last executing test programs: 712.912234ms ago: executing program 1 (id=2): r0 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}, 0x20000}}, {{0xa, 0x0, 0x0, @remote}}}, 0x108) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @loopback}}}, 0x108) 645.010455ms ago: executing program 1 (id=5): syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000090000082502000000000000000109025c00020100f92a0904"], 0x0) r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x72, 0x0, 0x7fff0000}]}) close_range(r0, 0xffffffffffffffff, 0x0) syz_usb_connect(0x0, 0x24, &(0x7f0000000040)=ANY=[], 0x0) 561.307487ms ago: executing program 3 (id=3): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x62) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f00000000c0)=0x1, 0x4) getsockopt$inet_tcp_int(r0, 0x6, 0x15, 0x0, &(0x7f0000000040)) 531.253528ms ago: executing program 3 (id=6): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x14c) mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc/sys/net/ipv4/conf/all/proxy_arp\x00', 0x1, 0x0) write(r0, 0x0, 0x0) 467.587579ms ago: executing program 3 (id=8): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqn(r0, 0x0, 0x27, &(0x7f0000000000)={@multicast1, @local}, 0xc) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x9) getsockopt$inet_buf(r0, 0x0, 0x29, &(0x7f0000000000)=""/145, &(0x7f0000695ffc)=0x24b) 467.275179ms ago: executing program 3 (id=10): r0 = syz_open_dev$evdev(&(0x7f0000000000), 0x0, 0x0) syz_usb_disconnect(r0) syz_usb_connect$printer(0x4, 0x2d, &(0x7f0000000040)=ANY=[], 0x0) ioctl$EVIOCRMFF(r0, 0x40085503, 0x0) 401.669391ms ago: executing program 0 (id=13): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='dummy_hcd.0', 0xb) 329.898922ms ago: executing program 0 (id=14): r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup.cpu/memory.force_empty\x00', 0x402, 0x50) close(0x3) openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write(r0, 0x0, 0x0) 304.235873ms ago: executing program 0 (id=15): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./tracing\x00', &(0x7f0000000080)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./tracing/per_cpu/cpu0/trace_pipe_raw\x00', 0x0, 0x0) ioctl$sock_SIOCGPGRP(r0, 0x8904, 0x0) 304.085173ms ago: executing program 2 (id=16): r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/power/wakeup_count', 0x0, 0x10) r1 = syz_open_dev$loop(&(0x7f00000005c0), 0xffff, 0x109041) ioctl$LOOP_CONFIGURE(r1, 0x4c0a, &(0x7f0000000400)={r0, 0x1000, {0x2a00, 0x80010000, 0x0, 0x52, 0x0, 0x0, 0x0, 0x0, 0x1c, "fee8a2ab78fc179fd1f8a0e91ddaaca7bd64c6a4b4e00d9683dda1af1ea89de2b7fb0a0100000000000000000300", "2809e8dbe108598948224ad54afac11d09000000000000008dd4992861ac1000", "9100", [0x0, 0x2]}}) ioctl$LOOP_SET_CAPACITY(r1, 0x4c06) 259.471734ms ago: executing program 0 (id=17): r0 = userfaultfd(0x801) munmap(&(0x7f00003fe000/0xc00000)=nil, 0xc00000) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_WRITEPROTECT(r0, 0xc018aa06, &(0x7f0000000180)={{&(0x7f00005cb000/0x4000)=nil, 0x4000}, 0x1}) 162.105436ms ago: executing program 2 (id=18): sendmsg$NFQNL_MSG_CONFIG(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x2d, &(0x7f0000000440)={&(0x7f0000000080)={0x24, 0x2, 0x3, 0x101, 0x0, 0x0, {0xd, 0x0, 0x2}, [@NFQA_CFG_FLAGS={0x8, 0x5, 0x1, 0x0, 0x13}, @NFQA_CFG_MASK={0x8, 0x4, 0x1, 0x0, 0x33}]}, 0x24}, 0x1, 0x0, 0x0, 0x4048880}, 0x24000080) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r0, &(0x7f0000002d80)={0x0, 0x0, &(0x7f0000002d40)={&(0x7f0000000000)=ANY=[@ANYBLOB="300000000203010200000000000000000000000009000200000000470200000008000340000000000800010001"], 0x30}}, 0x0) sendmsg$NFQNL_MSG_CONFIG(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="2000000002030500000000000040000002000000090002"], 0x20}, 0x1, 0x0, 0x0, 0x40049d1}, 0x0) 161.911446ms ago: executing program 0 (id=19): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x8001, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000080)={0x2, 0x0, [{0x10, 0x0, 0x4}, {0x10, 0x0, 0x8}]}) 132.089007ms ago: executing program 2 (id=20): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000002180)='blkio.bfq.io_merged\x00', 0x275a, 0x0) r1 = socket(0x10, 0x803, 0x0) sendto(r1, &(0x7f0000000080)="120000001200e7ef00341618a585107b462e", 0x12, 0x20000010, 0x0, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 89.986067ms ago: executing program 2 (id=21): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000c75000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f00000001c0)={@flat=@weak_binder={0x77622a85, 0xb, 0x2}, @fd={0x66642a85, 0x0, r0}, @flat=@weak_binder={0x77622a85, 0x100, 0x2}}, &(0x7f0000000280)={0x0, 0x18, 0x30}}, 0x10}], 0x0, 0x0, 0x0}) 9.864319ms ago: executing program 2 (id=23): bind$inet6(0xffffffffffffffff, &(0x7f0000000140)={0xa, 0x4e24, 0x0, @initdev={0xfe, 0x88, '\x00', 0x9, 0x0}, 0x6}, 0x1c) r0 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r0, 0x10e, 0xc, &(0x7f0000000640)=0x4, 0x4) sendmsg$netlink(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)=ANY=[@ANYBLOB="2400000022000106"], 0x24}], 0x1}, 0x0) 9.6334ms ago: executing program 0 (id=24): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000001c0)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x46d, 0xa07, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x20, 0xea, "", [{{0x9, 0x4, 0x0, 0x4, 0x2, 0x3, 0x0, 0x2, 0x0, {0x9, 0x21, 0x1106, 0x3, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x10, 0x0, 0xfc, 0x7}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) write$FUSE_NOTIFY_STORE(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000080)={0x0, 0x22, 0x18, {[@global=@item_012={0x1, 0x1, 0x0, "01"}, @main=@item_012={0x2, 0x0, 0xc, "09b3"}, @global=@item_4={0x3, 0x1, 0x1, "828abd88"}, @global=@item_4={0x3, 0x1, 0x2, "f3585a78"}, @main=@item_012={0x1, 0x0, 0xa, "01"}, @local=@item_012={0x1, 0x2, 0x0, "01"}, @main=@item_4={0x3, 0x0, 0xa, "a6d3bea8"}]}}, 0x0}, 0x0) 0s ago: executing program 2 (id=25): syz_usb_connect$hid(0x0, 0x3f, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000105804105000000000000109022d000107000000090400050503000000092100020801229403090581"], 0x0) r0 = socket$inet(0x2, 0x3, 0x4) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080)='ip6_vti0\x00', 0x10) sendmmsg$inet(r0, &(0x7f0000000280)=[{{&(0x7f0000000240)={0x2, 0x4e01, @dev={0xac, 0x14, 0x14, 0x44}}, 0x10, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="34000000000000000000000007000000441d"], 0x38}}], 0x1, 0x46000) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.17' (ED25519) to the list of known hosts. [ 23.161485][ T36] audit: type=1400 audit(1787666576.580:64): avc: denied { mounton } for pid=286 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 23.165501][ T286] cgroup: Unknown subsys name 'net' [ 23.184257][ T36] audit: type=1400 audit(1787666576.580:65): avc: denied { mount } for pid=286 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 23.212764][ T36] audit: type=1400 audit(1787666576.600:66): avc: denied { unmount } for pid=286 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 23.213305][ T286] cgroup: Unknown subsys name 'devices' [ 23.323370][ T286] cgroup: Unknown subsys name 'hugetlb' [ 23.329155][ T286] cgroup: Unknown subsys name 'rlimit' [ 23.424018][ T36] audit: type=1400 audit(1787666576.840:67): avc: denied { setattr } for pid=286 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 23.447322][ T36] audit: type=1400 audit(1787666576.840:68): avc: denied { mounton } for pid=286 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 23.472349][ T36] audit: type=1400 audit(1787666576.840:69): avc: denied { mount } for pid=286 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 23.498782][ T288] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 23.507828][ T36] audit: type=1400 audit(1787666576.920:70): avc: denied { relabelto } for pid=288 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.533436][ T36] audit: type=1400 audit(1787666576.920:71): avc: denied { write } for pid=288 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.594501][ T36] audit: type=1400 audit(1787666577.010:72): avc: denied { read } for pid=286 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.620157][ T36] audit: type=1400 audit(1787666577.010:73): avc: denied { open } for pid=286 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.621169][ T286] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 24.502640][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.509830][ T296] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.517113][ T296] bridge_slave_0: entered allmulticast mode [ 24.523584][ T296] bridge_slave_0: entered promiscuous mode [ 24.533487][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.540653][ T296] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.547785][ T296] bridge_slave_1: entered allmulticast mode [ 24.554294][ T296] bridge_slave_1: entered promiscuous mode [ 24.608966][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.616627][ T294] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.623873][ T294] bridge_slave_0: entered allmulticast mode [ 24.630291][ T294] bridge_slave_0: entered promiscuous mode [ 24.636818][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.644356][ T293] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.651518][ T293] bridge_slave_0: entered allmulticast mode [ 24.657985][ T293] bridge_slave_0: entered promiscuous mode [ 24.672505][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.679598][ T294] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.686833][ T294] bridge_slave_1: entered allmulticast mode [ 24.693245][ T294] bridge_slave_1: entered promiscuous mode [ 24.699361][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.706504][ T293] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.713744][ T293] bridge_slave_1: entered allmulticast mode [ 24.719992][ T293] bridge_slave_1: entered promiscuous mode [ 24.775279][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.782424][ T295] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.789534][ T295] bridge_slave_0: entered allmulticast mode [ 24.796000][ T295] bridge_slave_0: entered promiscuous mode [ 24.805394][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.812559][ T295] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.819685][ T295] bridge_slave_1: entered allmulticast mode [ 24.826280][ T295] bridge_slave_1: entered promiscuous mode [ 24.906483][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.913680][ T296] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.921053][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.928136][ T296] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.984655][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.992070][ T293] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.999747][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.007755][ T293] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.053398][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.060601][ T294] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.068126][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.075671][ T294] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.084464][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.092191][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.100180][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.108696][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.116465][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.124212][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.147773][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.155192][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.185319][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.192477][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.202126][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.209212][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.217767][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.224959][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.284610][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.291713][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.304935][ T296] veth0_vlan: entered promiscuous mode [ 25.311521][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.318590][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.326597][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.333741][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.341601][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.348658][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.374526][ T293] veth0_vlan: entered promiscuous mode [ 25.385264][ T296] veth1_macvtap: entered promiscuous mode [ 25.429969][ T293] veth1_macvtap: entered promiscuous mode [ 25.445781][ T296] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 25.476711][ T294] veth0_vlan: entered promiscuous mode [ 25.489341][ T295] veth0_vlan: entered promiscuous mode [ 25.528218][ T295] veth1_macvtap: entered promiscuous mode [ 25.541029][ T294] veth1_macvtap: entered promiscuous mode [ 25.583452][ T321] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 25.741301][ T337] rtc_cmos 00:00: Alarms can be up to one day in the future [ 25.762747][ T62] rtc_cmos 00:00: Alarms can be up to one day in the future [ 25.771040][ T62] rtc_cmos 00:00: Alarms can be up to one day in the future [ 25.778676][ T62] rtc_cmos 00:00: Alarms can be up to one day in the future [ 25.787788][ T62] rtc_cmos 00:00: Alarms can be up to one day in the future [ 25.795881][ T62] rtc rtc0: __rtc_set_alarm: err=-22 [ 25.807768][ T341] dummy_hcd dummy_hcd.0: remove, state 4 [ 25.813916][ T341] usb usb1: USB disconnect, device number 1 [ 25.822599][ T46] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 25.823075][ T341] dummy_hcd dummy_hcd.0: stopped [ 25.836003][ T341] dummy_hcd dummy_hcd.0: USB bus 1 deregistered [ 25.890158][ T347] loop5: detected capacity change from 0 to 7 [ 25.897098][ T347] Buffer I/O error on dev loop5, logical block 0, async page read [ 25.905948][ T347] Buffer I/O error on dev loop5, logical block 0, async page read [ 25.914681][ T347] loop5: unable to read partition table [ 25.927170][ T347] loop_reread_partitions: partition scan of loop5 (被xڬdƤݡ [ 25.927170][ T347] ) failed (rc=-5) [ 25.930004][ T314] Buffer I/O error on dev loop5, logical block 0, async page read [ 25.952105][ T314] Buffer I/O error on dev loop5, logical block 0, async page read [ 25.961436][ T314] Buffer I/O error on dev loop5, logical block 0, async page read [ 25.969518][ T314] Buffer I/O error on dev loop5, logical block 0, async page read [ 25.984609][ T46] usb 2-1: Using ep0 maxpacket: 8 [ 25.990037][ T314] Buffer I/O error on dev loop5, logical block 0, async page read [ 25.998981][ T314] Buffer I/O error on dev loop5, logical block 0, async page read [ 26.007248][ T46] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 26.024007][ T46] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 26.034129][ T314] Buffer I/O error on dev loop5, logical block 0, async page read [ 26.042396][ T46] usb 2-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 26.056341][ T314] Buffer I/O error on dev loop5, logical block 0, async page read [ 26.070493][ T46] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 26.099047][ T46] hub 2-1:1.0: bad descriptor, ignoring hub [ 26.109674][ T62] rust_binder: 359: undelivered TRANSACTION_ERROR: 29189 [ 26.120571][ T46] hub 2-1:1.0: probe with driver hub failed with error -5 [ 26.155746][ T364] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN PTI [ 26.168358][ T364] KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] [ 26.176899][ T364] CPU: 0 UID: 0 PID: 364 Comm: syz.0.24 Not tainted syzkaller #0 2456bfd0916d80188827445f664284f1a044436b [ 26.188235][ T364] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 26.198335][ T364] RIP: 0010:dummy_udc_start+0xd1/0x1f0 [ 26.203887][ T364] Code: 41 83 ff 03 74 18 41 83 ff 05 0f 85 94 00 00 00 e8 d4 c2 cd fd eb 0c e8 cd c2 cd fd eb 05 e8 c6 c2 cd fd 4c 89 f0 48 c1 e8 03 <42> 80 3c 20 00 74 08 4c 89 f7 e8 f0 9e 26 fe 4d 8b 36 4c 89 f7 e8 [ 26.223703][ T364] RSP: 0018:ffffc9000c08f818 EFLAGS: 00010246 [ 26.229868][ T364] RAX: 0000000000000000 RBX: ffff8881146da010 RCX: 0000000000080000 [ 26.237904][ T364] RDX: ffffc90001651000 RSI: 0000000000000925 RDI: 0000000000000926 [ 26.247325][ T364] RBP: ffffc9000c08f840 R08: ffff88810db35f00 R09: 0000000000000004 [ 26.255319][ T364] R10: 0000000000000005 R11: 0000000000000002 R12: dffffc0000000000 [ 26.263303][ T364] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000003 [ 26.271287][ T364] FS: 00007fde4e13f6c0(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 26.280242][ T364] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 26.286848][ T364] CR2: 00007fde4d187240 CR3: 0000000111296000 CR4: 00000000003526b0 [ 26.294871][ T364] Call Trace: [ 26.298191][ T364] [ 26.301162][ T364] ? __cfi_dummy_udc_start+0x10/0x10 [ 26.306481][ T364] gadget_bind_driver+0x3e4/0x9c0 [ 26.311556][ T364] ? __cfi_gadget_bind_driver+0x10/0x10 [ 26.317118][ T364] really_probe+0x2e1/0x8b0 [ 26.321645][ T364] __driver_probe_device+0x193/0x280 [ 26.326992][ T364] driver_probe_device+0x54/0x3f0 [ 26.332050][ T364] __driver_attach+0x422/0x5e0 [ 26.336854][ T364] bus_for_each_dev+0x249/0x2d0 [ 26.341764][ T364] ? __cfi___driver_attach+0x10/0x10 [ 26.347144][ T364] ? __cfi_bus_for_each_dev+0x10/0x10 [ 26.352583][ T364] ? __kasan_kmalloc+0x96/0xb0 [ 26.357404][ T364] ? _raw_spin_unlock+0x45/0x60 [ 26.362319][ T364] ? klist_add_tail+0x1dd/0x220 [ 26.367239][ T364] driver_attach+0x46/0x50 [ 26.371728][ T364] bus_add_driver+0x393/0x730 [ 26.376452][ T364] driver_register+0x2b7/0x3c0 [ 26.381584][ T364] usb_gadget_register_driver_owner+0xfc/0x270 [ 26.387781][ T364] raw_ioctl+0x144c/0x37a0 [ 26.392234][ T364] ? __cfi_raw_ioctl+0x10/0x10 [ 26.397056][ T364] ? selinux_file_ioctl+0x732/0x1480 [ 26.402386][ T364] ? __cfi_selinux_file_ioctl+0x10/0x10 [ 26.407953][ T364] ? bpf_lsm_file_ioctl+0xd/0x20 [ 26.412914][ T364] ? security_file_ioctl+0x3e/0x110 [ 26.418126][ T364] ? __cfi_raw_ioctl+0x10/0x10 [ 26.422940][ T364] __se_sys_ioctl+0x135/0x1b0 [ 26.427656][ T364] __x64_sys_ioctl+0x7f/0xa0 [ 26.432280][ T364] x64_sys_call+0x1878/0x2ee0 [ 26.436987][ T364] do_syscall_64+0x57/0xf0 [ 26.441474][ T364] ? clear_bhb_loop+0x50/0xa0 [ 26.446290][ T364] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 26.452262][ T364] RIP: 0033:0x7fde4d19dd6b [ 26.456726][ T364] Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00 [ 26.476673][ T364] RSP: 002b:00007fde4e13cf00 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 26.485150][ T364] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fde4d19dd6b [ 26.493164][ T364] RDX: 0000000000000000 RSI: 0000000000005501 RDI: 0000000000000003 [ 26.501168][ T364] RBP: 00007fde4e13dfd0 R08: 0000000000000001 R09: 00000000ffffffff [ 26.509156][ T364] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 26.517138][ T364] R13: 00002000000001c0 R14: 0000000000000000 R15: 0000000000000000 [ 26.525408][ T364] [ 26.528469][ T364] Modules linked in: [ 26.533202][ T364] ---[ end trace 0000000000000000 ]--- [ 26.544334][ T364] RIP: 0010:dummy_udc_start+0xd1/0x1f0 [ 26.549927][ T364] Code: 41 83 ff 03 74 18 41 83 ff 05 0f 85 94 00 00 00 e8 d4 c2 cd fd eb 0c e8 cd c2 cd fd eb 05 e8 c6 c2 cd fd 4c 89 f0 48 c1 e8 03 <42> 80 3c 20 00 74 08 4c 89 f7 e8 f0 9e 26 fe 4d 8b 36 4c 89 f7 e8 [ 26.569695][ T364] RSP: 0018:ffffc9000c08f818 EFLAGS: 00010246 [ 26.574071][ T46] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 26.575901][ T364] RAX: 0000000000000000 RBX: ffff8881146da010 RCX: 0000000000080000 [ 26.592888][ T364] RDX: ffffc90001651000 RSI: 0000000000000925 RDI: 0000000000000926 [ 26.600974][ T364] RBP: ffffc9000c08f840 R08: ffff88810db35f00 R09: 0000000000000004 [ 26.609080][ T364] R10: 0000000000000005 R11: 0000000000000002 R12: dffffc0000000000 [ 26.617180][ T364] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000003 [ 26.625328][ T364] FS: 00007fde4e13f6c0(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 26.634558][ T364] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 26.641322][ T364] CR2: 00007fde4d187240 CR3: 0000000111296000 CR4: 00000000003526b0 [ 26.649441][ T364] Kernel panic - not syncing: Fatal exception [ 26.656110][ T364] Kernel Offset: disabled [ 26.660450][ T364] Rebooting in 86400 seconds..