last executing test programs: 3.448663993s ago: executing program 2 (id=346): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000002100)={0x0, 0x0}) r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/memory.limit_in_bytes\x00', 0x2, 0x0) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00003, 0x8) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1, 0x32, 0xffffffffffffffff, 0x2ec37000) write(r0, &(0x7f0000000080)='4', 0x1) 3.299572886s ago: executing program 2 (id=349): r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) write$UHID_CREATE2(r0, &(0x7f00000007c0)=ANY=[@ANYBLOB="0b00000073797a31000000dfff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a30000037b35f0a000089b4c45a10000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a3100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001"], 0x119) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x8031, r0, 0x1000) r1 = syz_open_dev$hidraw(&(0x7f00000004c0), 0x0, 0xbb42) close(0x3) ioctl$F2FS_IOC_GET_FEATURES(r1, 0x8004f50c, 0x0) 3.000888954s ago: executing program 2 (id=352): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r0, &(0x7f0000000100)=ANY=[], 0x32600) unshare(0xc040480) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r0, 0x0) r1 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r1, &(0x7f0000000480)=@pppol2tpv3in6={0x18, 0x1, {0x0, r1, 0x0, 0x0, 0x0, 0x1, {0xa, 0x1, 0x3, @loopback, 0x70}}}, 0x3a) 2.920409056s ago: executing program 2 (id=353): mkdir(&(0x7f0000000000)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./tracing\x00', &(0x7f0000000200)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./tracing/events/xhci-hcd/xhci_handle_port_status/inject\x00', 0x1, 0x0) write(r0, &(0x7f0000000400)='busnum=1 portnum=2 portsc=0xfffffffe\n\x00', 0x26) r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./tracing/trace\x00', 0x0, 0x0) read(r1, &(0x7f0000000600), 0x1000) 2.885723447s ago: executing program 2 (id=354): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CAP_SPLIT_IRQCHIP(r1, 0x4068aea3, &(0x7f00000001c0)={0x79, 0x0, 0x78b}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)=@x86={0x6b, 0x4, 0x7, 0x0, 0x0, 0x0, 0x4, 0xa, 0xd, 0xa0, 0x8, 0x5, 0x0, 0x2, 0x9, 0x0, 0x3, 0x2e, 0x4, '\x00', 0x2, 0xffffffffffffff7f}) ioctl$KVM_SET_MP_STATE(r2, 0x4004ae99, &(0x7f0000000000)=0x3) 2.680431262s ago: executing program 2 (id=356): r0 = syz_usb_connect$rtl8150(0x3, 0x3f, &(0x7f0000000300)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xbda, 0x8150, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d}}]}}, 0x0) syz_usb_control_io$rtl8150(r0, 0x0, 0x0) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000001680)={0x2c, 0x0, 0x0, 0x0, 0x0, &(0x7f0000001640)={0x40, 0x5, 0x1, '/'}}) syz_usb_control_io(r0, 0x0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) syz_usb_control_io(r0, 0x0, 0x0) 1.496446012s ago: executing program 3 (id=361): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', @multicast}) write$tun(r0, &(0x7f0000000200)=ANY=[@ANYBLOB="0a0090000180c200000300000000000086dd694fd2cd00143afffe8000000000000000000000000000bbff020000000000000000000000000001"], 0x4e) 1.452426613s ago: executing program 3 (id=363): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x100, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CAP_EXIT_HYPERCALL(r1, 0x4068aea3, &(0x7f0000000040)={0x79}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_LAPIC(r2, 0x4400ae8f, &(0x7f00000001c0)={"c718ae3ddd25e4c2826499cb6a055b56a5a7336f377a556f824db28eb6743cf045afd0e932534b9eb3b847abbcef63c85319991745999ed89ff49783a84d57cf175a89f8733d74a1bdddcb0a6c3f7535e7976e79da1b52de6403f6710d606fafaf685ec19f369b7829b12aa2b8cd2ab52f9c688683979cdb9516cb61f2adb9aefd44fee30bddb81ebefa818f31f60d89a4e390920c7ed0e2512fd59f719e734b0a1d1f3ff7babb54258a1585514aac0b000000733671e0543929c06f72fc598939003ac6777f3497523536fd25ac4f1e265f5038fa7455f2cc6131d4a189a16b0f0b89e6a495e1d95b840c36488adc22cb2d1b8af57f6dce7214152ba1b3c0d3ad0a6db821518e44b24cb36a02d76ea11a1c45879fc77e7bb2af8c345ddddf49f41228df2114f2c27d16499fa36097a5015ad61a6a9484c09e0a2dfb50f7b7ca71135dc32804a80380a6e20e0ae03be775e472cd31d6a31e615937c38e746a5cf6c9d8194242990dd497a2c52ab50300000000000000cebbd983c3f86dbe92c4b751c04693cb09af88521ab305ceabf6d2bab40bb1b219fbe95ace2f6c49fea798e76b4ef336dff5ac0f7ab022b800ac1aa42fd231b52465a410177ed85dcc9c6d794e2aa0b90cdc40af41aa85fa16e3cbc3a9d6c83ffd4d01e5ba898555eeffccf0cb28ce5df0ba31cb793675276162de2fdcb486455bca57edf4fb14e1533554eb22527d66a28a960c430f6136927f54e670c46292454fe28485f35405025844fd24fe846f6656c77d9b5f2b4750ac4805897b02c85caba80000bb96f71f468c9e746d860238b3b113ab1eef51e1507f8832d5d69528083d44548e491477cda51d64083a134097438e9d7ea34eae8a2e6b516327db9310c7478a37f5c562037196131cc7c84fa29c3c2576f2ae7570b5a98aaa49ca7ddfd5a8c046ce82e4a2d06082ad7a3ab0dfbe208630b1410b674781855752c9c57c1c5ab0a74a336ce89b3a9c0d37a3ca4e698a798a85faf7f4f1dc020b7dd5750062c9810c4bc1ad7afe338f2b0f29059e6847e16098eb30da105be01ca11a293635dfc6d25ecc770ba72792fd3c6851d951b770d0f9edafb1cb4241350d85b04ed737a9bfd7e8301c43b65a95dda76d6850860ba3195040b14c8ad1a8b52472785521147182352a1dbd93595cbc26e813ccd75e16f9247fe82ed150c121f0041022522ec76476f0a9cffa3be1d3ffffffffffffffff29358bbfd8b7a12fe94a0355beb9420eee0a5c11220100c782b89e9430de84b220e8c0df4bd40be3400c58f1493c9f891fe86fba751dab3326bf2deb9e782b37ec9c7adf36025a091a4b3600000000000000000000000000000000000000000000000000000000000000000600"}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 1.363404555s ago: executing program 3 (id=366): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000000c0)=[@text32={0x20, &(0x7f0000000000)="660f38800b0f017f0f0f09b82fa200000f23d80f21f835800000d00f23f866ba2100ec0f001d3e2b0000f326263e0f4d6d000f07b99c0a0000b800000080ba000000000f30b8010000000f01c1", 0x4d}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 1.286975317s ago: executing program 3 (id=367): r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000240)={0x2, 0x0, @local}, 0x6f) connect$inet(r0, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='blkio.throttle.io_serviced\x00', 0x275a, 0x0) ftruncate(r1, 0x4) sendfile(r0, r1, 0x0, 0x10) 1.271555848s ago: executing program 3 (id=368): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000100)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) write$tun(r0, &(0x7f0000000340)={@void, @void, @eth={@broadcast, @remote, @val={@val={0x88a8, 0x7, 0x0, 0x2}, {0x8100, 0x0, 0x0, 0x1}}, {@arp={0x806, @ether_ipv4={0x1, 0x800, 0x6, 0x4, 0x1, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, @empty=0xf00, @remote, @local}}}}}, 0x32) 855.222718ms ago: executing program 0 (id=381): r0 = socket$pptp(0x18, 0x1, 0x2) bind$pptp(r0, &(0x7f0000000000)={0x18, 0x2, {0x0, @local}}, 0x1e) connect$pptp(r0, &(0x7f0000000080)={0x18, 0x2, {0x0, @rand_addr=0x64010103}}, 0x1e) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000180), 0x1ab880, 0x0) ioctl$PPPIOCATTCHAN(r1, 0x40047438, &(0x7f0000000040)=0x1) ioctl$PPPIOCSFLAGS1(r1, 0x40047459, &(0x7f00000001c0)=0x40000) 839.079188ms ago: executing program 0 (id=382): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) openat$cgroup_procs(r0, &(0x7f0000000080)='tasks\x00', 0x2, 0x0) openat$cgroup_procs(r0, &(0x7f0000000040)='tasks\x00', 0x2, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) 776.43283ms ago: executing program 0 (id=383): r0 = socket$netlink(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000000), 0x4) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r0, 0x10e, 0x4, &(0x7f0000000100)=0x1800, 0x4) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001cc0)=ANY=[@ANYBLOB="ac0100001700010000000000000000007f0000010000000000000000000000000000fefffffffffffd8000000000000000000000000000bbac1414bb000000000000000000000000ffffff2b6b57a470b83fce00000000004e210000000000000000006400000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fc0200000000000000000000000000000000000000000000000000000000000100000000000000000a00802000000000", @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000200000000f9ffffff00000000000000000000000084000500ffffffff000000000000000000000000000004d33c0000000a00000000000000000000000000000000000001053500000200ac0003000000010000000900000000000000000000000000000000000001000004d56c"], 0x1ac}}, 0x0) 776.1933ms ago: executing program 0 (id=384): mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x4, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@any_dev={0x2, 0xa49, 0x0, 0x0, 0x1000, 0x6}}}, &(0x7f0000000300)=0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) syz_ublk_setup_queues(r2, r0, &(0x7f0000000180)={0x0, 0x20002, 0x0, 0x1, 0x154}, 0x0, 0x1, &(0x7f0000000340)={0x2e, 0x4, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x2000000, 0x0, 0x0, {}, 0x0, 0x0, '\x00', {0xfff9, 0x42, 0x0, 0x0}}, 0x0) sendmsg$nl_generic(r2, &(0x7f0000002700)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x80000000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40010) 705.507032ms ago: executing program 0 (id=385): mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, 0x0) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000140)=0x1) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, 0x0) 689.408812ms ago: executing program 0 (id=386): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00220f000000540b4550182195"], 0x0}, 0x0) syz_usb_control_io$printer(0xffffffffffffffff, &(0x7f0000000800)={0x14, &(0x7f0000000780)={0x20, 0x4, 0xd, {0xd, 0x8, "a18661b4ea470454932a76"}}, 0x0}, 0x0) r1 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0) ioctl$HIDIOCGUCODE(r1, 0xc018480d, &(0x7f0000000280)={0x3, 0x200, 0x0, 0x8, 0x80000, 0x4}) 242.230024ms ago: executing program 3 (id=388): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x83, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, &(0x7f0000000900)="440f01f8660f383b6f0265450f0d130f23af48b8f2ffffffffffffff0f23c00f21f80f22110f23f826410f300f005000c4639dceff79420f0febbb", 0x3b}], 0x1, 0x17, 0x0, 0x0) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000140)=[@text16={0x10, 0x0}], 0x1, 0x6bb6c4a5b2d35090, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 199.121365ms ago: executing program 1 (id=389): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) writev(r0, &(0x7f0000000c40)=[{&(0x7f0000000340)="2e1221b23bb601c494d3df173e75963d86dd9d90491c3248060000dbb8a1", 0x1e}, {&(0x7f0000000140)="0400000002e8010000000000007b5dc42dc424a935960b22545e25261e4c19a18320fe2c5d12573b5b031b2e8dcb62e8", 0x30}], 0x2) 40.465169ms ago: executing program 1 (id=390): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) mount$incfs(&(0x7f0000000080)='./file0\x00', &(0x7f0000000140)='./file0\x00', &(0x7f0000000200), 0x82, 0x0) mount$incfs(&(0x7f0000000080)='./file0\x00', &(0x7f0000000140)='./file0\x00', &(0x7f0000000200), 0x82, 0x0) chdir(&(0x7f0000000100)='./file0\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000240)='./file0\x00', 0x0, 0x8008, 0x0) 40.212639ms ago: executing program 1 (id=391): r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x11}}, 0x10) connect$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @multicast2}, 0x10) r1 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r1, &(0x7f0000000140)=@pppol2tpin6={0x18, 0x1, {0x0, r0, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x4000000, @mcast1}}}, 0x32) sendmmsg(r1, &(0x7f0000005e40)=[{{0x0, 0x0, &(0x7f0000000800)=[{&(0x7f0000000180)="61c0b4f1e3b907f4abc594213038275c60b07541aac323e1b0dae6a0959cdb6e6a4bacaeba1e69259fcc7da2413aa156c96dd1081f1615f9d0ebb0057f613165a634b4cf3b1026aa2c400605cfc9dbfacf860aaaa07b22ba6f8b57a623cafb58e672fc1365f3d1c5c9c756d3cd39bc84fb4b07be0c4a9c8ce19f7463f60d4ac6154ce87b4244cad6b4ffe79d1adaf1162ba6c2467814b3d38712e974322e5794a245545844af695f07d2cb6b66256e51ca4873a249875270b8d6591eac2aa7a5974db3ab9b40a68852aaaeccb856071a52072a36199959c366006897e610d5e6946298b54a1da7b3962d47120d3bcbc9850ebdf101e6504bb80c35f0b46e1ff8e7115bd5af4badfdac20f06394f78d6b91ab564547db2c8b5f96a731b8fc7a93e9673af90d293f2b068fb25f870fc95606de0bd072f13ed5ac75da0fa781d31ccf1510ea8e5e97bc8bf0140093a554eb0bc061107a20007c41e25c6bc576ec92688d52cb699a453dc34c8c1491ed6846b94503097da5e442de229f8b89befa8d0ba481083ed6b3aad6df48e8e2a449d66a3b6f1f343b785f8e6f6430b85628d795f2ac0865592559ae59e348cf9aa32e55e1972da8d9fd8251ce55319b5f1c8793663cb3fb52c1fe31af4e923fbb9f05dea432a1e8967c7640a9cb54d4fee4698a2b8c67a4cf32177710086a12686a4b6c59a69b51f67e55cee8c3acd2667155350b238bc31e5dce37a8a028b8d8c951176ce1815f73885820b915a8458bc065dfd1339ba57cc6914a3d0509f0649661ff3af367d3c00d7ed2e8b095c97844186dee06e6504d311230f2defebfbcf283b1953d133d96ced2a796a6ff1b6f941b41f8d77180e17a39c55ce4f929b5abbfb144ca8114ab41d5038ca3edd34d43decffd8e8d7bf618aaed21b16d5bd39265f4bd28e6ca840f5cc4e1c52b15c4fbdcaca01e53d0839586e4c84a1309f00b1f0bab305be6a59f947434fa9350f85d9f9d4d84871395e405000713caf389a152f4fd217a9ec74aa8a1236a57e417d39b2548fe98dea29da51244a08a82b551c71f74e6b36d30762847e62fc6140f104c72047c57a3b92961843a9869fd0c90c0b1eb4aba5586279a532ad140b73c9da8ae6d12168f15a491c64d53607d619ecb177cc106fbdb02cea8cdff4da5136d09074d39ff3f2d91b3d5eb19c64b2ac397f03e847a74a4ac19fabed19541c9262be0077b8e5ff6a203c25b04c5f80280f0f1f144856f2c026b9c59547265bb610205f81ff70d7342e806bb891e80bcb57ed8dc26ceb88285cb0975307ac361b19d3566ae67bc76fae96b6c629947e4d90bc73affb6105c74a986786d9eff14b06c3086cb30d72787fbff3aaae726b985b06b06e7cac5d7e1701a91f47c11accfa45b72a206bd7de9e9332be164e5efbb54a3631eb142b482e68df5e8e961ecf1c1e654b05f12fb9fdb58003c579da902bc55d75da1b152130da953d53c9853ee28ee5ac4483da7547ccbef89eec74ba3d95ca9bfd415c0c5f3230608f3655c06d16c00133e7c3b85cd235acce4b72f3ffa71ac1d6b16b63d991de7548411b8846a32413403d0428c70c6cc2543ea77d549b7a426d95d969e432c7b34ce170f6f61020000000000000014e2e414d7448c959eab74e6894f218a88684d89171861d44a05e8a85858b147f2f7201f7f80f6a9e5ac9d344c8a6a3661d3ed75923150b833737aecfd8b49a180126c7d08dc001b049fac7f988a953a066b719754abd461b1fa07e0db18fd8b88a3277d356a9754adf99463c0de81cf91cbff5050a311c36184596c8bccd9aecbf956f728e1cc68f5c1b7ef35d73a66aed708f1d96c0cfd6c16af9605b290140f53938c4ffa499f09da5f713795581314bd1ec8c639a5e22510d5620f874ff6a036476e059be6c8215a429d76b365d737c3908aa8b723264553b3806ef264ccb45220e0f3c77cb1feed03c0254017c2d4b5515291a17836557dfc8989f8dcdf9a980daec0871f83b6cabab6ee022864917fdc", 0x59b}, {&(0x7f0000000740)="08c4423a7e559a268faf", 0xa}], 0x2}}], 0x1, 0x40) 39.994899ms ago: executing program 1 (id=392): r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) ioctl$VHOST_SET_LOG_BASE(r0, 0x4008af04, &(0x7f0000000040)=0xffffffffffffffff) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000140)={0x0, 0x1, 0x0, 0x0, 0x0}) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000100)) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000000)=0x1) 24.986589ms ago: executing program 1 (id=393): mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000b80), 0x8, &(0x7f0000000180)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) mount$incfs(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='./file0\x00', &(0x7f0000000200), 0x80, 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mkdirat(r0, &(0x7f0000000100)='./file0\x00', 0x88) 0s ago: executing program 1 (id=394): fstat(0xffffffffffffffff, 0x0) r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_tx_ring(r0, 0x107, 0x5, &(0x7f00000000c0)=@req3={0x8000, 0x6, 0x8000, 0x6, 0x0, 0x8, 0x1}, 0x1c) mmap(&(0x7f0000001000/0x3000)=nil, 0x30000, 0x0, 0x11, r0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000100)='pagemap\x00') pread64(r1, &(0x7f0000000200)=""/102400, 0x19020, 0x1000000000) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.165' (ED25519) to the list of known hosts. [ 29.372509][ T36] audit: type=1400 audit(1786085805.520:64): avc: denied { mounton } for pid=286 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 29.377558][ T286] cgroup: Unknown subsys name 'net' [ 29.395243][ T36] audit: type=1400 audit(1786085805.520:65): avc: denied { mount } for pid=286 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 29.422556][ T36] audit: type=1400 audit(1786085805.550:66): avc: denied { unmount } for pid=286 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 29.423074][ T286] cgroup: Unknown subsys name 'devices' [ 29.547693][ T286] cgroup: Unknown subsys name 'hugetlb' [ 29.553326][ T286] cgroup: Unknown subsys name 'rlimit' [ 29.668846][ T36] audit: type=1400 audit(1786085805.820:67): avc: denied { setattr } for pid=286 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 29.692069][ T36] audit: type=1400 audit(1786085805.820:68): avc: denied { mounton } for pid=286 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 29.716841][ T36] audit: type=1400 audit(1786085805.820:69): avc: denied { mount } for pid=286 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 29.742676][ T288] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 29.751492][ T36] audit: type=1400 audit(1786085805.900:70): avc: denied { relabelto } for pid=288 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 29.776950][ T36] audit: type=1400 audit(1786085805.900:71): avc: denied { write } for pid=288 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 29.799384][ T286] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 29.803098][ T36] audit: type=1400 audit(1786085805.940:72): avc: denied { read } for pid=286 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 29.836750][ T36] audit: type=1400 audit(1786085805.940:73): avc: denied { open } for pid=286 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 30.693636][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.701081][ T293] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.708252][ T293] bridge_slave_0: entered allmulticast mode [ 30.714525][ T293] bridge_slave_0: entered promiscuous mode [ 30.738620][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.745740][ T296] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.752891][ T296] bridge_slave_0: entered allmulticast mode [ 30.759286][ T296] bridge_slave_0: entered promiscuous mode [ 30.767327][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.774376][ T293] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.781572][ T293] bridge_slave_1: entered allmulticast mode [ 30.787936][ T293] bridge_slave_1: entered promiscuous mode [ 30.795944][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.803002][ T296] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.810168][ T296] bridge_slave_1: entered allmulticast mode [ 30.816487][ T296] bridge_slave_1: entered promiscuous mode [ 30.845041][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.852142][ T295] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.859321][ T295] bridge_slave_0: entered allmulticast mode [ 30.865658][ T295] bridge_slave_0: entered promiscuous mode [ 30.874728][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.881830][ T295] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.888959][ T295] bridge_slave_1: entered allmulticast mode [ 30.895188][ T295] bridge_slave_1: entered promiscuous mode [ 30.924456][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.931552][ T294] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.938698][ T294] bridge_slave_0: entered allmulticast mode [ 30.944986][ T294] bridge_slave_0: entered promiscuous mode [ 30.966172][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.973266][ T294] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.980424][ T294] bridge_slave_1: entered allmulticast mode [ 30.986763][ T294] bridge_slave_1: entered promiscuous mode [ 31.117283][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.124372][ T296] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.131754][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.138824][ T296] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.158270][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.165352][ T293] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.172678][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.179739][ T293] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.199307][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.206500][ T294] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.213782][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.220850][ T294] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.236307][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.243685][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.251075][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.259361][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.267094][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.274358][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.307853][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.314913][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.323238][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.330299][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.363527][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.370630][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.379599][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.386683][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.419606][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.426682][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.434206][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.441296][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.454889][ T296] veth0_vlan: entered promiscuous mode [ 31.461396][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.468461][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.479804][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.486885][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.507904][ T296] veth1_macvtap: entered promiscuous mode [ 31.526634][ T293] veth0_vlan: entered promiscuous mode [ 31.559132][ T293] veth1_macvtap: entered promiscuous mode [ 31.580817][ T295] veth0_vlan: entered promiscuous mode [ 31.589257][ T294] veth0_vlan: entered promiscuous mode [ 31.610827][ T295] veth1_macvtap: entered promiscuous mode [ 31.622142][ T296] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 31.653154][ T294] veth1_macvtap: entered promiscuous mode [ 31.679954][ T313] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 31.893393][ T339] netlink: 20 bytes leftover after parsing attributes in process `syz.0.12'. [ 31.920880][ T339] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.933465][ T339] bridge_slave_0 (unregistering): left allmulticast mode [ 31.941177][ T339] bridge_slave_0 (unregistering): left promiscuous mode [ 31.948432][ T339] bridge0: port 1(bridge_slave_0) entered disabled state [ 32.100673][ T365] netlink: 240 bytes leftover after parsing attributes in process `syz.0.22'. [ 32.405521][ T395] SELinux: Context system_u: is not valid (left unmapped). [ 32.440883][ T399] syzkaller1: entered promiscuous mode [ 32.446481][ T399] syzkaller1: entered allmulticast mode [ 32.951422][ T10] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 32.970586][ T439] tipc: Started in network mode [ 32.975595][ T439] tipc: Node identity , cluster identity 4711 [ 32.981695][ T439] tipc: Failed to obtain node identity [ 32.987512][ T439] tipc: Enabling of bearer rejected, failed to enable media [ 33.011242][ T441] syzkaller1: entered promiscuous mode [ 33.017026][ T441] syzkaller1: entered allmulticast mode [ 33.108706][ T10] usb 4-1: Using ep0 maxpacket: 32 [ 33.120113][ T10] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 33.132340][ T10] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 33.142305][ T10] usb 4-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 33.151601][ T10] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 33.162885][ T10] usb 4-1: config 0 descriptor?? [ 33.168994][ T10] hub 4-1:0.0: USB hub found [ 33.340340][ T466] kvm: kvm [465]: vcpu6, guest rIP: 0x9139 Unhandled WRMSR(0x11e) = 0xbe702111 [ 33.370876][ T10] hub 4-1:0.0: 1 port detected [ 33.976838][ T10] hub 4-1:0.0: activate --> -90 [ 34.177349][ T10] hub 4-1:0.0: hub_ext_port_status failed (err = -71) [ 34.205916][ T31] usb 4-1: USB disconnect, device number 2 [ 34.206516][ T10] usb 4-1: Failed to suspend device, error -71 [ 34.563357][ T36] kauditd_printk_skb: 134 callbacks suppressed [ 34.563377][ T36] audit: type=1400 audit(1786085810.710:208): avc: denied { mounton } for pid=523 comm="syz.1.85" path="/20/file0" dev="tmpfs" ino=123 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 34.612691][ T36] audit: type=1400 audit(1786085810.760:209): avc: denied { ioctl } for pid=527 comm="syz.2.87" path="socket:[4687]" dev="sockfs" ino=4687 ioctlcmd=0x8922 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 34.713358][ T36] audit: type=1400 audit(1786085810.860:210): avc: denied { bind } for pid=532 comm="syz.3.89" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 34.995529][ T36] audit: type=1400 audit(1786085811.130:211): avc: denied { read write } for pid=550 comm="syz.3.97" name="uinput" dev="devtmpfs" ino=194 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 35.032340][ T551] input: syz0 as /devices/virtual/input/input4 [ 35.035627][ T36] audit: type=1400 audit(1786085811.130:212): avc: denied { open } for pid=550 comm="syz.3.97" path="/dev/uinput" dev="devtmpfs" ino=194 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 35.087348][ T36] audit: type=1400 audit(1786085811.170:213): avc: denied { ioctl } for pid=550 comm="syz.3.97" path="/dev/uinput" dev="devtmpfs" ino=194 ioctlcmd=0x5564 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 35.117184][ T36] audit: type=1400 audit(1786085811.220:214): avc: denied { read } for pid=95 comm="acpid" name="event3" dev="devtmpfs" ino=438 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 35.146824][ T36] audit: type=1400 audit(1786085811.220:215): avc: denied { open } for pid=95 comm="acpid" path="/dev/input/event3" dev="devtmpfs" ino=438 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 35.171936][ T36] audit: type=1400 audit(1786085811.220:216): avc: denied { ioctl } for pid=95 comm="acpid" path="/dev/input/event3" dev="devtmpfs" ino=438 ioctlcmd=0x4520 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 35.288247][ T36] audit: type=1400 audit(1786085811.440:217): avc: denied { append } for pid=558 comm="syz.2.101" name="file0" dev="tmpfs" ino=204 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 35.940608][ T603] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 36.176832][ T611] random: crng reseeded on system resumption [ 36.242503][ T614] tipc: Started in network mode [ 36.257720][ T614] tipc: Node identity 7f000001, cluster identity 4711 [ 36.277251][ T614] tipc: Enabled bearer , priority 10 [ 36.299256][ T617] tipc: Disabling bearer [ 36.801740][ T658] syzkaller1: entered promiscuous mode [ 36.819206][ T658] syzkaller1: entered allmulticast mode [ 37.335874][ T31] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 37.487037][ T31] usb 3-1: unable to get BOS descriptor or descriptor too short [ 37.496854][ T31] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 37.507108][ T31] usb 3-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 37.516350][ T31] usb 3-1: too many endpoints for config 1 interface 1 altsetting 76: 188, using maximum allowed: 30 [ 37.527707][ T31] usb 3-1: config 1 interface 1 altsetting 76 has 0 endpoint descriptors, different from the interface descriptor's value: 188 [ 37.541226][ T31] usb 3-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 37.552242][ T31] usb 3-1: config 1 interface 1 has no altsetting 0 [ 37.561545][ T31] usb 3-1: string descriptor 0 read error: -22 [ 37.568016][ T31] usb 3-1: New USB device found, idVendor=21b4, idProduct=0081, bcdDevice= 0.40 [ 37.577477][ T31] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 37.665469][ T66] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 37.816876][ T66] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 37.828035][ T66] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 37.838008][ T66] usb 1-1: New USB device found, idVendor=28de, idProduct=1142, bcdDevice= 0.00 [ 37.847253][ T66] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 37.861643][ T66] usb 1-1: config 0 descriptor?? [ 37.945644][ T710] netlink: 8 bytes leftover after parsing attributes in process `syz.1.160'. [ 38.274247][ T66] hid-steam 0003:28DE:1142.0001: unknown main item tag 0x0 [ 38.281684][ T66] hid-steam 0003:28DE:1142.0001: unknown main item tag 0x0 [ 38.289292][ T66] hid-steam 0003:28DE:1142.0001: unknown main item tag 0x0 [ 38.296876][ T66] hid-steam 0003:28DE:1142.0001: unknown main item tag 0x0 [ 38.304200][ T66] hid-steam 0003:28DE:1142.0001: unknown main item tag 0x0 [ 38.313657][ T66] hid-steam 0003:28DE:1142.0001: hidraw0: USB HID v0.00 Device [HID 28de:1142] on usb-dummy_hcd.0-1/input0 [ 38.393267][ T31] usb 3-1: USB disconnect, device number 2 [ 38.465508][ T9] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 38.616837][ T9] usb 2-1: unable to get BOS descriptor or descriptor too short [ 38.625255][ T9] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 38.635492][ T9] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 38.644381][ T9] usb 2-1: config 1 interface 0 has no altsetting 0 [ 38.652393][ T9] usb 2-1: New USB device found, idVendor=041e, idProduct=3237, bcdDevice= 0.40 [ 38.661494][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 38.669560][ T9] usb 2-1: Product: syz [ 38.673763][ T9] usb 2-1: Manufacturer: syz [ 38.678425][ T9] usb 2-1: SerialNumber: syz [ 38.888038][ T9] usb 2-1: 0:1 : does not exist [ 38.897133][ T9] usb 2-1: USB disconnect, device number 2 [ 38.915734][ T481] udevd[481]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 39.081668][ T66] usb 1-1: USB disconnect, device number 2 [ 39.500841][ T811] tipc: Started in network mode [ 39.505843][ T811] tipc: Node identity 1, cluster identity 4711 [ 39.512087][ T811] tipc: Node number set to 1 [ 39.519844][ T811] tipc: New replicast peer: 127.0.0.2 [ 39.525601][ T811] tipc: Enabled bearer , priority 10 [ 39.533194][ T811] tipc: Disabling bearer [ 39.547787][ T813] netlink: 'syz.3.180': attribute type 11 has an invalid length. [ 39.587277][ T36] kauditd_printk_skb: 30 callbacks suppressed [ 39.587291][ T36] audit: type=1400 audit(1786085815.740:248): avc: denied { wake_alarm } for pid=816 comm="syz.3.182" capability=35 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 39.650261][ T36] audit: type=1400 audit(1786085815.800:249): avc: denied { mount } for pid=819 comm="syz.0.183" name="/" dev="devtmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 39.686934][ T823] af_packet: tpacket_rcv: packet too big, clamped from 40 to 4294967272. macoff=96 [ 39.705953][ T36] audit: type=1400 audit(1786085815.820:250): avc: denied { write } for pid=819 comm="syz.0.183" name="kmsg" dev="devtmpfs" ino=9 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kmsg_device_t tclass=chr_file permissive=1 [ 39.735458][ T36] audit: type=1400 audit(1786085815.850:251): avc: denied { unmount } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 39.772339][ T36] audit: type=1400 audit(1786085815.920:252): avc: denied { unmount } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 39.813611][ T831] syzkaller1: entered promiscuous mode [ 39.819401][ T831] syzkaller1: entered allmulticast mode [ 39.868451][ T833] capability: warning: `syz.3.190' uses deprecated v2 capabilities in a way that may be insecure [ 39.888943][ T36] audit: type=1400 audit(1786085816.040:253): avc: denied { read } for pid=834 comm="syz.1.191" name="binder0" dev="binder" ino=10 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 39.922048][ T36] audit: type=1400 audit(1786085816.040:254): avc: denied { open } for pid=834 comm="syz.1.191" path="/dev/binderfs/binder0" dev="binder" ino=10 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 39.948901][ T837] syz_tun: entered allmulticast mode [ 39.954643][ T66] rust_binder: 834: undelivered freeze notification, 0000000000000000 [ 39.955274][ T837] syz_tun: left allmulticast mode [ 39.987169][ T36] audit: type=1400 audit(1786085816.060:255): avc: denied { ioctl } for pid=834 comm="syz.1.191" path="/dev/binderfs/binder0" dev="binder" ino=10 ioctlcmd=0x620d scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 40.034152][ T36] audit: type=1400 audit(1786085816.060:256): avc: denied { set_context_mgr } for pid=834 comm="syz.1.191" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 40.055000][ T36] audit: type=1400 audit(1786085816.070:257): avc: denied { write } for pid=834 comm="syz.1.191" name="binder0" dev="binder" ino=10 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 40.208900][ T870] #! ./file0 [ 40.729462][ T906] capability: warning: `syz.1.221' uses 32-bit capabilities (legacy support in use) [ 41.011713][ T920] rust_binder: 919:920 error while translating object: EINVAL [ 41.020056][ T920] rust_binder: Failure in copy_transaction_data: EINVAL [ 41.020113][ T920] rust_binder: 919:920 transaction call to 919:0 failed EINVAL, code 0 size 120-24 [ 41.510792][ T963] ======================================================= [ 41.510792][ T963] WARNING: The mand mount option has been deprecated and [ 41.510792][ T963] and is ignored by this kernel. Remove the mand [ 41.510792][ T963] option from the mount to silence this warning. [ 41.510792][ T963] ======================================================= [ 41.656527][ T754] tipc: Subscription rejected, illegal request [ 41.826314][ T426] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 41.849923][ T426] hid-generic 0000:0000:0000.0002: hidraw0: HID v0.00 Device [syz1] on syz0 [ 41.941219][ T1007] input: syz1 as /devices/virtual/input/input5 [ 41.999716][ T1012] block device autoloading is deprecated and will be removed. [ 42.041587][ T1014] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 42.395484][ T31] usb 3-1: new full-speed USB device number 3 using dummy_hcd [ 42.421739][ T1065] KVM: debugfs: duplicate directory 1065-4 [ 42.557281][ T31] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 42.577946][ T1071] kvm: kvm [1070]: vcpu0, guest rIP: 0x9135 Unhandled WRMSR(0x11e) = 0x0 [ 42.586685][ T31] usb 3-1: config 1 has 0 interfaces, different from the descriptor's value: 3 [ 42.598134][ T31] usb 3-1: New USB device found, idVendor=249c, idProduct=9001, bcdDevice= 0.40 [ 42.607503][ T31] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 42.615746][ T31] usb 3-1: Product: syz [ 42.620008][ T31] usb 3-1: Manufacturer: syz [ 42.624625][ T31] usb 3-1: SerialNumber: syz [ 42.838944][ T31] usb 3-1: USB disconnect, device number 3 [ 43.209774][ T1114] bridge0: entered allmulticast mode [ 43.315484][ T426] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 43.465464][ T426] usb 2-1: Using ep0 maxpacket: 32 [ 43.471890][ T426] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 43.482944][ T426] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 43.492878][ T426] usb 2-1: New USB device found, idVendor=1e7d, idProduct=2d51, bcdDevice= 0.00 [ 43.502041][ T426] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 43.514419][ T426] usb 2-1: config 0 descriptor?? [ 43.617980][ T1138] syzkaller1: entered promiscuous mode [ 43.623574][ T1138] syzkaller1: entered allmulticast mode [ 43.826346][ T1146] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 43.835364][ T1146] kvm: kvm [1145]: vcpu0, guest rIP: 0x58ad29489c2a7d0a Unhandled WRMSR(0x4000006d) = 0x6 [ 43.923215][ T426] koneplus 0003:1E7D:2D51.0003: unknown main item tag 0x0 [ 43.931151][ T426] koneplus 0003:1E7D:2D51.0003: unknown main item tag 0x0 [ 43.938716][ T426] koneplus 0003:1E7D:2D51.0003: unknown main item tag 0x0 [ 43.946137][ T426] koneplus 0003:1E7D:2D51.0003: unknown main item tag 0x0 [ 43.953339][ T426] koneplus 0003:1E7D:2D51.0003: unknown main item tag 0x0 [ 43.962461][ T426] koneplus 0003:1E7D:2D51.0003: hidraw0: USB HID v0.00 Device [HID 1e7d:2d51] on usb-dummy_hcd.1-1/input0 [ 44.325652][ T66] usb 2-1: USB disconnect, device number 3 [ 44.393788][ T1178] tipc: Started in network mode [ 44.398868][ T1178] tipc: Node identity ac14140f, cluster identity 4711 [ 44.406035][ T1178] tipc: New replicast peer: 255.255.255.255 [ 44.412321][ T1178] tipc: Enabled bearer , priority 10 [ 44.540109][ T1189] syzkaller1: entered promiscuous mode [ 44.545952][ T1189] syzkaller1: entered allmulticast mode [ 44.854408][ T36] kauditd_printk_skb: 75 callbacks suppressed [ 44.854426][ T36] audit: type=1400 audit(1786085821.000:333): avc: denied { read write } for pid=1204 comm="syz.1.347" name="vhost-vsock" dev="devtmpfs" ino=200 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 44.886190][ T31] usb 4-1: new low-speed USB device number 4 using dummy_hcd [ 44.927566][ T36] audit: type=1400 audit(1786085821.040:334): avc: denied { open } for pid=1204 comm="syz.1.347" path="/dev/vhost-vsock" dev="devtmpfs" ino=200 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 44.965331][ T36] audit: type=1400 audit(1786085821.040:335): avc: denied { ioctl } for pid=1204 comm="syz.1.347" path="/dev/vhost-vsock" dev="devtmpfs" ino=200 ioctlcmd=0xaf01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 45.006555][ T1110] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 45.034569][ T1110] hid-generic 0000:0000:0000.0004: hidraw0: HID v0.00 Device [syz1] on syz0 [ 45.065760][ T31] usb 4-1: config 1 interface 0 altsetting 15 endpoint 0x81 has invalid maxpacket 1024, setting to 8 [ 45.101548][ T31] usb 4-1: config 1 interface 0 has no altsetting 0 [ 45.145810][ T31] usb 4-1: string descriptor 0 read error: -22 [ 45.152075][ T31] usb 4-1: New USB device found, idVendor=04b4, idProduct=ed81, bcdDevice= 0.40 [ 45.166832][ T31] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 45.189163][ T1197] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 45.307201][ T36] audit: type=1400 audit(1786085821.460:336): avc: denied { mount } for pid=1220 comm="syz.2.353" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 45.345709][ T36] audit: type=1400 audit(1786085821.490:337): avc: denied { search } for pid=1220 comm="syz.2.353" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 45.387710][ T36] audit: type=1400 audit(1786085821.490:338): avc: denied { read } for pid=1220 comm="syz.2.353" name="trace" dev="tracefs" ino=25 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=file permissive=1 [ 45.409807][ T1110] tipc: Node number set to 2886997007 [ 45.425468][ T36] audit: type=1400 audit(1786085821.520:339): avc: denied { unmount } for pid=294 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 45.445489][ T426] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 45.605470][ T426] usb 2-1: Using ep0 maxpacket: 8 [ 45.611796][ T426] usb 2-1: config 0 interface 0 altsetting 9 has 1 endpoint descriptor, different from the interface descriptor's value: 12 [ 45.624952][ T426] usb 2-1: config 0 interface 0 has no altsetting 0 [ 45.631630][ T426] usb 2-1: New USB device found, idVendor=17ef, idProduct=60b5, bcdDevice= 0.00 [ 45.640800][ T426] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 45.649947][ T426] usb 2-1: config 0 descriptor?? [ 45.795489][ T1110] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 45.824309][ T31] cypress 0003:04B4:ED81.0005: global environment stack underflow [ 45.825558][ T9] usb 1-1: new full-speed USB device number 3 using dummy_hcd [ 45.837876][ T31] cypress 0003:04B4:ED81.0005: item 0 2 1 11 parsing failed [ 45.847385][ T31] cypress 0003:04B4:ED81.0005: parse failed [ 45.853371][ T31] cypress 0003:04B4:ED81.0005: probe with driver cypress failed with error -22 [ 45.947644][ T1110] usb 3-1: New USB device found, idVendor=0bda, idProduct=8150, bcdDevice= 0.00 [ 45.956836][ T1110] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 45.964861][ T1110] usb 3-1: Product: syz [ 45.969147][ T1110] usb 3-1: Manufacturer: syz [ 45.973909][ T1110] usb 3-1: SerialNumber: syz [ 45.996440][ T9] usb 1-1: config 0 has an invalid interface number: 251 but max is 0 [ 46.004687][ T9] usb 1-1: config 0 has no interface number 0 [ 46.012190][ T9] usb 1-1: New USB device found, idVendor=0b95, idProduct=172a, bcdDevice=f7.f4 [ 46.021305][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 46.029374][ T9] usb 1-1: Product: syz [ 46.033584][ T9] usb 1-1: Manufacturer: syz [ 46.035662][ T31] usb 4-1: USB disconnect, device number 4 [ 46.038264][ T9] usb 1-1: SerialNumber: syz [ 46.051497][ T9] usb 1-1: config 0 descriptor?? [ 46.069616][ T426] lenovo 0003:17EF:60B5.0006: unknown main item tag 0x0 [ 46.076711][ T426] lenovo 0003:17EF:60B5.0006: unknown main item tag 0x0 [ 46.083698][ T426] lenovo 0003:17EF:60B5.0006: unknown main item tag 0x0 [ 46.090724][ T426] lenovo 0003:17EF:60B5.0006: unknown main item tag 0x0 [ 46.097777][ T426] lenovo 0003:17EF:60B5.0006: unknown main item tag 0x0 [ 46.104747][ T426] lenovo 0003:17EF:60B5.0006: unknown main item tag 0x0 [ 46.111783][ T426] lenovo 0003:17EF:60B5.0006: unknown main item tag 0x6 [ 46.118809][ T426] lenovo 0003:17EF:60B5.0006: collection stack underflow [ 46.125903][ T426] lenovo 0003:17EF:60B5.0006: item 0 4 0 12 parsing failed [ 46.133293][ T426] lenovo 0003:17EF:60B5.0006: hid_parse failed [ 46.139542][ T426] lenovo 0003:17EF:60B5.0006: probe with driver lenovo failed with error -22 [ 46.460561][ T9] asix 1-1:0.251 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 46.470866][ T9] asix 1-1:0.251 (unnamed net_device) (uninitialized): Failed to read MAC address: -71 [ 46.480670][ T9] asix 1-1:0.251: probe with driver asix failed with error -5 [ 46.489474][ T9] usb 1-1: USB disconnect, device number 3 [ 46.581954][ T1110] (unnamed net_device) (uninitialized): Assigned a random MAC address: de:3e:d7:88:e5:09 [ 46.593788][ T1110] rtl8150 3-1:1.0: eth1: rtl8150 is detected [ 46.607544][ T36] audit: type=1400 audit(1786085822.760:340): avc: denied { read } for pid=149 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=1 [ 46.634448][ T36] audit: type=1400 audit(1786085822.760:341): avc: denied { search } for pid=149 comm="dhcpcd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 46.655737][ T36] audit: type=1400 audit(1786085822.760:342): avc: denied { read } for pid=149 comm="dhcpcd" name="n15" dev="tmpfs" ino=2076 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 46.734471][ T1248] syzkaller1: entered promiscuous mode [ 46.740124][ T1248] syzkaller1: entered allmulticast mode [ 46.822101][ T1259] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=198462431 (396924862 ns) > initial count (148514 ns). Using initial count to start timer. [ 47.296800][ T1297] Need at least one configuration in g1. [ 47.302606][ T1297] udc dummy_udc.0: failed to start g1: -22 [ 47.308534][ T1297] configfs-gadget.g1 gadget.0: probe with driver configfs-gadget.g1 failed with error -22 [ 47.319650][ T1297] UDC core: g1: couldn't find an available UDC or it's busy [ 47.815487][ T9] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 47.890237][ T149] usb 3-1: device reset failed [ 47.900103][ C0] usb 3-1: eth1: intr status -71 [ 47.900278][ T66] usb 3-1: USB disconnect, device number 4 [ 47.966629][ T9] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 47.981204][ T9] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 47.991495][ T9] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 48.006200][ T9] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 48.035086][ T9] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 48.050838][ T9] usb 1-1: config 0 descriptor?? [ 48.089620][ T1336] kvm: kvm [1335]: vcpu0, guest rIP: 0x912a Unhandled WRMSR(0xc1) = 0x60000000 [ 48.102838][ T1336] kvm: kvm [1335]: vcpu0, guest rIP: 0x912a Unhandled WRMSR(0xc2) = 0x60000000 [ 48.124867][ T1336] kvm: kvm [1335]: vcpu0, guest rIP: 0x912a Unhandled WRMSR(0x11e) = 0x60000000 [ 48.145723][ T1336] kvm: kvm [1335]: vcpu0, guest rIP: 0x912a Unhandled WRMSR(0x186) = 0x60000000 [ 48.155098][ T1336] kvm: kvm [1335]: vcpu0, guest rIP: 0x912a Unhandled WRMSR(0x187) = 0x60000000 [ 48.246101][ T1352] incfs_lookup_dentry err:-40 [ 48.262768][ T295] ------------[ cut here ]------------ [ 48.268395][ T295] WARNING: CPU: 1 PID: 295 at fs/overlayfs/util.c:605 ovl_dir_modified+0x15a/0x190 [ 48.277830][ T295] Modules linked in: [ 48.281795][ T295] CPU: 1 UID: 0 PID: 295 Comm: syz-executor Not tainted syzkaller #0 28dc4f15f82f041c91cead1444746a7bfe1433af [ 48.293657][ T295] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 48.303865][ T295] RIP: 0010:ovl_dir_modified+0x15a/0x190 [ 48.309699][ T295] Code: c1 e8 03 42 80 3c 28 00 74 08 4c 89 f7 e8 ae 82 97 ff 49 ff 06 5b 41 5c 41 5d 41 5e 41 5f 5d e9 4c eb 5d 03 cc e8 26 be 3e ff <0f> 0b e9 3e ff ff ff e8 1a be 3e ff 0f 0b e9 6e ff ff ff 44 89 f9 [ 48.329391][ T295] RSP: 0018:ffffc9000b61fb88 EFLAGS: 00010293 [ 48.335532][ T295] RAX: ffffffff8248b39a RBX: 0000000000000000 RCX: ffff888101f5cc00 [ 48.343556][ T295] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 48.351647][ T295] RBP: ffffc9000b61fbb0 R08: ffff88811311b37f R09: 1ffff1102262366f [ 48.359944][ T295] R10: dffffc0000000000 R11: ffffed1022623670 R12: 0000000000000000 [ 48.368021][ T295] R13: dffffc0000000000 R14: ffff88811311b2e0 R15: ffff88811056bcc0 [ 48.376075][ T295] FS: 0000555589584500(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 48.385065][ T295] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 48.391739][ T295] CR2: 00005555895af998 CR3: 0000000125aaa000 CR4: 00000000003526b0 [ 48.399792][ T295] Call Trace: [ 48.403116][ T295] [ 48.406130][ T295] ovl_do_remove+0x824/0xd10 [ 48.410793][ T295] ? ovl_set_redirect+0x780/0x780 [ 48.415921][ T295] ? __cfi_down_write+0x10/0x10 [ 48.420811][ T295] ovl_rmdir+0x1e/0x30 [ 48.424930][ T295] vfs_rmdir+0x3de/0x560 [ 48.429250][ T295] incfs_kill_sb+0x102/0x220 [ 48.433884][ T295] deactivate_locked_super+0xd5/0x270 [ 48.439339][ T295] deactivate_super+0xb8/0xe0 [ 48.444071][ T295] cleanup_mnt+0x438/0x4d0 [ 48.448562][ T295] __cleanup_mnt+0x1d/0x40 [ 48.453025][ T295] task_work_run+0x1e8/0x260 [ 48.457696][ T295] ? __cfi_task_work_run+0x10/0x10 [ 48.462876][ T295] ? __x64_sys_umount+0x12e/0x180 [ 48.467972][ T295] ? __cfi___x64_sys_umount+0x10/0x10 [ 48.473382][ T295] ? __kasan_check_read+0x15/0x20 [ 48.478519][ T295] resume_user_mode_work+0x35/0x50 [ 48.483670][ T295] syscall_exit_to_user_mode+0x63/0xb0 [ 48.489200][ T295] do_syscall_64+0x63/0xf0 [ 48.493655][ T295] ? clear_bhb_loop+0x50/0xa0 [ 48.498416][ T295] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 48.504360][ T295] RIP: 0033:0x7f1ecf59f317 [ 48.508834][ T295] Code: a2 c7 05 dc 43 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 48.528499][ T295] RSP: 002b:00007ffc04420f98 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 48.536994][ T295] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f1ecf59f317 [ 48.543568][ T9] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 48.544997][ T295] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffc04421050 [ 48.545018][ T295] RBP: 00007ffc04421050 R08: 00007ffc04422050 R09: 00000000ffffffff [ 48.557512][ T9] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 48.560453][ T295] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffc044220e0 [ 48.569282][ T9] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 48.575864][ T295] R13: 00007f1ecf634474 R14: 000000000000bc6b R15: 00007ffc04422120 [ 48.586008][ T9] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 48.591250][ T295] [ 48.600305][ T9] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 48.606676][ T295] ---[ end trace 0000000000000000 ]--- [ 48.608422][ T295] ------------[ cut here ]------------ [ 48.611012][ T9] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 48.617146][ T295] WARNING: CPU: 1 PID: 295 at fs/overlayfs/util.c:605 ovl_dir_modified+0x15a/0x190 [ 48.623458][ T9] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 48.628117][ T295] Modules linked in: [ 48.628137][ T295] CPU: 1 UID: 0 PID: 295 Comm: syz-executor Tainted: G W syzkaller #0 28dc4f15f82f041c91cead1444746a7bfe1433af [ 48.637255][ T9] plantronics 0003:047F:FFFF.0007: No inputs registered, leaving [ 48.644840][ T295] Tainted: [W]=WARN [ 48.644851][ T295] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 48.673286][ T9] plantronics 0003:047F:FFFF.0007: hiddev96,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.0-1/input0 [ 48.677146][ T295] RIP: 0010:ovl_dir_modified+0x15a/0x190 [ 48.709130][ T295] Code: c1 e8 03 42 80 3c 28 00 74 08 4c 89 f7 e8 ae 82 97 ff 49 ff 06 5b 41 5c 41 5d 41 5e 41 5f 5d e9 4c eb 5d 03 cc e8 26 be 3e ff <0f> 0b e9 3e ff ff ff e8 1a be 3e ff 0f 0b e9 6e ff ff ff 44 89 f9 [ 48.728821][ T295] RSP: 0018:ffffc9000b61fb88 EFLAGS: 00010293 [ 48.734926][ T295] RAX: ffffffff8248b39a RBX: 0000000000000000 RCX: ffff888101f5cc00 [ 48.742973][ T295] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 48.751007][ T295] RBP: ffffc9000b61fbb0 R08: ffff88811311b37f R09: 1ffff1102262366f [ 48.759065][ T295] R10: dffffc0000000000 R11: ffffed1022623670 R12: 0000000000000000 [ 48.767119][ T295] R13: dffffc0000000000 R14: ffff88811311b2e0 R15: ffff88811056bcc0 [ 48.775141][ T295] FS: 0000555589584500(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 48.784150][ T295] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 48.790813][ T295] CR2: 00005555895af998 CR3: 0000000125aaa000 CR4: 00000000003526b0 [ 48.798870][ T295] Call Trace: [ 48.802180][ T295] [ 48.805118][ T295] ovl_do_remove+0x824/0xd10 [ 48.809763][ T295] ? ovl_set_redirect+0x780/0x780 [ 48.814831][ T295] ? __cfi_down_write+0x10/0x10 [ 48.819745][ T295] ovl_rmdir+0x1e/0x30 [ 48.823852][ T295] vfs_rmdir+0x3de/0x560 [ 48.827060][ T9] usb 1-1: USB disconnect, device number 4 [ 48.828196][ T295] incfs_kill_sb+0x197/0x220 [ 48.838588][ T295] deactivate_locked_super+0xd5/0x270 [ 48.844047][ T295] deactivate_super+0xb8/0xe0 [ 48.848815][ T295] cleanup_mnt+0x438/0x4d0 [ 48.853419][ T295] __cleanup_mnt+0x1d/0x40 [ 48.857965][ T295] task_work_run+0x1e8/0x260 [ 48.862604][ T295] ? __cfi_task_work_run+0x10/0x10 [ 48.867825][ T295] ? __x64_sys_umount+0x12e/0x180 [ 48.872887][ T295] ? __cfi___x64_sys_umount+0x10/0x10 [ 48.878336][ T295] ? __kasan_check_read+0x15/0x20 [ 48.883405][ T295] resume_user_mode_work+0x35/0x50 [ 48.888578][ T295] syscall_exit_to_user_mode+0x63/0xb0 [ 48.894071][ T295] do_syscall_64+0x63/0xf0 [ 48.898557][ T295] ? clear_bhb_loop+0x50/0xa0 [ 48.903271][ T295] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 48.909219][ T295] RIP: 0033:0x7f1ecf59f317 [ 48.913656][ T295] Code: a2 c7 05 dc 43 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 48.933314][ T295] RSP: 002b:00007ffc04420f98 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 48.941773][ T295] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f1ecf59f317 [ 48.949808][ T295] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffc04421050 [ 48.957826][ T295] RBP: 00007ffc04421050 R08: 00007ffc04422050 R09: 00000000ffffffff [ 48.965873][ T295] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffc044220e0 [ 48.973894][ T295] R13: 00007f1ecf634474 R14: 000000000000bc6b R15: 00007ffc04422120 [ 48.981941][ T295] [ 48.984980][ T295] ---[ end trace 0000000000000000 ]---