0x7f0000000440)=@req={0x3fc}, 0x10) sendmmsg(r0, &(0x7f0000002600)=[{{0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000300)="b62d4a", 0x3}], 0x1}}], 0x1, 0x80) r2 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r2, 0x10f, 0x87, &(0x7f0000000440)=@req={0x3fc}, 0x10) r3 = dup3(r1, r0, 0x0) ioctl$TCXONC(r3, 0x540a, 0x2) recvmmsg$unix(r3, &(0x7f0000001280)=[{{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000005140)=""/4111, 0x100f}], 0x1}}], 0x1, 0x58ca2280, 0x0) 37.405347ms ago: executing program 1 (id=2): mkdirat(0xffffffffffffff9c, &(0x7f00000004c0)='./file0\x00', 0x0) mkdir(&(0x7f0000000180)='./file0/file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f00000001c0)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) chdir(&(0x7f0000000380)='./bus/file0\x00') fchmodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000004280)='./file0\x00', 0x0, 0x4b) getdents(r0, 0x0, 0x0) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) stat(&(0x7f0000000040)='./bus/file0\x00', 0x0) r1 = open$dir(&(0x7f0000000100)='./file0\x00', 0x2000, 0x1d6) r2 = syz_open_procfs$userns(0xffffffffffffffff, &(0x7f00000001c0)) mount_setattr(r1, &(0x7f0000000180)='./bus/file0\x00', 0x100, &(0x7f0000000240)={0x100000, 0x73, 0x20000, {r2}}, 0x20) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x110) setxattr$incfs_size(&(0x7f0000000280)='./bus\x00', &(0x7f00000002c0), &(0x7f0000000300)=0x4, 0x8, 0x0) mount$incfs(&(0x7f0000000080)='./file0\x00', &(0x7f0000000140)='./file0\x00', &(0x7f0000000000), 0x80, 0x0) 37.118117ms ago: executing program 3 (id=6): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x42902, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x6, 0x12, r0, 0x8fe5e000) madvise(&(0x7f000012c000/0x3000)=nil, 0x3000, 0xe) r1 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000), 0x9b2f780f5e298ee0, 0x0) setsockopt$netlink_NETLINK_NO_ENOBUFS(r1, 0x10e, 0x5, &(0x7f0000000040)=0x2, 0x4) syz_kvm_setup_syzos_vm$x86(0xffffffffffffffff, &(0x7f0000308000/0x400000)=nil) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) 0s ago: executing program 1 (id=7): timerfd_settime(0xffffffffffffffff, 0x3, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x3938700}}, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text32={0x20, &(0x7f0000000180)="660f388173ab0fc76fb4360fc9bb25cc00007666ba6b41b000f303c70fae6e2fc0c00f0f2367260f01ca660f38817700c4c2459d78ad", 0x36}], 0x1, 0x51, 0x0, 0x0) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000200)={{{@in6=@empty, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@initdev}, 0x0, @in=@dev}}, &(0x7f0000000300)=0xe8) mount$incfs(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f00000001c0), 0x4, &(0x7f0000000340)=ANY=[@ANYBLOB='readahead=00000000000000000007,read_timeout_ms=00000000000000000002,pcr=00000000000000000055,uid>', @ANYRESDEC=r3, @ANYBLOB]) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fdd000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, 0x0}], 0x1, 0x74, 0x0, 0x0) ioctl$KVM_SET_NESTED_STATE(r2, 0x4080aebf, &(0x7f0000005700)=@vmx={0x0, 0x0, 0x2080}) ioctl$KVM_RUN(r2, 0xae80, 0x0) timer_create(0x7, &(0x7f0000000000)={0x0, 0x3a, 0x2, @tid=0xffffffffffffffff}, &(0x7f0000000040)) timerfd_settime(0xffffffffffffffff, 0x3, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x3938700}}, 0x0) (async) openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) (async) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) (async) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text32={0x20, &(0x7f0000000180)="660f388173ab0fc76fb4360fc9bb25cc00007666ba6b41b000f303c70fae6e2fc0c00f0f2367260f01ca660f38817700c4c2459d78ad", 0x36}], 0x1, 0x51, 0x0, 0x0) (async) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000200)={{{@in6=@empty, @in=@multicast2}}, {{@in=@initdev}, 0x0, @in=@dev}}, &(0x7f0000000300)=0xe8) (async) mount$incfs(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f00000001c0), 0x4, &(0x7f0000000340)=ANY=[@ANYBLOB='readahead=00000000000000000007,read_timeout_ms=00000000000000000002,pcr=00000000000000000055,uid>', @ANYRESDEC=r3, @ANYBLOB]) (async) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fdd000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, 0x0}], 0x1, 0x74, 0x0, 0x0) (async) ioctl$KVM_SET_NESTED_STATE(r2, 0x4080aebf, &(0x7f0000005700)=@vmx={0x0, 0x0, 0x2080}) (async) ioctl$KVM_RUN(r2, 0xae80, 0x0) (async) timer_create(0x7, &(0x7f0000000000)={0x0, 0x3a, 0x2, @tid=0xffffffffffffffff}, &(0x7f0000000040)) (async) kernel console output (not intermixed with test programs): cess permissive=1 [ 13.025896][ T36] audit: type=1400 audit(1773325485.449:63): avc: denied { siginh } for pid=232 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 Warning: Permanently added '10.128.1.221' (ED25519) to the list of known hosts. [ 19.897428][ T36] audit: type=1400 audit(1773325492.329:64): avc: denied { mounton } for pid=282 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2022 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 19.898561][ T282] cgroup: Unknown subsys name 'net' [ 19.920132][ T36] audit: type=1400 audit(1773325492.329:65): avc: denied { mount } for pid=282 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 19.947393][ T36] audit: type=1400 audit(1773325492.359:66): avc: denied { unmount } for pid=282 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 19.947559][ T282] cgroup: Unknown subsys name 'devices' [ 20.071430][ T282] cgroup: Unknown subsys name 'hugetlb' [ 20.077040][ T282] cgroup: Unknown subsys name 'rlimit' [ 20.229838][ T36] audit: type=1400 audit(1773325492.669:67): avc: denied { setattr } for pid=282 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 20.253037][ T36] audit: type=1400 audit(1773325492.669:68): avc: denied { mounton } for pid=282 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 20.267495][ T284] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 20.277913][ T36] audit: type=1400 audit(1773325492.669:69): avc: denied { mount } for pid=282 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 20.309514][ T36] audit: type=1400 audit(1773325492.729:70): avc: denied { relabelto } for pid=284 comm="mkswap" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 20.314079][ T282] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 20.335001][ T36] audit: type=1400 audit(1773325492.729:71): avc: denied { write } for pid=284 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 20.369320][ T36] audit: type=1400 audit(1773325492.749:72): avc: denied { read } for pid=282 comm="syz-executor" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 20.394844][ T36] audit: type=1400 audit(1773325492.749:73): avc: denied { open } for pid=282 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.157270][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.164428][ T289] bridge0: port 1(bridge_slave_0) entered disabled state [ 21.171604][ T289] bridge_slave_0: entered allmulticast mode [ 21.177778][ T289] bridge_slave_0: entered promiscuous mode [ 21.186850][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.193930][ T289] bridge0: port 2(bridge_slave_1) entered disabled state [ 21.201058][ T289] bridge_slave_1: entered allmulticast mode [ 21.207215][ T289] bridge_slave_1: entered promiscuous mode [ 21.256074][ T291] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.263910][ T291] bridge0: port 1(bridge_slave_0) entered disabled state [ 21.271007][ T291] bridge_slave_0: entered allmulticast mode [ 21.277164][ T291] bridge_slave_0: entered promiscuous mode [ 21.283436][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.290501][ T290] bridge0: port 1(bridge_slave_0) entered disabled state [ 21.297553][ T290] bridge_slave_0: entered allmulticast mode [ 21.303885][ T290] bridge_slave_0: entered promiscuous mode [ 21.312779][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.319864][ T290] bridge0: port 2(bridge_slave_1) entered disabled state [ 21.326946][ T290] bridge_slave_1: entered allmulticast mode [ 21.333160][ T290] bridge_slave_1: entered promiscuous mode [ 21.339353][ T292] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.346399][ T292] bridge0: port 1(bridge_slave_0) entered disabled state [ 21.353471][ T292] bridge_slave_0: entered allmulticast mode [ 21.359658][ T292] bridge_slave_0: entered promiscuous mode [ 21.365784][ T291] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.372865][ T291] bridge0: port 2(bridge_slave_1) entered disabled state [ 21.379956][ T291] bridge_slave_1: entered allmulticast mode [ 21.386119][ T291] bridge_slave_1: entered promiscuous mode [ 21.400441][ T292] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.407490][ T292] bridge0: port 2(bridge_slave_1) entered disabled state [ 21.414627][ T292] bridge_slave_1: entered allmulticast mode [ 21.420842][ T292] bridge_slave_1: entered promiscuous mode [ 21.544719][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.551794][ T289] bridge0: port 2(bridge_slave_1) entered forwarding state [ 21.559059][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.566092][ T289] bridge0: port 1(bridge_slave_0) entered forwarding state [ 21.605417][ T292] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.612488][ T292] bridge0: port 2(bridge_slave_1) entered forwarding state [ 21.619806][ T292] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.626822][ T292] bridge0: port 1(bridge_slave_0) entered forwarding state [ 21.635971][ T291] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.643028][ T291] bridge0: port 2(bridge_slave_1) entered forwarding state [ 21.650300][ T291] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.657315][ T291] bridge0: port 1(bridge_slave_0) entered forwarding state [ 21.680408][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.687463][ T290] bridge0: port 2(bridge_slave_1) entered forwarding state [ 21.694754][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.701786][ T290] bridge0: port 1(bridge_slave_0) entered forwarding state [ 21.719986][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 21.727254][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 21.734810][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 21.742324][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 21.749584][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 21.756773][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 21.764415][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 21.771663][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 21.785028][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.792102][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 21.805145][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.812258][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 21.826336][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.833411][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 21.851065][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.858131][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 21.866069][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.873107][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 21.880693][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.887706][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 21.926386][ T292] veth0_vlan: entered promiscuous mode [ 21.938648][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.945718][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 21.954112][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.961188][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 21.981000][ T291] veth0_vlan: entered promiscuous mode [ 21.991754][ T292] veth1_macvtap: entered promiscuous mode [ 22.007599][ T290] veth0_vlan: entered promiscuous mode [ 22.021467][ T289] veth0_vlan: entered promiscuous mode [ 22.037253][ T290] veth1_macvtap: entered promiscuous mode [ 22.057760][ T289] veth1_macvtap: entered promiscuous mode [ 22.067341][ T292] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 22.094871][ T291] veth1_macvtap: entered promiscuous mode [ 22.205879][ T289] ------------[ cut here ]------------ [ 22.211490][ T289] WARNING: CPU: 0 PID: 289 at fs/overlayfs/util.c:602 ovl_dir_modified+0x15a/0x190 [ 22.220961][ T289] Modules linked in: [ 22.224893][ T289] CPU: 0 UID: 0 PID: 289 Comm: syz-executor Not tainted syzkaller #0 0dee6928fadcbaccfa8f6f219e35e152cfee8851 [ 22.236588][ T289] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 22.246696][ T289] RIP: 0010:ovl_dir_modified+0x15a/0x190 [ 22.252432][ T289] Code: c1 e8 03 42 80 3c 28 00 74 08 4c 89 f7 e8 4e 79 97 ff 49 ff 06 5b 41 5c 41 5d 41 5e 41 5f 5d e9 cc 41 59 03 cc e8 f6 53 3f ff <0f> 0b e9 3e ff ff ff e8 ea 53 3f ff 0f 0b e9 6e ff ff ff 44 89 f9 [ 22.272164][ T289] RSP: 0018:ffffc9000125fb48 EFLAGS: 00010293 [ 22.278223][ T289] RAX: ffffffff82484f5a RBX: 0000000000000000 RCX: ffff888101faa600 [ 22.286233][ T289] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 22.294338][ T289] RBP: ffffc9000125fb70 R08: ffff888113b8567f R09: 1ffff11022770acf [ 22.302390][ T289] R10: dffffc0000000000 R11: ffffed1022770ad0 R12: 0000000000000000 [ 22.310423][ T289] R13: dffffc0000000000 R14: ffff888113b855e0 R15: ffff888121037cc0 [ 22.318407][ T289] FS: 000055557c4f2500(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 22.327395][ T289] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 22.334031][ T289] CR2: 0000200000000440 CR3: 000000010c298000 CR4: 00000000003526b0 [ 22.342158][ T289] Call Trace: [ 22.345440][ T289] [ 22.348375][ T289] ovl_do_remove+0x81b/0xda0 [ 22.353051][ T289] ? ovl_set_redirect+0x780/0x780 [ 22.358083][ T289] ? down_write+0xee/0x2b0 [ 22.362567][ T289] ? __cfi_down_write+0x10/0x10 [ 22.367436][ T289] ovl_rmdir+0x1e/0x30 [ 22.371543][ T289] vfs_rmdir+0x3e3/0x560 [ 22.375784][ T289] incfs_kill_sb+0x109/0x230 [ 22.380422][ T289] deactivate_locked_super+0xd5/0x2a0 [ 22.385883][ T289] deactivate_super+0xb8/0xe0 [ 22.390611][ T289] cleanup_mnt+0x406/0x4a0 [ 22.395032][ T289] __cleanup_mnt+0x1d/0x40 [ 22.399497][ T289] task_work_run+0x1e8/0x260 [ 22.404089][ T289] ? __cfi_task_work_run+0x10/0x10 [ 22.409198][ T289] ? __x64_sys_umount+0x12e/0x180 [ 22.414274][ T289] ? __cfi___x64_sys_umount+0x10/0x10 [ 22.419687][ T289] ? __kasan_check_read+0x15/0x20 [ 22.424722][ T289] resume_user_mode_work+0x35/0x50 [ 22.429717][ T31] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 22.429876][ T289] syscall_exit_to_user_mode+0x63/0xb0 [ 22.442758][ T289] do_syscall_64+0x63/0xf0 [ 22.447171][ T289] ? clear_bhb_loop+0x50/0xa0 [ 22.451887][ T289] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 22.457792][ T289] RIP: 0033:0x7f7bf959d9d7 [ 22.462246][ T289] Code: a2 c7 05 1c fd 24 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 22.482004][ T289] RSP: 002b:00007ffc577d5fa8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 22.490451][ T289] RAX: 0000000000000000 RBX: 00007f7bf9632050 RCX: 00007f7bf959d9d7 [ 22.498418][ T289] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffc577d6060 [ 22.506439][ T289] RBP: 00007ffc577d6060 R08: 00007ffc577d7060 R09: 00000000ffffffff [ 22.514519][ T289] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffc577d7150 [ 22.522630][ T289] R13: 00007f7bf9632050 R14: 0000000000005691 R15: 00007ffc577d9310 [ 22.530630][ T289] [ 22.533637][ T289] ---[ end trace 0000000000000000 ]--- [ 22.541318][ T289] ------------[ cut here ]------------ [ 22.546776][ T289] WARNING: CPU: 0 PID: 289 at fs/overlayfs/util.c:602 ovl_dir_modified+0x15a/0x190 [ 22.556115][ T289] Modules linked in: [ 22.560038][ T289] CPU: 0 UID: 0 PID: 289 Comm: syz-executor Tainted: G W syzkaller #0 0dee6928fadcbaccfa8f6f219e35e152cfee8851 [ 22.573188][ T289] Tainted: [W]=WARN [ 22.576985][ T289] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 22.579733][ T31] usb 1-1: Using ep0 maxpacket: 16 [ 22.587092][ T289] RIP: 0010:ovl_dir_modified+0x15a/0x190 [ 22.594351][ T31] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 22.597808][ T289] Code: c1 e8 03 42 80 3c 28 00 74 08 4c 89 f7 e8 4e 79 97 ff 49 ff 06 5b 41 5c 41 5d 41 5e 41 5f 5d e9 cc 41 59 03 cc e8 f6 53 3f ff <0f> 0b e9 3e ff ff ff e8 ea 53 3f ff 0f 0b e9 6e ff ff ff 44 89 f9 [ 22.597827][ T289] RSP: 0018:ffffc9000125fb48 EFLAGS: 00010293 [ 22.608753][ T31] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 22.627661][ T289] RAX: ffffffff82484f5a RBX: 0000000000000000 RCX: ffff888101faa600 [ 22.627683][ T289] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 22.627692][ T289] RBP: ffffc9000125fb70 R08: ffff888113b8567f R09: 1ffff11022770acf [ 22.627704][ T289] R10: dffffc0000000000 R11: ffffed1022770ad0 R12: 0000000000000000 [ 22.627715][ T289] R13: dffffc0000000000 R14: ffff888113b855e0 R15: ffff888121037cc0 [ 22.627726][ T289] FS: 000055557c4f2500(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 22.627740][ T289] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 22.634967][ T31] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 22.644729][ T289] CR2: 0000200000000440 CR3: 000000010c298000 CR4: 00000000003526b0 [ 22.644752][ T289] Call Trace: [ 22.644758][ T289] [ 22.644765][ T289] ovl_do_remove+0x81b/0xda0 [ 22.653652][ T31] usb 1-1: New USB device found, idVendor=057e, idProduct=2019, bcdDevice= 0.00 [ 22.660777][ T289] ? ovl_set_redirect+0x780/0x780 [ 22.668939][ T31] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 22.676792][ T289] ? down_write+0xee/0x2b0 [ 22.688793][ T31] usb 1-1: config 0 descriptor?? [ 22.693722][ T289] ? __cfi_down_write+0x10/0x10 [ 22.768626][ T289] ovl_rmdir+0x1e/0x30 [ 22.772745][ T289] vfs_rmdir+0x3e3/0x560 [ 22.776999][ T289] incfs_kill_sb+0x1a0/0x230 [ 22.781645][ T289] deactivate_locked_super+0xd5/0x2a0 [ 22.787020][ T289] deactivate_super+0xb8/0xe0 [ 22.791859][ T289] cleanup_mnt+0x406/0x4a0 [ 22.796290][ T289] __cleanup_mnt+0x1d/0x40 [ 22.800777][ T289] task_work_run+0x1e8/0x260 [ 22.805374][ T289] ? __cfi_task_work_run+0x10/0x10 [ 22.810527][ T289] ? __x64_sys_umount+0x12e/0x180 [ 22.815565][ T289] ? __cfi___x64_sys_umount+0x10/0x10 [ 22.820992][ T289] ? __kasan_check_read+0x15/0x20 [ 22.826033][ T289] resume_user_mode_work+0x35/0x50 [ 22.831265][ T289] syscall_exit_to_user_mode+0x63/0xb0 [ 22.836736][ T289] do_syscall_64+0x63/0xf0 [ 22.841211][ T289] ? clear_bhb_loop+0x50/0xa0 [ 22.845909][ T289] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 22.851828][ T289] RIP: 0033:0x7f7bf959d9d7 [ 22.856241][ T289] Code: a2 c7 05 1c fd 24 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 22.875898][ T289] RSP: 002b:00007ffc577d5fa8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 22.884350][ T289] RAX: 0000000000000000 RBX: 00007f7bf9632050 RCX: 00007f7bf959d9d7 [ 22.892388][ T289] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffc577d6060 [ 22.900402][ T289] RBP: 00007ffc577d6060 R08: 00007ffc577d7060 R09: 00000000ffffffff [ 22.908392][ T289] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffc577d7150 [ 22.916471][ T289] R13: 00007f7bf9632050 R14: 0000000000005691 R15: 00007ffc577d9310 [ 22.924494][ T289] [ 22.927518][ T289] ---[ end trace 0000000000000000 ]--- [ 22.944628][ T355] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 23.105085][ T339] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 23.113768][ T339] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 23.126449][ T31] usbhid 1-1:0.0: can't add hid device: -71 [ 23.132494][ T31] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 23.142968][ T31] usb 1-1: USB disconnect, device number 2 [ 23.589479][ T336] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 23.739505][ T336] usb 1-1: Using ep0 maxpacket: 32 [ 23.746059][ T336] usb 1-1: config index 0 descriptor too short (expected 29220, got 45) [ 23.754449][ T336] usb 1-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 23.763251][ T336] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 23.773374][ T336] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 23.782383][ T336] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 23.792405][ T336] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 23.803444][ T336] usb 1-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 23.816434][ T336] usb 1-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 23.825518][ T336] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 23.834381][ T336] usb 1-1: config 0 descriptor?? [ 24.041709][ T336] usblp 1-1:0.0: usblp0: USB Bidirectional printer dev 3 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 24.262385][ C1] usblp0: nonzero read bulk status received: -71 [ 24.269136][ T339] usblp0: error -71 reading from printer [ 24.275179][ C0] usblp0: nonzero read bulk status received: -71 [ 25.288591][ T336] usb 1-1: USB disconnect, device number 3 [ 25.298495][ T336] usblp0: removed