last executing test programs: 3.75496493s ago: executing program 1 (id=47): ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x8937, 0x0) r0 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x8, 0x57e, 0x200e, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x70, 0x3e, "", [{{0x9, 0x4, 0x0, 0x9, 0xfe, 0x3, 0x0, 0x6, 0x0, {0x9, 0x21, 0x1, 0xfc, 0x1, {0x22, 0x25}}, {{{0x9, 0x5, 0x81, 0x3, 0x40, 0x9, 0x81, 0x2}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000200)={0x2c, &(0x7f0000000240)={0x20, 0x31, 0x25, {0x5f, 0x4, "83efb930f0187ff0478fa22a61a54607b71ea9e43d359c479c37f525cde38bf7914077"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) accept4$bt_l2cap(0xffffffffffffffff, 0x0, &(0x7f0000000100), 0x800) 2.9292966s ago: executing program 0 (id=87): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f00000000c0)={0x1, 0x0, [{0x4b564d03, 0x0, 0xdcb}]}) 2.848851742s ago: executing program 0 (id=94): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x40, 0x2, 0x3, 0x101, 0x0, 0x0, {0x3, 0x0, 0x2}, [@NFQA_CFG_FLAGS={0x8, 0x5, 0x1, 0x0, 0x2}, @NFQA_CFG_PARAMS={0x9, 0x2, {0x8, 0x2}}, @NFQA_CFG_CMD={0x8, 0x1, {0x0, 0x0, 0x5}}, @NFQA_CFG_QUEUE_MAXLEN={0x8, 0x3, 0x1, 0x0, 0x6}, @NFQA_CFG_MASK={0x8, 0x4, 0x1, 0x0, 0x3}]}, 0x40}, 0x1, 0x0, 0x0, 0x20000040}, 0x2000004c) symlink(&(0x7f0000000000)='.\x00', 0x0) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) 2.810745813s ago: executing program 0 (id=96): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x3, 0x10012, r2, 0x0) 2.699201336s ago: executing program 0 (id=103): r0 = syz_usb_connect$cdc_ecm(0x0, 0x4d, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x2, 0x0, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x0, 0x0, 0xffffffffffff8001, 0x1, [{{0x9, 0x2, 0x3b, 0x1, 0x1, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x12, 0x2, 0x6, 0x0, 0x0, {{0x5}, {0x5}, {0xd}}, {[], {{0x9, 0x5, 0x82, 0x2, 0x200}}, {{0x9, 0x5, 0x3, 0x2, 0x200}}}}}]}}]}}, &(0x7f0000001400)={0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, &(0x7f0000000080)={0x14, 0x0, &(0x7f0000000040)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) syz_usb_ep_write(r0, 0x82, 0x5, &(0x7f0000002340)='hello') 2.337975604s ago: executing program 3 (id=119): r0 = socket$inet_udp(0x2, 0x2, 0x0) close(0x3) socket$unix(0x1, 0x1, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x41, &(0x7f0000000200)=0x474c, 0x4) close(r0) 2.329180265s ago: executing program 3 (id=120): r0 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'ip6gre0\x00', 0x0}) bind$packet(r0, &(0x7f0000000140)={0x11, 0x0, r1, 0x1, 0x6, 0x6, @remote}, 0x14) sendmmsg$sock(r0, &(0x7f0000000440)=[{{0x0, 0x0, 0x0}}], 0x1, 0x40500f0) 2.319556145s ago: executing program 3 (id=121): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000000000010bd28710000000000000109022400010000000009040100010300000009210200000122050009058103"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f00000000c0)={0x2c, &(0x7f00000005c0)=ANY=[@ANYBLOB="200f05"], 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000080)={0x24, 0x0, &(0x7f00000001c0)={0x0, 0x3, 0xc, @string={0xc, 0x3, "c4d71213ba2c142d5d97"}}, 0x0, 0x0}, 0x0) 2.10084377s ago: executing program 1 (id=122): capset(&(0x7f0000000040)={0x20071026}, &(0x7f0000000080)={0x0, 0x2, 0x556}) r0 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f0000000000), 0x0, 0x0, 0x1) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) fremovexattr(r0, &(0x7f0000000000)=@known='system.posix_acl_default\x00') 2.07943563s ago: executing program 1 (id=123): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="1c000000020303000000000000000000000100000800010001"], 0x1c}}, 0x0) sendmsg$NFQNL_MSG_CONFIG(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)={0x1c, 0x2, 0x3, 0x3, 0x0, 0x0, {0x0, 0x0, 0x10}, [@NFQA_CFG_CMD={0x8, 0x1, {0x1}}]}, 0x1c}}, 0x0) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000080)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) close_range(r1, 0xffffffffffffffff, 0x0) 2.069233571s ago: executing program 1 (id=124): r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x101042, 0x15) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) r2 = dup(r1) setsockopt$TIPC_CONN_TIMEOUT(r2, 0x10f, 0x82, &(0x7f0000000100)=0x81, 0x4) 2.011237092s ago: executing program 1 (id=125): symlink(&(0x7f0000000080)='.\x00', &(0x7f0000000200)='./file0\x00') chmod(&(0x7f0000000180)='./file0\x00', 0x3ed) lstat(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0}) lchown(&(0x7f00000001c0)='./file0\x00', r0, 0x0) open(&(0x7f00009e1000)='./file0\x00', 0x60840, 0x0) 2.009745803s ago: executing program 1 (id=126): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100), 0x382, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000080)=0xf) ioctl$TCFLSH(r1, 0x400455c8, 0x1000000000) ioctl$sock_bt_hci(r0, 0x400448e2, &(0x7f0000000380)) 673.215904ms ago: executing program 0 (id=127): r0 = socket(0xa, 0x3, 0x3a) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000003c0)={'bridge0\x00', 0x0}) setsockopt$MRT6_ADD_MIF(r0, 0x29, 0xca, &(0x7f0000000000)={0x4, 0x0, 0x0, r2}, 0xc) setsockopt$MRT6_FLUSH(r0, 0x29, 0xd4, &(0x7f0000000180)=0x8, 0x4) 654.835985ms ago: executing program 0 (id=128): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000002c0)={0x24, 0x0, 0x0, &(0x7f0000000200)={0x0, 0x22, 0xf, {[@local=@item_4={0x3, 0x2, 0x4, "3512a263"}, @local=@item_4={0x3, 0x2, 0x0, "45501821"}, @global=@item_4={0x3, 0x1, 0x1, "5cf3d095"}]}}, 0x0}, 0x0) r1 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0) ioctl$HIDIOCGREPORT(r1, 0x400c4807, &(0x7f0000000040)={0x3, 0x200, 0x7}) 455.171ms ago: executing program 3 (id=129): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @broadcast}, 0x10) sendto$inet(r0, &(0x7f00000000c0)="9d", 0x1, 0x20008005, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) shutdown(r0, 0x1) recvfrom$inet(r0, 0x0, 0xffffffc6, 0x10022, 0x0, 0x0) 444.853ms ago: executing program 3 (id=130): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = socket$netlink(0x10, 0x3, 0x0) preadv(r0, &(0x7f0000000300)=[{&(0x7f00000003c0)=""/18, 0xfdef}], 0x1, 0x4e, 0x6) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) 318.169943ms ago: executing program 3 (id=135): syz_usb_connect(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120110037f1ce808000000a3f30a010203010902240001020010110904630702584200080905fe0f1000080009090502"], 0x0) r0 = socket$inet(0x2, 0x3, 0x4) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080)='ip6_vti0\x00', 0x10) sendmmsg$inet(r0, &(0x7f0000000280)=[{{&(0x7f0000000240)={0x2, 0x4e01, @dev={0xac, 0x14, 0x14, 0x44}}, 0x10, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="34000000000000000000000007000000441d"], 0x38}}], 0x1, 0x46000) 105.685868ms ago: executing program 2 (id=140): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_GET(r0, &(0x7f0000000ac0)={0x0, 0x0, &(0x7f0000000a80)={&(0x7f0000000200)=ANY=[@ANYBLOB="14000000", @ANYRES16=r1, @ANYBLOB="8fdf2cbd7000030000000b"], 0x14}, 0x1, 0x0, 0x0, 0x4005}, 0x40000) recvmmsg(r0, &(0x7f0000007ec0)=[{{0x0, 0x0, 0x0}, 0xfffffff8}, {{0x0, 0x0, 0x0}, 0xe2c3}, {{0x0, 0x0, &(0x7f00000030c0)=[{&(0x7f00000005c0)=""/163, 0xa3}, {&(0x7f0000000240)=""/92, 0x5c}, {&(0x7f0000000340)=""/180, 0xb4}, {&(0x7f0000000b00)=""/258, 0x102}, {&(0x7f0000001040)=""/52, 0x34}, {&(0x7f0000003140)=""/4096, 0x1000}], 0x6}, 0xe}, {{0x0, 0x0, 0x0}, 0x8000}], 0x4, 0x0, 0x0) 94.796188ms ago: executing program 2 (id=141): r0 = landlock_create_ruleset(&(0x7f0000000140)={0x0, 0x3, 0x3}, 0x18, 0x0) landlock_restrict_self(r0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x200) 86.286138ms ago: executing program 2 (id=142): pipe2(&(0x7f0000001cc0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) r2 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0}, &(0x7f0000cab000)=0xc) mount$9p_fd(0x0, &(0x7f0000000000)='.\x00', &(0x7f0000000080), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r1, @ANYBLOB=',access=', @ANYRESDEC=r3]) 23.00378ms ago: executing program 2 (id=143): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x7}, 0x4) unshare(0x20000400) setsockopt$packet_int(r0, 0x107, 0x16, &(0x7f0000000000)=0x4, 0x4) 13.93415ms ago: executing program 2 (id=144): r0 = syz_open_dev$loop(&(0x7f00000005c0), 0xffff, 0x109041) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events.local\x00', 0x275a, 0x0) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f0000000400)={r1, 0x1000, {0x2a00, 0x80010000, 0x0, 0x52, 0x0, 0x0, 0x0, 0x0, 0x1c, "fee8a2ab78fc179fd1f8a0e91ddaaca7bd64c6a4b4e00d9683dda1af1ea89de2b7fb0a0100000000000000000300", "2809e8dbe108598948224ad54afac11d09000000000000008dd4992861ac1000", "90be6c09306003d8006000", [0x0, 0x2]}}) ioctl$LOOP_SET_CAPACITY(r0, 0x4c06) 0s ago: executing program 2 (id=145): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = fcntl$dupfd(r0, 0x0, r0) sendmsg$IPCTNL_MSG_CT_GET_STATS_CPU(r1, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000440)={0x14, 0x4, 0x1, 0x301, 0x0, 0x0, {0x0, 0x0, 0x9}}, 0x14}, 0x1, 0x0, 0x0, 0x10}, 0x4040) syz_genetlink_get_family_id$nl80211(&(0x7f0000000540), r1) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.12' (ED25519) to the list of known hosts. [ 20.669721][ T36] audit: type=1400 audit(1787259587.290:64): avc: denied { mounton } for pid=287 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 20.670808][ T287] cgroup: Unknown subsys name 'net' [ 20.692370][ T36] audit: type=1400 audit(1787259587.290:65): avc: denied { mount } for pid=287 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 20.719646][ T36] audit: type=1400 audit(1787259587.310:66): avc: denied { unmount } for pid=287 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 20.720121][ T287] cgroup: Unknown subsys name 'devices' [ 20.840997][ T287] cgroup: Unknown subsys name 'hugetlb' [ 20.846599][ T287] cgroup: Unknown subsys name 'rlimit' [ 20.938681][ T36] audit: type=1400 audit(1787259587.550:67): avc: denied { setattr } for pid=287 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 20.961863][ T36] audit: type=1400 audit(1787259587.550:68): avc: denied { mounton } for pid=287 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 20.986542][ T36] audit: type=1400 audit(1787259587.550:69): avc: denied { mount } for pid=287 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 21.033933][ T289] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 21.042746][ T36] audit: type=1400 audit(1787259587.660:70): avc: denied { relabelto } for pid=289 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" Setting up swapspace version 1, size = 127995904 bytes [ 21.068167][ T36] audit: type=1400 audit(1787259587.660:71): avc: denied { write } for pid=289 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.106868][ T36] audit: type=1400 audit(1787259587.720:72): avc: denied { read } for pid=287 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.132406][ T36] audit: type=1400 audit(1787259587.720:73): avc: denied { open } for pid=287 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.132661][ T287] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 21.924903][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.932017][ T295] bridge0: port 1(bridge_slave_0) entered disabled state [ 21.939069][ T295] bridge_slave_0: entered allmulticast mode [ 21.945487][ T295] bridge_slave_0: entered promiscuous mode [ 21.953041][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.960123][ T295] bridge0: port 2(bridge_slave_1) entered disabled state [ 21.967215][ T295] bridge_slave_1: entered allmulticast mode [ 21.973413][ T295] bridge_slave_1: entered promiscuous mode [ 21.979453][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.986467][ T294] bridge0: port 1(bridge_slave_0) entered disabled state [ 21.993582][ T294] bridge_slave_0: entered allmulticast mode [ 21.999755][ T294] bridge_slave_0: entered promiscuous mode [ 22.006123][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.013178][ T294] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.020239][ T294] bridge_slave_1: entered allmulticast mode [ 22.026463][ T294] bridge_slave_1: entered promiscuous mode [ 22.060104][ T297] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.067143][ T297] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.074256][ T297] bridge_slave_0: entered allmulticast mode [ 22.080386][ T297] bridge_slave_0: entered promiscuous mode [ 22.089092][ T297] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.096146][ T297] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.103196][ T297] bridge_slave_1: entered allmulticast mode [ 22.109448][ T297] bridge_slave_1: entered promiscuous mode [ 22.156236][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.163327][ T296] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.170413][ T296] bridge_slave_0: entered allmulticast mode [ 22.176522][ T296] bridge_slave_0: entered promiscuous mode [ 22.189756][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.196792][ T296] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.203872][ T296] bridge_slave_1: entered allmulticast mode [ 22.210000][ T296] bridge_slave_1: entered promiscuous mode [ 22.295265][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.302333][ T294] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.309611][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.316618][ T294] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.340455][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.347495][ T295] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.354752][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.361777][ T295] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.388277][ T297] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.395333][ T297] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.402594][ T297] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.409616][ T297] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.427818][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.434865][ T296] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.442127][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.449157][ T296] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.469944][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.477125][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.484349][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.491984][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.499174][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.506379][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.513639][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.520794][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.535560][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.542599][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.550169][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.557189][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.581758][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.588791][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.596362][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.603396][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.611094][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.618113][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.625610][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.632717][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.644962][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.652001][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.681546][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.688572][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.700384][ T297] veth0_vlan: entered promiscuous mode [ 22.720930][ T294] veth0_vlan: entered promiscuous mode [ 22.738127][ T297] veth1_macvtap: entered promiscuous mode [ 22.751831][ T296] veth0_vlan: entered promiscuous mode [ 22.763951][ T294] veth1_macvtap: entered promiscuous mode [ 22.775894][ T295] veth0_vlan: entered promiscuous mode [ 22.804304][ T296] veth1_macvtap: entered promiscuous mode [ 22.813603][ T297] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 22.829920][ T295] veth1_macvtap: entered promiscuous mode [ 22.879214][ T317] netlink: 72 bytes leftover after parsing attributes in process `syz.0.1'. [ 22.892960][ T317] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1'. [ 22.913989][ T320] input: syz0 as /devices/virtual/input/input4 [ 22.977238][ T331] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 23.004669][ T337] capability: warning: `syz.2.10' uses 32-bit capabilities (legacy support in use) [ 23.309231][ T313] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 23.469182][ T313] usb 3-1: Using ep0 maxpacket: 32 [ 23.475418][ T313] usb 3-1: config 0 has an invalid interface number: 196 but max is 0 [ 23.483783][ T313] usb 3-1: config 0 has no interface number 0 [ 23.490040][ T31] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 23.497562][ T313] usb 3-1: config 0 interface 196 altsetting 1 bulk endpoint 0x2 has invalid maxpacket 528 [ 23.507630][ T313] usb 3-1: config 0 interface 196 has no altsetting 0 [ 23.515864][ T313] usb 3-1: New USB device found, idVendor=05ac, idProduct=7700, bcdDevice=eb.3a [ 23.524954][ T313] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 23.532953][ T313] usb 3-1: Product: syz [ 23.537085][ T313] usb 3-1: Manufacturer: syz [ 23.541743][ T313] usb 3-1: SerialNumber: syz [ 23.546876][ T313] usb 3-1: config 0 descriptor?? [ 23.552130][ T341] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 23.659217][ T31] usb 4-1: Using ep0 maxpacket: 32 [ 23.665395][ T31] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 23.675520][ T31] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 23.685877][ T31] usb 4-1: New USB device found, idVendor=05ac, idProduct=7700, bcdDevice=eb.3a [ 23.694969][ T31] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 23.702964][ T31] usb 4-1: Product: syz [ 23.707110][ T31] usb 4-1: Manufacturer: syz [ 23.711711][ T31] usb 4-1: SerialNumber: syz [ 23.716891][ T31] usb 4-1: config 0 descriptor?? [ 24.131886][ T399] MTRR 1 not used [ 24.136577][ T372] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 24.146045][ T372] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 24.156492][ T31] usb 4-1: USB disconnect, device number 2 [ 24.164717][ T313] ipheth 3-1:0.196: ipheth_enable_ncm: usb_control_msg: 0 [ 24.175258][ T313] ipheth 3-1:0.196: Apple iPhone USB Ethernet device attached [ 24.385537][ C0] ipheth 3-1:0.196: ipheth_rcvbulk_callback: callback retval: -22 [ 24.549368][ T66] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 24.586385][ T10] usb 3-1: USB disconnect, device number 2 [ 24.635308][ T10] ipheth 3-1:0.196: Apple iPhone USB Ethernet now disconnected [ 24.663864][ T464] tipc: Started in network mode [ 24.672203][ T464] tipc: Node identity 01000001, cluster identity 4369 [ 24.681576][ T464] tipc: New replicast peer: 127.0.0.1 [ 24.687409][ T464] tipc: Enabled bearer , priority 10 [ 24.709161][ T66] usb 2-1: Using ep0 maxpacket: 8 [ 24.715414][ T66] usb 2-1: too many endpoints for config 0 interface 0 altsetting 9: 254, using maximum allowed: 30 [ 24.728260][ T66] usb 2-1: config 0 interface 0 altsetting 9 has 1 endpoint descriptor, different from the interface descriptor's value: 254 [ 24.741434][ T66] usb 2-1: config 0 interface 0 has no altsetting 0 [ 24.748046][ T66] usb 2-1: New USB device found, idVendor=057e, idProduct=200e, bcdDevice= 0.00 [ 24.757244][ T66] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 24.766237][ T66] usb 2-1: config 0 descriptor?? [ 24.912463][ T489] process 'syz.0.66' launched './file1' with NULL argv: empty string added [ 24.992930][ T507] input: syz0 as /devices/virtual/input/input5 [ 25.158297][ T539] device-mapper: ioctl: Invalid new mapped device name or uuid string supplied. [ 25.187152][ T66] nintendo 0003:057E:200E.0001: unknown main item tag 0x3 [ 25.196036][ T66] nintendo 0003:057E:200E.0001: unexpected long global item [ 25.203561][ T66] nintendo 0003:057E:200E.0001: HID parse failed [ 25.207632][ T546] zero sized request [ 25.211289][ T66] nintendo 0003:057E:200E.0001: probe - fail = -22 [ 25.221789][ T66] nintendo 0003:057E:200E.0001: probe with driver nintendo failed with error -22 [ 25.255731][ T554] netlink: 72 bytes leftover after parsing attributes in process `syz.2.97'. [ 25.317702][ T560] Bluetooth: ISO socket layer initialized [ 25.398481][ T66] usb 2-1: USB disconnect, device number 2 [ 25.625420][ T310] Bluetooth: hci0: Frame reassembly failed (-84) [ 25.634662][ T375] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 25.790229][ T375] usb 1-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 25.803944][ T375] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 25.813028][ T31] tipc: Node number set to 16777217 [ 25.818338][ T375] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 25.826567][ T375] usb 1-1: SerialNumber: syz [ 25.935912][ T609] capability: warning: `syz.1.122' uses deprecated v2 capabilities in a way that may be insecure [ 25.968309][ T36] kauditd_printk_skb: 160 callbacks suppressed [ 25.968324][ T36] audit: type=1400 audit(1787259592.580:234): avc: denied { create } for pid=612 comm="syz.1.124" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 25.969225][ T313] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 25.975565][ T36] audit: type=1400 audit(1787259592.590:235): avc: denied { setopt } for pid=612 comm="syz.1.124" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 26.033525][ T36] audit: type=1400 audit(1787259592.650:236): avc: denied { ioctl } for pid=616 comm="syz.1.126" path="socket:[5534]" dev="sockfs" ino=5534 ioctlcmd=0x48e2 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 26.139208][ T313] usb 4-1: Using ep0 maxpacket: 16 [ 26.145369][ T313] usb 4-1: config 0 has an invalid interface number: 1 but max is 0 [ 26.153467][ T313] usb 4-1: config 0 has no interface number 0 [ 26.159579][ T313] usb 4-1: config 0 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 26.170473][ T313] usb 4-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 26.180224][ T313] usb 4-1: New USB device found, idVendor=28bd, idProduct=0071, bcdDevice= 0.00 [ 26.189280][ T313] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 26.197775][ T313] usb 4-1: config 0 descriptor?? [ 26.436166][ T375] cdc_ether 1-1:1.0 usb0: register 'cdc_ether' at usb-dummy_hcd.0-1, CDC Ethernet Device, 42:42:42:42:42:42 [ 26.477171][ T36] audit: type=1400 audit(1787259593.090:237): avc: denied { search } for pid=150 comm="dhcpcd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 26.502827][ T36] audit: type=1400 audit(1787259593.120:238): avc: denied { read } for pid=621 comm="dhcpcd-run-hook" name="resolv.conf" dev="tmpfs" ino=426 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 26.525826][ T36] audit: type=1400 audit(1787259593.120:239): avc: denied { open } for pid=621 comm="dhcpcd-run-hook" path="/run/dhcpcd/hook-state/resolv.conf" dev="tmpfs" ino=426 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 26.550795][ T36] audit: type=1400 audit(1787259593.120:240): avc: denied { getattr } for pid=621 comm="dhcpcd-run-hook" path="/run/dhcpcd/hook-state/resolv.conf" dev="tmpfs" ino=426 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 26.602634][ T36] audit: type=1400 audit(1787259593.220:241): avc: denied { write } for pid=620 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=425 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 26.625528][ T36] audit: type=1400 audit(1787259593.220:242): avc: denied { add_name } for pid=620 comm="dhcpcd-run-hook" name="resolv.conf.usb0.link" scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 26.649015][ T36] audit: type=1400 audit(1787259593.220:243): avc: denied { remove_name } for pid=631 comm="rm" name="resolv.conf.usb0.link" dev="tmpfs" ino=892 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 26.845966][ T375] usb 1-1: USB disconnect, device number 2 [ 26.852979][ T313] input: HID 28bd:0071 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.1/0003:28BD:0071.0002/input/input6 [ 26.865704][ T313] input: HID 28bd:0071 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.1/0003:28BD:0071.0002/input/input7 [ 26.877401][ T375] cdc_ether 1-1:1.0 usb0: unregister 'cdc_ether' usb-dummy_hcd.0-1, CDC Ethernet Device [ 26.890509][ T313] uclogic 0003:28BD:0071.0002: input,hidraw0: USB HID v0.02 Keypad [HID 28bd:0071] on usb-dummy_hcd.3-1/input1 [ 27.065707][ T66] usb 4-1: USB disconnect, device number 3 [ 27.361729][ T663] bridge0: entered allmulticast mode [ 27.367549][ T663] bridge0: left allmulticast mode [ 27.619186][ T66] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 27.639180][ T592] Bluetooth: hci0: command 0x1003 tx timeout [ 27.639669][ T54] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 27.770194][ T66] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 27.781222][ T66] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 27.790971][ T66] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 27.804002][ T66] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 27.813174][ T66] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 27.821838][ T66] usb 1-1: config 0 descriptor?? [ 27.866810][ T66] usbhid 1-1:0.0: can't add hid device: -71 [ 27.872848][ T66] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 27.885328][ T66] usb 1-1: USB disconnect, device number 3 [ 27.904096][ T686] synth uevent: /bus/acpi: unknown uevent action string [ 27.950148][ T694] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 27.962248][ T375] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 27.963794][ T694] 9p: Unknown uid 00000000004294967295 [ 28.039539][ T593] Bluetooth: hci1: Opcode 0x1003 failed: -110 [ 28.045657][ T54] Bluetooth: hci1: command 0x1003 tx timeout [ 28.052303][ T665] ================================================================== [ 28.059279][ T702] netlink: 44 bytes leftover after parsing attributes in process `syz.2.146'. [ 28.060384][ T665] BUG: KASAN: slab-use-after-free in string+0x20f/0x2b0 [ 28.069331][ T702] netlink: 43 bytes leftover after parsing attributes in process `syz.2.146'. [ 28.076133][ T665] Read of size 1 at addr ffff888105f20300 by task syz.0.128/665 [ 28.085236][ T702] netlink: 'syz.2.146': attribute type 6 has an invalid length. [ 28.092570][ T665] [ 28.092592][ T665] CPU: 0 UID: 0 PID: 665 Comm: syz.0.128 Not tainted syzkaller #0 8b5107c30037f7cfe212f1198c23c0388356dd7c [ 28.092617][ T665] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 28.092637][ T665] Call Trace: [ 28.092644][ T665] [ 28.092652][ T665] __dump_stack+0x21/0x30 [ 28.092682][ T665] dump_stack_lvl+0x140/0x1c0 [ 28.092707][ T665] ? __cfi_dump_stack_lvl+0x10/0x10 [ 28.092733][ T665] print_address_description+0x71/0x210 [ 28.092758][ T665] print_report+0x4a/0x70 [ 28.092781][ T665] kasan_report+0x162/0x1a0 [ 28.092805][ T665] ? string+0x20f/0x2b0 [ 28.092827][ T665] ? string+0x20f/0x2b0 [ 28.092848][ T665] __asan_report_load1_noabort+0x18/0x20 [ 28.092866][ T665] string+0x20f/0x2b0 [ 28.092887][ T665] vsnprintf+0xe65/0x1ad0 [ 28.092910][ T665] snprintf+0xe9/0x140 [ 28.092931][ T665] ? is_bpf_text_address+0x17b/0x1a0 [ 28.092957][ T665] ? __cfi_snprintf+0x10/0x10 [ 28.092979][ T665] ? kernel_text_address+0xa9/0xe0 [ 28.093003][ T665] ? __kernel_text_address+0x11/0x40 [ 28.093027][ T665] ? unwind_get_return_address+0x51/0x90 [ 28.093050][ T665] ? dev_vprintk_emit+0x179/0x400 [ 28.093071][ T665] dev_vprintk_emit+0x313/0x400 [ 28.093092][ T665] ? __cfi_dev_vprintk_emit+0x10/0x10 [ 28.093121][ T665] ? stack_depot_save_flags+0x38/0x800 [ 28.093144][ T665] dev_printk_emit+0xef/0x150 [ 28.093163][ T665] ? __asan_memcpy+0x5a/0x80 [ 28.093181][ T665] ? avc_has_extended_perms+0x94b/0xe60 [ 28.093204][ T665] ? __cfi_dev_printk_emit+0x10/0x10 [ 28.093225][ T665] ? __asan_set_shadow_00+0x12/0x20 [ 28.093249][ T665] ? do_vfs_ioctl+0x182d/0x2010 [ 28.093272][ T665] __dev_printk+0x17f/0x1b0 [ 28.093291][ T665] _dev_err+0x11f/0x180 [ 28.093312][ T665] ? __cfi__dev_err+0x10/0x10 [ 28.093332][ T665] ? _raw_spin_lock_irqsave+0xc1/0x160 [ 28.093355][ T665] ? __cfi__raw_spin_lock_irqsave+0x10/0x10 [ 28.093380][ T665] ? usb_ep_queue+0xf0/0x230 [ 28.093405][ T665] raw_process_ep0_io+0x54b/0x7a0 [ 28.093423][ T665] raw_ioctl+0x25d2/0x37a0 [ 28.093449][ T665] ? __cfi_futex_wait+0x10/0x10 [ 28.093466][ T665] ? __cfi_raw_ioctl+0x10/0x10 [ 28.093490][ T665] ? selinux_file_ioctl+0x732/0x1480 [ 28.093509][ T665] ? __cfi_selinux_file_ioctl+0x10/0x10 [ 28.093526][ T665] ? hrtimer_nanosleep+0x265/0x340 [ 28.093552][ T665] ? do_futex+0x32a/0x510 [ 28.093574][ T665] ? __cfi_hrtimer_wakeup+0x10/0x10 [ 28.093592][ T665] ? __cfi_do_futex+0x10/0x10 [ 28.093614][ T665] ? get_timespec64+0x11a/0x1b0 [ 28.093640][ T665] ? bpf_lsm_file_ioctl+0xd/0x20 [ 28.093662][ T665] ? security_file_ioctl+0x3e/0x110 [ 28.093679][ T665] ? __cfi_raw_ioctl+0x10/0x10 [ 28.093703][ T665] __se_sys_ioctl+0x135/0x1b0 [ 28.093725][ T665] __x64_sys_ioctl+0x7f/0xa0 [ 28.093747][ T665] x64_sys_call+0x1878/0x2ee0 [ 28.093763][ T665] do_syscall_64+0x57/0xf0 [ 28.093786][ T665] ? clear_bhb_loop+0x50/0xa0 [ 28.093804][ T665] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 28.093831][ T665] RIP: 0033:0x7fcf89b9dd6b [ 28.093848][ T665] Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00 [ 28.093863][ T665] RSP: 002b:00007fcf8aa95f50 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 28.093886][ T665] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fcf89b9dd6b [ 28.093900][ T665] RDX: 00007fcf8aa95fd0 RSI: 00000000c0085504 RDI: 0000000000000003 [ 28.093913][ T665] RBP: 00007fcf89c35024 R08: 0000000000000000 R09: 0000000000000000 [ 28.093925][ T665] R10: 0000000000000003 R11: 0000000000000246 R12: 00007fcf8aa95fd8 [ 28.093937][ T665] R13: 0000000000000000 R14: 00007fcf89e25fa0 R15: 00007ffea2ae45b8 [ 28.093952][ T665] [ 28.093959][ T665] [ 28.103402][ T702] netlink: 'syz.2.146': attribute type 5 has an invalid length. [ 28.113897][ T665] Allocated by task 1: [ 28.113911][ T665] kasan_save_track+0x3e/0x80 [ 28.113934][ T665] kasan_save_alloc_info+0x3a/0x50 [ 28.113950][ T665] __kasan_kmalloc+0x96/0xb0 [ 28.113967][ T665] __kmalloc_node_track_caller_noprof+0x24e/0x4f0 [ 28.113985][ T665] kvasprintf+0xf1/0x260 [ 28.113998][ T665] kvasprintf_const+0xf6/0x250 [ 28.114013][ T665] kobject_set_name_vargs+0x65/0x120 [ 28.114035][ T665] dev_set_name+0xe3/0x140 [ 28.146057][ T702] netlink: 43 bytes leftover after parsing attributes in process `syz.2.146'. [ 28.149968][ T665] usb_add_gadget+0x436/0x780 [ 28.149993][ T665] usb_add_gadget_udc+0x11e/0x160 [ 28.150011][ T665] dummy_udc_probe+0x6ea/0x7f0 [ 28.160155][ T375] usb 4-1: Using ep0 maxpacket: 8 [ 28.162937][ T665] platform_probe+0x17a/0x200 [ 28.193596][ T375] usb 4-1: unable to get BOS descriptor or descriptor too short [ 28.194962][ T665] really_probe+0x2e1/0x8b0 [ 28.217767][ T375] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 28.220800][ T665] __driver_probe_device+0x193/0x280 [ 28.220832][ T665] driver_probe_device+0x54/0x3f0 [ 28.227735][ T375] usb 4-1: can't read configurations, error -71 [ 28.231627][ T665] __device_attach_driver+0x2f1/0x4b0 [ 28.231650][ T665] bus_for_each_drv+0x264/0x300 [ 28.595849][ T665] __device_attach+0x2c4/0x3c0 [ 28.600615][ T665] device_initial_probe+0x1e/0x30 [ 28.605626][ T665] bus_probe_device+0x18b/0x270 [ 28.610466][ T665] device_add+0x7fd/0xbf0 [ 28.614785][ T665] platform_device_add+0x464/0x6c0 [ 28.619882][ T665] dummy_hcd_init+0xce2/0x1230 [ 28.624639][ T665] do_one_initcall+0x1e8/0x6a0 [ 28.629398][ T665] do_initcall_level+0x174/0x2e5 [ 28.634326][ T665] do_initcalls+0x7e/0x160 [ 28.638728][ T665] do_basic_setup+0x95/0xb0 [ 28.643218][ T665] kernel_init_freeable+0x2b1/0x400 [ 28.648405][ T665] kernel_init+0x21/0x1e0 [ 28.652724][ T665] ret_from_fork+0x67/0xa0 [ 28.657129][ T665] ret_from_fork_asm+0x1a/0x30 [ 28.661874][ T665] [ 28.664181][ T665] Freed by task 682: [ 28.668054][ T665] kasan_save_track+0x3e/0x80 [ 28.672717][ T665] kasan_save_free_info+0x44/0x50 [ 28.677722][ T665] __kasan_slab_free+0x5f/0x80 [ 28.682472][ T665] kfree+0x158/0x440 [ 28.686783][ T665] kfree_const+0x3d/0x50 [ 28.691012][ T665] kobject_put+0x21f/0x2a0 [ 28.695419][ T665] put_device+0x23/0x40 [ 28.699560][ T665] usb_del_gadget_udc+0x25/0x30 [ 28.704403][ T665] dummy_udc_remove+0x5c/0x70 [ 28.709066][ T665] platform_remove+0x7e/0xb0 [ 28.713643][ T665] device_release_driver_internal+0x4ad/0x830 [ 28.719707][ T665] device_driver_detach+0x3f/0x50 [ 28.724721][ T665] unbind_store+0x1ab/0x1f0 [ 28.729215][ T665] drv_attr_store+0x91/0xb0 [ 28.733706][ T665] sysfs_kf_write+0x13e/0x160 [ 28.738368][ T665] kernfs_fop_write_iter+0x316/0x510 [ 28.743645][ T665] vfs_write+0x75f/0xfd0 [ 28.747875][ T665] ksys_write+0x145/0x260 [ 28.752189][ T665] __x64_sys_write+0x7f/0x90 [ 28.756760][ T665] x64_sys_call+0x271c/0x2ee0 [ 28.761420][ T665] do_syscall_64+0x57/0xf0 [ 28.765824][ T665] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 28.771707][ T665] [ 28.774011][ T665] The buggy address belongs to the object at ffff888105f20300 [ 28.774011][ T665] which belongs to the cache kmalloc-16 of size 16 [ 28.787870][ T665] The buggy address is located 0 bytes inside of [ 28.787870][ T665] freed 16-byte region [ffff888105f20300, ffff888105f20310) [ 28.801397][ T665] [ 28.803708][ T665] The buggy address belongs to the physical page: [ 28.810108][ T665] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x105f20 [ 28.818940][ T665] flags: 0x4000000000000000(zone=1) [ 28.824120][ T665] page_type: f5(slab) [ 28.828085][ T665] raw: 4000000000000000 ffff888100041640 ffffea000416fbc0 0000000000000002 [ 28.836664][ T665] raw: 0000000000000000 0000000000800080 00000001f5000000 0000000000000000 [ 28.845241][ T665] page dumped because: kasan: bad access detected [ 28.851654][ T665] page_owner tracks the page as allocated [ 28.857355][ T665] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 1, tgid 1 (swapper/0), ts 2818803442, free_ts 0 [ 28.874882][ T665] post_alloc_hook+0x37d/0x3b0 [ 28.879649][ T665] prep_new_page+0x2d/0x180 [ 28.884144][ T665] get_page_from_freelist+0x4aea/0x4ba0 [ 28.889680][ T665] __alloc_pages_noprof+0x35a/0x7e0 [ 28.894878][ T665] alloc_slab_page+0x6b/0x1e0 [ 28.899554][ T665] allocate_slab+0x69/0x430 [ 28.904055][ T665] ___slab_alloc+0x591/0x8c0 [ 28.908663][ T665] __kmalloc_noprof+0x2fc/0x510 [ 28.913501][ T665] usb_hcd_submit_urb+0x7d5/0x19d0 [ 28.918621][ T665] usb_submit_urb+0xfa1/0x1610 [ 28.923372][ T665] usb_start_wait_urb+0x127/0x380 [ 28.928387][ T665] usb_control_msg+0x25c/0x490 [ 28.933142][ T665] hub_probe+0x1041/0x2f80 [ 28.937555][ T665] usb_probe_interface+0x6ab/0xbf0 [ 28.942659][ T665] really_probe+0x2e1/0x8b0 [ 28.947152][ T665] __driver_probe_device+0x193/0x280 [ 28.952431][ T665] page_owner free stack trace missing [ 28.957781][ T665] [ 28.960095][ T665] Memory state around the buggy address: [ 28.965715][ T665] ffff888105f20200: 00 05 fc fc 00 03 fc fc 00 07 fc fc 00 00 fc fc [ 28.973765][ T665] ffff888105f20280: 00 04 fc fc 00 00 fc fc 00 05 fc fc 00 07 fc fc [ 28.981811][ T665] >ffff888105f20300: fa fb fc fc 00 01 fc fc 00 00 fc fc 00 01 fc fc [ 28.989855][ T665] ^ [ 28.993909][ T665] ffff888105f20380: 00 00 fc fc 00 00 fc fc 00 05 fc fc 00 04 fc fc [ 29.001954][ T665] ffff888105f20400: 00 00 fc fc 00 04 fc fc 00 01 fc fc 00 00 fc fc [ 29.009998][ T665] ================================================================== [ 29.023501][ T665] Disabling lock debugging due to kernel taint [ 29.031509][ T665] gadget : fail, usb_ep_queue returned -108