last executing test programs:
500.830948ms ago: executing program 3 (id=4):
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/strings/0x409/s1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/strings/0x409/s2\x00', 0x1ff)
rmdir(&(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409/s1\x00')
rmdir(&(0x7f0000000240)='./config/usb_gadget/g1/strings/0x409/s2\x00')
rmdir(&(0x7f0000000280)='./config/usb_gadget/g1/strings/0x409\x00')
rmdir(&(0x7f00000002c0)='./config/usb_gadget/g1\x00')
umount2(&(0x7f0000000300)='./config\x00', 0x0)
rmdir(&(0x7f0000000340)='./config\x00')
442.11857ms ago: executing program 3 (id=6):
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup/cgroup.subtree_control\x00', 0x2, 0x0)
write(r0, &(0x7f0000000080)='+pids\x00', 0x6)
close(r0)
mkdir(&(0x7f00000000c0)='./cgroup/g1\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup/g1/pids.max\x00', 0x2, 0x0)
write(r1, &(0x7f0000000140)='30', 0x2)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./cgroup/g1/cgroup.procs\x00', 0x2, 0x0)
write(r2, &(0x7f00000001c0)='0', 0x1)
close(r2)
r3 = syz_open_procfs(0x0, &(0x7f0000000200)='oom_score_adj\x00')
write(r3, &(0x7f0000000240)='1000', 0x4)
mmap(&(0x7f0000000000/0x1000000)=nil, 0x1000000, 0x3, 0x8032, 0xffffffff, 0x0)
384.627991ms ago: executing program 1 (id=2):
syz_usb_connect(0x0, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x97, 0xff, 0x82, 0x8, 0x2058, 0x1005, 0xc19b, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x8f, 0x0, 0x0, 0xbf, 0x57, 0x5a}}]}}]}}, 0x0)
nanosleep(&(0x7f0000000000)={0x5}, 0x0)
r0 = syz_usb_connect(0x3, 0x4e, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000401107500500010102030109023c0001010080320904000006ffffff0007058e0200020007050e02000200070501020002000705030200020007058d0200020007050d02000200"], &(0x7f00000000c0))
syz_usb_control_io(r0, &(0x7f0000000100), &(0x7f0000000140))
syz_usb_control_io(r0, &(0x7f0000000200), &(0x7f0000000240))
syz_usb_control_io(r0, &(0x7f0000000300), &(0x7f0000000340))
syz_usb_control_io(r0, &(0x7f0000000400), &(0x7f0000000440))
syz_usb_control_io(r0, &(0x7f0000000500), &(0x7f0000000540))
334.037182ms ago: executing program 4 (id=5):
syz_usb_connect(0x0, 0x5b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000202020040dd04058000000102030109024900010100c0320904000003020a0000152412000174f03dbd1ec14470a3677134c9f5543707241301000100090583030800080000090581024000000000090502024000000000"], 0x0)
r0 = socket(0x2, 0x2, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'})
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'syzkaller1\x00'})
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
232.978475ms ago: executing program 2 (id=3):
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./dev\x00', &(0x7f0000000080)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000140)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/msr/parameters/allow_writes\x00', 0x2, 0x0)
write(r0, &(0x7f0000000200)='on\n\x00', 0x3)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./dev/cpu/0/msr\x00', 0x2, 0x0)
r2 = openat$kvm(0x0, &(0x7f0000000280), 0x0, 0x0)
r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
r4 = syz_kvm_setup_syzos_vm$x86(r3, &(0x7f0000c00000/0x400000)=nil)
r5 = syz_kvm_add_vcpu$x86(r4, &(0x7f00000001c0)={0x0, &(0x7f00000002c0)=[@code={0xa, 0x13, {"ebfe", 0x2}}], 0x13})
r6 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r2, 0xae04)
mmap$KVM_VCPU(&(0x7f0000009000/0x1000)=nil, r6, 0x3, 0x11, r5, 0x0)
pwrite64(r1, &(0x7f0000000400)="f400000000000000", 0x8, 0x83f)
pwrite64(r1, &(0x7f0000000480)="00000300000000f4", 0x8, 0x830)
ioctl$KVM_RUN(r5, 0xae80, 0x0)
pwrite64(r1, &(0x7f0000000500)="f400000000000000", 0x8, 0x83f)
pwrite64(r1, &(0x7f0000000580)="00000300000000f4", 0x8, 0x830)
ioctl$KVM_RUN(r5, 0xae80, 0x0)
210.312545ms ago: executing program 0 (id=1):
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
write$UHID_CREATE2(r0, &(0x7f0000000100)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x1b, 0x3, 0x1, 0x1, 0x1, 0x0, "05010906a101050719e029e71500250175019508810295088101c0"}}, 0x1a8)
read(r0, &(0x7f0000000500), 0x1000)
syz_open_dev$hidraw(&(0x7f0000000040), 0x0, 0x2)
syz_open_dev$hidraw(&(0x7f0000000040), 0x0, 0x2)
syz_open_dev$hidraw(&(0x7f0000000040), 0x0, 0x2)
syz_open_dev$hidraw(&(0x7f0000000040), 0x0, 0x2)
syz_open_dev$hidraw(&(0x7f0000000040), 0x0, 0x2)
syz_open_dev$hidraw(&(0x7f0000000040), 0x0, 0x2)
syz_open_dev$hidraw(&(0x7f0000000040), 0x0, 0x2)
syz_open_dev$hidraw(&(0x7f0000000040), 0x0, 0x2)
syz_open_dev$hidraw(&(0x7f0000000040), 0x0, 0x2)
syz_open_dev$hidraw(&(0x7f0000000040), 0x0, 0x2)
syz_open_dev$hidraw(&(0x7f0000000040), 0x0, 0x2)
syz_open_dev$hidraw(&(0x7f0000000040), 0x0, 0x2)
syz_open_dev$hidraw(&(0x7f0000000040), 0x0, 0x2)
syz_open_dev$hidraw(&(0x7f0000000040), 0x0, 0x2)
syz_open_dev$hidraw(&(0x7f0000000040), 0x0, 0x2)
syz_open_dev$hidraw(&(0x7f0000000040), 0x0, 0x2)
syz_open_dev$hidraw(&(0x7f0000000040), 0x0, 0x2)
syz_open_dev$hidraw(&(0x7f0000000040), 0x0, 0x2)
syz_open_dev$hidraw(&(0x7f0000000040), 0x0, 0x2)
syz_open_dev$hidraw(&(0x7f0000000040), 0x0, 0x2)
syz_open_dev$hidraw(&(0x7f0000000040), 0x0, 0x2)
syz_open_dev$hidraw(&(0x7f0000000040), 0x0, 0x2)
syz_open_dev$hidraw(&(0x7f0000000040), 0x0, 0x2)
syz_open_dev$hidraw(&(0x7f0000000040), 0x0, 0x2)
syz_open_dev$hidraw(&(0x7f0000000040), 0x0, 0x2)
syz_open_dev$hidraw(&(0x7f0000000040), 0x0, 0x2)
syz_open_dev$hidraw(&(0x7f0000000040), 0x0, 0x2)
syz_open_dev$hidraw(&(0x7f0000000040), 0x0, 0x2)
syz_open_dev$hidraw(&(0x7f0000000040), 0x0, 0x2)
syz_open_dev$hidraw(&(0x7f0000000040), 0x0, 0x2)
write$UHID_INPUT2(r0, &(0x7f0000000600)={0xc, {0x10, '\x00'/16}}, 0x16)
write$UHID_INPUT2(r0, &(0x7f0000000600)={0xc, {0x10, '\x00'/16}}, 0x16)
write$UHID_INPUT2(r0, &(0x7f0000000600)={0xc, {0x10, '\x00'/16}}, 0x16)
write$UHID_INPUT2(r0, &(0x7f0000000600)={0xc, {0x10, '\x00'/16}}, 0x16)
write$UHID_INPUT2(r0, &(0x7f0000000600)={0xc, {0x10, '\x00'/16}}, 0x16)
109.208198ms ago: executing program 0 (id=7):
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000200)='./debug\x00', &(0x7f0000000300)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/split_huge_pages\x00', 0x1, 0x0)
write(r0, &(0x7f0000000600), 0x0)
99.666258ms ago: executing program 3 (id=8):
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000200)='./debug\x00', &(0x7f0000000300)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/split_huge_pages\x00', 0x1, 0x0)
write(r0, &(0x7f0000000600)='1,0x7f0000800000,0x', 0x13)
24.28246ms ago: executing program 0 (id=9):
mkdir(&(0x7f0000000150)='./config\x00', 0x1ff)
mount(&(0x7f0000000000)=@filename='none\x00', &(0x7f0000000100)='./config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g_syz/functions/ecm.usb0/ifname\x00', 0x1, 0x0)
write(r0, &(0x7f0000000700)='syzkaller', 0x9)
24.08145ms ago: executing program 3 (id=10):
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./dev\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x1, 0x0)
write(r0, &(0x7f0000000280)='0x0525\n\x00', 0x7)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/idProduct\x00', 0x1, 0x0)
write(r1, &(0x7f0000000300)='0xa4a7\n\x00', 0x7)
close(r1)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/functions/acm.usb0\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/acm.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/acm.usb0\x00')
r2 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r2, &(0x7f00000004c0)='dummy_udc.0\n\x00', 0xc)
close(r2)
nanosleep(&(0x7f0000000500)={0x0, 0x1dcd6500}, 0x0)
ioctl$TCSBRK(0xffffffffffffffff, 0x5409, 0x0)
ioctl$TIOCCBRK(0xffffffffffffffff, 0x5428)
close(0xffffffffffffffff)
17.08865ms ago: executing program 0 (id=11):
r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
r1 = syz_kvm_setup_syzos_vm$x86(r0, &(0x7f0000c00000/0x400000)=nil)
r2 = syz_kvm_add_vcpu$x86(r1, &(0x7f00000001c0)={0x0, &(0x7f0000000200)=[@code={0xa, 0x18, {"0f0b6b766ddbe3"}}], 0x18})
ioctl$KVM_RUN(r2, 0xae80, 0x0)
0s ago: executing program 0 (id=12):
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0)
write(r0, &(0x7f0000000180)='0x1d6b\x00', 0x6)
r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0)
write(r1, &(0x7f0000000200)='0x0104\x00', 0x6)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0)
write(r2, &(0x7f00000002c0)='1234567890\x00', 0xb)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/strings/0x409/manufacturer\x00', 0x2, 0x0)
write(r3, &(0x7f0000000340)='Linux Foundation\x00', 0x11)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/strings/0x409/product\x00', 0x2, 0x0)
write(r4, &(0x7f00000003c0)='Test Gadget\x00', 0xc)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/functions/midi.usb0\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/configs/c.1/strings/0x409\x00', 0x1ff)
r5 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./config/usb_gadget/g1/configs/c.1/strings/0x409/configuration\x00', 0x2, 0x0)
write(r5, &(0x7f0000000500)='Conf 1\x00', 0x7)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/usb_gadget/g1/configs/c.1\x00', 0x0, 0x0)
symlinkat(&(0x7f0000000580)='./config/usb_gadget/g1/functions/midi.usb0\x00', r6, &(0x7f00000005c0)='midi.usb0\x00')
mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g1/configs/c.2\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000640)='./config/usb_gadget/g1/configs/c.2/strings/0x409\x00', 0x1ff)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000680)='./config/usb_gadget/g1/configs/c.2/strings/0x409/configuration\x00', 0x2, 0x0)
write(r7, &(0x7f00000006c0)='Conf 2\x00', 0x7)
r8 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./config/usb_gadget/g1/configs/c.2\x00', 0x0, 0x0)
symlinkat(&(0x7f0000000580)='./config/usb_gadget/g1/functions/midi.usb0\x00', r8, &(0x7f0000000740)='midi.usb0\x00')
r9 = openat(0xffffffffffffff9c, &(0x7f0000000780)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0)
write(r9, &(0x7f00000007c0)='dummy_udc.0\x00', 0xb)
nanosleep(&(0x7f0000000800)={0x0, 0x23c34600}, 0x0)
r10 = openat(0xffffffffffffff9c, &(0x7f0000000840)='./sys/bus/usb/devices/5-1/bConfigurationValue\x00', 0x2, 0x0)
write(r10, &(0x7f00000008c0)='2\x00', 0x2)
write(r10, &(0x7f0000000900)='0\x00', 0x2)
kernel console output (not intermixed with test programs):
Warning: Permanently added '10.128.10.29' (ED25519) to the list of known hosts.
[ 29.940698][ T28] audit: type=1400 audit(1786961715.932:64): avc: denied { mounton } for pid=279 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1
[ 29.945014][ T279] cgroup: Unknown subsys name 'net'
[ 29.963393][ T28] audit: type=1400 audit(1786961715.932:65): avc: denied { mount } for pid=279 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1
[ 29.990781][ T28] audit: type=1400 audit(1786961715.962:66): avc: denied { unmount } for pid=279 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1
[ 29.991299][ T279] cgroup: Unknown subsys name 'devices'
[ 30.134082][ T279] cgroup: Unknown subsys name 'hugetlb'
[ 30.139773][ T279] cgroup: Unknown subsys name 'rlimit'
[ 30.277032][ T28] audit: type=1400 audit(1786961716.272:67): avc: denied { setattr } for pid=279 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=258 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[ 30.300493][ T28] audit: type=1400 audit(1786961716.272:68): avc: denied { mounton } for pid=279 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1
[ 30.325343][ T28] audit: type=1400 audit(1786961716.272:69): avc: denied { mount } for pid=279 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1
[ 30.352065][ T281] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped).
Setting up swapspace version 1, size = 127995904 bytes
[ 30.361187][ T28] audit: type=1400 audit(1786961716.352:70): avc: denied { relabelto } for pid=281 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t"
[ 30.386918][ T28] audit: type=1400 audit(1786961716.352:71): avc: denied { write } for pid=281 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t"
[ 30.412146][ T279] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 30.413560][ T28] audit: type=1400 audit(1786961716.392:72): avc: denied { read } for pid=279 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t"
[ 30.446820][ T28] audit: type=1400 audit(1786961716.392:73): avc: denied { open } for pid=279 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t"
[ 31.344452][ T288] bridge0: port 1(bridge_slave_0) entered blocking state
[ 31.351657][ T288] bridge0: port 1(bridge_slave_0) entered disabled state
[ 31.359312][ T288] device bridge_slave_0 entered promiscuous mode
[ 31.367574][ T288] bridge0: port 2(bridge_slave_1) entered blocking state
[ 31.374714][ T288] bridge0: port 2(bridge_slave_1) entered disabled state
[ 31.382260][ T288] device bridge_slave_1 entered promiscuous mode
[ 31.471136][ T291] bridge0: port 1(bridge_slave_0) entered blocking state
[ 31.478338][ T291] bridge0: port 1(bridge_slave_0) entered disabled state
[ 31.485956][ T291] device bridge_slave_0 entered promiscuous mode
[ 31.494232][ T291] bridge0: port 2(bridge_slave_1) entered blocking state
[ 31.501297][ T291] bridge0: port 2(bridge_slave_1) entered disabled state
[ 31.509052][ T291] device bridge_slave_1 entered promiscuous mode
[ 31.569811][ T287] bridge0: port 1(bridge_slave_0) entered blocking state
[ 31.576957][ T287] bridge0: port 1(bridge_slave_0) entered disabled state
[ 31.584561][ T287] device bridge_slave_0 entered promiscuous mode
[ 31.593410][ T287] bridge0: port 2(bridge_slave_1) entered blocking state
[ 31.600499][ T287] bridge0: port 2(bridge_slave_1) entered disabled state
[ 31.608086][ T287] device bridge_slave_1 entered promiscuous mode
[ 31.704198][ T289] bridge0: port 1(bridge_slave_0) entered blocking state
[ 31.711294][ T289] bridge0: port 1(bridge_slave_0) entered disabled state
[ 31.718909][ T289] device bridge_slave_0 entered promiscuous mode
[ 31.729143][ T289] bridge0: port 2(bridge_slave_1) entered blocking state
[ 31.736398][ T289] bridge0: port 2(bridge_slave_1) entered disabled state
[ 31.743908][ T289] device bridge_slave_1 entered promiscuous mode
[ 31.763612][ T290] bridge0: port 1(bridge_slave_0) entered blocking state
[ 31.770696][ T290] bridge0: port 1(bridge_slave_0) entered disabled state
[ 31.778310][ T290] device bridge_slave_0 entered promiscuous mode
[ 31.791689][ T290] bridge0: port 2(bridge_slave_1) entered blocking state
[ 31.798831][ T290] bridge0: port 2(bridge_slave_1) entered disabled state
[ 31.806275][ T290] device bridge_slave_1 entered promiscuous mode
[ 31.828223][ T288] bridge0: port 2(bridge_slave_1) entered blocking state
[ 31.835344][ T288] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 31.862437][ T291] bridge0: port 2(bridge_slave_1) entered blocking state
[ 31.869518][ T291] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 31.876875][ T291] bridge0: port 1(bridge_slave_0) entered blocking state
[ 31.883964][ T291] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 31.997955][ T289] bridge0: port 2(bridge_slave_1) entered blocking state
[ 32.005123][ T289] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 32.012470][ T289] bridge0: port 1(bridge_slave_0) entered blocking state
[ 32.019541][ T289] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 32.034384][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 32.042928][ T44] bridge0: port 1(bridge_slave_0) entered disabled state
[ 32.050178][ T44] bridge0: port 2(bridge_slave_1) entered disabled state
[ 32.058746][ T44] bridge0: port 1(bridge_slave_0) entered disabled state
[ 32.066329][ T44] bridge0: port 2(bridge_slave_1) entered disabled state
[ 32.074790][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[ 32.082326][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 32.089800][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[ 32.098546][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 32.106799][ T44] bridge0: port 1(bridge_slave_0) entered blocking state
[ 32.113897][ T44] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 32.135108][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 32.142934][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 32.151221][ T44] bridge0: port 1(bridge_slave_0) entered blocking state
[ 32.158521][ T44] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 32.179801][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 32.188461][ T44] bridge0: port 2(bridge_slave_1) entered blocking state
[ 32.195561][ T44] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 32.203455][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[ 32.222045][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[ 32.245668][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[ 32.262564][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 32.270497][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 32.279315][ T44] bridge0: port 1(bridge_slave_0) entered blocking state
[ 32.286462][ T44] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 32.295344][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[ 32.318132][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[ 32.327309][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 32.335861][ T44] bridge0: port 2(bridge_slave_1) entered blocking state
[ 32.343079][ T44] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 32.355502][ T288] device veth0_vlan entered promiscuous mode
[ 32.366409][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready
[ 32.374507][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[ 32.383009][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
[ 32.390603][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
[ 32.412466][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[ 32.420234][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 32.428108][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready
[ 32.436716][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[ 32.445216][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready
[ 32.453542][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[ 32.461687][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
[ 32.470056][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[ 32.494498][ T288] device veth1_macvtap entered promiscuous mode
[ 32.506595][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[ 32.515256][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 32.523802][ T44] bridge0: port 1(bridge_slave_0) entered blocking state
[ 32.530942][ T44] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 32.538676][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[ 32.547300][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 32.555712][ T44] bridge0: port 2(bridge_slave_1) entered blocking state
[ 32.562906][ T44] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 32.570348][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[ 32.578043][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 32.585899][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[ 32.594430][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 32.602716][ T44] bridge0: port 1(bridge_slave_0) entered blocking state
[ 32.609847][ T44] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 32.617464][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready
[ 32.625813][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[ 32.633964][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[ 32.642588][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 32.650817][ T44] bridge0: port 2(bridge_slave_1) entered blocking state
[ 32.657914][ T44] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 32.665673][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
[ 32.674034][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[ 32.682222][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready
[ 32.690434][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[ 32.698903][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready
[ 32.706791][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready
[ 32.714942][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[ 32.723300][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
[ 32.731075][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
[ 32.739102][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
[ 32.747058][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
[ 32.759751][ T291] device veth0_vlan entered promiscuous mode
[ 32.770471][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready
[ 32.778933][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[ 32.787141][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready
[ 32.795805][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[ 32.815910][ T287] device veth0_vlan entered promiscuous mode
[ 32.823446][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready
[ 32.833004][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[ 32.841668][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready
[ 32.850404][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
[ 32.859105][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
[ 32.867509][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[ 32.875652][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready
[ 32.884010][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[ 32.892444][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
[ 32.900167][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
[ 32.920810][ T287] device veth1_macvtap entered promiscuous mode
[ 32.927853][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready
[ 32.936645][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[ 32.945216][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready
[ 32.954205][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[ 32.962839][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready
[ 32.972525][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready
[ 32.981036][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[ 32.992795][ T291] device veth1_macvtap entered promiscuous mode
[ 33.004876][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[ 33.013485][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready
[ 33.021233][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready
[ 33.029349][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[ 33.051045][ T289] device veth0_vlan entered promiscuous mode
[ 33.057666][ T288] request_module fs-gadgetfs succeeded, but still no fs?
[ 33.057910][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[ 33.073592][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
[ 33.081293][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
[ 33.089443][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
[ 33.097099][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
[ 33.104726][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready
[ 33.113185][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[ 33.125946][ T290] device veth0_vlan entered promiscuous mode
[ 33.142934][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready
[ 33.154695][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[ 33.169273][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready
[ 33.178779][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
[ 33.187465][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready
[ 33.200226][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
[ 33.223808][ T290] device veth1_macvtap entered promiscuous mode
[ 33.236559][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[ 33.263615][ T289] device veth1_macvtap entered promiscuous mode
[ 33.277069][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[ 33.285659][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready
[ 33.316100][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready
[ 33.325372][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[ 33.336199][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready
[ 33.345785][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
[ 33.355561][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready
[ 33.364628][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[ 33.374098][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready
[ 33.383022][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
[ 33.442399][ T37] input: syz0 as /devices/virtual/misc/uhid/0003:0001:0001.0001/input/input4
[ 33.473494][ T326] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details.
[ 33.491475][ T37] hid-generic 0003:0001:0001.0001: input,hidraw0: USB HID v0.01 Keyboard [syz0] on syz0
[ 33.546881][ C0] Spurious interrupt (vector 0xf4) on CPU#0. Acked
[ 33.570247][ C0] Spurious interrupt (vector 0xf4) on CPU#0. Acked
[ 33.581807][ T19] usb 2-1: new high-speed USB device number 2 using dummy_hcd
[ 33.593083][ T327] fido_id[327]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory
[ 33.606748][ T297] usb 5-1: new high-speed USB device number 2 using dummy_hcd
[ 33.647858][ T341] ==================================================================
[ 33.655993][ T341] BUG: KASAN: use-after-free in kobject_get+0x113/0x120
[ 33.663011][ T341] Read of size 1 at addr ffff888112b5603c by task syz.0.12/341
[ 33.670599][ T341]
[ 33.672937][ T341] CPU: 0 PID: 341 Comm: syz.0.12 Tainted: G S syzkaller #0
[ 33.681545][ T341] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[ 33.691647][ T341] Call Trace:
[ 33.694953][ T341]
[ 33.697885][ T341] __dump_stack+0x21/0x24
[ 33.702249][ T341] dump_stack_lvl+0x110/0x170
[ 33.707062][ T341] ? __cfi_dump_stack_lvl+0x8/0x8
[ 33.712111][ T341] ? __cfi__printk+0x8/0x8
[ 33.712910][ T342] Need at least one configuration in g1.
[ 33.716566][ T341] ? kobject_get+0x113/0x120
[ 33.722722][ T342] udc dummy_udc.0: failed to start g1: -22
[ 33.726874][ T341] print_address_description+0x71/0x200
[ 33.733039][ T342] configfs-gadget.g1: probe of gadget.0 failed with error -22
[ 33.738344][ T341] print_report+0x4a/0x60
[ 33.749530][ T342] UDC core: g1: couldn't find an available UDC or it's busy
[ 33.750162][ T341] kasan_report+0x122/0x150
[ 33.762683][ T341] ? kobject_get+0x113/0x120
[ 33.767328][ T341] ? kasan_save_alloc_info+0x1f/0x30
[ 33.772653][ T341] __asan_report_load1_noabort+0x14/0x20
[ 33.778318][ T341] kobject_get+0x113/0x120
[ 33.783010][ T341] device_add+0x2f0/0xec0
[ 33.787364][ T341] device_create+0x26c/0x300
[ 33.791972][ T341] ? __cfi_device_create+0x10/0x10
[ 33.797110][ T341] create_function_device+0x60/0x70
[ 33.802336][ T341] f_midi_alloc_inst+0x1a8/0x380
[ 33.807400][ T341] usb_get_function_instance+0xf3/0x310
[ 33.813024][ T341] function_make+0x118/0x360
[ 33.817665][ T341] ? __cfi_function_make+0x10/0x10
[ 33.822824][ T341] ? __cfi_mutex_lock+0x10/0x10
[ 33.827715][ T341] ? __kasan_kmalloc+0x95/0xb0
[ 33.832525][ T341] ? configfs_mkdir+0x444/0x9e0
[ 33.837392][ T341] ? __kmalloc+0xb4/0x1e0
[ 33.841748][ T341] ? __kasan_check_write+0x14/0x20
[ 33.846896][ T341] configfs_mkdir+0x518/0x9e0
[ 33.851619][ T341] vfs_mkdir+0x39c/0x580
[ 33.855891][ T341] do_mkdirat+0x174/0x4d0
[ 33.860281][ T341] __x64_sys_mkdirat+0x89/0xa0
[ 33.865141][ T341] x64_sys_call+0x73d/0x9a0
[ 33.869706][ T341] do_syscall_64+0x4c/0xa0
[ 33.874166][ T341] ? clear_bhb_loop+0x30/0x80
[ 33.878866][ T341] ? clear_bhb_loop+0x30/0x80
[ 33.883595][ T341] entry_SYSCALL_64_after_hwframe+0x68/0xd2
[ 33.889507][ T341] RIP: 0033:0x7f407839e0d9
[ 33.893944][ T341] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 33.913576][ T341] RSP: 002b:00007f40791e0028 EFLAGS: 00000246 ORIG_RAX: 0000000000000102
[ 33.922021][ T341] RAX: ffffffffffffffda RBX: 00007f4078625fa0 RCX: 00007f407839e0d9
[ 33.930010][ T341] RDX: 00000000000001ff RSI: 0000200000000400 RDI: ffffffffffffff9c
[ 33.937998][ T341] RBP: 00007f4078435024 R08: 0000000000000000 R09: 0000000000000000
[ 33.945981][ T341] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 33.953974][ T341] R13: 00007f4078626038 R14: 00007f4078625fa0 R15: 00007ffec6b6c108
[ 33.962000][ T341]
[ 33.965088][ T341]
[ 33.967504][ T341] Allocated by task 311:
[ 33.971759][ T341] kasan_set_track+0x4b/0x70
[ 33.976421][ T341] kasan_save_alloc_info+0x1f/0x30
[ 33.981575][ T341] __kasan_kmalloc+0x95/0xb0
[ 33.986209][ T341] kmalloc_trace+0x40/0xb0
[ 33.990813][ T341] device_create+0x13a/0x300
[ 33.995424][ T341] gadgets_make+0x84a/0xad0
[ 33.999942][ T341] configfs_mkdir+0x518/0x9e0
[ 34.004681][ T341] vfs_mkdir+0x39c/0x580
[ 34.008960][ T341] do_mkdirat+0x174/0x4d0
[ 34.013373][ T341] __x64_sys_mkdirat+0x89/0xa0
[ 34.018165][ T341] x64_sys_call+0x73d/0x9a0
[ 34.022730][ T341] do_syscall_64+0x4c/0xa0
[ 34.027172][ T341] entry_SYSCALL_64_after_hwframe+0x68/0xd2
[ 34.033102][ T341]
[ 34.035543][ T341] Freed by task 311:
[ 34.039443][ T341] kasan_set_track+0x4b/0x70
[ 34.044056][ T341] kasan_save_free_info+0x2b/0x40
[ 34.049112][ T341] ____kasan_slab_free+0x132/0x180
[ 34.054259][ T341] __kasan_slab_free+0x11/0x20
[ 34.059088][ T341] slab_free_freelist_hook+0xc2/0x190
[ 34.064481][ T341] __kmem_cache_free+0xb7/0x1b0
[ 34.069379][ T341] kfree+0x6f/0xf0
[ 34.073147][ T341] device_create_release+0x15/0x20
[ 34.078365][ T341] device_release+0xa4/0x1d0
[ 34.082985][ T341] kobject_put+0x19d/0x280
[ 34.087443][ T341] device_destroy+0xb4/0xf0
[ 34.092071][ T341] gadgets_drop+0xa0/0xd0
[ 34.096419][ T341] configfs_rmdir+0x89b/0x980
[ 34.101105][ T341] vfs_rmdir+0x381/0x4f0
[ 34.105415][ T341] do_rmdir+0x261/0x6b0
[ 34.109634][ T341] __x64_sys_rmdir+0x49/0x50
[ 34.114244][ T341] x64_sys_call+0x68e/0x9a0
[ 34.118781][ T341] do_syscall_64+0x4c/0xa0
[ 34.123242][ T341] entry_SYSCALL_64_after_hwframe+0x68/0xd2
[ 34.129182][ T341]
[ 34.131511][ T341] The buggy address belongs to the object at ffff888112b56000
[ 34.131511][ T341] which belongs to the cache kmalloc-1k of size 1024
[ 34.145589][ T341] The buggy address is located 60 bytes inside of
[ 34.145589][ T341] 1024-byte region [ffff888112b56000, ffff888112b56400)
[ 34.158872][ T341]
[ 34.161208][ T341] The buggy address belongs to the physical page:
[ 34.167631][ T341] page:ffffea00044ad400 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x112b50
[ 34.177879][ T341] head:ffffea00044ad400 order:3 compound_mapcount:0 compound_pincount:0
[ 34.186216][ T341] flags: 0x4000000000010200(slab|head|zone=1)
[ 34.192317][ T341] raw: 4000000000010200 0000000000000000 dead000000000001 ffff888100043080
[ 34.201153][ T341] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000
[ 34.209829][ T341] page dumped because: kasan: bad access detected
[ 34.216302][ T341] page_owner tracks the page as allocated
[ 34.222064][ T341] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 110, tgid 110 (udevd), ts 6216209432, free_ts 0
[ 34.241712][ T341] post_alloc_hook+0x1f5/0x210
[ 34.246564][ T341] prep_new_page+0x1c/0x110
[ 34.251099][ T341] get_page_from_freelist+0x2ca9/0x2d20
[ 34.256719][ T341] __alloc_pages+0x1fa/0x610
[ 34.261361][ T341] alloc_slab_page+0x6e/0xf0
[ 34.265993][ T341] new_slab+0x98/0x3e0
[ 34.270099][ T341] ___slab_alloc+0x70f/0xb70
[ 34.274772][ T341] __slab_alloc+0x5e/0xa0
[ 34.279123][ T341] __kmem_cache_alloc_node+0x204/0x2d0
[ 34.284694][ T341] __kmalloc_node_track_caller+0xa1/0x1e0
[ 34.290425][ T341] __alloc_skb+0x226/0x4a0
[ 34.294890][ T341] netlink_sendmsg+0x635/0xbd0
[ 34.299687][ T341] ____sys_sendmsg+0x5fb/0x9c0
[ 34.304555][ T341] ___sys_sendmsg+0x2a2/0x360
[ 34.309256][ T341] __x64_sys_sendmsg+0x20d/0x2e0
[ 34.314236][ T341] x64_sys_call+0x171/0x9a0
[ 34.319211][ T341] page_owner free stack trace missing
[ 34.324599][ T341]
[ 34.326974][ T341] Memory state around the buggy address:
[ 34.332761][ T341] ffff888112b55f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 34.340847][ T341] ffff888112b55f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 34.349112][ T341] >ffff888112b56000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 34.357282][ T341] ^
[ 34.363208][ T341] ffff888112b56080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 34.371310][ T341] ffff888112b56100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 34.379489][ T341] ==================================================================
[ 34.392750][ T341] Disabling lock debugging due to kernel taint
[ 34.413017][ T341] ------------[ cut here ]------------
[ 34.418589][ T341] refcount_t: addition on 0; use-after-free.
[ 34.426022][ T341] WARNING: CPU: 0 PID: 341 at lib/refcount.c:25 refcount_warn_saturate+0x104/0x1a0
[ 34.435503][ T341] Modules linked in:
[ 34.439469][ T341] CPU: 0 PID: 341 Comm: syz.0.12 Tainted: G S B syzkaller #0
[ 34.448313][ T341] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[ 34.458612][ T341] RIP: 0010:refcount_warn_saturate+0x104/0x1a0
[ 34.465020][ T341] Code: 05 01 48 c7 c7 40 0d ca 85 e8 d8 28 d9 fe 0f 0b eb df e8 2f 9a 08 ff c6 05 0f ca 26 05 01 48 c7 c7 80 0c ca 85 e8 bc 28 d9 fe <0f> 0b eb c3 e8 13 9a 08 ff c6 05 f4 c9 26 05 01 48 c7 c7 e0 0c ca
[ 34.484954][ T341] RSP: 0018:ffffc9000dc6fa18 EFLAGS: 00010246
[ 34.491046][ T341] RAX: 06a22649e8665b00 RBX: 0000000000000002 RCX: 0000000000080000
[ 34.499315][ T341] RDX: ffffc900016ca000 RSI: 000000000007ffff RDI: 0000000000080000
[ 34.507588][ T341] RBP: ffffc9000dc6fa28 R08: ffffc9000dc6f727 R09: 1ffff92001b8dee4
[ 34.515792][ T341] R10: dffffc0000000000 R11: fffff52001b8dee5 R12: 1ffff1102271b10e
[ 34.523901][ T341] R13: dffffc0000000000 R14: 0000000000000002 R15: 0000000000000000
[ 34.531985][ T341] FS: 00007f40791e06c0(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000
[ 34.541046][ T341] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 34.548113][ T341] CR2: 00007f40791beff8 CR3: 000000013391f000 CR4: 00000000003506b0
[ 34.556179][ T341] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 34.564327][ T341] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 34.572371][ T341] Call Trace:
[ 34.575687][ T341]
[ 34.578643][ T341] kobject_get+0xfb/0x120
[ 34.583050][ T341] device_add+0x2f0/0xec0
[ 34.587417][ T341] device_create+0x26c/0x300
[ 34.592086][ T341] ? __cfi_device_create+0x10/0x10
[ 34.597255][ T341] create_function_device+0x60/0x70
[ 34.602553][ T341] f_midi_alloc_inst+0x1a8/0x380
[ 34.607625][ T341] usb_get_function_instance+0xf3/0x310
[ 34.613314][ T341] function_make+0x118/0x360
[ 34.617934][ T341] ? __cfi_function_make+0x10/0x10
[ 34.623516][ T341] ? __cfi_mutex_lock+0x10/0x10
[ 34.628629][ T341] ? __kasan_kmalloc+0x95/0xb0
[ 34.633529][ T341] ? configfs_mkdir+0x444/0x9e0
[ 34.638446][ T341] ? __kmalloc+0xb4/0x1e0
[ 34.642925][ T341] ? __kasan_check_write+0x14/0x20
[ 34.648106][ T341] configfs_mkdir+0x518/0x9e0
[ 34.652903][ T341] vfs_mkdir+0x39c/0x580
[ 34.657192][ T341] do_mkdirat+0x174/0x4d0
[ 34.661539][ T341] __x64_sys_mkdirat+0x89/0xa0
[ 34.666389][ T341] x64_sys_call+0x73d/0x9a0
[ 34.668000][ T349] Need at least one configuration in g1.
[ 34.670934][ T341] do_syscall_64+0x4c/0xa0
[ 34.670967][ T341] ? clear_bhb_loop+0x30/0x80
[ 34.678288][ T349] udc dummy_udc.0: failed to start g1: -22
[ 34.681087][ T341] ? clear_bhb_loop+0x30/0x80
[ 34.686456][ T349] configfs-gadget.g1: probe of gadget.0 failed with error -22
[ 34.691665][ T341] entry_SYSCALL_64_after_hwframe+0x68/0xd2
[ 34.691705][ T341] RIP: 0033:0x7f407839e0d9
[ 34.701599][ T349] UDC core: g1: couldn't find an available UDC or it's busy
[ 34.703957][ T341] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 34.703978][ T341] RSP: 002b:00007f40791e0028 EFLAGS: 00000246 ORIG_RAX: 0000000000000102
[ 34.749996][ T341] RAX: ffffffffffffffda RBX: 00007f4078625fa0 RCX: 00007f407839e0d9
[ 34.758048][ T341] RDX: 00000000000001ff RSI: 0000200000000400 RDI: ffffffffffffff9c
[ 34.766195][ T341] RBP: 00007f4078435024 R08: 0000000000000000 R09: 0000000000000000
[ 34.774261][ T341] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 34.782762][ T341] R13: 00007f4078626038 R14: 00007f4078625fa0 R15: 00007ffec6b6c108
[ 34.790800][ T341]
[ 34.793894][ T341] ---[ end trace 0000000000000000 ]---
[ 34.799452][ T341] ------------[ cut here ]------------
[ 34.805059][ T341] refcount_t: saturated; leaking memory.
[ 34.812811][ T341] WARNING: CPU: 1 PID: 341 at lib/refcount.c:22 refcount_warn_saturate+0x158/0x1a0
[ 34.822457][ T341] Modules linked in:
[ 34.826534][ T341] CPU: 1 PID: 341 Comm: syz.0.12 Tainted: G S B W syzkaller #0
[ 34.832023][ T19] usb 2-1: Using ep0 maxpacket: 8
[ 34.835600][ T341] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[ 34.843294][ T297] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64
[ 34.851040][ T341] RIP: 0010:refcount_warn_saturate+0x158/0x1a0
[ 34.860943][ T297] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64
[ 34.867168][ T341] Code: 05 01 48 c7 c7 20 0c ca 85 e8 84 28 d9 fe 0f 0b eb 8b e8 db 99 08 ff c6 05 ba c9 26 05 01 48 c7 c7 20 0c ca 85 e8 68 28 d9 fe <0f> 0b e9 6c ff ff ff e8 bc 99 08 ff c6 05 9f c9 26 05 01 48 c7 c7
[ 34.882919][ T19] usb 2-1: config 0 has an invalid interface number: 143 but max is 0
[ 34.896759][ T341] RSP: 0018:ffffc9000dc6f8d8 EFLAGS: 00010246
[ 34.904756][ T19] usb 2-1: config 0 has no interface number 0
[ 34.910843][ T341] RAX: 06a22649e8665b00 RBX: 0000000000000001 RCX: 0000000000080000
[ 34.910864][ T341] RDX: ffffc900016ca000 RSI: 000000000007ffff RDI: 0000000000080000
[ 34.910879][ T341] RBP: ffffc9000dc6f8e8 R08: ffffc9000dc6f4c7 R09: 1ffff92001b8de98
[ 34.917062][ T19] usb 2-1: New USB device found, idVendor=2058, idProduct=1005, bcdDevice=c1.9b
[ 34.917090][ T19] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 34.925185][ T341] R10: dffffc0000000000 R11: fffff52001b8de99 R12: dffffc0000000000
[ 34.934875][ T297] usb 5-1: New USB device found, idVendor=04dd, idProduct=8005, bcdDevice= 0.00
[ 34.941554][ T341] R13: ffff8881138d8818 R14: 0000000000000001 R15: 00000000c0000000
[ 34.976112][ T297] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 34.984097][ T341] FS: 00007f40791e06c0(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000
[ 34.984123][ T341] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 34.984138][ T341] CR2: 00007f40783eb7c0 CR3: 000000013391f000 CR4: 00000000003506a0
[ 34.992446][ T297] usb 5-1: Product: syz
[ 35.001218][ T341] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 35.008163][ T297] usb 5-1: Manufacturer: syz
[ 35.015908][ T341] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 35.020446][ T297] usb 5-1: SerialNumber: syz
[ 35.028154][ T341] Call Trace:
[ 35.028165][ T341]
[ 35.044138][ T19] usb 2-1: config 0 descriptor??
[ 35.045730][ T341] kobject_add_internal+0xa81/0xc20
[ 35.055581][ T319] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22
[ 35.056732][ T341] kobject_add+0x165/0x230
[ 35.063853][ T319] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22
[ 35.069197][ T341] ? __cfi_kobject_add+0x10/0x10
[ 35.086990][ T341] ? get_device_parent+0x12e/0x410
[ 35.092186][ T341] device_add+0x398/0xec0
[ 35.096569][ T341] device_create+0x26c/0x300
[ 35.101225][ T341] ? __cfi_device_create+0x10/0x10
[ 35.106453][ T341] create_function_device+0x60/0x70
[ 35.111919][ T341] f_midi_alloc_inst+0x1a8/0x380
[ 35.116912][ T341] usb_get_function_instance+0xf3/0x310
[ 35.122592][ T341] function_make+0x118/0x360
[ 35.127315][ T341] ? __cfi_function_make+0x10/0x10
[ 35.132565][ T341] ? __cfi_mutex_lock+0x10/0x10
[ 35.137469][ T341] ? __kasan_kmalloc+0x95/0xb0
[ 35.142325][ T341] ? configfs_mkdir+0x444/0x9e0
[ 35.147268][ T341] ? __kmalloc+0xb4/0x1e0
[ 35.151640][ T341] ? __kasan_check_write+0x14/0x20
[ 35.156913][ T341] configfs_mkdir+0x518/0x9e0
[ 35.161643][ T341] vfs_mkdir+0x39c/0x580
[ 35.165969][ T341] do_mkdirat+0x174/0x4d0
[ 35.170352][ T341] __x64_sys_mkdirat+0x89/0xa0
[ 35.175261][ T341] x64_sys_call+0x73d/0x9a0
[ 35.179847][ T341] do_syscall_64+0x4c/0xa0
[ 35.184352][ T341] ? clear_bhb_loop+0x30/0x80
[ 35.189165][ T341] ? clear_bhb_loop+0x30/0x80
[ 35.193927][ T341] entry_SYSCALL_64_after_hwframe+0x68/0xd2
[ 35.199883][ T341] RIP: 0033:0x7f407839e0d9
[ 35.204372][ T341] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 35.224206][ T341] RSP: 002b:00007f40791e0028 EFLAGS: 00000246 ORIG_RAX: 0000000000000102
[ 35.232726][ T341] RAX: ffffffffffffffda RBX: 00007f4078625fa0 RCX: 00007f407839e0d9
[ 35.240738][ T341] RDX: 00000000000001ff RSI: 0000200000000400 RDI: ffffffffffffff9c
[ 35.248790][ T341] RBP: 00007f4078435024 R08: 0000000000000000 R09: 0000000000000000
[ 35.256862][ T341] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 35.264919][ T341] R13: 00007f4078626038 R14: 00007f4078625fa0 R15: 00007ffec6b6c108
[ 35.272988][ T341]
[ 35.276156][ T341] ---[ end trace 0000000000000000 ]---
[ 35.281676][ T341] ------------[ cut here ]------------
[ 35.287437][ T341] refcount_t: underflow; use-after-free.
[ 35.295416][ T341] WARNING: CPU: 1 PID: 341 at lib/refcount.c:28 refcount_warn_saturate+0x120/0x1a0
[ 35.304825][ T341] Modules linked in:
[ 35.308751][ T341] CPU: 1 PID: 341 Comm: syz.0.12 Tainted: G S B W syzkaller #0
[ 35.317457][ T341] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[ 35.327570][ T341] RIP: 0010:refcount_warn_saturate+0x120/0x1a0
[ 35.333805][ T341] Code: 05 01 48 c7 c7 80 0c ca 85 e8 bc 28 d9 fe 0f 0b eb c3 e8 13 9a 08 ff c6 05 f4 c9 26 05 01 48 c7 c7 e0 0c ca 85 e8 a0 28 d9 fe <0f> 0b eb a7 e8 f7 99 08 ff c6 05 d5 c9 26 05 01 48 c7 c7 20 0c ca
[ 35.353483][ T341] RSP: 0018:ffffc9000dc6f8a0 EFLAGS: 00010246
[ 35.359641][ T341] RAX: 06a22649e8665b00 RBX: 0000000000000003 RCX: 0000000000080000
[ 35.359676][ T351] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[ 35.367810][ T341] RDX: ffffc900016ca000 RSI: 000000000007ffff RDI: 0000000000080000
[ 35.367829][ T341] RBP: ffffc9000dc6f8b0 R08: ffffc9000dc6f487 R09: 1ffff92001b8de90
[ 35.367845][ T341] R10: dffffc0000000000 R11: fffff52001b8de91 R12: 00000000c0000000
[ 35.367860][ T341] R13: ffff888112b5603c R14: 0000000000000003 R15: ffff888112b56038
[ 35.367875][ T341] FS: 00007f40791e06c0(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000
[ 35.380951][ T351] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[ 35.384640][ T341] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 35.432087][ T341] CR2: 0000001b2ed1aff8 CR3: 000000013391f000 CR4: 00000000003506a0
[ 35.440114][ T341] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 35.448529][ T341] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 35.456672][ T341] Call Trace:
[ 35.459988][ T341]
[ 35.463002][ T341] kobject_put+0x244/0x280
[ 35.468123][ T341] kobject_add_internal+0x9a2/0xc20
[ 35.475197][ T341] kobject_add+0x165/0x230
[ 35.479771][ T341] ? __cfi_kobject_add+0x10/0x10
[ 35.484789][ T341] ? get_device_parent+0x12e/0x410
[ 35.489991][ T341] device_add+0x398/0xec0
[ 35.494398][ T341] device_create+0x26c/0x300
[ 35.499034][ T341] ? __cfi_device_create+0x10/0x10
[ 35.504238][ T341] create_function_device+0x60/0x70
[ 35.509490][ T341] f_midi_alloc_inst+0x1a8/0x380
[ 35.514619][ T341] usb_get_function_instance+0xf3/0x310
[ 35.520216][ T341] function_make+0x118/0x360
[ 35.525483][ T341] ? __cfi_function_make+0x10/0x10
[ 35.530724][ T341] ? __cfi_mutex_lock+0x10/0x10
[ 35.535680][ T341] ? __kasan_kmalloc+0x95/0xb0
[ 35.540500][ T341] ? configfs_mkdir+0x444/0x9e0
[ 35.545470][ T341] ? __kmalloc+0xb4/0x1e0
[ 35.549843][ T341] ? __kasan_check_write+0x14/0x20
[ 35.555036][ T341] configfs_mkdir+0x518/0x9e0
[ 35.559761][ T341] vfs_mkdir+0x39c/0x580
[ 35.564090][ T341] do_mkdirat+0x174/0x4d0
[ 35.568468][ T341] __x64_sys_mkdirat+0x89/0xa0
[ 35.573344][ T341] x64_sys_call+0x73d/0x9a0
[ 35.577893][ T341] do_syscall_64+0x4c/0xa0
[ 35.582407][ T341] ? clear_bhb_loop+0x30/0x80
[ 35.587126][ T341] ? clear_bhb_loop+0x30/0x80
[ 35.591873][ T341] entry_SYSCALL_64_after_hwframe+0x68/0xd2
[ 35.597819][ T341] RIP: 0033:0x7f407839e0d9
[ 35.602328][ T341] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 35.622394][ T341] RSP: 002b:00007f40791e0028 EFLAGS: 00000246 ORIG_RAX: 0000000000000102
[ 35.630847][ T341] RAX: ffffffffffffffda RBX: 00007f4078625fa0 RCX: 00007f407839e0d9
[ 35.638936][ T341] RDX: 00000000000001ff RSI: 0000200000000400 RDI: ffffffffffffff9c
[ 35.647002][ T341] RBP: 00007f4078435024 R08: 0000000000000000 R09: 0000000000000000
[ 35.655063][ T341] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 35.663110][ T341] R13: 00007f4078626038 R14: 00007f4078625fa0 R15: 00007ffec6b6c108
[ 35.671135][ T341]
[ 35.674268][ T341] ---[ end trace 0000000000000000 ]---
[ 35.679803][ T341] kobject_add_internal failed for f_midi (error: -2 parent: ཱ7)
[ 35.690772][ T28] kauditd_printk_skb: 58 callbacks suppressed
[ 35.690788][ T28] audit: type=1400 audit(1786961721.692:132): avc: denied { read } for pid=340 comm="syz.0.12" name="c.2" dev="configfs" ino=16190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[ 35.719905][ T28] audit: type=1400 audit(1786961721.702:133): avc: denied { open } for pid=340 comm="syz.0.12" path="/4/config/usb_gadget/g1/configs/c.2" dev="configfs" ino=16190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1
[ 36.309690][ T297] zaurus: probe of 5-1:1.0 failed with error -71
[ 36.319887][ T297] usb 5-1: USB disconnect, device number 2
[ 36.423231][ T19] usb 2-1: USB disconnect, device number 2