last executing test programs: 12.673001338s ago: executing program 3 (id=221): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./config\x00', 0x0, 0x0, 0x0) open$dir(&(0x7f00000003c0)='./config/usb_gadget/g1\x00', 0x10000, 0x18) rmdir(&(0x7f00000002c0)='./config/usb_gadget/g1\x00') 12.662799199s ago: executing program 3 (id=222): r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000380)={0x2, 0x13, 0x53, 0x0, 0x16, 0x0, 0x70bd27, 0x25dfdbfe, [@sadb_x_nat_t_type={0x1}, @sadb_x_nat_t_port={0x1, 0x15, 0x4e21}, @sadb_lifetime={0x4, 0x0, 0x5, 0x3, 0xc, 0x1}, @sadb_x_kmaddress={0x8, 0x19, 0x0, @in6={0xa, 0x4e22, 0x80000000, @mcast1, 0x1}, @in6={0xa, 0x4e20, 0x7, @private2={0xfc, 0x2, '\x00', 0x1}, 0x9}}, @sadb_x_nat_t_port={0x1, 0x15, 0x4e21}, @sadb_address={0x5, 0x17, 0x33, 0x80, 0x0, @in6={0xa, 0x4e23, 0xffff7e00, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0xc}}, 0x4}}]}, 0xb0}}, 0x20000800) r1 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x13, 0x0, 0x0) sendmsg$tipc(r1, &(0x7f0000000c80)={&(0x7f0000000980)=@id, 0x10, 0x0}, 0x0) chdir(&(0x7f0000000540)='./cgroup\x00') r2 = syz_open_procfs(0x0, &(0x7f0000000140)='coredump_filter\x00') writev(r2, &(0x7f00000012c0)=[{&(0x7f0000000280)='0', 0x1}, {&(0x7f0000000000)="792792e9", 0x4}], 0x2) r3 = openat(r2, &(0x7f0000000040)='.\x00', 0x0, 0x1bc) r4 = socket$xdp(0x2c, 0x3, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_sys\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1, 0x10012, r5, 0x0) r6 = socket$vsock_stream(0x28, 0x1, 0x0) setsockopt$SO_VM_SOCKETS_BUFFER_MIN_SIZE(r6, 0x28, 0x8, 0x0, 0x0) setsockopt$XDP_UMEM_REG(r4, 0x11b, 0x4, &(0x7f0000000040)={0xfffffffffffffffc, 0x100d000, 0x800}, 0x20) lseek(r3, 0x7fffdfff, 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1d0) mount$overlay(0x300, &(0x7f0000000100)='./file0\x00', &(0x7f0000000240), 0x8, &(0x7f0000000340)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) 12.610181271s ago: executing program 3 (id=224): r0 = fsopen(&(0x7f00000002c0)='configfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x0) fchdir(r1) ioctl$INCFS_IOC_READ_FILE_SIGNATURE(r1, 0x8010671f, &(0x7f0000001340)={&(0x7f0000000340)=""/4096, 0x1000}) setresuid(0xee01, 0xee01, 0x0) fchmodat(0xffffffffffffff9c, &(0x7f0000000300)='.\x00', 0xffffffd3) fsopen(&(0x7f00000002c0)='configfs\x00', 0x0) (async) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) (async) fsmount(r0, 0x0, 0x0) (async) fchdir(r1) (async) ioctl$INCFS_IOC_READ_FILE_SIGNATURE(r1, 0x8010671f, &(0x7f0000001340)={&(0x7f0000000340)=""/4096, 0x1000}) (async) setresuid(0xee01, 0xee01, 0x0) (async) fchmodat(0xffffffffffffff9c, &(0x7f0000000300)='.\x00', 0xffffffd3) (async) 12.591199602s ago: executing program 3 (id=226): r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000380)={0x2, 0x13, 0x53, 0x0, 0x16, 0x0, 0x70bd27, 0x25dfdbfe, [@sadb_x_nat_t_type={0x1}, @sadb_x_nat_t_port={0x1, 0x15, 0x4e21}, @sadb_lifetime={0x4, 0x0, 0x5, 0x3, 0xc, 0x1}, @sadb_x_kmaddress={0x8, 0x19, 0x0, @in6={0xa, 0x4e22, 0x80000000, @mcast1, 0x1}, @in6={0xa, 0x4e20, 0x7, @private2={0xfc, 0x2, '\x00', 0x1}, 0x9}}, @sadb_x_nat_t_port={0x1, 0x15, 0x4e21}, @sadb_address={0x5, 0x17, 0x33, 0x80, 0x0, @in6={0xa, 0x4e23, 0xffff7e00, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0xc}}, 0x4}}]}, 0xb0}}, 0x20000800) r1 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x13, 0x0, 0x0) sendmsg$tipc(r1, &(0x7f0000000c80)={&(0x7f0000000980)=@id, 0x10, 0x0}, 0x0) chdir(&(0x7f0000000540)='./cgroup\x00') r2 = syz_open_procfs(0x0, &(0x7f0000000140)='coredump_filter\x00') writev(r2, &(0x7f00000012c0)=[{&(0x7f0000000280)='0', 0x1}, {&(0x7f0000000000)="792792e9", 0x4}], 0x2) r3 = openat(r2, &(0x7f0000000040)='.\x00', 0x0, 0x1bc) r4 = socket$xdp(0x2c, 0x3, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_sys\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1, 0x10012, r5, 0x0) r6 = socket$vsock_stream(0x28, 0x1, 0x0) setsockopt$SO_VM_SOCKETS_BUFFER_MIN_SIZE(r6, 0x28, 0x8, 0x0, 0x0) setsockopt$XDP_UMEM_REG(r4, 0x11b, 0x4, &(0x7f0000000040)={0xfffffffffffffffc, 0x100d000, 0x800}, 0x20) lseek(r3, 0x7fffdfff, 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1d0) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000240), 0x8, &(0x7f0000000340)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) (fail_nth: 5) 12.349145883s ago: executing program 3 (id=227): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r3, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) bind$inet6(0xffffffffffffffff, 0x0, 0x0) io_submit(0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt\x00', 0x1ff) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f0000000100)='ext4\x00', 0x8410, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) chdir(&(0x7f0000000140)='./file0\x00') open(&(0x7f0000000200)='./mnt\x00', 0x4c27e, 0x40) r4 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x18e) write$binfmt_elf64(r4, &(0x7f0000000340)=ANY=[], 0x78) close(r4) r5 = syz_clone(0x20000091, 0x0, 0x0, 0x0, 0x0, 0x0) r6 = syz_open_procfs(r5, &(0x7f0000000280)='net/sctp\x00') fchdir(r6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f0000000080)='.\x00', &(0x7f0000000000)='proc\x00', 0x0, 0x0) r7 = syz_open_procfs(r5, &(0x7f0000000040)='status\x00') preadv(r7, &(0x7f0000002c80)=[{&(0x7f0000000100)=""/228, 0xe4}], 0x1, 0x6, 0x2f00) sendmsg$IPCTNL_MSG_CT_DELETE(0xffffffffffffffff, 0x0, 0x4000) setsockopt$packet_rx_ring(r3, 0x107, 0x5, &(0x7f0000000140)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x7ff, 0x2, 0x3b}, 0x1c) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000100)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) write$tun(r0, &(0x7f0000000140)=ANY=[@ANYBLOB="ffffffffffffaaaaaaaaaabb88a82700810010"], 0x32) 12.178465872s ago: executing program 3 (id=229): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r3, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_rx_ring(r3, 0x107, 0x5, &(0x7f0000000140)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x7ff, 0x2, 0x3b}, 0x1c) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000100)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) write$tun(r0, &(0x7f0000000140)=ANY=[@ANYBLOB="ffffffffffffaaaaaaaaaabb88a82700810010"], 0x32) 1.118540088s ago: executing program 0 (id=280): unshare(0x6c000600) r0 = syz_clone3(&(0x7f0000000340)={0x801400, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x19}, 0x0, 0x0, 0x0, 0x0}, 0x40) pidfd_send_signal(r1, 0x5, &(0x7f00000000c0)={0x5, 0x8, 0xffffffc4}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) ioctl$sock_SIOCETHTOOL(r2, 0x80108906, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet6(0xa, 0x6, 0x5) keyctl$invalidate(0x15, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a, 0xfffffffffffffffd}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x50, 0x0, &(0x7f0000000080)="f4eeb0199438243bae8b3d61a19a48bc1c3b026b853f64bef5e4656448677dbc7b948e5c67ef9bab41828bd5c7c5ecc239b18fa8b902d58f31213cecdbbedacd4c8908c1d2bc18f100dfe04356f3648e"}) ioctl$BINDER_FREEZE(0xffffffffffffffff, 0x400c620e, &(0x7f0000000400)={r0, 0x1, 0x1000}) 681.409928ms ago: executing program 1 (id=282): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) open$dir(&(0x7f00000003c0)='./config/usb_gadget/g1\x00', 0x10000, 0x18) rmdir(0x0) 628.041311ms ago: executing program 1 (id=284): r0 = socket$netlink(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r1 = socket$netlink(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f0000000000), 0x4) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001cc0)=ANY=[@ANYBLOB="ac0100001700010000000000000000007f0000010000000000000000000000000000fefffffffffffd8000000000000000000000000000bbac1414bb000000000000000000000000ffffff2b6b57a470b83fce00000000004e210000000000000000006400000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fc0200000000000000000000000000000000000000000000000000000000000100000000000000000a00802000000000", @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000200000000f9ffffff00000000000000000000000084000500ffffffff000000000000000000000000000004d33c0000000a00000000000000000000000000000000000001053500000200ac0003000000010000000900000000000000000000000000000000000001000004d56c"], 0x1ac}}, 0x0) 614.129511ms ago: executing program 1 (id=285): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/custom0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x18, 0x0, &(0x7f0000000040)=[@increfs_done, @register_looper], 0x69, 0x0, &(0x7f0000000080)="46f66d08dcedf0ef73a3a03d9ab0f25d45379bb2274e3fa5142b98a5b25bb01fd4dfe1e30f3e9633e9475103be9201cf5040b363b394d34997c31ce35e32bb203f2f925c6f5d52f8f2a1480844e9c01631f2805d648cf5ea5c7e206db5c4b1b6cb68dd27f1e75150b8"}) fcntl$F_SET_RW_HINT(r0, 0x40c, &(0x7f0000000140)=0x5) sendmsg$AUDIT_ADD_RULE(0xffffffffffffffff, &(0x7f0000000640)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000600)={&(0x7f00000001c0)={0x428, 0x3f3, 0x800, 0x70bd2b, 0x25dfdbff, {0x2, 0x0, 0x3b, [0x10, 0x800, 0x2, 0x5, 0x3, 0x3, 0x9, 0x77, 0x4, 0x2, 0x9, 0x10001, 0x3ff, 0x2, 0xa43, 0x9, 0x7, 0x0, 0x1, 0x8, 0x7f, 0xfffffff3, 0x6, 0x9, 0x200, 0x8, 0xfff, 0x800, 0x2, 0x8, 0x8, 0x8, 0x8, 0x8, 0x8001, 0x8000, 0x1, 0xa0000000, 0x4, 0x9, 0xd, 0x400, 0xbf8, 0xf76b, 0x9, 0x5, 0x5, 0x3, 0xfd, 0x4, 0x6, 0xbf, 0xea10, 0x1, 0xef, 0x1, 0x7fff, 0x4, 0xc, 0x0, 0x4, 0x10000, 0xff, 0x4], [0x1, 0x7ff, 0x0, 0xf3, 0x7, 0x2, 0x8, 0x8000, 0x2, 0x9, 0x1ff, 0x2, 0x200, 0x40, 0x2, 0x4, 0x3, 0x4, 0x9, 0xff, 0x3, 0xfff, 0x4, 0x7941, 0x7, 0x8e4f, 0x5, 0x4, 0x1, 0x8, 0x1000, 0x7, 0x55b0, 0x3, 0x6, 0x1, 0x1000, 0xe80, 0x7, 0x1, 0x4, 0x9, 0x7, 0xe, 0x7, 0x7, 0x2, 0x100, 0x0, 0xfffffffe, 0x7f, 0x3, 0x6, 0x2, 0x4, 0x4, 0x7, 0x9, 0x4, 0x1, 0x6, 0xb29, 0x1, 0xffffffff], [0x1, 0x200, 0x5, 0x8fc, 0x8, 0xfffffffd, 0xdef, 0x8, 0x6, 0x2, 0x6, 0x1, 0x7, 0x5, 0x0, 0xfffffffb, 0x40, 0x8, 0x9, 0x1, 0xb, 0x0, 0x4, 0x9, 0xc, 0xffff, 0x9, 0x7, 0x1, 0x7, 0x7, 0x2, 0xdf00, 0x8, 0x0, 0xac, 0xe456, 0x9, 0xc, 0x5, 0x99, 0x10, 0x5, 0x7f0, 0xf5, 0x5620a0e4, 0x3, 0x2, 0x8, 0x9, 0xc, 0x9, 0x800, 0x6, 0x81, 0x2, 0x4, 0x6, 0x0, 0x6, 0x7, 0x8, 0xfffffff9, 0x6], [0x7, 0xff, 0x5, 0x5, 0xffff, 0x3, 0x8, 0xb, 0x3, 0x3, 0x6218b947, 0x8, 0x2, 0x6, 0x4, 0xa611, 0x0, 0xfc5, 0xa, 0x2, 0xc000, 0x3, 0x8, 0x3, 0x4, 0x3, 0x10001, 0x4, 0x6, 0x0, 0xf, 0xb, 0x8, 0xb44, 0x6, 0x960f, 0x9082, 0x7ff, 0xba3, 0x9, 0x80000000, 0x1d2f, 0x7fffffff, 0x0, 0x5, 0x6, 0x3, 0x200, 0xff, 0x4, 0x4, 0x0, 0xa, 0x4, 0x5, 0x8001, 0xfb07, 0x6, 0xa, 0x968, 0x8, 0x0, 0x7, 0x7], 0x8, ['&,&\x00', ':(:\x00']}, ["", "", ""]}, 0x428}, 0x1, 0x0, 0x0, 0x20008080}, 0x20008044) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000680), 0x0, 0x0) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1c, &(0x7f00000006c0)={@loopback, 0x0}, &(0x7f0000000700)=0x14) ioctl$sock_inet6_SIOCADDRT(r1, 0x890b, &(0x7f0000000740)={@private0={0xfc, 0x0, '\x00', 0x1}, @empty, @private2={0xfc, 0x2, '\x00', 0x1}, 0x1, 0x2, 0x7, 0x100, 0x7b1, 0x105810081, r2}) newfstatat(0xffffffffffffff9c, &(0x7f00000007c0)='./file0\x00', &(0x7f0000000800)={0x0, 0x0, 0x0, 0x0, 0x0}, 0x400) quotactl_fd$Q_GETNEXTQUOTA(r1, 0xffffffff80000902, r3, &(0x7f0000000880)) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000940), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_MAX_FRAME_RETRIES(r4, &(0x7f0000000a00)={&(0x7f0000000900), 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x34, r5, 0x200, 0x70bd27, 0x25dfdbfe, {}, [@NL802154_ATTR_MAX_FRAME_RETRIES={0x5, 0xf, 0x5}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}]}, 0x34}}, 0x8000) sendmsg$inet(r1, &(0x7f0000000a80)={0x0, 0x0, &(0x7f0000000a40)}, 0x0) sendmsg$AUDIT_ADD_RULE(r1, &(0x7f0000000f80)={&(0x7f0000000ac0)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000f40)={&(0x7f0000000b00)={0x430, 0x3f3, 0x20, 0x70bd2b, 0x25dfdbfc, {0x3, 0x2, 0x1a, [0x101, 0x5e3323ba, 0x65, 0xffff, 0xffffffff, 0xdf7d, 0x3, 0xc, 0x2, 0x4, 0x8, 0x1, 0x6, 0x300, 0x5, 0x200, 0x0, 0x3, 0xba1, 0x1, 0xe, 0x8, 0x5, 0x7, 0x6, 0x7, 0x1442, 0x0, 0x6, 0x3de8, 0x7, 0x800, 0x4, 0x0, 0x4323d770, 0x4, 0x6, 0x5e, 0x1ff, 0x2, 0x7fff, 0x1, 0x2, 0x5, 0xff, 0x4, 0x4, 0xb, 0x0, 0x63e, 0xfffffffb, 0x1, 0x25, 0x2, 0x1, 0x80000001, 0x8, 0xc, 0x401, 0x9, 0x8, 0x8000, 0x6, 0x1], [0xffff8d4a, 0xffffffff, 0x4, 0x8001, 0x8, 0x800, 0x6, 0xffff, 0x400, 0x3, 0x3, 0xbc8b, 0x6, 0x174b, 0x3, 0x141, 0x6, 0x8, 0x6, 0x3, 0x8, 0x9, 0x8, 0x9d, 0x4, 0x1, 0x6, 0x8b6, 0x3, 0x28740000, 0x9, 0x2, 0x3, 0x800, 0x4e4, 0x808, 0x1000, 0x7, 0x7d5, 0x4, 0x9, 0xb8, 0x5, 0x0, 0x200, 0x15, 0xc000000, 0x6, 0x0, 0x5, 0x46abace7, 0xfffffe00, 0x5, 0xccbe, 0x401, 0xbf, 0x59, 0xffffffc5, 0x3, 0x10001, 0x7, 0x8, 0x6, 0x3], [0x0, 0x2, 0x9, 0x2, 0x100, 0x3, 0x9, 0x7, 0x8, 0x7, 0x2ca000, 0xe, 0xf, 0x1, 0x8000, 0x8, 0x0, 0x2, 0x0, 0x0, 0xb6, 0xc933, 0x8, 0xe, 0x6, 0xfffffffc, 0x1, 0xfffffffd, 0x2, 0x7fff, 0x7, 0x38000, 0x6, 0xffffffff, 0x3, 0x5, 0x3, 0x5, 0x8, 0x80, 0x5, 0x2, 0x5, 0x6b68d80, 0x1, 0xa, 0x80, 0xffffffff, 0xa0, 0x4, 0x5, 0x3, 0x9, 0x0, 0x4, 0x8, 0x1, 0xb2d3, 0x10000, 0xbac, 0x7, 0x1, 0x7, 0xff], [0x0, 0x1, 0x2, 0x7f, 0x3, 0xe, 0xfffffff7, 0x1, 0x8001, 0x8, 0x4, 0xe, 0x8941, 0x4, 0x4, 0x9, 0x100, 0x1, 0x401, 0x9, 0xc8, 0xe96d, 0x1, 0x6, 0x3b9, 0xf, 0x2, 0xf, 0x2, 0x9a, 0x40800000, 0x0, 0x9, 0x7, 0x6, 0xc32, 0x2, 0x80000001, 0xe6a0, 0x38f3, 0x81, 0x0, 0xe22, 0x2db, 0x593, 0x8, 0x7ff, 0x0, 0x9, 0xc, 0x81, 0xfffffff9, 0x6, 0x8, 0x5, 0x3, 0x1000, 0xcd35, 0x3c81ff17, 0x7b1, 0xe, 0x5187, 0x7f, 0x96c0], 0xf, ['nl802154\x00', '&,&\x00', ')\x00']}, ["", "", "", "", ""]}, 0x430}, 0x1, 0x0, 0x0, 0x1}, 0x20000004) r6 = openat$cgroup_netprio_ifpriomap(r1, &(0x7f0000000fc0), 0x2, 0x0) ioctl$FITRIM(r6, 0xc0185879, &(0x7f0000001000)={0x4, 0x2eb6, 0xac6}) sendmsg$NFT_MSG_GETCHAIN(r1, &(0x7f0000001100)={&(0x7f0000001040)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000010c0)={&(0x7f0000001080)={0x2c, 0x4, 0xa, 0x301, 0x0, 0x0, {0x0, 0x0, 0x3}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}, @NFTA_CHAIN_HOOK={0xc, 0x4, 0x0, 0x1, [@NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x1}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x80080}, 0x4000) syz_genetlink_get_family_id$SEG6(&(0x7f0000001140), r1) r7 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000001180), r4) sendmsg$IPSET_CMD_TEST(r1, &(0x7f0000001340)={&(0x7f00000011c0)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000001300)={&(0x7f0000001200)={0xfc, 0xb, 0x6, 0x0, 0x0, 0x0, {0x0, 0x0, 0xa}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_ADT={0x4}, @IPSET_ATTR_ADT={0x88, 0x8, 0x0, 0x1, [{0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_CIDR={0x5}}, {0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_LINENO={0x8, 0x9, 0x1, 0x0, 0x5}}, {0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_TIMEOUT={0x8, 0x6, 0x1, 0x0, 0x1000}}, {0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_MARKMASK={0x8, 0xb, 0x1, 0x0, 0x2}}, {0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_SKBQUEUE={0x6, 0x1d, 0x1, 0x0, 0x1}}, {0x1c, 0x7, 0x0, 0x1, @IPSET_ATTR_IP2={0x18, 0x14, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x14, 0x2, 0x1, 0x0, @remote}}}, {0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_CIDR={0x5, 0x3, 0x1}}, {0x10, 0x7, 0x0, 0x1, @IPSET_ATTR_NAME={0x9, 0x12, 'syz0\x00'}}, {0x10, 0x7, 0x0, 0x1, @IPSET_ATTR_SKBMARK={0xc, 0x1b, 0x1, 0x0, 0x4}}]}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0x38, 0x7, 0x0, 0x1, [@IPSET_ATTR_CIDR2={0x5, 0x15, 0x6}, @IPSET_ATTR_SKBMARK={0xc, 0x1b, 0x1, 0x0, 0x701}, @IPSET_ATTR_PACKETS={0xc}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x4e20}, @IPSET_ATTR_IP2={0xc, 0x14, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}}}]}]}, 0xfc}, 0x1, 0x0, 0x0, 0x8000}, 0x0) r8 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f00000013c0), r4) sendmsg$NLBL_UNLABEL_C_STATICLIST(r4, &(0x7f0000001480)={&(0x7f0000001380)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000001440)={&(0x7f0000001400)={0x14, r8, 0x800, 0x70bd2d, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x8080}, 0x4000) sendmsg$NLBL_UNLABEL_C_STATICREMOVE(r4, &(0x7f0000001580)={&(0x7f00000014c0)={0x10, 0x0, 0x0, 0x22000000}, 0xc, &(0x7f0000001540)={&(0x7f0000001500)={0x34, r8, 0x20, 0x70bd28, 0x25dfdbfe, {}, [@NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @local}, @NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @multicast1}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @broadcast}, @NLBL_UNLABEL_A_ACPTFLG={0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x4000014}, 0x240040c0) sendmsg$NLBL_MGMT_C_PROTOCOLS(r4, &(0x7f0000001680)={&(0x7f00000015c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000001640)={&(0x7f0000001600)={0x3c, r7, 0x700, 0x70bd25, 0x25dfdbff, {}, [@NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x2}, @NLBL_MGMT_A_IPV4ADDR={0x8, 0x7, @local}, @NLBL_MGMT_A_CLPDOI={0x8, 0xc, 0x1}, @NLBL_MGMT_A_DOMAIN={0x5, 0x1, '\x00'}, @NLBL_MGMT_A_IPV4ADDR={0x8, 0x7, @local}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40000}, 0x800) sendmsg$NLBL_MGMT_C_ADD(r4, &(0x7f0000001780)={&(0x7f00000016c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000001740)={&(0x7f0000001700)={0x1c, r7, 0x200, 0x70bd25, 0x25dfdbfd, {}, [@NLBL_MGMT_A_IPV4ADDR={0x8, 0x7, @remote}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x40000) sendmsg$NL802154_CMD_DEL_SEC_KEY(r4, &(0x7f0000001880)={&(0x7f00000017c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000001840)={&(0x7f0000001800)={0x2c, r5, 0x20, 0x70bd25, 0x25dfdbfe, {}, [@NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}]}, 0x2c}, 0x1, 0x0, 0x0, 0x880}, 0x44004) ioctl$BINDER_SET_MAX_THREADS(r1, 0x40046205, &(0x7f00000018c0)) r9 = socket(0x11, 0x4, 0x4) r10 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001940), r9) sendmsg$NL80211_CMD_SET_PMKSA(r1, &(0x7f0000001a80)={&(0x7f0000001900)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000001a40)={&(0x7f0000001980)={0x88, r10, 0x1, 0x70bd27, 0x25dfdbff, {{}, {@void, @void}}, [@NL80211_ATTR_SSID={0x6, 0x34, @random='~.'}, @NL80211_ATTR_PMKID={0x14, 0x55, "858a58d4a747e82b89bb402df3e26f51"}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_PMK={0x14, 0xfe, "586e8c45a3e1cabcd15f8caa8485d01d"}, @NL80211_ATTR_FILS_CACHE_ID={0x6, 0xfd, 0xb}, @NL80211_ATTR_PMK={0x14, 0xfe, "dbe79a0f698cbbc93faf473a37614d46"}, @NL80211_ATTR_PMK_REAUTH_THRESHOLD={0x5, 0x120, 0x8}, @NL80211_ATTR_PMKID={0x14, 0x55, "9429db66a6a6ed724949ed2a9d8874a7"}]}, 0x88}, 0x1, 0x0, 0x0, 0x4000}, 0x81) 550.481734ms ago: executing program 1 (id=287): r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000380)={0x2, 0x13, 0x53, 0x0, 0x16, 0x0, 0x70bd27, 0x25dfdbfe, [@sadb_x_nat_t_type={0x1}, @sadb_x_nat_t_port={0x1, 0x15, 0x4e21}, @sadb_lifetime={0x4, 0x0, 0x5, 0x3, 0xc, 0x1}, @sadb_x_kmaddress={0x8, 0x19, 0x0, @in6={0xa, 0x4e22, 0x80000000, @mcast1, 0x1}, @in6={0xa, 0x4e20, 0x7, @private2={0xfc, 0x2, '\x00', 0x1}, 0x9}}, @sadb_x_nat_t_port={0x1, 0x15, 0x4e21}, @sadb_address={0x5, 0x17, 0x33, 0x80, 0x0, @in6={0xa, 0x4e23, 0xffff7e00, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0xc}}, 0x4}}]}, 0xb0}}, 0x20000800) r1 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x13, 0x0, 0x0) sendmsg$tipc(r1, &(0x7f0000000c80)={&(0x7f0000000980)=@id, 0x10, 0x0}, 0x0) chdir(&(0x7f0000000540)='./cgroup\x00') r2 = syz_open_procfs(0x0, &(0x7f0000000140)='coredump_filter\x00') writev(r2, &(0x7f00000012c0)=[{&(0x7f0000000280)='0', 0x1}, {&(0x7f0000000000)="792792e9", 0x4}], 0x2) r3 = openat(r2, &(0x7f0000000040)='.\x00', 0x0, 0x1bc) r4 = socket$xdp(0x2c, 0x3, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_sys\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1, 0x10012, r5, 0x0) r6 = socket$vsock_stream(0x28, 0x1, 0x0) setsockopt$SO_VM_SOCKETS_BUFFER_MIN_SIZE(r6, 0x28, 0x8, 0x0, 0x0) setsockopt$XDP_UMEM_REG(r4, 0x11b, 0x4, &(0x7f0000000040)={0xfffffffffffffffc, 0x100d000, 0x800}, 0x20) lseek(r3, 0x7fffdfff, 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1d0) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000240), 0x8, &(0x7f0000000340)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) (fail_nth: 9) 350.702683ms ago: executing program 1 (id=289): setuid(0xee01) ioperm(0x3, 0x9, 0x80) r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = dup(0xffffffffffffffff) r2 = socket$packet(0x11, 0x2, 0x300) bind$802154_raw(0xffffffffffffffff, 0x0, 0x0) mount(0x0, &(0x7f0000001040)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt\x00', 0x1ff) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f0000000100)='ext4\x00', 0x8410, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./mnt\x00', 0x0, 0x0) getdents64(r3, &(0x7f0000001640)=""/4096, 0x1000) setsockopt$packet_int(r2, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x2, 0x0) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) r6 = dup3(r5, r4, 0x80000) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000640)={0xc, 0x0, &(0x7f0000000100)=[@free_buffer], 0x0, 0x0, 0x0}) ioctl$TIOCGISO7816(r1, 0x80285442, &(0x7f0000000200)) setsockopt$packet_rx_ring(r6, 0x107, 0x5, &(0x7f0000000140)=@req={0xf, 0x93d, 0x2, 0xfb8}, 0x10) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000100)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet6_int(r7, 0x29, 0x10, 0x0, &(0x7f0000002740)) r8 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000), 0x8802, 0x0) write$cgroup_pressure(r8, 0x0, 0x0) r9 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(r9, 0x89f0, &(0x7f0000001440)={'bridge0\x00', &(0x7f0000000000)=@ethtool_ringparam={0xa, 0x0, 0x300, 0x0, 0x10, 0x200003, 0x2, 0xfffffffd, 0x4}}) write$tun(r0, &(0x7f0000000140)=ANY=[@ANYBLOB="ffffffffffffaaaaaaaaaabb88a82700810010"], 0x32) 290.430556ms ago: executing program 1 (id=290): mmap$IORING_OFF_SQ_RING(0x0, 0xc00003, 0x3000007, 0x401d032, 0xffffffffffffffff, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f00000004c0)={0x2e, 0x64, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet6(0xa, 0x80002, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) openat$binfmt(0xffffffffffffff9c, 0x0, 0x42, 0x1ff) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) syz_usb_control_io(0xffffffffffffffff, &(0x7f0000000180)={0x2c, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) write(0xffffffffffffffff, &(0x7f0000000140)='p', 0x1) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) socket$tipc(0x1e, 0x2, 0x0) sendmsg$inet(r2, 0x0, 0x0) recvmsg$unix(r1, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, &(0x7f00000008c0)=[@cred={{0x1c}}, @rights={{0x10}}, @rights={{0x10}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}], 0xa0}, 0x80) socketpair$unix(0x1, 0x2, 0x0, 0x0) r3 = syz_ublk_setup_io_uring(0x505e, &(0x7f0000000140)={0x0, 0xcfab, 0x2000, 0x2, 0x118}, &(0x7f0000000280), &(0x7f00000002c0), &(0x7f00000003c0)) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) r5 = dup(r4) syz_ublk_setup_queues(r5, r0, &(0x7f00000004c0)={0x0, 0x400042cc, 0x10, 0x1, 0x10080, 0x0, r3}, &(0x7f0000000640)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe706, 0x4, 0x3, 0x91, 0x0, r5}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x403b40, 0x2, 0x4, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x2e95, 0x2, 0x4003bfff, 0x2b5}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5, 0x800, 0x3, 0x200008}}], 0x1, 0x0, 0x0) 290.063496ms ago: executing program 0 (id=291): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff) open$dir(&(0x7f00000003c0)='./config/usb_gadget/g1\x00', 0x10000, 0x18) rmdir(&(0x7f00000002c0)='./config/usb_gadget/g1\x00') setns(0xc9, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = eventfd2(0xe5c, 0x80000) r3 = eventfd2(0x4001, 0x800) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000100)={r2, 0x7, 0x2, r3}) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_IRQ_LINE(r1, 0x4008ae61, &(0x7f00000000c0)={0x7, 0x4}) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f0000000600)={0x0, 0x0, @pic={0x87, 0x82, 0x4, 0x1, 0x2, 0x9, 0xb3, 0xc6, 0x2, 0x6, 0x5, 0x84, 0x5, 0xfd, 0xc0, 0xec}}) syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') 260.028248ms ago: executing program 0 (id=292): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) open$dir(&(0x7f00000003c0)='./config/usb_gadget/g1\x00', 0x10000, 0x18) rmdir(0x0) 249.688788ms ago: executing program 0 (id=293): r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000380)=ANY=[@ANYBLOB="021353001600000027bd7000fedbdf250100140000000000010015004e210000040000000500000003000000000000000c00000000000000010000000000000008001900000000000a004e2280000000ff010000000000000000000000000001050000000a004e2000000007fc02000000000000000000000000160109000000010015004e21000005001700338000000a004e23ffff7e0000000000000000000000ffffac14140c0400000000000000"], 0xb0}}, 0x20000800) r1 = socket$tipc(0x1e, 0x5, 0x0) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000001a40)='./binderfs/binder0\x00', 0x2, 0x0) ioctl$BINDER_SET_MAX_THREADS(r2, 0x40046205, 0x0) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x13, 0x0, 0x0) r3 = gettid() capget(&(0x7f0000000080)={0x20071026, r3}, &(0x7f00000000c0)={0xee96, 0x8, 0x3, 0x8, 0x7}) r4 = socket$inet(0x2, 0x1, 0x0) setsockopt$inet_mreqn(r4, 0x0, 0x27, &(0x7f0000000000)={@multicast1, @local}, 0xc) setsockopt$inet_mreqn(r4, 0x0, 0x25, &(0x7f0000000080)={@multicast1, @local}, 0xc) sendmsg$tipc(r1, &(0x7f0000000c80)={&(0x7f0000000980)=@id, 0x10, 0x0}, 0x0) chdir(&(0x7f0000000540)='./cgroup\x00') r5 = syz_open_procfs(0x0, &(0x7f0000000140)='coredump_filter\x00') writev(r5, &(0x7f00000012c0)=[{&(0x7f0000000280)='0', 0x1}, {&(0x7f0000000000)="792792e9", 0x4}], 0x2) r6 = openat(r5, &(0x7f0000000040)='.\x00', 0x0, 0x1bc) r7 = socket$xdp(0x2c, 0x3, 0x0) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_sys\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1, 0x10012, r8, 0x0) r9 = socket$vsock_stream(0x28, 0x1, 0x0) setsockopt$SO_VM_SOCKETS_BUFFER_MIN_SIZE(r9, 0x28, 0x8, 0x0, 0x0) setsockopt$XDP_UMEM_REG(r7, 0x11b, 0x4, &(0x7f0000000040)={0xfffffffffffffffc, 0x100d000, 0x800}, 0x20) lseek(r6, 0x7fffdfff, 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1d0) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000240), 0x8, &(0x7f0000000340)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) 178.569712ms ago: executing program 0 (id=294): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = eventfd2(0xe5c, 0x80000) (async) r3 = eventfd2(0x4eec, 0x180800) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000100)={r2, 0x7, 0x2, r3}) (async) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$sock(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f0000000300)="64000000100001060000000000000000000000003f000000000000000000000010000300766574683000000000000000250012000800010076657468180002000a000100000002000000000d05e2cf6c50a3070010000300766574683100000000000000", 0x64}], 0x1}, 0x0) (async) r5 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_open_dev$evdev(&(0x7f0000000080), 0x0, 0x309040) (async) ioctl$KVM_IRQ_LINE(r1, 0x4008ae61, &(0x7f00000000c0)={0x7, 0x1}) (async) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f0000000600)={0x0, 0x0, @pic={0x87, 0x82, 0x4, 0x1, 0x2, 0x9, 0xb3, 0xc6, 0x2, 0x6, 0x5, 0x84, 0x5, 0xfd, 0xc0, 0xec}}) (async) ioctl$KVM_SET_REGS(r5, 0x4090ae82, &(0x7f00000003c0)={[0x35, 0xe, 0x4, 0x1, 0x2, 0x1000, 0xf1, 0x0, 0x7fffffffffffb, 0x1, 0x1, 0x40001, 0x0, 0xc12, 0x1, 0xbde], 0x1000, 0x3d4316}) r6 = openat$binfmt_register(0xffffff9c, &(0x7f0000000040), 0x1, 0x0) pwrite64(r6, &(0x7f0000000600)="e67ab1415f2ce290f4681ef5c755f60473b17b7887d68440dd9005bc69f6c3c5238bebfbce42365029d64c6bdf5fc2251eda45a465e64de685865063ff5f776983521685b3a3206ce46af9d586dd02dda5defa42c86b8c26de340e02c25f5801ca2e4fe456d3c9dc8599f9a3fc2b5152b9d2f123697defb2c35e0800", 0x7c, 0x800) (async) ioctl$KVM_RUN(r5, 0xae80, 0x0) 178.408972ms ago: executing program 2 (id=295): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000100)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) write$tun(r0, &(0x7f0000000140)=ANY=[@ANYBLOB="ffffffffffffaaaaaaaaaabb88a827008100100008060001080006040006", @ANYRES64, @ANYRES32], 0x32) 159.933402ms ago: executing program 2 (id=296): r0 = socket$netlink(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r1 = socket$netlink(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f0000000000), 0x4) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001cc0)=ANY=[@ANYBLOB="ac0100001700010000000000000000007f0000010000000000000000000000000000fefffffffffffd8000000000000000000000000000bbac1414bb000000000000000000000000ffffff2b6b57a470b83fce00000000004e210000000000000000006400000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fc0200000000000000000000000000000000000000000000000000000000000100000000000000000a00802000000000", @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fffc000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000200000000f9ffffff00000000000000000000000084000500ffffffff000000000000000000000000000004d33c0000000a00000000000000000000000000000000000001053500000200ac0003000000010000000900000000000000000000000000000000000001000004d56c"], 0x1ac}}, 0x0) 146.530093ms ago: executing program 2 (id=297): r0 = gettid() rt_sigqueueinfo(r0, 0x21, &(0x7f00000002c0)={0xb, 0x4, 0xfffffffe}) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x8ab43, 0x0) r2 = getpid() ptrace$pokeuser(0x6, r2, 0x5, 0x0) r3 = syz_pidfd_open(r2, 0x0) copy_file_range(r3, 0x0, r3, 0x0, 0x22b1, 0x0) r4 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x2) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r4, r5, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000000)=[@text32={0x20, 0x0}], 0x1, 0x2c, 0x0, 0x0) 70.527557ms ago: executing program 0 (id=298): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./trace\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./trace\x00', &(0x7f0000000040)='tracefs\x00', 0x810018, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x3) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1000003, 0x13, r1, 0x0) setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0x7, &(0x7f0000000000)={0x100, 0x1, 0x8, 0x7fffffff}, 0x10) ioctl$KVM_RUN(r1, 0xae80, 0x0) r2 = socket(0x840000000002, 0x3, 0xff) sendmsg$inet(r2, &(0x7f00000001c0)={&(0x7f00000006c0)={0x2, 0x4e21, @multicast2=0xe0000001}, 0x10, &(0x7f0000000ec0)=[{&(0x7f0000000140)="9745edff0000000001008cc5ffffffff", 0x10}, {&(0x7f0000000040)="74145fda", 0x4}], 0x2, &(0x7f0000000840)}, 0x4004804) ioctl$KVM_SET_CPUID2(r1, 0x4008ae90, &(0x7f00000000c0)={0x3, 0x0, [{0x80000008, 0xfff, 0xc, 0x2, 0x4000f818, 0xa83, 0x6}, {0xc0000001, 0xffffffff, 0x6, 0x9, 0x4, 0x2, 0x80}, {0x6, 0x2, 0x2, 0x2, 0x100, 0x7, 0x3}]}) r3 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) r4 = fsmount(r3, 0x0, 0x0) r5 = openat$cgroup(r4, &(0x7f0000000080)='syz1\x00', 0x200002, 0x0) r6 = openat$cgroup_type(r5, &(0x7f00000001c0), 0x2, 0x0) write$cgroup_type(r6, &(0x7f0000000140), 0x9) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x800, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) r9 = socket$inet_tcp(0x2, 0x1, 0x0) r10 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) ioctl$KVM_CHECK_EXTENSION(r10, 0xae03, 0xe8) bind$inet(r9, &(0x7f0000000100)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_int(r9, 0x6, 0x1, &(0x7f0000000040)=0x100000001, 0x4) connect$inet(r9, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) sendto$inet(r9, &(0x7f0000000380)='x', 0x1, 0x480d1, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r8, 0xae60) r11 = ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r11, 0x4008ae89, &(0x7f0000000180)={0x1, 0x0, [{0x40000072, 0x0, 0x7fffffffffffffff}]}) 30.223759ms ago: executing program 2 (id=299): r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000380)={0x2, 0x13, 0x53, 0x0, 0x16, 0x0, 0x70bd27, 0x25dfdbfe, [@sadb_x_nat_t_type={0x1}, @sadb_x_nat_t_port={0x1, 0x15, 0x4e21}, @sadb_lifetime={0x4, 0x0, 0x5, 0x3, 0xc, 0x1}, @sadb_x_kmaddress={0x8, 0x19, 0x0, @in6={0xa, 0x4e22, 0x80000000, @mcast1, 0x1}, @in6={0xa, 0x4e20, 0x7, @private2={0xfc, 0x2, '\x00', 0x1}, 0x9}}, @sadb_x_nat_t_port={0x1, 0x15, 0x4e21}, @sadb_address={0x5, 0x17, 0x33, 0x80, 0x0, @in6={0xa, 0x4e23, 0xffff7e00, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0xc}}, 0x4}}]}, 0xb0}}, 0x20000800) r1 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x13, 0x0, 0x0) sendmsg$tipc(r1, &(0x7f0000000c80)={&(0x7f0000000980)=@id, 0x10, 0x0}, 0x0) chdir(&(0x7f0000000540)='./cgroup\x00') r2 = syz_open_procfs(0x0, &(0x7f0000000140)='coredump_filter\x00') writev(r2, &(0x7f00000012c0)=[{&(0x7f0000000280)='0', 0x1}, {&(0x7f0000000000)="792792e9", 0x4}], 0x2) r3 = openat(r2, &(0x7f0000000040)='.\x00', 0x0, 0x1bc) r4 = socket$xdp(0x2c, 0x3, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_sys\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1, 0x10012, r5, 0x0) r6 = socket$vsock_stream(0x28, 0x1, 0x0) setsockopt$SO_VM_SOCKETS_BUFFER_MIN_SIZE(r6, 0x28, 0x8, 0x0, 0x0) setsockopt$XDP_UMEM_REG(r4, 0x11b, 0x4, &(0x7f0000000040)={0xfffffffffffffffc, 0x100d000, 0x800}, 0x20) lseek(r3, 0x7fffdfff, 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1d0) mount$overlay(0x2000000, &(0x7f0000000100)='./file0\x00', &(0x7f0000000240), 0x8, &(0x7f0000000340)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) 17.132669ms ago: executing program 2 (id=300): unshare(0x6c000600) r0 = syz_clone3(&(0x7f0000000340)={0x801400, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x19}, 0x0, 0x0, 0x0, 0x0}, 0x40) pidfd_send_signal(r1, 0x5, &(0x7f00000000c0)={0x5, 0x8, 0xffffffc4}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) ioctl$sock_SIOCETHTOOL(r2, 0x80108906, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet6(0xa, 0x6, 0x5) keyctl$invalidate(0x15, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a, 0xfffffffffffffffd}) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_FREEZE(r4, 0x400c620e, &(0x7f0000000400)={r0, 0x1, 0x1000}) 0s ago: executing program 2 (id=301): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff) open$dir(&(0x7f00000003c0)='./config/usb_gadget/g1\x00', 0x10000, 0x18) rmdir(&(0x7f00000002c0)='./config/usb_gadget/g1\x00') setns(0xc9, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = eventfd2(0xe5c, 0x80000) r3 = eventfd2(0x4001, 0x800) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000100)={r2, 0x7, 0x2, r3}) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_IRQ_LINE(r1, 0x4008ae61, &(0x7f00000000c0)={0x7, 0x4}) syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.57' (ED25519) to the list of known hosts. [ 21.364237][ T36] audit: type=1400 audit(1789140970.029:64): avc: denied { mounton } for pid=287 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 21.365427][ T287] cgroup: Unknown subsys name 'net' [ 21.386944][ T36] audit: type=1400 audit(1789140970.029:65): avc: denied { mount } for pid=287 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 21.414178][ T36] audit: type=1400 audit(1789140970.059:66): avc: denied { unmount } for pid=287 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 21.414343][ T287] cgroup: Unknown subsys name 'devices' [ 21.539536][ T287] cgroup: Unknown subsys name 'hugetlb' [ 21.545163][ T287] cgroup: Unknown subsys name 'rlimit' [ 21.637516][ T36] audit: type=1400 audit(1789140970.299:67): avc: denied { setattr } for pid=287 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 21.660716][ T36] audit: type=1400 audit(1789140970.309:68): avc: denied { mounton } for pid=287 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 21.685511][ T36] audit: type=1400 audit(1789140970.309:69): avc: denied { mount } for pid=287 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 21.693778][ T289] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 21.717377][ T36] audit: type=1400 audit(1789140970.379:70): avc: denied { relabelto } for pid=289 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.742836][ T36] audit: type=1400 audit(1789140970.379:71): avc: denied { write } for pid=289 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.776507][ T36] audit: type=1400 audit(1789140970.439:72): avc: denied { read } for pid=287 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.802263][ T36] audit: type=1400 audit(1789140970.439:73): avc: denied { open } for pid=287 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.802591][ T287] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 23.047977][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.055032][ T295] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.062321][ T295] bridge_slave_0: entered allmulticast mode [ 23.068544][ T295] bridge_slave_0: entered promiscuous mode [ 23.082080][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.089140][ T294] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.096186][ T294] bridge_slave_0: entered allmulticast mode [ 23.102501][ T294] bridge_slave_0: entered promiscuous mode [ 23.110292][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.117318][ T294] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.124395][ T294] bridge_slave_1: entered allmulticast mode [ 23.130687][ T294] bridge_slave_1: entered promiscuous mode [ 23.136636][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.143731][ T295] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.150852][ T295] bridge_slave_1: entered allmulticast mode [ 23.156976][ T295] bridge_slave_1: entered promiscuous mode [ 23.217418][ T297] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.224491][ T297] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.231579][ T297] bridge_slave_0: entered allmulticast mode [ 23.237800][ T297] bridge_slave_0: entered promiscuous mode [ 23.244166][ T297] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.251230][ T297] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.258316][ T297] bridge_slave_1: entered allmulticast mode [ 23.264595][ T297] bridge_slave_1: entered promiscuous mode [ 23.279211][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.286296][ T296] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.293419][ T296] bridge_slave_0: entered allmulticast mode [ 23.299608][ T296] bridge_slave_0: entered promiscuous mode [ 23.316126][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.323199][ T296] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.330299][ T296] bridge_slave_1: entered allmulticast mode [ 23.336434][ T296] bridge_slave_1: entered promiscuous mode [ 23.455803][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.462849][ T294] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.470158][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.477172][ T294] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.501392][ T297] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.508460][ T297] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.515710][ T297] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.522746][ T297] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.538950][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.545996][ T295] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.553287][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.560322][ T295] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.585697][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.592769][ T296] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.600068][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.607090][ T296] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.624205][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.631958][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.639342][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.646490][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.654141][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.661356][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.668621][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.675771][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.698063][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.705088][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.713894][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.720939][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.732886][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.739932][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.748196][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.755211][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.779460][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.786502][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.794275][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.801306][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.819201][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.826220][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.833833][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.840879][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.884061][ T295] veth0_vlan: entered promiscuous mode [ 23.891021][ T294] veth0_vlan: entered promiscuous mode [ 23.900973][ T297] veth0_vlan: entered promiscuous mode [ 23.917378][ T294] veth1_macvtap: entered promiscuous mode [ 23.933124][ T295] veth1_macvtap: entered promiscuous mode [ 23.947092][ T297] veth1_macvtap: entered promiscuous mode [ 23.974899][ T296] veth0_vlan: entered promiscuous mode [ 23.981702][ T294] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 24.015432][ T296] veth1_macvtap: entered promiscuous mode [ 24.062918][ T317] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 24.327694][ T10] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 24.338435][ T350] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 24.340235][ T350] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 24.347139][ T350] rust_binder: 343:350 got reply transaction with no transaction stack [ 24.363630][ T350] rust_binder: 343:350 transaction reply to 0:0 failed EINVAL, code 0 size 88-24 [ 24.508167][ T10] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 24.527847][ T10] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 24.538423][ T10] usb 4-1: New USB device found, idVendor=28de, idProduct=1142, bcdDevice= 0.00 [ 24.547474][ T10] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 24.557118][ T10] usb 4-1: config 0 descriptor?? [ 24.637684][ T312] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 24.677842][ T332] usb 3-1: new full-speed USB device number 2 using dummy_hcd [ 24.788704][ T312] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 1023 [ 24.798875][ T312] usb 2-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 24.812575][ T312] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 24.821650][ T312] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 24.830277][ T9] rust_binder: 343: undelivered TRANSACTION_ERROR: 29201 [ 24.832418][ T312] usb 2-1: SerialNumber: syz [ 24.838497][ T332] usb 3-1: unable to read config index 0 descriptor/start: -71 [ 24.850325][ T332] usb 3-1: can't read configurations, error -71 [ 24.851679][ T352] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 24.966518][ T10] hid-steam 0003:28DE:1142.0001: unknown main item tag 0x0 [ 24.974102][ T10] hid-steam 0003:28DE:1142.0001: : USB HID v0.00 Device [HID 28de:1142] on usb-dummy_hcd.3-1/input0 [ 25.037584][ T10] hid-steam 0003:28DE:1142.0001: Steam wireless receiver connected [ 25.045558][ T10] hid-steam 0003:28DE:1142.0001: No HID_FEATURE_REPORT submitted - nothing to read [ 25.056559][ T10] hid-steam 0003:28DE:1142.0002: unknown main item tag 0x0 [ 25.064524][ T10] hid-steam 0003:28DE:1142.0002: hidraw0: USB HID v0.00 Device [HID 28de:1142] on usb-dummy_hcd.3-1/input0 [ 25.113170][ T352] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 25.536782][ T31] usb 4-1: USB disconnect, device number 2 [ 25.550777][ T31] hid-steam 0003:28DE:1142.0001: Steam wireless receiver disconnected [ 25.571164][ T383] kvm: requested 5866 ns i8254 timer period limited to 200000 ns [ 25.589083][ T384] kvm: pic: level sensitive irq not supported [ 25.589400][ T384] kvm: pic: single mode not supported [ 25.595986][ T384] kvm: pic: single mode not supported [ 25.601442][ T384] kvm: pic: level sensitive irq not supported [ 25.607075][ T384] kvm: pic: single mode not supported [ 25.772227][ T312] cdc_ether 2-1:1.0: probe with driver cdc_ether failed with error -71 [ 25.794448][ T312] usb 2-1: USB disconnect, device number 2 [ 25.806275][ T401] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=529 sclass=netlink_route_socket pid=401 comm=syz.0.25 [ 25.870162][ T406] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 25.875030][ T406] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 25.884031][ T406] rust_binder: 402:406 got reply transaction with no transaction stack [ 25.898976][ T406] rust_binder: 402:406 transaction reply to 0:0 failed EINVAL, code 0 size 88-24 [ 26.077643][ T332] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 26.247614][ T332] usb 1-1: Using ep0 maxpacket: 32 [ 26.253821][ T332] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 26.263964][ T332] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0xF has invalid maxpacket 1023, setting to 64 [ 26.274760][ T332] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0xE has invalid maxpacket 1024, setting to 64 [ 26.285763][ T332] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x84 has invalid maxpacket 32 [ 26.296067][ T332] usb 1-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 8 [ 26.298462][ T413] overlayfs: missing 'lowerdir' [ 26.316836][ T332] usb 1-1: New USB device found, idVendor=1430, idProduct=474b, bcdDevice= 0.40 [ 26.326027][ T332] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 26.334359][ T332] usb 1-1: Product: syz [ 26.338875][ T332] usb 1-1: Manufacturer: syz [ 26.343508][ T332] usb 1-1: SerialNumber: syz [ 26.349152][ T401] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 26.371655][ T36] kauditd_printk_skb: 139 callbacks suppressed [ 26.371669][ T36] audit: type=1400 audit(1789140975.039:213): avc: denied { unmount } for pid=294 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 26.403953][ T421] overlayfs: failed to resolve './file1': -2 [ 26.561405][ T332] usb 1-1: USB disconnect, device number 2 [ 26.572485][ T321] udevd[321]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 26.626148][ T312] rust_binder: 402: undelivered TRANSACTION_ERROR: 29201 [ 26.641772][ T36] audit: type=1400 audit(1789140975.309:214): avc: denied { read append } for pid=428 comm="syz.2.37" name="rtc0" dev="devtmpfs" ino=195 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 26.665089][ T36] audit: type=1400 audit(1789140975.309:215): avc: denied { ioctl open } for pid=428 comm="syz.2.37" path="/dev/rtc0" dev="devtmpfs" ino=195 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 26.727597][ T10] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 26.800095][ T36] audit: type=1400 audit(1789140975.469:216): avc: denied { mount } for pid=431 comm="syz.2.38" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 26.878585][ T10] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 26.889539][ T10] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 26.899400][ T10] usb 2-1: New USB device found, idVendor=28de, idProduct=1142, bcdDevice= 0.00 [ 26.908562][ T10] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 26.919234][ T10] usb 2-1: config 0 descriptor?? [ 26.923884][ T436] overlayfs: missing 'lowerdir' [ 26.969855][ T442] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 26.982170][ T36] audit: type=1400 audit(1789140975.649:217): avc: denied { bind } for pid=441 comm="syz.2.42" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 27.001391][ T36] audit: type=1400 audit(1789140975.649:218): avc: denied { name_bind } for pid=441 comm="syz.2.42" src=20001 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=rawip_socket permissive=1 [ 27.022027][ T36] audit: type=1400 audit(1789140975.649:219): avc: denied { node_bind } for pid=441 comm="syz.2.42" saddr=::ffff:0.0.0.0 src=20001 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=rawip_socket permissive=1 [ 27.044434][ T36] audit: type=1400 audit(1789140975.649:220): avc: denied { connect } for pid=441 comm="syz.2.42" laddr=::ffff:0.0.0.0 lport=20001 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 27.066679][ T36] audit: type=1400 audit(1789140975.649:221): avc: denied { setopt } for pid=441 comm="syz.2.42" laddr=::ffff:127.0.0.1 lport=20001 faddr=::ffff:127.0.0.1 fport=20001 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 27.093895][ T36] audit: type=1400 audit(1789140975.649:222): avc: denied { write } for pid=441 comm="syz.2.42" path="socket:[3966]" dev="sockfs" ino=3966 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 27.126528][ T451] rust_binder: 450:451 got reply transaction with no transaction stack [ 27.134910][ T451] rust_binder: 450:451 transaction reply to 0:0 failed EINVAL, code 0 size 88-24 [ 27.144573][ T45] rust_binder: 450: undelivered TRANSACTION_ERROR: 29201 [ 27.168465][ T454] FAULT_INJECTION: forcing a failure. [ 27.168465][ T454] name failslab, interval 1, probability 0, space 0, times 1 [ 27.169683][ T456] ./dev/sda1: Can't lookup blockdev [ 27.181177][ T454] CPU: 1 UID: 0 PID: 454 Comm: syz.0.46 Not tainted syzkaller #0 67445127a0e550c06f7dc74ca5ff4a71fcbc5924 [ 27.181206][ T454] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 27.181224][ T454] Call Trace: [ 27.181231][ T454] [ 27.181240][ T454] __dump_stack+0x21/0x30 [ 27.181280][ T454] dump_stack_lvl+0x140/0x1c0 [ 27.181305][ T454] ? __cfi_dump_stack_lvl+0x10/0x10 [ 27.181332][ T454] ? do_futex+0x37d/0x510 [ 27.181356][ T454] dump_stack+0x19/0x20 [ 27.181379][ T454] should_fail_ex+0x3c2/0x510 [ 27.181401][ T454] should_failslab+0xac/0x100 [ 27.181423][ T454] kmem_cache_alloc_noprof+0x42/0x410 [ 27.181442][ T454] ? from_kgid_munged+0x197/0x6e0 [ 27.181463][ T454] ? prepare_creds+0x47/0x6b0 [ 27.181483][ T454] ? __cfi_make_kgid+0x10/0x10 [ 27.181504][ T454] prepare_creds+0x47/0x6b0 [ 27.181523][ T454] __sys_setfsgid+0xda/0x3d0 [ 27.181547][ T454] __x64_sys_setfsgid+0x3b/0x50 [ 27.181569][ T454] x64_sys_call+0x2674/0x2ee0 [ 27.181586][ T454] do_syscall_64+0x57/0xf0 [ 27.181603][ T454] ? clear_bhb_loop+0x50/0xa0 [ 27.181624][ T454] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 27.181645][ T454] RIP: 0033:0x7f31d599e159 [ 27.181664][ T454] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 27.181679][ T454] RSP: 002b:00007f31d6829028 EFLAGS: 00000246 ORIG_RAX: 000000000000007b [ 27.181706][ T454] RAX: ffffffffffffffda RBX: 00007f31d5c25fa0 RCX: 00007f31d599e159 [ 27.181720][ T454] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000000000ee01 [ 27.181731][ T454] RBP: 00007f31d5a3503b R08: 0000000000000000 R09: 0000000000000000 [ 27.181743][ T454] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 27.181755][ T454] R13: 00007f31d5c26038 R14: 00007f31d5c25fa0 R15: 00007ffd17f11bf8 [ 27.181771][ T454] [ 27.376582][ T10] hid-steam 0003:28DE:1142.0003: unknown main item tag 0x0 [ 27.384061][ T10] hid-steam 0003:28DE:1142.0003: : USB HID v0.00 Device [HID 28de:1142] on usb-dummy_hcd.1-1/input0 [ 27.407806][ T462] overlayfs: missing 'workdir' [ 27.449265][ T10] hid-steam 0003:28DE:1142.0003: Steam wireless receiver connected [ 27.461703][ T10] hid-steam 0003:28DE:1142.0003: No HID_FEATURE_REPORT submitted - nothing to read [ 27.473974][ T10] hid-steam 0003:28DE:1142.0004: unknown main item tag 0x0 [ 27.480408][ T473] tipc: Enabling of bearer rejected, failed to enable media [ 27.485355][ T10] hid-steam 0003:28DE:1142.0004: hidraw0: USB HID v0.00 Device [HID 28de:1142] on usb-dummy_hcd.1-1/input0 [ 27.517883][ T477] rust_binder: 476:477 got reply transaction with no transaction stack [ 27.526498][ T477] rust_binder: 476:477 transaction reply to 0:0 failed EINVAL, code 0 size 88-24 [ 27.536152][ T45] rust_binder: 476: undelivered TRANSACTION_ERROR: 29201 [ 27.555018][ T471] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 27.567684][ T480] syz.3.55 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 27.647604][ T332] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 27.797779][ T332] usb 1-1: Using ep0 maxpacket: 32 [ 27.804037][ T332] usb 1-1: config 0 has an invalid interface number: 196 but max is 0 [ 27.812257][ T332] usb 1-1: config 0 has no interface number 0 [ 27.818421][ T332] usb 1-1: config 0 interface 196 altsetting 1 bulk endpoint 0x2 has invalid maxpacket 528 [ 27.828776][ T332] usb 1-1: config 0 interface 196 altsetting 1 endpoint 0x82 has invalid wMaxPacketSize 0 [ 27.839401][ T332] usb 1-1: config 0 interface 196 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 0 [ 27.849324][ T332] usb 1-1: config 0 interface 196 has no altsetting 0 [ 27.857421][ T332] usb 1-1: New USB device found, idVendor=05ac, idProduct=7700, bcdDevice=eb.3a [ 27.866540][ T332] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 27.874551][ T332] usb 1-1: Product: syz [ 27.878981][ T332] usb 1-1: Manufacturer: syz [ 27.883581][ T332] usb 1-1: SerialNumber: syz [ 27.888911][ T332] usb 1-1: config 0 descriptor?? [ 27.894151][ T463] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 27.942981][ T45] usb 2-1: USB disconnect, device number 3 [ 27.950637][ T45] hid-steam 0003:28DE:1142.0003: Steam wireless receiver disconnected [ 27.967625][ T10] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 28.118928][ T10] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 28.131226][ T10] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 1.00 [ 28.140406][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 28.148456][ T10] usb 3-1: Product: syz [ 28.152626][ T10] usb 3-1: Manufacturer: syz [ 28.157210][ T10] usb 3-1: SerialNumber: syz [ 28.164445][ T10] cdc_wdm 3-1:1.0: cdc-wdm0: USB WDM device [ 28.170410][ T10] cdc_wdm 3-1:1.0: Unknown control protocol [ 28.303411][ T332] ipheth 1-1:0.196: ipheth_get_macaddr: usb_control_msg: short packet: 0 bytes [ 28.312441][ T332] ipheth 1-1:0.196: probe with driver ipheth failed with error -22 [ 28.429820][ T501] 9pnet_fd: Insufficient options for proto=fd [ 28.490475][ T509] overlayfs: missing 'workdir' [ 28.516880][ T45] usb 1-1: USB disconnect, device number 3 [ 28.540416][ T514] rust_binder: 513:514 got reply transaction with no transaction stack [ 28.560754][ T514] rust_binder: 513:514 transaction reply to 0:0 failed EINVAL, code 0 size 88-24 [ 28.570557][ T332] rust_binder: 513: undelivered TRANSACTION_ERROR: 29201 [ 28.580739][ T486] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 28.590333][ T486] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 28.693756][ T523] process 'syz.1.69' launched './tracing/events/kvm/kvm_hv_stimer_cleanup/trigger' with NULL argv: empty string added [ 28.706447][ T523] kernel read not supported for file events/kvm/kvm_hv_stimer_cleanup/trigger (pid: 523 comm: syz.1.69) [ 28.831618][ T45] usb 3-1: USB disconnect, device number 4 [ 29.031806][ T536] overlayfs: missing 'workdir' [ 29.099201][ T548] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 29.100004][ T548] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 29.106600][ T548] rust_binder: 537:548 got reply transaction with no transaction stack [ 29.121326][ T548] rust_binder: 537:548 transaction reply to 0:0 failed EINVAL, code 0 size 88-24 [ 29.184562][ T551] cgroup: fork rejected by pids controller in /syz3 [ 29.240069][ T589] netlink: 20 bytes leftover after parsing attributes in process `syz.3.81'. [ 29.320090][ T332] usb 1-1: new full-speed USB device number 4 using dummy_hcd [ 29.467694][ T332] usb 1-1: device descriptor read/64, error -71 [ 29.527635][ T493] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 29.546654][ T606] overlayfs: failed to resolve './bus': -2 [ 29.677731][ T493] usb 4-1: Using ep0 maxpacket: 16 [ 29.684014][ T493] usb 4-1: config index 0 descriptor too short (expected 51443, got 18) [ 29.693888][ T493] usb 4-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 29.703065][ T493] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 29.711117][ T332] usb 1-1: device descriptor read/64, error -71 [ 29.717359][ T493] usb 4-1: Product: syz [ 29.722039][ T493] usb 4-1: Manufacturer: syz [ 29.726624][ T493] usb 4-1: SerialNumber: syz [ 29.733522][ T493] r8152-cfgselector 4-1: Unknown version 0x0000 [ 29.739817][ T493] r8152-cfgselector 4-1: config 0 descriptor?? [ 29.876548][ T45] rust_binder: 537: undelivered TRANSACTION_ERROR: 29201 [ 29.947626][ T332] usb 1-1: new full-speed USB device number 5 using dummy_hcd [ 29.956546][ T589] input: syz0 as /devices/virtual/input/input4 [ 29.965635][ T493] r8152-cfgselector 4-1: Unknown version 0x0000 [ 29.978201][ T493] r8152-cfgselector 4-1: bad CDC descriptors [ 29.988226][ T493] r8152-cfgselector 4-1: USB disconnect, device number 3 [ 30.002477][ T618] Zero length message leads to an empty skb [ 30.087669][ T332] usb 1-1: device descriptor read/64, error -71 [ 30.189519][ T635] overlayfs: failed to resolve './bus': -2 [ 30.283294][ T644] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 30.284182][ T644] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 30.297627][ T45] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 30.337618][ T332] usb 1-1: device descriptor read/64, error -71 [ 30.457756][ T332] usb usb1-port1: attempt power cycle [ 30.458748][ T45] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 30.473322][ T45] usb 2-1: config 1 interface 0 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 30.486259][ T45] usb 2-1: config 1 interface 0 has no altsetting 0 [ 30.497834][ T45] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 30.508074][ T45] usb 2-1: config 1 interface 0 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 30.520990][ T45] usb 2-1: config 1 interface 0 has no altsetting 0 [ 30.528304][ T45] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 30.538427][ T45] usb 2-1: config 1 interface 0 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 30.551310][ T45] usb 2-1: config 1 interface 0 has no altsetting 0 [ 30.559251][ T45] usb 2-1: New USB device found, idVendor=04b8, idProduct=0202, bcdDevice= 0.40 [ 30.568323][ T45] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 30.576300][ T45] usb 2-1: Product: syz [ 30.580495][ T45] usb 2-1: Manufacturer: syz [ 30.585083][ T45] usb 2-1: SerialNumber: syz [ 30.737606][ T493] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 30.793850][ T45] usb 2-1: USB disconnect, device number 4 [ 30.797599][ T332] usb 1-1: new full-speed USB device number 6 using dummy_hcd [ 30.828792][ T332] usb 1-1: device descriptor read/8, error -71 [ 30.888672][ T493] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 30.899703][ T493] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 30.909461][ T493] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 30.922456][ T493] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 30.931561][ T493] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 30.940098][ T493] usb 4-1: config 0 descriptor?? [ 30.958583][ T332] usb 1-1: device descriptor read/8, error -71 [ 31.197669][ T332] usb 1-1: new full-speed USB device number 7 using dummy_hcd [ 31.218484][ T332] usb 1-1: device descriptor read/8, error -71 [ 31.354942][ T493] plantronics 0003:047F:FFFF.0005: unknown main item tag 0x0 [ 31.362454][ T493] plantronics 0003:047F:FFFF.0005: unbalanced collection at end of report description [ 31.373455][ T493] plantronics 0003:047F:FFFF.0005: parse failed [ 31.379890][ T493] plantronics 0003:047F:FFFF.0005: probe with driver plantronics failed with error -22 [ 31.389742][ T332] usb 1-1: device descriptor read/8, error -71 [ 31.497689][ T332] usb usb1-port1: unable to enumerate USB device [ 31.556220][ T31] usb 4-1: USB disconnect, device number 4 [ 31.842371][ T36] kauditd_printk_skb: 63 callbacks suppressed [ 31.842387][ T36] audit: type=1400 audit(1789140980.509:286): avc: denied { write } for pid=655 comm="syz.1.103" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=key permissive=1 [ 31.967737][ T660] overlayfs: failed to resolve './bus': -2 [ 32.001393][ T36] audit: type=1400 audit(1789140980.669:287): avc: denied { mount } for pid=665 comm="syz.2.108" name="/" dev="ramfs" ino=5419 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ramfs_t tclass=filesystem permissive=1 [ 32.008228][ T666] fuse: Unknown parameter 'eser_id' [ 32.060206][ T666] overlay: ./file0 is not a directory [ 32.153023][ T681] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 32.153664][ T681] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 32.447602][ T332] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 32.587652][ T332] usb 3-1: device descriptor read/64, error -71 [ 32.740141][ T36] audit: type=1326 audit(1789140981.409:288): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=657 comm="syz.1.104" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc458b9e159 code=0x7fc00000 [ 32.765342][ T36] audit: type=1326 audit(1789140981.409:289): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=657 comm="syz.1.104" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fc458b9e159 code=0x7fc00000 [ 32.790351][ T36] audit: type=1326 audit(1789140981.409:290): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=657 comm="syz.1.104" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc458b9e159 code=0x7fc00000 [ 32.815400][ T36] audit: type=1326 audit(1789140981.409:291): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=657 comm="syz.1.104" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc458b9e159 code=0x7fc00000 [ 32.840444][ T36] audit: type=1326 audit(1789140981.409:292): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=657 comm="syz.1.104" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc458b9e159 code=0x7fc00000 [ 32.847622][ T332] usb 3-1: device descriptor read/64, error -71 [ 32.865504][ T36] audit: type=1326 audit(1789140981.409:293): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=657 comm="syz.1.104" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc458b9e159 code=0x7fc00000 [ 32.896833][ T36] audit: type=1326 audit(1789140981.409:294): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=657 comm="syz.1.104" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc458b9e159 code=0x7fc00000 [ 32.921869][ T36] audit: type=1326 audit(1789140981.409:295): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=657 comm="syz.1.104" exe="/root/ci2-android-6-12-rust/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc458b9e159 code=0x7fc00000 [ 32.945068][ T687] netlink: 1412 bytes leftover after parsing attributes in process `syz.0.114'. [ 32.979717][ T689] overlayfs: failed to resolve './bus': -2 [ 33.107646][ T332] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 33.197648][ T66] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 33.237660][ T332] usb 3-1: device descriptor read/64, error -71 [ 33.257645][ T493] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 33.327642][ T66] usb 1-1: device descriptor read/64, error -71 [ 33.417612][ T493] usb 2-1: Using ep0 maxpacket: 32 [ 33.423978][ T493] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 33.435774][ T493] usb 2-1: New USB device found, idVendor=22b8, idProduct=6027, bcdDevice=c2.80 [ 33.445084][ T493] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 33.453183][ T493] usb 2-1: Product: syz [ 33.457463][ T493] usb 2-1: Manufacturer: syz [ 33.462164][ T493] usb 2-1: SerialNumber: syz [ 33.470735][ T493] usb 2-1: config 0 descriptor?? [ 33.477773][ T493] usb 2-1: bad CDC descriptors [ 33.482757][ T493] usb 2-1: unsupported MDLM descriptors [ 33.488405][ T332] usb 3-1: device descriptor read/64, error -71 [ 33.597654][ T66] usb 1-1: device descriptor read/64, error -71 [ 33.607768][ T332] usb usb3-port1: attempt power cycle [ 33.689751][ T31] usb 2-1: USB disconnect, device number 5 [ 33.777651][ T492] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 33.837631][ T66] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 33.927599][ T492] usb 4-1: Using ep0 maxpacket: 8 [ 33.933746][ T492] usb 4-1: config 0 interface 0 altsetting 5 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 33.944807][ T492] usb 4-1: config 0 interface 0 altsetting 5 endpoint 0x81 has invalid maxpacket 1040, setting to 1024 [ 33.955907][ T332] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 33.963528][ T492] usb 4-1: config 0 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 33.976383][ T66] usb 1-1: device descriptor read/64, error -71 [ 33.982691][ T492] usb 4-1: config 0 interface 0 has no altsetting 0 [ 33.989348][ T492] usb 4-1: New USB device found, idVendor=1b96, idProduct=000a, bcdDevice= 0.00 [ 33.998424][ T492] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 34.007258][ T332] usb 3-1: device descriptor read/8, error -71 [ 34.013584][ T492] usb 4-1: config 0 descriptor?? [ 34.018816][ T705] raw-gadget.3 gadget.3: fail, usb_ep_enable returned -22 [ 34.138573][ T332] usb 3-1: device descriptor read/8, error -71 [ 34.227627][ T66] usb 1-1: device descriptor read/64, error -71 [ 34.303145][ T711] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 34.337703][ T66] usb usb1-port1: attempt power cycle [ 34.377633][ T332] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 34.398551][ T332] usb 3-1: device descriptor read/8, error -71 [ 34.438292][ T492] input: HID 1b96:000a as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/0003:1B96:000A.0006/input/input5 [ 34.457872][ T492] ntrig 0003:1B96:000A.0006: input,hidraw0: USB HID v0.00 Joystick [HID 1b96:000a] on usb-dummy_hcd.3-1/input0 [ 34.528549][ T332] usb 3-1: device descriptor read/8, error -71 [ 34.637711][ T332] usb usb3-port1: unable to enumerate USB device [ 34.647210][ T492] usb 4-1: USB disconnect, device number 5 [ 34.687650][ T66] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 34.708595][ T66] usb 1-1: device descriptor read/8, error -71 [ 34.839086][ T66] usb 1-1: device descriptor read/8, error -71 [ 35.077657][ T66] usb 1-1: new high-speed USB device number 11 using dummy_hcd [ 35.114653][ T66] usb 1-1: device descriptor read/8, error -71 [ 35.150022][ T716] overlayfs: failed to resolve './bus': -2 [ 35.248567][ T66] usb 1-1: device descriptor read/8, error -71 [ 35.298340][ T740] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 35.367717][ T66] usb usb1-port1: unable to enumerate USB device [ 35.404089][ T747] overlayfs: failed to resolve './bus': -2 [ 35.545939][ T755] 9pnet: p9_errstr2errno: server reported unknown error 0x000000 [ 35.750028][ T767] overlay: filesystem on ./file0 not supported as upperdir [ 35.990268][ T773] overlayfs: failed to resolve './bus': -2 [ 36.007069][ T311] usb 3-1: new high-speed USB device number 9 using dummy_hcd [ 36.027825][ T777] overlayfs: failed to resolve './bus': -2 [ 36.049076][ T779] device-mapper: ioctl: Invalid new mapped device name or uuid string supplied. [ 36.093141][ T784] devpts: called with bogus options [ 36.098561][ T784] devpts: called with bogus options [ 36.106759][ T784] devpts: called with bogus options [ 36.112900][ T784] devpts: called with bogus options [ 36.118236][ T784] devpts: called with bogus options [ 36.123568][ T784] devpts: called with bogus options [ 36.128865][ T784] devpts: called with bogus options [ 36.134156][ T784] devpts: called with bogus options [ 36.139483][ T784] devpts: called with bogus options [ 36.144769][ T784] devpts: called with bogus options [ 36.150287][ T784] devpts: called with bogus options [ 36.155784][ T784] devpts: called with bogus options [ 36.161102][ T784] devpts: called with bogus options [ 36.166349][ T784] devpts: called with bogus options [ 36.171663][ T784] devpts: called with bogus options [ 36.176931][ T784] devpts: called with bogus options [ 36.177587][ T311] usb 3-1: Using ep0 maxpacket: 16 [ 36.182241][ T784] devpts: called with bogus options [ 36.188582][ T311] usb 3-1: config 64 has an invalid interface number: 238 but max is 0 [ 36.192528][ T784] devpts: called with bogus options [ 36.200904][ T311] usb 3-1: config 64 has an invalid descriptor of length 0, skipping remainder of the config [ 36.206075][ T784] devpts: called with bogus options [ 36.216344][ T311] usb 3-1: config 64 has no interface number 0 [ 36.221471][ T784] devpts: called with bogus options [ 36.227724][ T311] usb 3-1: config 64 interface 238 has no altsetting 0 [ 36.232840][ T784] devpts: called with bogus options [ 36.241388][ T311] usb 3-1: New USB device found, idVendor=046d, idProduct=087c, bcdDevice=b0.7a [ 36.245238][ T784] devpts: called with bogus options [ 36.253912][ T311] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 36.259096][ T784] devpts: called with bogus options [ 36.267103][ T311] usb 3-1: Product: syz [ 36.272257][ T784] devpts: called with bogus options [ 36.276335][ T311] usb 3-1: Manufacturer: syz [ 36.281589][ T784] devpts: called with bogus options [ 36.286312][ T311] usb 3-1: SerialNumber: syz [ 36.291383][ T784] devpts: called with bogus options [ 36.301118][ T784] devpts: called with bogus options [ 36.306432][ T784] devpts: called with bogus options [ 36.311750][ T784] devpts: called with bogus options [ 36.317048][ T784] devpts: called with bogus options [ 36.322362][ T784] devpts: called with bogus options [ 36.327693][ T784] devpts: called with bogus options [ 36.333000][ T784] devpts: called with bogus options [ 36.377661][ T45] usb 2-1: new full-speed USB device number 6 using dummy_hcd [ 36.502358][ T311] uvcvideo 3-1:64.238: Found Unit with invalid ID 0 [ 36.509034][ T311] usb 3-1: Found UVC 0.00 device syz (046d:087c) [ 36.515381][ T311] usb 3-1: No valid video chain found. [ 36.520913][ T45] usb 2-1: device descriptor read/64, error -71 [ 36.530122][ T311] usb 3-1: USB disconnect, device number 9 [ 36.587627][ T643] usb 1-1: new high-speed USB device number 12 using dummy_hcd [ 36.737617][ T643] usb 1-1: Using ep0 maxpacket: 32 [ 36.743832][ T643] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 36.754737][ T643] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 36.764497][ T45] usb 2-1: device descriptor read/64, error -71 [ 36.770778][ T643] usb 1-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 36.779840][ T643] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 36.788308][ T643] usb 1-1: config 0 descriptor?? [ 36.794115][ T643] hub 1-1:0.0: USB hub found [ 36.994572][ T791] capability: warning: `syz.0.155' uses deprecated v2 capabilities in a way that may be insecure [ 37.018428][ T45] usb 2-1: new full-speed USB device number 7 using dummy_hcd [ 37.039666][ T36] kauditd_printk_skb: 86 callbacks suppressed [ 37.039681][ T36] audit: type=1400 audit(1789140985.709:382): avc: denied { listen } for pid=803 comm="syz.2.159" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 37.068812][ T36] audit: type=1400 audit(1789140985.709:383): avc: denied { accept } for pid=803 comm="syz.2.159" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 37.147595][ T45] usb 2-1: device descriptor read/64, error -71 [ 37.387620][ T45] usb 2-1: device descriptor read/64, error -71 [ 37.497702][ T45] usb usb2-port1: attempt power cycle [ 37.546231][ T818] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 37.837610][ T45] usb 2-1: new full-speed USB device number 8 using dummy_hcd [ 37.868849][ T45] usb 2-1: device descriptor read/8, error -71 [ 37.905801][ T36] audit: type=1400 audit(1789140986.569:384): avc: denied { ioctl } for pid=838 comm="syz.2.164" path="/dev/fuse" dev="devtmpfs" ino=23 ioctlcmd=0x6609 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 37.998488][ T45] usb 2-1: device descriptor read/8, error -71 [ 38.237636][ T45] usb 2-1: new full-speed USB device number 9 using dummy_hcd [ 38.258584][ T45] usb 2-1: device descriptor read/8, error -71 [ 38.398600][ T45] usb 2-1: device descriptor read/8, error -71 [ 38.507718][ T45] usb usb2-port1: unable to enumerate USB device [ 38.838375][ T851] rust_binder: Write failure EINVAL in pid:177 [ 38.851303][ T36] audit: type=1400 audit(1789140987.519:385): avc: denied { mount } for pid=852 comm="syz.2.169" name="/" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=filesystem permissive=1 [ 38.851804][ T853] ======================================================= [ 38.851804][ T853] WARNING: The mand mount option has been deprecated and [ 38.851804][ T853] and is ignored by this kernel. Remove the mand [ 38.851804][ T853] option from the mount to silence this warning. [ 38.851804][ T853] ======================================================= [ 38.857894][ T36] audit: type=1400 audit(1789140987.519:386): avc: denied { mounton } for pid=852 comm="syz.2.169" path="/63/debug/tracing/trace_pipe" dev="tracefs" ino=18 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=file permissive=1 [ 38.938538][ T36] audit: type=1400 audit(1789140987.549:387): avc: denied { unmount } for pid=296 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=filesystem permissive=1 [ 38.951963][ T855] overlayfs: failed to resolve './bus': -2 [ 39.053171][ T863] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 39.131153][ T865] FAULT_INJECTION: forcing a failure. [ 39.131153][ T865] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 39.150694][ T865] CPU: 1 UID: 0 PID: 865 Comm: syz.1.174 Not tainted syzkaller #0 67445127a0e550c06f7dc74ca5ff4a71fcbc5924 [ 39.150724][ T865] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 39.150736][ T865] Call Trace: [ 39.150742][ T865] [ 39.150750][ T865] __dump_stack+0x21/0x30 [ 39.150782][ T865] dump_stack_lvl+0x140/0x1c0 [ 39.150808][ T865] ? __cfi_dump_stack_lvl+0x10/0x10 [ 39.150834][ T865] ? check_stack_object+0x81/0x150 [ 39.150854][ T865] ? __virt_addr_valid+0x2a1/0x370 [ 39.150877][ T865] dump_stack+0x19/0x20 [ 39.150901][ T865] should_fail_ex+0x3c2/0x510 [ 39.150925][ T865] should_fail+0xf/0x20 [ 39.150946][ T865] should_fail_usercopy+0x1e/0x30 [ 39.150969][ T865] _copy_from_user+0x20/0xa0 [ 39.150994][ T865] memdup_user+0x81/0x170 [ 39.151011][ T865] ? strndup_user+0x40/0xd0 [ 39.151029][ T865] strndup_user+0x6c/0xd0 [ 39.151045][ T865] __se_sys_mount+0x9f/0x480 [ 39.151066][ T865] ? ksys_write+0x1f3/0x260 [ 39.151086][ T865] ? __x64_sys_mount+0xf0/0xf0 [ 39.151108][ T865] __x64_sys_mount+0xc3/0xf0 [ 39.151128][ T865] x64_sys_call+0x2021/0x2ee0 [ 39.151146][ T865] do_syscall_64+0x57/0xf0 [ 39.151164][ T865] ? clear_bhb_loop+0x50/0xa0 [ 39.151187][ T865] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 39.151209][ T865] RIP: 0033:0x7fc458b9e159 [ 39.151225][ T865] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 39.151241][ T865] RSP: 002b:00007fc459a86028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 39.151269][ T865] RAX: ffffffffffffffda RBX: 00007fc458e25fa0 RCX: 00007fc458b9e159 [ 39.151285][ T865] RDX: 0000200000000240 RSI: 0000200000000100 RDI: 0000000000000000 [ 39.151298][ T865] RBP: 00007fc459a86090 R08: 0000200000000340 R09: 0000000000000000 [ 39.151309][ T865] R10: 0000000000000008 R11: 0000000000000246 R12: 0000000000000001 [ 39.151321][ T865] R13: 00007fc458e26038 R14: 00007fc458e25fa0 R15: 00007ffcc80e22b8 [ 39.151337][ T865] [ 39.376254][ T36] audit: type=1400 audit(1789140988.039:388): avc: denied { create } for pid=866 comm="syz.1.175" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 39.400545][ T643] hub 1-1:0.0: config failed, can't read hub descriptor (err -22) [ 39.401459][ T36] audit: type=1400 audit(1789140988.039:389): avc: denied { wake_alarm } for pid=866 comm="syz.1.175" capability=35 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 39.409799][ T643] usbhid 1-1:0.0: can't add hid device: -71 [ 39.436830][ T643] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 39.469007][ T643] usb 1-1: USB disconnect, device number 12 [ 39.681677][ T891] overlayfs: failed to resolve './bus': -2 [ 39.699798][ T893] FAULT_INJECTION: forcing a failure. [ 39.699798][ T893] name failslab, interval 1, probability 0, space 0, times 0 [ 39.712505][ T893] CPU: 0 UID: 0 PID: 893 Comm: syz.3.186 Not tainted syzkaller #0 67445127a0e550c06f7dc74ca5ff4a71fcbc5924 [ 39.712535][ T893] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 39.712547][ T893] Call Trace: [ 39.712552][ T893] [ 39.712560][ T893] __dump_stack+0x21/0x30 [ 39.712588][ T893] dump_stack_lvl+0x140/0x1c0 [ 39.712610][ T893] ? __cfi_dump_stack_lvl+0x10/0x10 [ 39.712633][ T893] ? check_stack_object+0x81/0x150 [ 39.712651][ T893] ? __virt_addr_valid+0x2a1/0x370 [ 39.712673][ T893] dump_stack+0x19/0x20 [ 39.712694][ T893] should_fail_ex+0x3c2/0x510 [ 39.712715][ T893] should_failslab+0xac/0x100 [ 39.712738][ T893] __kmalloc_cache_noprof+0x41/0x470 [ 39.712757][ T893] ? memdup_user+0xb1/0x170 [ 39.712773][ T893] ? __se_sys_mount+0x15f/0x480 [ 39.712793][ T893] __se_sys_mount+0x15f/0x480 [ 39.712810][ T893] ? ksys_write+0x1f3/0x260 [ 39.712823][ T893] ? __x64_sys_mount+0xf0/0xf0 [ 39.712834][ T893] __x64_sys_mount+0xc3/0xf0 [ 39.712845][ T893] x64_sys_call+0x2021/0x2ee0 [ 39.712854][ T893] do_syscall_64+0x57/0xf0 [ 39.712864][ T893] ? clear_bhb_loop+0x50/0xa0 [ 39.712877][ T893] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 39.712888][ T893] RIP: 0033:0x7f69d059e159 [ 39.712898][ T893] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 39.712907][ T893] RSP: 002b:00007f69d148b028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 39.712963][ T893] RAX: ffffffffffffffda RBX: 00007f69d0825fa0 RCX: 00007f69d059e159 [ 39.712971][ T893] RDX: 0000200000000240 RSI: 0000200000000100 RDI: 0000000000000000 [ 39.712978][ T893] RBP: 00007f69d148b090 R08: 0000200000000340 R09: 0000000000000000 [ 39.712984][ T893] R10: 0000000000000008 R11: 0000000000000246 R12: 0000000000000001 [ 39.712991][ T893] R13: 00007f69d0826038 R14: 00007f69d0825fa0 R15: 00007ffe1d601638 [ 39.712999][ T893] [ 39.910736][ T36] audit: type=1400 audit(1789140988.399:390): avc: denied { setopt } for pid=894 comm="syz.3.187" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 39.963127][ T36] audit: type=1400 audit(1789140988.629:391): avc: denied { append } for pid=899 comm="syz.2.189" name="trace" dev="tracefs" ino=17 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=file permissive=1 [ 40.077982][ T643] usb 1-1: new high-speed USB device number 13 using dummy_hcd [ 40.228901][ T643] usb 1-1: unable to get BOS descriptor or descriptor too short [ 40.237295][ T643] usb 1-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 64, changing to 7 [ 40.249692][ T643] usb 1-1: New USB device found, idVendor=0582, idProduct=004c, bcdDevice= 0.40 [ 40.258790][ T643] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 40.266767][ T643] usb 1-1: Product: syz [ 40.270960][ T643] usb 1-1: Manufacturer: syz [ 40.275549][ T643] usb 1-1: SerialNumber: syz [ 40.442247][ T919] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 40.486803][ T889] mmap: syz.0.184 (889) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 40.580759][ T643] usb 1-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 40.587775][ T643] usb 1-1: 2:1 : unknown format tag 0x4 is detected. processed as MPEG. [ 40.596186][ T643] usb 1-1: found format II with max.bitrate = 4, frame size=7372 [ 40.604424][ T643] usb 1-1: parse_audio_format_rates_v2v3(): unable to retrieve number of sample rates (clock 0) [ 40.617382][ T643] usb 1-1: USB disconnect, device number 13 [ 40.630514][ T403] udevd[403]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 40.860104][ T924] FAULT_INJECTION: forcing a failure. [ 40.860104][ T924] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 40.873233][ T924] CPU: 1 UID: 0 PID: 924 Comm: syz.2.198 Not tainted syzkaller #0 67445127a0e550c06f7dc74ca5ff4a71fcbc5924 [ 40.873263][ T924] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 40.873275][ T924] Call Trace: [ 40.873279][ T924] [ 40.873285][ T924] __dump_stack+0x21/0x30 [ 40.873303][ T924] dump_stack_lvl+0x140/0x1c0 [ 40.873317][ T924] ? __cfi_dump_stack_lvl+0x10/0x10 [ 40.873331][ T924] dump_stack+0x19/0x20 [ 40.873344][ T924] should_fail_ex+0x3c2/0x510 [ 40.873357][ T924] should_fail+0xf/0x20 [ 40.873368][ T924] should_fail_usercopy+0x1e/0x30 [ 40.873380][ T924] _copy_from_iter+0x1a6/0x1520 [ 40.873396][ T924] ? __cfi__copy_from_iter+0x10/0x10 [ 40.873410][ T924] tun_get_user+0x231/0x3720 [ 40.873422][ T924] ? arch_stack_walk+0x10a/0x170 [ 40.873450][ T924] ? ptr_ring_consume+0x430/0x430 [ 40.873460][ T924] ? _parse_integer+0x2e/0x40 [ 40.873471][ T924] ? kstrtoull+0x13b/0x1e0 [ 40.873482][ T924] ? __kasan_check_write+0x18/0x20 [ 40.873494][ T924] ? ref_tracker_alloc+0x32b/0x5b0 [ 40.873507][ T924] ? __cfi_ref_tracker_alloc+0x10/0x10 [ 40.873519][ T924] ? selinux_file_permission+0x318/0xb60 [ 40.873532][ T924] ? __kasan_check_write+0x18/0x20 [ 40.873541][ T924] ? proc_fail_nth_write+0x184/0x220 [ 40.873557][ T924] tun_chr_write_iter+0x1fa/0x310 [ 40.873568][ T924] vfs_write+0x75f/0xfd0 [ 40.873579][ T924] ? __cfi_vfs_write+0x10/0x10 [ 40.873591][ T924] ksys_write+0x145/0x260 [ 40.873602][ T924] ? __cfi_ksys_write+0x10/0x10 [ 40.873612][ T924] ? __kasan_check_write+0x18/0x20 [ 40.873622][ T924] ? __kasan_check_read+0x15/0x20 [ 40.873632][ T924] __x64_sys_write+0x7f/0x90 [ 40.873642][ T924] x64_sys_call+0x271c/0x2ee0 [ 40.873652][ T924] do_syscall_64+0x57/0xf0 [ 40.873662][ T924] ? clear_bhb_loop+0x50/0xa0 [ 40.873675][ T924] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 40.873694][ T924] RIP: 0033:0x7fa555d9e159 [ 40.873710][ T924] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 40.873724][ T924] RSP: 002b:00007fa556c5f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 40.873736][ T924] RAX: ffffffffffffffda RBX: 00007fa556025fa0 RCX: 00007fa555d9e159 [ 40.873744][ T924] RDX: 0000000000000032 RSI: 0000200000000140 RDI: 0000000000000003 [ 40.873751][ T924] RBP: 00007fa556c5f090 R08: 0000000000000000 R09: 0000000000000000 [ 40.873757][ T924] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 40.873763][ T924] R13: 00007fa556026038 R14: 00007fa556025fa0 R15: 00007fffc2c8f718 [ 40.873772][ T924] [ 41.203107][ T934] overlayfs: failed to resolve './bus': -2 [ 41.242550][ T941] FAULT_INJECTION: forcing a failure. [ 41.242550][ T941] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 41.255743][ T941] CPU: 1 UID: 0 PID: 941 Comm: syz.0.206 Not tainted syzkaller #0 67445127a0e550c06f7dc74ca5ff4a71fcbc5924 [ 41.255772][ T941] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 41.255783][ T941] Call Trace: [ 41.255790][ T941] [ 41.255797][ T941] __dump_stack+0x21/0x30 [ 41.255827][ T941] dump_stack_lvl+0x140/0x1c0 [ 41.255852][ T941] ? __cfi_dump_stack_lvl+0x10/0x10 [ 41.255878][ T941] dump_stack+0x19/0x20 [ 41.255901][ T941] should_fail_ex+0x3c2/0x510 [ 41.255923][ T941] should_fail+0xf/0x20 [ 41.255941][ T941] should_fail_usercopy+0x1e/0x30 [ 41.255971][ T941] _copy_from_user+0x20/0xa0 [ 41.255996][ T941] __se_sys_mount+0x182/0x480 [ 41.256016][ T941] ? ksys_write+0x1f3/0x260 [ 41.256036][ T941] ? __x64_sys_mount+0xf0/0xf0 [ 41.256057][ T941] __x64_sys_mount+0xc3/0xf0 [ 41.256076][ T941] x64_sys_call+0x2021/0x2ee0 [ 41.256093][ T941] do_syscall_64+0x57/0xf0 [ 41.256110][ T941] ? clear_bhb_loop+0x50/0xa0 [ 41.256132][ T941] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 41.256153][ T941] RIP: 0033:0x7f31d599e159 [ 41.256170][ T941] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 41.256185][ T941] RSP: 002b:00007f31d6829028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 41.256206][ T941] RAX: ffffffffffffffda RBX: 00007f31d5c25fa0 RCX: 00007f31d599e159 [ 41.256220][ T941] RDX: 0000200000000240 RSI: 0000200000000100 RDI: 0000000000000000 [ 41.256233][ T941] RBP: 00007f31d6829090 R08: 0000200000000340 R09: 0000000000000000 [ 41.256246][ T941] R10: 0000000000000008 R11: 0000000000000246 R12: 0000000000000001 [ 41.256257][ T941] R13: 00007f31d5c26038 R14: 00007f31d5c25fa0 R15: 00007ffd17f11bf8 [ 41.256273][ T941] [ 41.256529][ T941] overlayfs: failed to resolve './bus': -2 [ 41.598699][ T960] FAULT_INJECTION: forcing a failure. [ 41.598699][ T960] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 41.612157][ T960] CPU: 1 UID: 0 PID: 960 Comm: syz.2.215 Not tainted syzkaller #0 67445127a0e550c06f7dc74ca5ff4a71fcbc5924 [ 41.612184][ T960] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 41.612195][ T960] Call Trace: [ 41.612200][ T960] [ 41.612207][ T960] __dump_stack+0x21/0x30 [ 41.612233][ T960] dump_stack_lvl+0x140/0x1c0 [ 41.612255][ T960] ? __cfi_dump_stack_lvl+0x10/0x10 [ 41.612276][ T960] ? x64_sys_call+0x271c/0x2ee0 [ 41.612292][ T960] ? entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 41.612313][ T960] dump_stack+0x19/0x20 [ 41.612342][ T960] should_fail_ex+0x3c2/0x510 [ 41.612362][ T960] should_fail+0xf/0x20 [ 41.612380][ T960] should_fail_usercopy+0x1e/0x30 [ 41.612400][ T960] _copy_from_iter+0x1a6/0x1520 [ 41.612424][ T960] ? __cfi__copy_from_iter+0x10/0x10 [ 41.612445][ T960] ? __check_object_size+0x54c/0x870 [ 41.612464][ T960] ? __cfi___check_object_size+0x10/0x10 [ 41.612482][ T960] ? __kasan_check_write+0x18/0x20 [ 41.612498][ T960] ? __build_skb_around+0x2a4/0x590 [ 41.612518][ T960] skb_copy_datagram_from_iter+0xf4/0x6f0 [ 41.612540][ T960] ? napi_alloc_skb+0x212/0x560 [ 41.612559][ T960] tun_get_user+0xd99/0x3720 [ 41.612579][ T960] ? ptr_ring_consume+0x430/0x430 [ 41.612596][ T960] ? _parse_integer+0x2e/0x40 [ 41.612613][ T960] ? kstrtoull+0x13b/0x1e0 [ 41.612631][ T960] ? __kasan_check_write+0x18/0x20 [ 41.612647][ T960] ? ref_tracker_alloc+0x32b/0x5b0 [ 41.612668][ T960] ? __cfi_ref_tracker_alloc+0x10/0x10 [ 41.612688][ T960] ? selinux_file_permission+0x318/0xb60 [ 41.612708][ T960] ? __kasan_check_write+0x18/0x20 [ 41.612724][ T960] ? proc_fail_nth_write+0x184/0x220 [ 41.612748][ T960] tun_chr_write_iter+0x1fa/0x310 [ 41.612766][ T960] vfs_write+0x75f/0xfd0 [ 41.612784][ T960] ? __cfi_vfs_write+0x10/0x10 [ 41.612804][ T960] ksys_write+0x145/0x260 [ 41.612821][ T960] ? __cfi_ksys_write+0x10/0x10 [ 41.612838][ T960] ? __kasan_check_write+0x18/0x20 [ 41.612855][ T960] ? __kasan_check_read+0x15/0x20 [ 41.612872][ T960] __x64_sys_write+0x7f/0x90 [ 41.612889][ T960] x64_sys_call+0x271c/0x2ee0 [ 41.612904][ T960] do_syscall_64+0x57/0xf0 [ 41.612920][ T960] ? clear_bhb_loop+0x50/0xa0 [ 41.612939][ T960] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 41.612958][ T960] RIP: 0033:0x7fa555d9e159 [ 41.612972][ T960] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 41.612986][ T960] RSP: 002b:00007fa556c5f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 41.613004][ T960] RAX: ffffffffffffffda RBX: 00007fa556025fa0 RCX: 00007fa555d9e159 [ 41.613017][ T960] RDX: 0000000000000032 RSI: 0000200000000140 RDI: 0000000000000003 [ 41.613028][ T960] RBP: 00007fa556c5f090 R08: 0000000000000000 R09: 0000000000000000 [ 41.613039][ T960] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 41.613049][ T960] R13: 00007fa556026038 R14: 00007fa556025fa0 R15: 00007fffc2c8f718 [ 41.613063][ T960] [ 41.915652][ T961] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 41.967621][ T31] usb 2-1: new full-speed USB device number 10 using dummy_hcd [ 42.087578][ T36] kauditd_printk_skb: 15 callbacks suppressed [ 42.087593][ T36] audit: type=1400 audit(1789140990.749:407): avc: denied { setattr } for pid=979 comm="syz.3.224" name="/" dev="configfs" ino=2600 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 42.129712][ T31] usb 2-1: not running at top speed; connect to a high speed hub [ 42.133871][ T986] FAULT_INJECTION: forcing a failure. [ 42.133871][ T986] name failslab, interval 1, probability 0, space 0, times 0 [ 42.138191][ T31] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0 [ 42.162573][ T31] usb 2-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice= 0.40 [ 42.165513][ T986] CPU: 0 UID: 0 PID: 986 Comm: syz.3.226 Not tainted syzkaller #0 67445127a0e550c06f7dc74ca5ff4a71fcbc5924 [ 42.165542][ T986] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 42.165553][ T986] Call Trace: [ 42.165560][ T986] [ 42.165567][ T986] __dump_stack+0x21/0x30 [ 42.165595][ T986] dump_stack_lvl+0x140/0x1c0 [ 42.165619][ T986] ? __cfi_dump_stack_lvl+0x10/0x10 [ 42.165644][ T986] dump_stack+0x19/0x20 [ 42.165665][ T986] should_fail_ex+0x3c2/0x510 [ 42.165687][ T986] should_failslab+0xac/0x100 [ 42.165709][ T986] kmem_cache_alloc_noprof+0x42/0x410 [ 42.165728][ T986] ? getname_flags+0xcc/0x6b0 [ 42.165748][ T986] getname_flags+0xcc/0x6b0 [ 42.165768][ T986] user_path_at+0x2b/0x60 [ 42.165789][ T986] __se_sys_mount+0x28a/0x480 [ 42.165807][ T986] ? ksys_write+0x1f3/0x260 [ 42.165826][ T986] ? __x64_sys_mount+0xf0/0xf0 [ 42.165853][ T986] __x64_sys_mount+0xc3/0xf0 [ 42.165871][ T986] x64_sys_call+0x2021/0x2ee0 [ 42.165887][ T986] do_syscall_64+0x57/0xf0 [ 42.165903][ T986] ? clear_bhb_loop+0x50/0xa0 [ 42.165925][ T986] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 42.165945][ T986] RIP: 0033:0x7f69d059e159 [ 42.165961][ T986] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 42.165975][ T986] RSP: 002b:00007f69d148b028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 42.165995][ T986] RAX: ffffffffffffffda RBX: 00007f69d0825fa0 RCX: 00007f69d059e159 [ 42.166008][ T986] RDX: 0000200000000240 RSI: 0000200000000100 RDI: 0000000000000000 [ 42.166021][ T986] RBP: 00007f69d148b090 R08: 0000200000000340 R09: 0000000000000000 [ 42.166033][ T986] R10: 0000000000000008 R11: 0000000000000246 R12: 0000000000000001 [ 42.166045][ T986] R13: 00007f69d0826038 R14: 00007f69d0825fa0 R15: 00007ffe1d601638 [ 42.166060][ T986] [ 42.359300][ T31] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 42.367532][ T31] usb 2-1: Product: syz [ 42.371796][ T31] usb 2-1: Manufacturer: syz [ 42.376399][ T31] usb 2-1: SerialNumber: syz [ 42.446375][ T36] audit: type=1400 audit(1789140991.109:408): avc: denied { mounton } for pid=988 comm="syz.3.227" path="/45/mnt" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 42.530529][ T36] audit: type=1400 audit(1789140991.199:409): avc: denied { rmdir } for pid=297 comm="syz-executor" name="proc" dev="sda1" ino=1264 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 42.594155][ T31] snd-usb-audio 2-1:1.0: probe with driver snd-usb-audio failed with error -2 [ 42.801162][ T36] audit: type=1400 audit(1789140991.469:410): avc: denied { read write } for pid=946 comm="syz.1.209" name="uhid" dev="devtmpfs" ino=199 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:uhid_device_t tclass=chr_file permissive=1 [ 42.803437][ T947] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 42.825385][ T36] audit: type=1400 audit(1789140991.469:411): avc: denied { open } for pid=946 comm="syz.1.209" path="/dev/uhid" dev="devtmpfs" ino=199 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:uhid_device_t tclass=chr_file permissive=1 [ 42.832893][ T31] wiimote 0005:057E:0306.0007: hidraw0: BLUETOOTH HID v0.03 Gamepad [syz0] on syz0 [ 42.856309][ T947] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 42.868831][ T31] wiimote 0005:057E:0306.0007: New device registered [ 42.893211][ T946] wiimote 0005:057E:0306.0007: Device removed [ 43.112421][ T1006] FAULT_INJECTION: forcing a failure. [ 43.112421][ T1006] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 43.125569][ T1006] CPU: 1 UID: 0 PID: 1006 Comm: syz.0.232 Not tainted syzkaller #0 67445127a0e550c06f7dc74ca5ff4a71fcbc5924 [ 43.125599][ T1006] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 43.125610][ T1006] Call Trace: [ 43.125618][ T1006] [ 43.125626][ T1006] __dump_stack+0x21/0x30 [ 43.125650][ T1006] dump_stack_lvl+0x140/0x1c0 [ 43.125664][ T1006] ? __cfi_dump_stack_lvl+0x10/0x10 [ 43.125678][ T1006] ? check_stack_object+0x138/0x150 [ 43.125689][ T1006] dump_stack+0x19/0x20 [ 43.125702][ T1006] should_fail_ex+0x3c2/0x510 [ 43.125717][ T1006] should_fail+0xf/0x20 [ 43.125729][ T1006] should_fail_usercopy+0x1e/0x30 [ 43.125741][ T1006] _copy_to_user+0x24/0xa0 [ 43.125756][ T1006] simple_read_from_buffer+0xed/0x160 [ 43.125771][ T1006] proc_fail_nth_read+0x1aa/0x220 [ 43.125786][ T1006] ? __cfi_proc_fail_nth_read+0x10/0x10 [ 43.125800][ T1006] ? bpf_lsm_file_permission+0xd/0x20 [ 43.125813][ T1006] ? __cfi_proc_fail_nth_read+0x10/0x10 [ 43.125827][ T1006] vfs_read+0x288/0xc70 [ 43.125839][ T1006] ? __cfi_vfs_read+0x10/0x10 [ 43.125848][ T1006] ? __kasan_check_write+0x18/0x20 [ 43.125859][ T1006] ? mutex_lock+0x97/0x1d0 [ 43.125871][ T1006] ? __cfi_mutex_lock+0x10/0x10 [ 43.125883][ T1006] ksys_read+0x145/0x260 [ 43.125893][ T1006] ? __cfi_ksys_read+0x10/0x10 [ 43.125904][ T1006] ? __kasan_check_read+0x15/0x20 [ 43.125914][ T1006] __x64_sys_read+0x7f/0x90 [ 43.125924][ T1006] x64_sys_call+0x2638/0x2ee0 [ 43.125934][ T1006] do_syscall_64+0x57/0xf0 [ 43.125943][ T1006] ? clear_bhb_loop+0x50/0xa0 [ 43.125955][ T1006] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 43.125967][ T1006] RIP: 0033:0x7f31d595e98e [ 43.125976][ T1006] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 43.125985][ T1006] RSP: 002b:00007f31d6828fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 43.125997][ T1006] RAX: ffffffffffffffda RBX: 00007f31d68296c0 RCX: 00007f31d595e98e [ 43.126004][ T1006] RDX: 000000000000000f RSI: 00007f31d68290a0 RDI: 0000000000000007 [ 43.126011][ T1006] RBP: 00007f31d6829090 R08: 0000000000000000 R09: 0000000000000000 [ 43.126017][ T1006] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 43.126024][ T1006] R13: 00007f31d5c26038 R14: 00007f31d5c25fa0 R15: 00007ffd17f11bf8 [ 43.126032][ T1006] [ 43.437709][ T1010] overlayfs: failed to resolve './bus': -2 [ 43.641073][ T36] audit: type=1400 audit(1789140992.309:412): avc: denied { read } for pid=297 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 43.657612][ T492] usb 1-1: new high-speed USB device number 14 using dummy_hcd [ 43.666930][ T36] audit: type=1400 audit(1789140992.309:413): avc: denied { open } for pid=297 comm="syz-executor" path="/45/mnt/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 43.700940][ T36] audit: type=1400 audit(1789140992.309:414): avc: denied { setattr } for pid=297 comm="syz-executor" path="/45/mnt/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 43.737620][ T66] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 43.817612][ T492] usb 1-1: Using ep0 maxpacket: 16 [ 43.823965][ T492] usb 1-1: too many endpoints for config 0 interface 0 altsetting 0: 255, using maximum allowed: 30 [ 43.835292][ T492] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 255 [ 43.848584][ T492] usb 1-1: New USB device found, idVendor=048d, idProduct=8595, bcdDevice= 0.00 [ 43.857800][ T492] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 43.868061][ T111] udevd[111]: could not touch /run/udev/queue: No such file or directory [ 43.876611][ T492] usb 1-1: config 0 descriptor?? [ 43.884587][ T111] udevd[111]: could not touch /run/udev/queue: No such file or directory [ 43.894483][ T66] usb 3-1: too many endpoints for config 1 interface 0 altsetting 13: 33, using maximum allowed: 30 [ 43.905914][ T66] usb 3-1: config 1 interface 0 altsetting 13 has 1 endpoint descriptor, different from the interface descriptor's value: 33 [ 43.927749][ T66] usb 3-1: config 1 interface 0 has no altsetting 0 [ 43.937038][ T66] usb 3-1: string descriptor 0 read error: -22 [ 43.943535][ T66] usb 3-1: New USB device found, idVendor=0458, idProduct=5013, bcdDevice= 0.40 [ 43.952894][ T66] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 43.968650][ T31] wiimote 0005:057E:0306.0007: detected device: Nintendo Wii Remote (Gen 1) [ 43.988707][ T31] input: Nintendo Wii Remote Accelerometer as /devices/virtual/misc/uhid/0005:057E:0306.0007/input/input7 [ 44.012233][ T31] input: Nintendo Wii Remote IR as /devices/virtual/misc/uhid/0005:057E:0306.0007/input/input8 [ 44.026513][ T31] input: Nintendo Wii Remote as /devices/virtual/misc/uhid/0005:057E:0306.0007/input/input6 [ 44.095333][ T1008] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 44.105106][ T1008] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 44.106544][ T492] itetech 0003:048D:8595.0008: unexpected long global item [ 44.120493][ T492] itetech 0003:048D:8595.0008: probe with driver itetech failed with error -22 [ 44.163026][ T1014] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 44.171533][ T1014] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 44.179590][ T1014] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 44.188054][ T1014] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 44.196115][ T1014] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 44.204938][ T1014] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 44.213030][ T1014] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 44.222074][ T1014] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 44.231221][ T1014] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 44.240748][ T1014] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 44.251914][ T66] usbhid 3-1:1.0: can't add hid device: -32 [ 44.257919][ T66] usbhid 3-1:1.0: probe with driver usbhid failed with error -32 [ 44.305226][ T311] usb 1-1: USB disconnect, device number 14 [ 44.887275][ T1028] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 46.515537][ T312] usb 3-1: USB disconnect, device number 10 [ 46.549519][ T1045] FAULT_INJECTION: forcing a failure. [ 46.549519][ T1045] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 46.562702][ T1045] CPU: 1 UID: 0 PID: 1045 Comm: syz.2.244 Not tainted syzkaller #0 67445127a0e550c06f7dc74ca5ff4a71fcbc5924 [ 46.562733][ T1045] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 46.562744][ T1045] Call Trace: [ 46.562750][ T1045] [ 46.562757][ T1045] __dump_stack+0x21/0x30 [ 46.562787][ T1045] dump_stack_lvl+0x140/0x1c0 [ 46.562812][ T1045] ? __cfi_dump_stack_lvl+0x10/0x10 [ 46.562838][ T1045] dump_stack+0x19/0x20 [ 46.562862][ T1045] should_fail_ex+0x3c2/0x510 [ 46.562884][ T1045] should_fail+0xf/0x20 [ 46.562903][ T1045] should_fail_usercopy+0x1e/0x30 [ 46.562926][ T1045] strncpy_from_user+0x29/0x280 [ 46.562948][ T1045] getname_flags+0x106/0x6b0 [ 46.562970][ T1045] user_path_at+0x2b/0x60 [ 46.562992][ T1045] __se_sys_mount+0x28a/0x480 [ 46.563012][ T1045] ? ksys_write+0x1f3/0x260 [ 46.563031][ T1045] ? __x64_sys_mount+0xf0/0xf0 [ 46.563052][ T1045] __x64_sys_mount+0xc3/0xf0 [ 46.563072][ T1045] x64_sys_call+0x2021/0x2ee0 [ 46.563089][ T1045] do_syscall_64+0x57/0xf0 [ 46.563106][ T1045] ? clear_bhb_loop+0x50/0xa0 [ 46.563129][ T1045] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 46.563150][ T1045] RIP: 0033:0x7fa555d9e159 [ 46.563166][ T1045] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 46.563181][ T1045] RSP: 002b:00007fa556c5f028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 46.563201][ T1045] RAX: ffffffffffffffda RBX: 00007fa556025fa0 RCX: 00007fa555d9e159 [ 46.563215][ T1045] RDX: 0000200000000240 RSI: 0000200000000100 RDI: 0000000000000000 [ 46.563228][ T1045] RBP: 00007fa556c5f090 R08: 0000200000000340 R09: 0000000000000000 [ 46.563241][ T1045] R10: 0000000000000008 R11: 0000000000000246 R12: 0000000000000001 [ 46.563253][ T1045] R13: 00007fa556026038 R14: 00007fa556025fa0 R15: 00007fffc2c8f718 [ 46.563269][ T1045] [ 47.547614][ T312] usb 1-1: new high-speed USB device number 15 using dummy_hcd [ 47.698698][ T312] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 47.709138][ T1055] overlayfs: failed to resolve './bus': -2 [ 47.719075][ T312] usb 1-1: New USB device found, idVendor=1ae7, idProduct=9001, bcdDevice= 0.00 [ 47.734736][ T312] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 47.746289][ T312] usb 1-1: config 0 descriptor?? [ 47.921964][ T36] audit: type=1400 audit(1789140996.589:415): avc: denied { mounton } for pid=1063 comm="syz.2.252" path="/92/file0" dev="tmpfs" ino=532 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=fifo_file permissive=1 [ 47.921988][ T1064] fuse: Bad value for 'fd' [ 47.955510][ T1064] syz.2.252 (1064): attempted to duplicate a private mapping with mremap. This is not supported. [ 48.169443][ T312] speedlink 0003:1AE7:9001.0009: ignoring exceeding usage max [ 48.182570][ T312] speedlink 0003:1AE7:9001.0009: item 0 1 0 9 parsing failed [ 48.194906][ T312] speedlink 0003:1AE7:9001.0009: probe with driver speedlink failed with error -22 [ 48.377258][ T36] audit: type=1400 audit(1789140997.039:416): avc: denied { map } for pid=1052 comm="syz.0.247" path="socket:[8743]" dev="sockfs" ino=8743 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=udp_socket permissive=1 [ 48.403767][ T1053] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 48.422515][ T1053] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 48.438024][ T36] audit: type=1400 audit(1789140997.039:417): avc: denied { accept } for pid=1052 comm="syz.0.247" path="socket:[8743]" dev="sockfs" ino=8743 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=udp_socket permissive=1 [ 48.570427][ T492] usb 1-1: USB disconnect, device number 15 [ 49.474811][ T1088] FAULT_INJECTION: forcing a failure. [ 49.474811][ T1088] name failslab, interval 1, probability 0, space 0, times 0 [ 49.487648][ T1088] CPU: 1 UID: 0 PID: 1088 Comm: syz.2.258 Not tainted syzkaller #0 67445127a0e550c06f7dc74ca5ff4a71fcbc5924 [ 49.487679][ T1088] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 49.487691][ T1088] Call Trace: [ 49.487696][ T1088] [ 49.487704][ T1088] __dump_stack+0x21/0x30 [ 49.487732][ T1088] dump_stack_lvl+0x140/0x1c0 [ 49.487765][ T1088] ? __cfi_dump_stack_lvl+0x10/0x10 [ 49.487791][ T1088] dump_stack+0x19/0x20 [ 49.487813][ T1088] should_fail_ex+0x3c2/0x510 [ 49.487835][ T1088] should_failslab+0xac/0x100 [ 49.487858][ T1088] __kmalloc_cache_noprof+0x41/0x470 [ 49.487879][ T1088] ? alloc_fs_context+0x6f/0x800 [ 49.487902][ T1088] ? __asan_memcpy+0x5a/0x80 [ 49.487922][ T1088] alloc_fs_context+0x6f/0x800 [ 49.487944][ T1088] ? __kasan_check_write+0x18/0x20 [ 49.487960][ T1088] fs_context_for_mount+0x26/0x40 [ 49.487983][ T1088] do_new_mount+0x116/0xb40 [ 49.488002][ T1088] ? security_capable+0x44/0x130 [ 49.488024][ T1088] path_mount+0x66a/0xff0 [ 49.488042][ T1088] ? putname+0x113/0x150 [ 49.488063][ T1088] __se_sys_mount+0x2bf/0x480 [ 49.488083][ T1088] ? ksys_write+0x1f3/0x260 [ 49.488100][ T1088] ? __x64_sys_mount+0xf0/0xf0 [ 49.488124][ T1088] __x64_sys_mount+0xc3/0xf0 [ 49.488143][ T1088] x64_sys_call+0x2021/0x2ee0 [ 49.488159][ T1088] do_syscall_64+0x57/0xf0 [ 49.488176][ T1088] ? clear_bhb_loop+0x50/0xa0 [ 49.488197][ T1088] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 49.488218][ T1088] RIP: 0033:0x7fa555d9e159 [ 49.488233][ T1088] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 49.488248][ T1088] RSP: 002b:00007fa556c5f028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 49.488272][ T1088] RAX: ffffffffffffffda RBX: 00007fa556025fa0 RCX: 00007fa555d9e159 [ 49.488287][ T1088] RDX: 0000200000000240 RSI: 0000200000000100 RDI: 0000000000000000 [ 49.488300][ T1088] RBP: 00007fa556c5f090 R08: 0000200000000340 R09: 0000000000000000 [ 49.488312][ T1088] R10: 0000000000000008 R11: 0000000000000246 R12: 0000000000000001 [ 49.488324][ T1088] R13: 00007fa556026038 R14: 00007fa556025fa0 R15: 00007fffc2c8f718 [ 49.488340][ T1088] [ 50.277608][ T643] usb 1-1: new high-speed USB device number 16 using dummy_hcd [ 50.330958][ T45] usb 2-1: USB disconnect, device number 10 [ 50.407624][ T643] usb 1-1: device descriptor read/64, error -71 [ 50.647661][ T643] usb 1-1: device descriptor read/64, error -71 [ 50.679120][ T45] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 50.827765][ T45] usb 2-1: Using ep0 maxpacket: 32 [ 50.834182][ T45] usb 2-1: config 0 has an invalid interface number: 196 but max is 0 [ 50.842826][ T45] usb 2-1: config 0 has no interface number 0 [ 50.849226][ T45] usb 2-1: config 0 interface 196 altsetting 1 bulk endpoint 0x2 has invalid maxpacket 528 [ 50.859543][ T45] usb 2-1: config 0 interface 196 altsetting 1 endpoint 0x82 has invalid wMaxPacketSize 0 [ 50.871769][ T45] usb 2-1: config 0 interface 196 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 0 [ 50.887626][ T643] usb 1-1: new high-speed USB device number 17 using dummy_hcd [ 50.897714][ T45] usb 2-1: config 0 interface 196 has no altsetting 0 [ 50.906015][ T45] usb 2-1: New USB device found, idVendor=05ac, idProduct=7700, bcdDevice=eb.3a [ 50.915155][ T45] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 50.923389][ T45] usb 2-1: Product: syz [ 50.927595][ T45] usb 2-1: Manufacturer: syz [ 50.932212][ T45] usb 2-1: SerialNumber: syz [ 50.940946][ T45] usb 2-1: config 0 descriptor?? [ 50.946231][ T1119] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 51.027635][ T643] usb 1-1: device descriptor read/64, error -71 [ 51.267628][ T643] usb 1-1: device descriptor read/64, error -71 [ 51.387765][ T643] usb usb1-port1: attempt power cycle [ 51.416244][ T45] ipheth 2-1:0.196: ipheth_get_macaddr: usb_control_msg: short packet: 0 bytes [ 51.425408][ T45] ipheth 2-1:0.196: probe with driver ipheth failed with error -22 [ 51.580085][ T1131] FAULT_INJECTION: forcing a failure. [ 51.580085][ T1131] name failslab, interval 1, probability 0, space 0, times 0 [ 51.592795][ T1131] CPU: 0 UID: 0 PID: 1131 Comm: syz.2.273 Not tainted syzkaller #0 67445127a0e550c06f7dc74ca5ff4a71fcbc5924 [ 51.592826][ T1131] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 51.592837][ T1131] Call Trace: [ 51.592842][ T1131] [ 51.592850][ T1131] __dump_stack+0x21/0x30 [ 51.592880][ T1131] dump_stack_lvl+0x140/0x1c0 [ 51.592905][ T1131] ? __cfi_dump_stack_lvl+0x10/0x10 [ 51.592932][ T1131] dump_stack+0x19/0x20 [ 51.592955][ T1131] should_fail_ex+0x3c2/0x510 [ 51.592978][ T1131] should_failslab+0xac/0x100 [ 51.593000][ T1131] __kmalloc_cache_noprof+0x41/0x470 [ 51.593021][ T1131] ? kasan_save_alloc_info+0x3a/0x50 [ 51.593038][ T1131] ? ovl_init_fs_context+0x65/0x790 [ 51.593059][ T1131] ? __kasan_kmalloc+0x96/0xb0 [ 51.593082][ T1131] ovl_init_fs_context+0x65/0x790 [ 51.593103][ T1131] alloc_fs_context+0x5c4/0x800 [ 51.593128][ T1131] fs_context_for_mount+0x26/0x40 [ 51.593152][ T1131] do_new_mount+0x116/0xb40 [ 51.593172][ T1131] ? security_capable+0x44/0x130 [ 51.593195][ T1131] path_mount+0x66a/0xff0 [ 51.593214][ T1131] ? putname+0x113/0x150 [ 51.593235][ T1131] __se_sys_mount+0x2bf/0x480 [ 51.593254][ T1131] ? ksys_write+0x1f3/0x260 [ 51.593274][ T1131] ? __x64_sys_mount+0xf0/0xf0 [ 51.593295][ T1131] __x64_sys_mount+0xc3/0xf0 [ 51.593315][ T1131] x64_sys_call+0x2021/0x2ee0 [ 51.593332][ T1131] do_syscall_64+0x57/0xf0 [ 51.593348][ T1131] ? clear_bhb_loop+0x50/0xa0 [ 51.593369][ T1131] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 51.593389][ T1131] RIP: 0033:0x7fa555d9e159 [ 51.593405][ T1131] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 51.593420][ T1131] RSP: 002b:00007fa556c5f028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 51.593440][ T1131] RAX: ffffffffffffffda RBX: 00007fa556025fa0 RCX: 00007fa555d9e159 [ 51.593455][ T1131] RDX: 0000200000000240 RSI: 0000200000000100 RDI: 0000000000000000 [ 51.593468][ T1131] RBP: 00007fa556c5f090 R08: 0000200000000340 R09: 0000000000000000 [ 51.593480][ T1131] R10: 0000000000000008 R11: 0000000000000246 R12: 0000000000000001 [ 51.593492][ T1131] R13: 00007fa556026038 R14: 00007fa556025fa0 R15: 00007fffc2c8f718 [ 51.593508][ T1131] [ 51.807631][ T643] usb 1-1: new high-speed USB device number 18 using dummy_hcd [ 51.857840][ T643] usb 1-1: device descriptor read/8, error -71 [ 51.988688][ T643] usb 1-1: device descriptor read/8, error -71 [ 52.147745][ C1] af_packet: tpacket_rcv: packet too big, clamped from 32820 to 3944. macoff=96 [ 52.237638][ T643] usb 1-1: new high-speed USB device number 19 using dummy_hcd [ 52.258735][ T643] usb 1-1: device descriptor read/8, error -71 [ 52.388649][ T643] usb 1-1: device descriptor read/8, error -71 [ 52.497704][ T643] usb usb1-port1: unable to enumerate USB device [ 52.804487][ T1141] overlayfs: failed to resolve './bus': -2 [ 53.117606][ T643] usb 3-1: new high-speed USB device number 11 using dummy_hcd [ 53.277629][ T643] usb 3-1: Using ep0 maxpacket: 32 [ 53.284020][ T643] usb 3-1: config index 0 descriptor too short (expected 8228, got 36) [ 53.292646][ T643] usb 3-1: New USB device found, idVendor=28bd, idProduct=0078, bcdDevice= 0.00 [ 53.302677][ T643] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 53.311584][ T643] usb 3-1: config 0 descriptor?? [ 53.395448][ T45] usb 2-1: USB disconnect, device number 11 [ 53.522132][ T643] usbhid 3-1:0.0: can't add hid device: -71 [ 53.528735][ T643] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 53.539918][ T643] usb 3-1: USB disconnect, device number 11 [ 54.051138][ T36] audit: type=1400 audit(1789141002.719:418): avc: denied { name_bind } for pid=1158 comm="syz.2.283" src=3618 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=udp_socket permissive=1 [ 54.078808][ T1159] netlink: 108 bytes leftover after parsing attributes in process `syz.2.283'. [ 54.124714][ T1167] FAULT_INJECTION: forcing a failure. [ 54.124714][ T1167] name failslab, interval 1, probability 0, space 0, times 0 [ 54.137530][ T1167] CPU: 1 UID: 0 PID: 1167 Comm: syz.1.287 Not tainted syzkaller #0 67445127a0e550c06f7dc74ca5ff4a71fcbc5924 [ 54.137564][ T1167] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 54.137575][ T1167] Call Trace: [ 54.137581][ T1167] [ 54.137588][ T1167] __dump_stack+0x21/0x30 [ 54.137618][ T1167] dump_stack_lvl+0x140/0x1c0 [ 54.137642][ T1167] ? __cfi_dump_stack_lvl+0x10/0x10 [ 54.137668][ T1167] dump_stack+0x19/0x20 [ 54.137691][ T1167] should_fail_ex+0x3c2/0x510 [ 54.137713][ T1167] should_failslab+0xac/0x100 [ 54.137737][ T1167] __kmalloc_cache_noprof+0x41/0x470 [ 54.137757][ T1167] ? ovl_init_fs_context+0xb8/0x790 [ 54.137780][ T1167] ovl_init_fs_context+0xb8/0x790 [ 54.137801][ T1167] alloc_fs_context+0x5c4/0x800 [ 54.137825][ T1167] fs_context_for_mount+0x26/0x40 [ 54.137847][ T1167] do_new_mount+0x116/0xb40 [ 54.137866][ T1167] ? security_capable+0x44/0x130 [ 54.137887][ T1167] path_mount+0x66a/0xff0 [ 54.137922][ T1167] ? putname+0x113/0x150 [ 54.137943][ T1167] __se_sys_mount+0x2bf/0x480 [ 54.137962][ T1167] ? ksys_write+0x1f3/0x260 [ 54.137982][ T1167] ? __x64_sys_mount+0xf0/0xf0 [ 54.138003][ T1167] __x64_sys_mount+0xc3/0xf0 [ 54.138022][ T1167] x64_sys_call+0x2021/0x2ee0 [ 54.138041][ T1167] do_syscall_64+0x57/0xf0 [ 54.138058][ T1167] ? clear_bhb_loop+0x50/0xa0 [ 54.138081][ T1167] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 54.138101][ T1167] RIP: 0033:0x7fc458b9e159 [ 54.138117][ T1167] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 54.138132][ T1167] RSP: 002b:00007fc459a86028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 54.138153][ T1167] RAX: ffffffffffffffda RBX: 00007fc458e25fa0 RCX: 00007fc458b9e159 [ 54.138167][ T1167] RDX: 0000200000000240 RSI: 0000200000000100 RDI: 0000000000000000 [ 54.138180][ T1167] RBP: 00007fc459a86090 R08: 0000200000000340 R09: 0000000000000000 [ 54.138193][ T1167] R10: 0000000000000008 R11: 0000000000000246 R12: 0000000000000001 [ 54.138205][ T1167] R13: 00007fc458e26038 R14: 00007fc458e25fa0 R15: 00007ffcc80e22b8 [ 54.138221][ T1167] [ 54.472977][ T1182] overlayfs: failed to resolve './bus': -2 [ 54.511300][ T1184] netlink: 12 bytes leftover after parsing attributes in process `syz.0.294'. [ 54.537631][ T1184] netlink: 1 bytes leftover after parsing attributes in process `syz.0.294'. [ 54.723371][ T1204] BUG: scheduling while atomic: syz.2.301/1204/0x00000002 [ 54.730569][ T1204] Modules linked in: [ 54.734482][ T1204] CPU: 1 UID: 0 PID: 1204 Comm: syz.2.301 Not tainted syzkaller #0 67445127a0e550c06f7dc74ca5ff4a71fcbc5924 [ 54.734508][ T1204] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 54.734520][ T1204] Call Trace: [ 54.734526][ T1204] [ 54.734534][ T1204] __dump_stack+0x21/0x30 [ 54.734569][ T1204] dump_stack_lvl+0x140/0x1c0 [ 54.734593][ T1204] ? __cfi_dump_stack_lvl+0x10/0x10 [ 54.734616][ T1204] dump_stack+0x19/0x20 [ 54.734637][ T1204] __schedule_bug+0x12b/0x200 [ 54.734656][ T1204] ? find_proxy_task+0x2460/0x2460 [ 54.734676][ T1204] ? update_load_avg+0x4f3/0x1980 [ 54.734698][ T1204] __schedule+0xb85/0x20b0 [ 54.734719][ T1204] ? sched_clock_noinstr+0xd/0x30 [ 54.734741][ T1204] ? __kasan_check_read+0x15/0x20 [ 54.734762][ T1204] ? __sched_text_start+0x10/0x10 [ 54.734782][ T1204] ? dl_server_update+0x6b/0x90 [ 54.734811][ T1204] ? update_curr+0x51c/0x9c0 [ 54.734831][ T1204] ? __kasan_check_write+0x18/0x20 [ 54.734851][ T1204] ? _raw_spin_lock_irq+0x93/0x120 [ 54.734869][ T1204] ? __cfi__raw_spin_lock_irq+0x10/0x10 [ 54.734901][ T1204] schedule+0xc5/0x240 [ 54.734920][ T1204] schedule_preempt_disabled+0x14/0x30 [ 54.734941][ T1204] rwsem_down_write_slowpath+0x5c9/0x1b60 [ 54.734968][ T1204] ? ttwu_do_activate+0x620/0x620 [ 54.734996][ T1204] ? rwsem_down_read_slowpath+0x14c0/0x14c0 [ 54.735021][ T1204] ? try_to_wake_up+0x111a/0x1fd0 [ 54.735043][ T1204] ? __kasan_check_write+0x18/0x20 [ 54.735063][ T1204] ? wake_q_add_safe+0x29/0x100 [ 54.735081][ T1204] ? __kasan_check_write+0x18/0x20 [ 54.735100][ T1204] ? rwsem_read_trylock+0x275/0x5a0 [ 54.735128][ T1204] ? downgrade_write+0x470/0x470 [ 54.735152][ T1204] ? __kasan_check_write+0x18/0x20 [ 54.735171][ T1204] ? wake_up_q+0x10a/0x1c0 [ 54.735189][ T1204] down_write+0x163/0x2b0 [ 54.735212][ T1204] ? __cfi_down_write+0x10/0x10 [ 54.735236][ T1204] ? _raw_spin_lock+0x92/0x120 [ 54.735253][ T1204] ? __cfi__raw_spin_lock+0x10/0x10 [ 54.735270][ T1204] kernfs_remove+0x87/0xc0 [ 54.735295][ T1204] sysfs_remove_dir+0xad/0xf0 [ 54.735316][ T1204] __kobject_del+0xe2/0x2c0 [ 54.735333][ T1204] kobject_del+0x49/0x80 [ 54.735349][ T1204] cleanup_glue_dir+0x1a6/0x220 [ 54.735367][ T1204] device_del+0xbb2/0xcf0 [ 54.735385][ T1204] ? __cfi_device_del+0x10/0x10 [ 54.735403][ T1204] ? __kasan_check_write+0x18/0x20 [ 54.735423][ T1204] ? kobject_put+0x1cc/0x2a0 [ 54.735441][ T1204] device_destroy+0xb0/0x100 [ 54.735460][ T1204] ? __cfi_device_destroy+0x10/0x10 [ 54.735479][ T1204] ? __kasan_check_write+0x18/0x20 [ 54.735501][ T1204] android_device_destroy+0x118/0x180 [ 54.735529][ T1204] gadgets_drop+0x1d/0x30 [ 54.735548][ T1204] ? __cfi_gadgets_drop+0x10/0x10 [ 54.735568][ T1204] configfs_rmdir+0x8b7/0x9b0 [ 54.735595][ T1204] vfs_rmdir+0x3db/0x560 [ 54.735621][ T1204] do_rmdir+0x29a/0x590 [ 54.735647][ T1204] ? __cfi_do_rmdir+0x10/0x10 [ 54.735673][ T1204] ? __kasan_check_write+0x18/0x20 [ 54.735694][ T1204] __x64_sys_rmdir+0x4b/0x60 [ 54.735720][ T1204] x64_sys_call+0xaf7/0x2ee0 [ 54.735738][ T1204] do_syscall_64+0x57/0xf0 [ 54.735755][ T1204] ? clear_bhb_loop+0x50/0xa0 [ 54.735778][ T1204] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 54.735800][ T1204] RIP: 0033:0x7fa555d9e159 [ 54.735818][ T1204] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 54.735835][ T1204] RSP: 002b:00007fa556c5f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000054 [ 54.735856][ T1204] RAX: ffffffffffffffda RBX: 00007fa556025fa0 RCX: 00007fa555d9e159 [ 54.735872][ T1204] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00002000000002c0 [ 54.735893][ T1204] RBP: 00007fa555e3503b R08: 0000000000000000 R09: 0000000000000000 [ 54.735913][ T1204] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 54.735926][ T1204] R13: 00007fa556026038 R14: 00007fa556025fa0 R15: 00007fffc2c8f718 [ 54.735943][ T1204] [ 54.887698][ T1204] BUG: scheduling while atomic: syz.2.301/1204/0x00000000 [ 55.142593][ T1204] Modules linked in: [ 55.146530][ T1204] CPU: 0 UID: 0 PID: 1204 Comm: syz.2.301 Tainted: G W syzkaller #0 67445127a0e550c06f7dc74ca5ff4a71fcbc5924 [ 55.146567][ T1204] Tainted: [W]=WARN [ 55.146574][ T1204] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 55.146596][ T1204] Call Trace: [ 55.146603][ T1204] [ 55.146611][ T1204] __dump_stack+0x21/0x30 [ 55.146646][ T1204] dump_stack_lvl+0x140/0x1c0 [ 55.146673][ T1204] ? __cfi_dump_stack_lvl+0x10/0x10 [ 55.146703][ T1204] dump_stack+0x19/0x20 [ 55.146727][ T1204] __schedule_bug+0x12b/0x200 [ 55.146748][ T1204] ? find_proxy_task+0x2460/0x2460 [ 55.146769][ T1204] ? psi_task_change+0x24d/0x4f0 [ 55.146795][ T1204] __schedule+0xb85/0x20b0 [ 55.146817][ T1204] ? plist_check_list+0x2a1/0x2c0 [ 55.146836][ T1204] ? __sched_text_start+0x10/0x10 [ 55.146854][ T1204] ? plist_add+0x4d4/0x570 [ 55.146872][ T1204] ? __futex_queue+0x19f/0x350 [ 55.146898][ T1204] ? __cfi___futex_queue+0x10/0x10 [ 55.146922][ T1204] schedule+0xc5/0x240 [ 55.146942][ T1204] futex_wait_queue+0xfc/0x240 [ 55.146960][ T1204] __futex_wait+0x15b/0x3d0 [ 55.146979][ T1204] ? __cfi___futex_wait+0x10/0x10 [ 55.146997][ T1204] ? __cfi_futex_wake_mark+0x10/0x10 [ 55.147017][ T1204] ? futex_wake+0x666/0x950 [ 55.147035][ T1204] futex_wait+0x128/0x7c0 [ 55.147053][ T1204] ? __cfi_futex_wait+0x10/0x10 [ 55.147072][ T1204] do_futex+0x32a/0x510 [ 55.147096][ T1204] ? __cfi_do_futex+0x10/0x10 [ 55.147119][ T1204] ? __kasan_slab_free+0x6a/0x80 [ 55.147143][ T1204] ? kmem_cache_free+0x1bd/0x4f0 [ 55.147164][ T1204] __se_sys_futex+0x13c/0x320 [ 55.147187][ T1204] ? putname+0x113/0x150 [ 55.147207][ T1204] ? __x64_sys_futex+0x110/0x110 [ 55.147233][ T1204] __x64_sys_futex+0xe9/0x110 [ 55.147258][ T1204] x64_sys_call+0x227f/0x2ee0 [ 55.147276][ T1204] do_syscall_64+0x57/0xf0 [ 55.147294][ T1204] ? clear_bhb_loop+0x50/0xa0 [ 55.147317][ T1204] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 55.147339][ T1204] RIP: 0033:0x7fa555d9e159 [ 55.147357][ T1204] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 55.147384][ T1204] RSP: 002b:00007fa556c5f0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 55.147404][ T1204] RAX: ffffffffffffffda RBX: 00007fa556025fa8 RCX: 00007fa555d9e159 [ 55.147419][ T1204] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fa556025fa8 [ 55.147432][ T1204] RBP: 00007fa556025fa0 R08: 0000000000000000 R09: 0000000000000000 [ 55.147445][ T1204] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 55.147457][ T1204] R13: 00007fa556026038 R14: 00007fffc2c8f630 R15: 00007fffc2c8f718 [ 55.147474][ T1204]