last executing test programs: 8.920744197s ago: executing program 4 (id=595): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000040)={0x0, 0x0}) openat$dir(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x20141, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r1, &(0x7f00000021c0)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r1, &(0x7f0000000040)={0x50, 0x0, r2, {0x7, 0x1f, 0x100000, 0x5691409, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x100000}}, 0x50) syz_fuse_handle_req(r1, &(0x7f0000004200)="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000fdff00000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d838aae8c05dd22d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea21056000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c7f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001354c4b600", 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={0x20, 0x0, 0x6, {0x0, 0x3022d6e144aa3ceb}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x80000, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 8.035238107s ago: executing program 4 (id=603): recvmmsg(0xffffffffffffffff, &(0x7f0000007280)=[{{0x0, 0x0, 0x0}, 0xe9}, {{0x0, 0x0, 0x0}, 0x20e8bd}], 0x2, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x8000, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0xe8, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2800003, 0x31, r2, 0x47550000) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000000)=@x86={0x6, 0x3, 0x0, 0x0, 0x5, 0xa, 0x98, 0x3, 0x3, 0x6, 0x9, 0x40, 0x0, 0x7, 0x1, 0x7, 0x2, 0xad, 0xda, '\x00', 0x6, 0x100000}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 7.872077061s ago: executing program 4 (id=604): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x1, 0x0, 0x100000, &(0x7f0000000000/0x100000)=nil}) ioctl$KVM_PRE_FAULT_MEMORY(0xffffffffffffffff, 0xc040aed5, &(0x7f0000000240)={0x0, 0x100000}) ioctl$KVM_GET_DIRTY_LOG(r1, 0x4010ae42, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000/0x3000)=nil}) 7.676477927s ago: executing program 4 (id=606): syz_open_dev$vim2m(&(0x7f0000000000), 0x800, 0x2) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x1) r2 = ioctl$KVM_CREATE_GUEST_MEMFD(r1, 0xc040aed4, &(0x7f0000000080)={0x1000000}) ioctl$KVM_SET_USER_MEMORY_REGION2(r1, 0x40a0ae49, &(0x7f0000000180)={0x1, 0x4, 0x10000, 0x1000000, &(0x7f0000000000/0x1000000)=nil, 0x0, r2}) ioctl$KVM_SET_MEMORY_ATTRIBUTES(r1, 0x4020aed2, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_PRE_FAULT_MEMORY(r3, 0xc040aed5, &(0x7f0000000340)={0x10000, 0x1000000}) (async) socket$vsock_stream(0x28, 0x1, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) 6.95474118s ago: executing program 3 (id=617): r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) write$dsp(r0, &(0x7f0000000200)='m', 0x1) r1 = syz_open_dev$sndctrl(&(0x7f0000000480), 0x0, 0x801) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r1, 0x40045532, 0x0) r2 = syz_open_dev$sndpcmp(&(0x7f0000001200), 0x0, 0xa2c65) ioctl$SNDRV_PCM_IOCTL_DRAIN(r2, 0x4144, 0x0) ioctl$SNDCTL_DSP_GETOPTR(r0, 0x800c5012, &(0x7f0000000040)) 6.452217991s ago: executing program 3 (id=618): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = socket$nl_route(0x10, 0x3, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x9, &(0x7f0000006680)) bpf$MAP_CREATE(0x0, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000004c0)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r2, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x48, 0x2, {{0x3, 0xae0, 0x6361, 0x5, 0xffffffff, 0x7}, [@TCA_NETEM_SLOT={0x2c, 0xc, {0x4, 0x7fffffffffffffff, 0x0, 0x1000, 0xc, 0x215}}]}}}]}, 0x78}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r3) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$tipc(&(0x7f0000000380), r5) sendmsg$TIPC_CMD_ENABLE_BEARER(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}, 0x1, 0x0, 0x0, 0x44081}, 0x0) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) close(r7) r8 = socket$unix(0x1, 0x5, 0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000180)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56441, 0x70bd2d, 0x0, {0x0, 0x0, 0x0, r10, {0x0, 0xb}, {0xffff, 0xffff}, {0xb, 0x3}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x48, 0x2, {{0xfff, 0x7, 0x7, 0x5, 0xfffffdff, 0x6}, [@TCA_NETEM_SLOT={0x2c, 0xc, {0x9, 0xfffd, 0x5, 0x96, 0xfff, 0xc}}]}}}]}, 0x78}, 0x1, 0x0, 0x0, 0x2400c045}, 0x0) ioctl$SIOCSIFHWADDR(r7, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) 4.078126746s ago: executing program 0 (id=623): r0 = inotify_init() mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./security\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./security\x00', &(0x7f0000000080)='securityfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./security/ima/policy\x00', 0x1, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) openat$vimc0(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$VIDIOC_SUBDEV_S_EDID(r1, 0xc0285629, &(0x7f0000000340)={0x0, 0x8, 0x7, '\x00', &(0x7f0000000300)=0x7a}) 4.077802803s ago: executing program 1 (id=624): r0 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wlan0\x00'}) ioctl$sock_proto_private(r0, 0x8b19, &(0x7f0000000080)) 4.058704065s ago: executing program 3 (id=626): r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000000)={&(0x7f0000000000), 0x1000, 0x800}, 0x20) setsockopt$XDP_RX_RING(r0, 0x11b, 0x2, &(0x7f0000001000)=0x10, 0x4) setsockopt$XDP_UMEM_FILL_RING(r0, 0x11b, 0x5, &(0x7f0000001200)=0x10, 0x4) setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x6, &(0x7f0000001300)=0x10, 0x4) bind$xdp(r0, &(0x7f0000001400)={0x2c, 0x0, 0x1, 0x0, 0x0}, 0x10) recvmmsg(r0, 0x0, 0x0, 0x40000000, 0x0) 4.000909669s ago: executing program 4 (id=627): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x6a855000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/test\x00', 0x777) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x2, 0x0) write(r0, &(0x7f0000000180)='100000', 0x6) write(0xffffffffffffffff, &(0x7f0000000200)='1', 0x1) ioctl$XFS_IOC_BULKSTAT(0xffffffffffffffff, 0x8040587f, &(0x7f00000006c0)={{0x7dc, 0x4, 0x5, 0xff, 0x3}, &(0x7f0000000480)=[{}, {}]}) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000001000000080000000800000000000000", @ANYRES32, @ANYBLOB, @ANYRES32], 0x48) bpf$BPF_PROG_DETACH(0x1c, &(0x7f0000000000)={@map=r2, 0xffffffffffffffff, 0x2c}, 0x20) write(r1, &(0x7f0000000280)='0', 0x1) socket$nl_rdma(0x10, 0x3, 0x14) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000400)=@base={0x5, 0x8, 0x4936, 0xc2, 0x1, 0x1, 0x6}, 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0), &(0x7f00000006c0), 0xca, r3}, 0x38) socket$nl_xfrm(0x10, 0x3, 0x6) getgid() read$FUSE(0xffffffffffffffff, 0x0, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) syz_ublk_setup_io_uring(0x23, &(0x7f0000000340)={0x0, 0x0, 0x100, 0xffffffff, 0x1e5}, &(0x7f00000001c0), &(0x7f0000000080), &(0x7f0000000140)) 3.898413479s ago: executing program 1 (id=628): r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) write$dsp(r0, &(0x7f0000000200)='m', 0x1) r1 = syz_open_dev$sndctrl(&(0x7f0000000480), 0x0, 0x801) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r1, 0x40045532, 0x0) r2 = syz_open_dev$sndpcmp(&(0x7f0000001200), 0x0, 0xa2c65) ioctl$SNDRV_PCM_IOCTL_DRAIN(r2, 0x4144, 0x0) ioctl$SNDCTL_DSP_GETOPTR(r0, 0x800c5012, &(0x7f0000000040)) 3.898169361s ago: executing program 0 (id=629): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nfc(0x0, r1) sendmsg$NFC_CMD_LLC_GET_PARAMS(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000300)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r2, @ANYBLOB="010028bd7800fcdbdf250f00000008000100df3e"], 0x1c}, 0x1, 0x0, 0x0, 0x44804}, 0x840) 3.842403955s ago: executing program 3 (id=630): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000980)=ANY=[@ANYBLOB="120100009080e140fc044a500243010203010902120001000000000904"], 0x0) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0xa4242, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000007, 0x38011, r1, 0xffffd000) r2 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) ioctl$SCSI_IOCTL_GET_PCI(r2, 0x5393, &(0x7f0000000000)) syz_usb_control_io(r0, 0x0, &(0x7f0000000b80)={0x84, &(0x7f0000000380)=ANY=[@ANYBLOB="3e000100000002"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x60140, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_SET_TSC_KHZ_vm(r4, 0xaea2, 0xffffff8000100002) fanotify_init(0x2, 0x80000) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000040)=[@text16={0x10, &(0x7f0000000100)="f3af66b8010000000f01c12e670f01c3660fc77002f20f1c006766c74424006a0000006766c7442402f9ffffff6766c744240600000000670f011424660f38806600640fc7acae00ba4000ec0fa7c0"}], 0x1, 0x82, 0x0, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x8000, 0x0) ioctl$VHOST_SET_OWNER(0xffffffffffffffff, 0xaf01, 0x0) ioctl$VHOST_SET_VRING_ADDR(0xffffffffffffffff, 0x4028af11, &(0x7f0000001500)={0x1, 0x0, 0x0, 0x0, 0x0, 0xeeef0000}) ioctl$VHOST_SET_MEM_TABLE(0xffffffffffffffff, 0x4008af03, &(0x7f0000001840)) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x4c, 0x2, 0x6, 0x801, 0xe4340000, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_TYPENAME={0x12, 0x3, 'hash:net,port\x00'}]}, 0x4c}}, 0x2) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000c80)={0x5c, 0x9, 0x6, 0x801, 0x0, 0x0, {0x7}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x34, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0x18, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x14, 0x2, 0x1, 0x0, @remote}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0xe1f}, @IPSET_ATTR_PROTO={0x5, 0x7, 0x88}, @IPSET_ATTR_PORT_TO={0x6, 0x5, 0x1, 0x0, 0x4e22}]}]}, 0x5c}, 0x1, 0x0, 0x0, 0x10000042}, 0x90) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_open_procfs(0x0, &(0x7f0000000200)='net/udplite\x00') bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, 0x0, 0x0}, 0x94) sendmsg$IPSET_CMD_LIST(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, 0x7, 0x6, 0x5, 0x0, 0x0, {0x1, 0x0, 0x2}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20004080}, 0x48810) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) 3.841582301s ago: executing program 0 (id=631): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) connect$bt_l2cap(r0, &(0x7f0000000040)={0x1f, 0x0, @any, 0x240}, 0xe) setsockopt$bt_BT_SECURITY(r0, 0x112, 0x4, &(0x7f0000000000)={0x2, 0x8}, 0x2) 3.293531791s ago: executing program 1 (id=634): futex_waitv(&(0x7f0000000400)=[{0x2eb, 0x0, 0x86}], 0x1, 0x0, 0x0, 0x1) 3.218774945s ago: executing program 1 (id=635): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) sendmsg$IPSET_CMD_TYPE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0xffffffffffffffec, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="380000000d06010200000000000000000500000211000300686173683a69702c706f727400000000050001"], 0x38}, 0x1, 0x0, 0x0, 0x20008040}, 0x40048100) r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180), 0x60042, 0x0) syz_usb_connect$hid(0x6, 0x0, 0x0, 0x0) write$binfmt_elf64(r0, &(0x7f0000000100)=ANY=[], 0x78) ioctl$SNDCTL_SEQ_SYNC(r0, 0x5101) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000200), 0x400, 0x0) 2.94261634s ago: executing program 0 (id=636): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = socket$nl_route(0x10, 0x3, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x9, &(0x7f0000006680)) bpf$MAP_CREATE(0x0, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000004c0)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r2, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x48, 0x2, {{0x3, 0xae0, 0x6361, 0x5, 0xffffffff, 0x7}, [@TCA_NETEM_SLOT={0x2c, 0xc, {0x4, 0x7fffffffffffffff, 0x0, 0x1000, 0xc, 0x215}}]}}}]}, 0x78}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r3) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$tipc(&(0x7f0000000380), r5) sendmsg$TIPC_CMD_ENABLE_BEARER(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}, 0x1, 0x0, 0x0, 0x44081}, 0x0) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) close(r7) r8 = socket$unix(0x1, 0x5, 0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000180)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56441, 0x70bd2d, 0x0, {0x0, 0x0, 0x0, r10, {0x0, 0xb}, {0xffff, 0xffff}, {0xb, 0x3}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x48, 0x2, {{0xfff, 0x7, 0x7, 0x5, 0xfffffdff, 0x6}, [@TCA_NETEM_SLOT={0x2c, 0xc, {0x9, 0xfffd, 0x5, 0x96, 0xfff, 0xc}}]}}}]}, 0x78}, 0x1, 0x0, 0x0, 0x2400c045}, 0x0) ioctl$SIOCSIFHWADDR(r7, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) 2.303531461s ago: executing program 2 (id=639): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_CONNECT(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000e40)={0x30, r1, 0x5, 0x70bd2c, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}]]}, 0x30}}, 0x0) syz_80211_inject_frame(&(0x7f00000002c0)=@device_b, &(0x7f0000000000)=@mgmt_frame=@probe_response={{{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x1, [{0x2, 0x1}]}, @void, @void, @void, @void, @void, @void}, 0x2f) nanosleep(&(0x7f0000000340)={0x77359400}, 0x0) syz_80211_inject_frame(&(0x7f00000003c0)=@device_b, &(0x7f0000000200)=@mgmt_frame=@auth={{{}, {}, @device_b, @device_a, @from_mac, {0x0, 0x1}}, 0x0, 0x2, 0x0, @val={0x10, 0x1, 0x21}}, 0x21) syz_80211_inject_frame(&(0x7f00000004c0)=@device_b, &(0x7f0000000500)=ANY=[@ANYBLOB="1000000008021100000108021100000008021100"], 0x20) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) 931.769227ms ago: executing program 2 (id=640): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/test\x00', 0x777) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x2, 0x0) write(r0, &(0x7f0000000180)='100000', 0x6) r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.cpu/test/memory.oom_control\x00', 0x2, 0x0) write(r1, &(0x7f0000000200)='1', 0x1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) write(r2, &(0x7f0000000280)='0', 0x1) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r3, 0x8983, &(0x7f0000000d00)={0x0, 'syz_tun\x00', {0x4}, 0xa}) openat$vicodec1(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nfc_raw(0x27, 0x5, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000480), 0x200000c, &(0x7f00000003c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) 818.552261ms ago: executing program 4 (id=641): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/test\x00', 0x777) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x2, 0x0) write(r0, &(0x7f0000000380)='100000', 0x6) r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.cpu/test/memory.oom_control\x00', 0x2, 0x0) write(r1, &(0x7f0000000200)='1', 0x1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) write(r2, &(0x7f0000000280)='0', 0x1) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0xffffff23, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x15610}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @ipip6={{0xb}, {0x4}}}]}, 0x34}, 0x1, 0x0, 0x0, 0x20040001}, 0x40) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000000)={0x1, 0x2, &(0x7f0000000140)=@raw=[@ldst={0x1, 0x2, 0x4, 0x0, 0x1, 0x7d}, @exit], &(0x7f00000000c0)='GPL\x00'}, 0x94) 800.075659ms ago: executing program 2 (id=642): sendmsg$RDMA_NLDEV_CMD_STAT_SET(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000140)={0x20, 0x1410, 0x8b7fbbc5948fecd9, 0x70bd29, 0x25dfd9fc, "", [@RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0xfffffffe}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8}]}, 0x20}, 0x1, 0x0, 0x0, 0x20004085}, 0x4004080) 769.208899ms ago: executing program 2 (id=643): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000540)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_KEY(r1, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000580)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="010800040000000000000b00000008000300", @ANYRES32=r2, @ANYBLOB="0a000600080211000001000030005080110001004abee33908f8eef16f162471f4000000050002"], 0x58}}, 0x0) 732.575737ms ago: executing program 2 (id=644): openat$kvm(0xffffffffffffff9c, 0x0, 0x28100, 0x0) madvise(&(0x7f0000c00000/0x400000)=nil, 0x400000, 0xe) r0 = openat$kvm(0x0, &(0x7f00000002c0), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000bff000/0x400000)=nil) r2 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup.cpu/memory.force_empty\x00', 0x2, 0x0) write(r2, &(0x7f00000002c0)='0', 0x1) 168.697479ms ago: executing program 1 (id=645): r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000007c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) r1 = eventfd(0x0) ioctl$VHOST_SET_LOG_FD(r0, 0x4004af07, &(0x7f0000000240)=r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000200)={0x0, 0x1, 0x0, &(0x7f0000000500)=""/68, 0x0, 0x60000}) ioctl$VHOST_SET_VRING_KICK(r0, 0x4008af20, 0x0) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, 0x0, &(0x7f00000000c0)=""/87, 0x0}) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, 0x0) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000340)=0x1) ioctl$VHOST_SET_LOG_BASE(r0, 0x4008af04, &(0x7f0000000040)=0x0) 166.374287ms ago: executing program 2 (id=646): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/test\x00', 0x777) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x2, 0x0) write(r0, &(0x7f0000000380)='100000', 0x6) r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.cpu/test/memory.oom_control\x00', 0x2, 0x0) write(r1, &(0x7f0000000200)='1', 0x1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) write(r2, &(0x7f0000000280)='0', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracing\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r3, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) socket$inet6(0xa, 0x1, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) 124.293374ms ago: executing program 0 (id=647): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000c00)=@updpolicy={0xfc, 0x19, 0x1, 0x0, 0x0, {{@in6=@rand_addr=' \x01\x00', @in=@local, 0x4e22, 0x5, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xa9, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x9, 0xa00, 0x40800000000000, 0x800000000000000}, 0x0, 0x0, 0x0, 0x1}, [@tmpl={0x44, 0x5, [{{@in6=@private2, 0x4d3, 0x6c}, 0x2, @in6=@mcast1, 0x3507, 0x1, 0x3, 0x9, 0x2, 0x1, 0x4}]}]}, 0xfc}}, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000500)=ANY=[@ANYBLOB="cc0000002100010000000000fefffffffe8000000000000000000000000000aa00000000000000000000000000000000fffe0000000200000a00e08000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="020000000000000050001100fc020000000000000000000000000000ff010000000000000000000000000001ff0200"/59], 0xcc}, 0x1, 0x0, 0x0, 0x800}, 0x0) 120.8585ms ago: executing program 3 (id=648): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nfc(0x0, r1) sendmsg$NFC_CMD_LLC_GET_PARAMS(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000300)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r2, @ANYBLOB="010028bd7800fcdbdf250f00000008000100df3e"], 0x1c}, 0x1, 0x0, 0x0, 0x44804}, 0x840) 105.085806ms ago: executing program 0 (id=649): r0 = syz_usb_connect(0x2, 0x2d, &(0x7f0000000180)=ANY=[@ANYBLOB="120100000cb768405e0483020b990102030109021b00010000000009040000010129000009054f"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) close_range(r1, 0xffffffffffffffff, 0x0) 39.878954ms ago: executing program 1 (id=650): ioctl$LOOP_CONFIGURE(0xffffffffffffffff, 0x4c0a, &(0x7f0000000080)={0xffffffffffffffff, 0x0, {0x0, 0x0, 0x0, 0x7, 0x4000000000000ffd, 0x0, 0x0, 0x1c, 0xc, "faf98317e5a1149989fc8dbe43ea6acc96e3a2503dc3bd3fe37d58128bbad0099cebdc25f5ab60c9e6d680f985881a7beda9d69098c8b534464c516bdd8a0f35", "32d8cc26f7061a74df2cfc06c89f3d9e234b30c50997d3bef409ff2176ff7bfe45cd4a5d83cd4a524bd3ffe70c7f3f800b2f7b6aa54cc50a1fcaed1e831fa79a", "67523760fd40f78d2cfc03d81a8ca55ba139c01802c4dae4162e43ac61b7ad33", [0x10, 0x9]}}) syz_emit_ethernet(0x52, &(0x7f0000000100)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaa"], 0x0) r0 = add_key$user(&(0x7f00000001c0), &(0x7f0000000300)={'syz', 0x0}, &(0x7f0000000240)="166ec4b16abf8d77", 0x8, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000140)={r0, r1, r0}, &(0x7f00000000c0)=""/83, 0xfffffffffffffe4f, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x20042, 0x0) add_key$user(&(0x7f0000000080), 0x0, 0x0, 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = dup(r3) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x2) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r3, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text64={0x40, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) 0s ago: executing program 3 (id=651): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./debug/usb/usbmon/1s\x00', 0x40000, 0x0) read(r0, &(0x7f0000000600), 0x100) kernel console output (not intermixed with test programs): usb 5-1: USB disconnect, device number 21 [ 103.965951][ C1] iowarrior 5-1:0.1: iowarrior_callback - usb_submit_urb failed with result -19 [ 103.984742][ T5786] usb 2-1: config 0 has an invalid interface number: 8 but max is 0 [ 103.992933][ T5786] usb 2-1: config 0 has no interface number 0 [ 103.992971][ T5786] usb 2-1: config 0 interface 8 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 104.011442][ T48] appleir 0003:05AC:8243.0004: unknown main item tag 0x0 [ 104.018696][ T5786] usb 2-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 104.018720][ T5786] usb 2-1: Product: syz [ 104.018732][ T5786] usb 2-1: SerialNumber: syz [ 104.021832][ T48] appleir 0003:05AC:8243.0004: hiddev0,hidraw0: USB HID v0.00 Device [syz] on usb-dummy_hcd.2-1/input0 [ 104.050015][ T5786] usb 2-1: config 0 descriptor?? [ 104.059132][ T5786] usbhid 2-1:0.8: couldn't find an input interrupt endpoint [ 104.087925][ T5701] usb 4-1: device descriptor read/64, error -71 [ 104.198086][ T5701] usb usb4-port1: attempt power cycle [ 104.212308][ T2299] usb 3-1: USB disconnect, device number 13 [ 104.258793][ T10] usb 2-1: USB disconnect, device number 8 [ 104.547719][ T5701] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 104.569224][ T5701] usb 4-1: device descriptor read/8, error -71 [ 104.811946][ T5701] usb 4-1: new high-speed USB device number 12 using dummy_hcd [ 104.832303][ T5701] usb 4-1: device descriptor read/8, error -71 [ 104.938925][ T5701] usb usb4-port1: unable to enumerate USB device [ 105.254499][ T6538] dvmrp0: entered allmulticast mode [ 105.369621][ T30] audit: type=1400 audit(1788493712.410:300): avc: denied { read } for pid=6541 comm="syz.0.279" lport=56 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 105.460877][ T30] audit: type=1400 audit(1788493712.500:301): avc: denied { ioctl } for pid=6543 comm="syz.4.280" path="socket:[13725]" dev="sockfs" ino=13725 ioctlcmd=0x8904 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 105.718894][ T5588] usb 1-1: new high-speed USB device number 18 using dummy_hcd [ 105.788599][ T5701] usb 5-1: new high-speed USB device number 22 using dummy_hcd [ 105.869516][ T5588] usb 1-1: New USB device found, idVendor=04fc, idProduct=504a, bcdDevice=43.02 [ 105.873622][ T5588] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 105.873647][ T5588] usb 1-1: Product: syz [ 105.873660][ T5588] usb 1-1: Manufacturer: syz [ 105.873671][ T5588] usb 1-1: SerialNumber: syz [ 105.897568][ T5588] usb 1-1: config 0 descriptor?? [ 105.904097][ T5588] gspca_main: sunplus-2.14.0 probing 04fc:504a [ 105.938963][ T5701] usb 5-1: Using ep0 maxpacket: 32 [ 105.939631][ T5701] usb 5-1: New USB device found, idVendor=1e7d, idProduct=2d5a, bcdDevice= 0.00 [ 105.940525][ T5701] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 105.940548][ T5701] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 105.940576][ T5701] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 105.946582][ T5701] usb 5-1: config 0 descriptor?? [ 106.400160][ T30] audit: type=1400 audit(1788493713.440:302): avc: denied { create } for pid=6555 comm="syz.2.286" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 106.442342][ T5701] savu 0003:1E7D:2D5A.0005: hiddev0,hidraw0: USB HID v0.00 Device [HID 1e7d:2d5a] on usb-dummy_hcd.4-1/input0 [ 106.666717][ T5701] usb 5-1: USB disconnect, device number 22 [ 106.681652][ T6563] fido_id[6563]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.4/usb5/5-1/report_descriptor': No such file or directory [ 106.838068][ T5588] gspca_sunplus: reg_w_riv err -110 [ 106.838154][ T5588] sunplus 1-1:0.0: probe with driver sunplus failed with error -110 [ 107.040967][ T10] usb 1-1: USB disconnect, device number 18 [ 107.279195][ T6579] netlink: 'syz.4.291': attribute type 1 has an invalid length. [ 107.528211][ T6585] netlink: 24 bytes leftover after parsing attributes in process `syz.4.293'. [ 107.539799][ T6585] netlink: 24 bytes leftover after parsing attributes in process `syz.4.293'. [ 107.835270][ T6593] netlink: 12 bytes leftover after parsing attributes in process `syz.3.296'. [ 107.868164][ T6591] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 107.963839][ T6595] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 108.215579][ T30] audit: type=1400 audit(1788493715.250:303): avc: denied { getopt } for pid=6600 comm="syz.3.300" lport=6 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 108.617858][ T10] usb 1-1: new high-speed USB device number 19 using dummy_hcd [ 108.625868][ T2299] usb 4-1: new high-speed USB device number 13 using dummy_hcd [ 108.637892][ T5786] usb 3-1: new high-speed USB device number 14 using dummy_hcd [ 108.753556][ T30] audit: type=1400 audit(1788493715.790:304): avc: denied { unmount } for pid=5600 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 108.787747][ T10] usb 1-1: Using ep0 maxpacket: 32 [ 108.798869][ T10] usb 1-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 108.811447][ T10] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 108.825508][ T10] usb 1-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 108.825559][ T10] usb 1-1: Product: syz [ 108.825576][ T10] usb 1-1: Manufacturer: syz [ 108.825593][ T10] usb 1-1: SerialNumber: syz [ 108.834508][ T2299] usb 4-1: Using ep0 maxpacket: 32 [ 108.834634][ T5786] usb 3-1: Using ep0 maxpacket: 32 [ 108.843889][ T5786] usb 3-1: New USB device found, idVendor=1e7d, idProduct=2d5a, bcdDevice= 0.00 [ 108.859533][ T2299] usb 4-1: New USB device found, idVendor=1e7d, idProduct=2d5a, bcdDevice= 0.00 [ 108.879693][ T5786] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 108.879732][ T5786] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 108.879774][ T5786] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 108.901614][ T2299] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 108.901646][ T2299] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 108.901679][ T2299] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 108.935129][ T10] usb 1-1: config 0 descriptor?? [ 108.944109][ T6605] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 108.962878][ T2299] usb 4-1: config 0 descriptor?? [ 108.970211][ T5786] usb 3-1: config 0 descriptor?? [ 109.172220][ T5588] usb 1-1: USB disconnect, device number 19 [ 109.439723][ T2299] savu 0003:1E7D:2D5A.0006: hiddev0,hidraw0: USB HID v0.00 Device [HID 1e7d:2d5a] on usb-dummy_hcd.3-1/input0 [ 109.457214][ T5786] savu 0003:1E7D:2D5A.0007: hiddev1,hidraw1: USB HID v0.00 Device [HID 1e7d:2d5a] on usb-dummy_hcd.2-1/input0 [ 109.712416][ T2299] usb 4-1: USB disconnect, device number 13 [ 109.774937][ T5588] usb 3-1: USB disconnect, device number 14 [ 110.147800][ T10] usb 5-1: new high-speed USB device number 23 using dummy_hcd [ 110.244252][ T30] audit: type=1400 audit(1788493717.280:305): avc: denied { listen } for pid=6626 comm="syz.0.309" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 110.265665][ T30] audit: type=1400 audit(1788493717.300:306): avc: denied { connect } for pid=6626 comm="syz.0.309" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 110.287136][ T30] audit: type=1400 audit(1788493717.320:307): avc: denied { write } for pid=6626 comm="syz.0.309" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 110.309427][ T10] usb 5-1: New USB device found, idVendor=0dba, idProduct=1000, bcdDevice= 0.40 [ 110.320756][ T10] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 110.331007][ T10] usb 5-1: config 1 has 0 interfaces, different from the descriptor's value: 3 [ 110.345072][ T10] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 110.353239][ T10] usb 5-1: Product: syz [ 110.353258][ T10] usb 5-1: Manufacturer: syz [ 110.353271][ T10] usb 5-1: SerialNumber: syz [ 110.361106][ T30] audit: type=1400 audit(1788493717.400:308): avc: denied { write } for pid=6626 comm="syz.0.309" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 110.613908][ T6625] netlink: 16 bytes leftover after parsing attributes in process `syz.4.308'. [ 110.657985][ T5786] usb 3-1: new high-speed USB device number 15 using dummy_hcd [ 110.689673][ T30] audit: type=1400 audit(1788493717.730:309): avc: denied { ioctl } for pid=6624 comm="syz.4.308" path="socket:[13983]" dev="sockfs" ino=13983 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 110.791782][ T10] usb 5-1: USB disconnect, device number 23 [ 110.808285][ T5786] usb 3-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 110.819976][ T5786] usb 3-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 110.820014][ T5786] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 110.820057][ T5786] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 110.820102][ T5786] usb 3-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 110.865631][ T5786] usb 3-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 110.865663][ T5786] usb 3-1: Product: syz [ 110.865687][ T5786] usb 3-1: Manufacturer: syz [ 110.895576][ T5786] cdc_wdm 3-1:1.0: probe with driver cdc_wdm failed with error -22 [ 110.917702][ T2299] usb 1-1: new high-speed USB device number 20 using dummy_hcd [ 111.077758][ T2299] usb 1-1: Using ep0 maxpacket: 16 [ 111.083341][ T2299] usb 1-1: New USB device found, idVendor=2ef5, idProduct=000a, bcdDevice=c5.7a [ 111.095421][ T2299] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 111.095458][ T2299] usb 1-1: Product: syz [ 111.095489][ T2299] usb 1-1: Manufacturer: syz [ 111.095506][ T2299] usb 1-1: SerialNumber: syz [ 111.125655][ T10] usb 3-1: USB disconnect, device number 15 [ 111.354529][ T2299] plfxlc 1-1:251.0: Firmware Version: 0 [ 111.354580][ T2299] plfxlc 1-1:251.0: Unit type is station [ 111.600508][ T10] usb 3-1: new high-speed USB device number 16 using dummy_hcd [ 111.758390][ T10] usb 3-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 111.759271][ T10] usb 3-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 111.759291][ T10] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 111.759305][ T10] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 111.759336][ T10] usb 3-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 111.760579][ T10] usb 3-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 111.760594][ T10] usb 3-1: Product: syz [ 111.760607][ T10] usb 3-1: Manufacturer: syz [ 111.792390][ T10] cdc_wdm 3-1:1.0: probe with driver cdc_wdm failed with error -22 [ 111.857768][ T2299] plfxlc 1-1:251.0: vendor command failed (-71) [ 111.857795][ T2299] plfxlc 1-1:251.0: FPGA download failed (-22) [ 111.897724][ T48] usb 4-1: new full-speed USB device number 14 using dummy_hcd [ 111.932463][ T2299] plfxlc 1-1:251.0: pureLifi:Device error [ 111.932506][ T2299] plfxlc 1-1:251.0: probe with driver plfxlc failed with error -22 [ 111.935856][ T2299] usb 1-1: USB disconnect, device number 20 [ 111.977767][ T5588] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 111.995670][ T5701] usb 3-1: USB disconnect, device number 16 [ 112.058365][ T48] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 112.069629][ T48] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 65535, setting to 64 [ 112.069677][ T48] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x82 has invalid maxpacket 1024, setting to 64 [ 112.069700][ T48] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid maxpacket 512, setting to 64 [ 112.075161][ T48] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 112.075185][ T48] usb 4-1: Product: syz [ 112.075197][ T48] usb 4-1: Manufacturer: syz [ 112.075209][ T48] usb 4-1: SerialNumber: syz [ 112.079569][ T48] cdc_mbim 4-1:1.0: skipping garbage [ 112.128479][ T5588] usb 2-1: device descriptor read/64, error -71 [ 112.267699][ T2299] usb 1-1: new high-speed USB device number 21 using dummy_hcd [ 112.282580][ T6659] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 112.282673][ T6659] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 112.367829][ T5588] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 112.387378][ T6665] netlink: 16402 bytes leftover after parsing attributes in process `syz.4.322'. [ 112.387561][ T6664] netlink: 16402 bytes leftover after parsing attributes in process `syz.4.322'. [ 112.417713][ T2299] usb 1-1: Using ep0 maxpacket: 16 [ 112.423415][ T2299] usb 1-1: New USB device found, idVendor=2ef5, idProduct=000a, bcdDevice=c5.7a [ 112.436384][ T2299] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 112.445290][ T2299] usb 1-1: Product: syz [ 112.445311][ T2299] usb 1-1: Manufacturer: syz [ 112.445324][ T2299] usb 1-1: SerialNumber: syz [ 112.497840][ T5588] usb 2-1: device descriptor read/64, error -71 [ 112.608180][ T5588] usb usb2-port1: attempt power cycle [ 112.679079][ T6639] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 112.691551][ T6639] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 112.694083][ T30] audit: type=1400 audit(1788493719.730:310): avc: denied { create } for pid=6658 comm="syz.3.321" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 112.723508][ T6639] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 112.736030][ T6639] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 112.751914][ T6639] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 112.752302][ T6639] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 112.774992][ T2299] plfxlc 1-1:251.0: Firmware Version: 0 [ 112.781098][ T2299] plfxlc 1-1:251.0: Unit type is station [ 112.948801][ T5588] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 112.969853][ T5588] usb 2-1: device descriptor read/8, error -71 [ 113.027668][ T2299] plfxlc 1-1:251.0: vendor command failed (-71) [ 113.035552][ T2299] plfxlc 1-1:251.0: FPGA download failed (-22) [ 113.129052][ T2299] plfxlc 1-1:251.0: pureLifi:Device error [ 113.134900][ T2299] plfxlc 1-1:251.0: probe with driver plfxlc failed with error -22 [ 113.157903][ T2299] usb 1-1: USB disconnect, device number 21 [ 113.207754][ T5588] usb 2-1: new high-speed USB device number 12 using dummy_hcd [ 113.232052][ T5588] usb 2-1: device descriptor read/8, error -71 [ 113.338238][ T5588] usb usb2-port1: unable to enumerate USB device [ 113.497911][ T5701] usb 3-1: new high-speed USB device number 17 using dummy_hcd [ 113.648313][ T5701] usb 3-1: New USB device found, idVendor=04fc, idProduct=504a, bcdDevice=43.02 [ 113.651184][ T5701] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 113.651205][ T5701] usb 3-1: Product: syz [ 113.651216][ T5701] usb 3-1: Manufacturer: syz [ 113.651227][ T5701] usb 3-1: SerialNumber: syz [ 113.655114][ T5701] usb 3-1: config 0 descriptor?? [ 113.662188][ T5701] gspca_main: sunplus-2.14.0 probing 04fc:504a [ 113.667932][ T5588] usb 1-1: new high-speed USB device number 22 using dummy_hcd [ 113.818415][ T5588] usb 1-1: New USB device found, idVendor=0dba, idProduct=1000, bcdDevice= 0.40 [ 113.819418][ T5588] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 113.819438][ T5588] usb 1-1: config 1 has 0 interfaces, different from the descriptor's value: 3 [ 113.821241][ T5588] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 113.821258][ T5588] usb 1-1: Product: syz [ 113.821269][ T5588] usb 1-1: Manufacturer: syz [ 113.821281][ T5588] usb 1-1: SerialNumber: syz [ 113.938468][ T30] audit: type=1400 audit(1788493720.970:311): avc: denied { mounton } for pid=6688 comm="syz.4.331" path="/sys/kernel/address_bits" dev="sysfs" ino=11 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=file permissive=1 [ 113.939170][ T6693] ======================================================= [ 113.939170][ T6693] WARNING: The mand mount option has been deprecated and [ 113.939170][ T6693] and is ignored by this kernel. Remove the mand [ 113.939170][ T6693] option from the mount to silence this warning. [ 113.939170][ T6693] ======================================================= [ 114.031635][ T6680] netlink: 16 bytes leftover after parsing attributes in process `syz.0.328'. [ 114.277901][ T5588] usb 1-1: USB disconnect, device number 22 [ 114.590060][ T5701] gspca_sunplus: reg_w_riv err -110 [ 114.590170][ T5701] sunplus 3-1:0.0: probe with driver sunplus failed with error -110 [ 114.758199][ T5786] usb 3-1: USB disconnect, device number 17 [ 114.774794][ T48] cdc_mbim 4-1:1.0: failed GET_NTB_PARAMETERS [ 114.774891][ T48] cdc_mbim 4-1:1.0: bind() failure [ 114.833537][ T48] cdc_ncm 4-1:1.1: CDC Union missing and no IAD found [ 114.841551][ T48] cdc_ncm 4-1:1.1: bind() failure [ 114.872579][ T48] usb 4-1: USB disconnect, device number 14 [ 114.928474][ T30] audit: type=1400 audit(1788493721.970:312): avc: denied { mounton } for pid=6701 comm="syz.0.335" path="/55/file0" dev="tmpfs" ino=296 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=fifo_file permissive=1 [ 114.992569][ T6704] netlink: 16 bytes leftover after parsing attributes in process `syz.1.334'. [ 115.014187][ T6708] netlink: 16402 bytes leftover after parsing attributes in process `syz.3.333'. [ 115.028125][ T6702] netlink: 16402 bytes leftover after parsing attributes in process `syz.3.333'. [ 115.115828][ T6709] x_tables: duplicate underflow at hook 2 [ 115.216899][ T6712] syzkaller0: entered promiscuous mode [ 115.216947][ T6712] syzkaller0: entered allmulticast mode [ 115.758431][ T2299] usb 2-1: new high-speed USB device number 13 using dummy_hcd [ 115.907728][ T2299] usb 2-1: Using ep0 maxpacket: 16 [ 115.909855][ T2299] usb 2-1: New USB device found, idVendor=2ef5, idProduct=000a, bcdDevice=c5.7a [ 115.912445][ T2299] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 115.912469][ T2299] usb 2-1: Product: syz [ 115.912482][ T2299] usb 2-1: Manufacturer: syz [ 115.912496][ T2299] usb 2-1: SerialNumber: syz [ 115.993605][ T6725] capability: warning: `syz.0.342' uses 32-bit capabilities (legacy support in use) [ 116.069479][ T6723] syzkaller0: entered promiscuous mode [ 116.069530][ T6723] syzkaller0: entered allmulticast mode [ 116.078206][ T6728] netlink: 24 bytes leftover after parsing attributes in process `syz.3.341'. [ 116.078400][ T6728] netlink: 24 bytes leftover after parsing attributes in process `syz.3.341'. [ 116.135190][ T2299] plfxlc 2-1:251.0: Firmware Version: 0 [ 116.135251][ T2299] plfxlc 2-1:251.0: Unit type is station [ 116.300172][ T5701] usb 1-1: new high-speed USB device number 23 using dummy_hcd [ 116.406963][ T6735] netlink: 16 bytes leftover after parsing attributes in process `syz.4.346'. [ 116.441536][ T5701] usb 1-1: device descriptor read/64, error -71 [ 116.448673][ T6735] bridge0: port 1(bridge_slave_0) entered disabled state [ 116.619045][ T2299] plfxlc 2-1:251.0: vendor command failed (-71) [ 116.619103][ T2299] plfxlc 2-1:251.0: FPGA download failed (-22) [ 116.637459][ T30] audit: type=1400 audit(1788493723.670:313): avc: denied { map_create } for pid=6738 comm="syz.4.348" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 116.657755][ T10] usb 4-1: new high-speed USB device number 15 using dummy_hcd [ 116.677791][ T5701] usb 1-1: new high-speed USB device number 24 using dummy_hcd [ 116.807692][ T5701] usb 1-1: device descriptor read/64, error -71 [ 116.826800][ T10] usb 4-1: New USB device found, idVendor=a257, idProduct=2013, bcdDevice= 0.01 [ 116.827990][ T10] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 116.831070][ T2299] plfxlc 2-1:251.0: pureLifi:Device error [ 116.831096][ T2299] plfxlc 2-1:251.0: probe with driver plfxlc failed with error -22 [ 116.851633][ T2299] usb 2-1: USB disconnect, device number 13 [ 116.919419][ T5701] usb usb1-port1: attempt power cycle [ 116.938627][ T5789] usb 5-1: new full-speed USB device number 24 using dummy_hcd [ 117.067573][ C0] dln2 4-1:1.0: short response: 7 [ 117.068516][ T10] dln2 4-1:1.0: USB write failed: -110 [ 117.068537][ T10] dln2 4-1:1.0: failed to initialize hardware [ 117.071332][ T10] dln2 4-1:1.0: probe with driver dln2 failed with error -110 [ 117.100064][ T5789] usb 5-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 117.100915][ T5789] usb 5-1: config 0 has an invalid interface number: 8 but max is 0 [ 117.100934][ T5789] usb 5-1: config 0 has no interface number 0 [ 117.100963][ T5789] usb 5-1: config 0 interface 8 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 117.102188][ T5789] usb 5-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 117.102207][ T5789] usb 5-1: Product: syz [ 117.102221][ T5789] usb 5-1: SerialNumber: syz [ 117.121759][ T5789] usb 5-1: config 0 descriptor?? [ 117.139994][ T5789] usbhid 5-1:0.8: couldn't find an input interrupt endpoint [ 117.239570][ T2299] usb 2-1: new high-speed USB device number 14 using dummy_hcd [ 117.257691][ T5701] usb 1-1: new high-speed USB device number 25 using dummy_hcd [ 117.276313][ T5789] usb 4-1: USB disconnect, device number 15 [ 117.283680][ T5701] usb 1-1: device descriptor read/8, error -71 [ 117.298712][ T30] audit: type=1400 audit(1788493724.330:314): avc: denied { create } for pid=6736 comm="syz.2.347" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_rdma_socket permissive=1 [ 117.319844][ T30] audit: type=1400 audit(1788493724.360:315): avc: denied { map_read map_write } for pid=6736 comm="syz.2.347" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 117.355954][ T10] usb 5-1: USB disconnect, device number 24 [ 117.397732][ T2299] usb 2-1: Using ep0 maxpacket: 16 [ 117.398666][ T2299] usb 2-1: New USB device found, idVendor=2ef5, idProduct=000a, bcdDevice=c5.7a [ 117.401430][ T2299] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 117.401451][ T2299] usb 2-1: Product: syz [ 117.401491][ T2299] usb 2-1: Manufacturer: syz [ 117.401503][ T2299] usb 2-1: SerialNumber: syz [ 117.426455][ T6737] syz.2.347 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 117.426485][ T6737] CPU: 0 UID: 0 PID: 6737 Comm: syz.2.347 Not tainted syzkaller #0 PREEMPT(full) [ 117.426503][ T6737] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 117.426512][ T6737] Call Trace: [ 117.426518][ T6737] [ 117.426524][ T6737] dump_stack_lvl+0x100/0x190 [ 117.426553][ T6737] dump_header+0xfb/0x606 [ 117.426575][ T6737] oom_kill_process.cold+0xd/0x380 [ 117.426602][ T6737] out_of_memory+0x340/0x14f0 [ 117.426627][ T6737] ? __pfx_out_of_memory+0x10/0x10 [ 117.426653][ T6737] mem_cgroup_out_of_memory+0xc6/0x130 [ 117.426670][ T6737] ? __pfx_mem_cgroup_out_of_memory+0x10/0x10 [ 117.426685][ T6737] ? find_held_lock+0x2b/0x80 [ 117.426712][ T6737] ? do_raw_spin_unlock+0x145/0x1e0 [ 117.426733][ T6737] ? _raw_spin_unlock+0x28/0x50 [ 117.426760][ T6737] try_charge_memcg+0x783/0xf60 [ 117.426786][ T6737] ? __pfx_try_charge_memcg+0x10/0x10 [ 117.426806][ T6737] ? find_held_lock+0x2b/0x80 [ 117.426826][ T6737] ? rcu_read_unlock+0x17/0x60 [ 117.426847][ T6737] ? rcu_read_unlock+0x17/0x60 [ 117.426870][ T6737] ? find_held_lock+0x2b/0x80 [ 117.426892][ T6737] ? rcu_read_unlock+0x17/0x60 [ 117.426918][ T6737] charge_memcg+0x1ae/0x210 [ 117.426941][ T6737] __mem_cgroup_charge+0x2b/0x1c0 [ 117.426965][ T6737] shmem_alloc_and_add_folio+0x451/0xd40 [ 117.426994][ T6737] ? __pfx_shmem_alloc_and_add_folio+0x10/0x10 [ 117.427018][ T6737] ? shmem_allowable_huge_orders+0x2bd/0x400 [ 117.427045][ T6737] shmem_get_folio_gfp+0x75b/0x1980 [ 117.427072][ T6737] ? __pfx_shmem_get_folio_gfp+0x10/0x10 [ 117.427097][ T6737] ? filemap_map_pages+0x114a/0x2100 [ 117.427117][ T6737] ? set_pte_range+0x489/0xa20 [ 117.427138][ T6737] shmem_fault+0x1fb/0xa30 [ 117.427161][ T6737] ? __pfx_shmem_fault+0x10/0x10 [ 117.427186][ T6737] ? __pfx_filemap_map_pages+0x10/0x10 [ 117.427209][ T6737] ? find_held_lock+0x2b/0x80 [ 117.427232][ T6737] ? __pfx_filemap_map_pages+0x10/0x10 [ 117.427250][ T6737] __do_fault+0x10b/0x440 [ 117.427268][ T6737] do_fault+0xb3f/0x1830 [ 117.427288][ T6737] ? __pfx_do_fault+0x10/0x10 [ 117.427305][ T6737] ? rcu_read_unlock+0x2d/0xb0 [ 117.427326][ T6737] ? rcu_read_unlock+0x2d/0xb0 [ 117.427347][ T6737] ? __pte_offset_map+0x179/0x310 [ 117.427367][ T6737] __handle_mm_fault+0x150b/0x2f60 [ 117.427393][ T6737] ? __pfx___handle_mm_fault+0x10/0x10 [ 117.427413][ T6737] ? __pfx_mt_find+0x10/0x10 [ 117.427445][ T6737] ? find_vma+0xbf/0x140 [ 117.427461][ T6737] ? __pfx_find_vma+0x10/0x10 [ 117.427480][ T6737] handle_mm_fault+0x363/0xa20 [ 117.427506][ T6737] do_user_addr_fault+0x745/0x12f0 [ 117.427532][ T6737] exc_page_fault+0x6f/0xd0 [ 117.427550][ T6737] asm_exc_page_fault+0x26/0x30 [ 117.427566][ T6737] RIP: 0010:rep_movs_alternative+0x4a/0xa0 [ 117.427595][ T6737] Code: cc cc cc 66 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 8b 06 48 89 07 48 83 c6 08 48 83 c7 08 83 e9 08 74 db 83 f9 08 73 e8 eb c5 a4 e9 ff b0 04 00 48 8b 06 48 89 07 48 8d 47 08 48 83 e0 f8 48 [ 117.427610][ T6737] RSP: 0018:ffffc9000250f9e8 EFLAGS: 00050206 [ 117.427625][ T6737] RAX: 0000000000000001 RBX: 0000200000009930 RCX: 0000000000002ba0 [ 117.427636][ T6737] RDX: 0000000000000001 RSI: 0000200000010000 RDI: ffff8880543b66d0 [ 117.427646][ T6737] RBP: 0000000000009270 R08: 0000000000000001 R09: ffffed100a87724d [ 117.427656][ T6737] R10: ffff8880543b926f R11: 0000000000000000 R12: 0000000000000000 [ 117.427666][ T6737] R13: ffff8880543b0000 R14: 00000000000000ca R15: 0000000000009270 [ 117.427687][ T6737] _copy_from_user+0x98/0xd0 [ 117.427713][ T6737] generic_map_update_batch+0x4bb/0x800 [ 117.427744][ T6737] ? __pfx_generic_map_update_batch+0x10/0x10 [ 117.427774][ T6737] ? __pfx_generic_map_update_batch+0x10/0x10 [ 117.427798][ T6737] bpf_map_do_batch+0x66f/0x6d0 [ 117.427821][ T6737] __sys_bpf+0x4ce/0x4a30 [ 117.427842][ T6737] ? __pfx___sys_bpf+0x10/0x10 [ 117.427856][ T6737] ? find_held_lock+0x2b/0x80 [ 117.427877][ T6737] ? futex_wake+0x4ea/0x5e0 [ 117.427915][ T6737] ? percpu_counter_add_batch+0xb9/0x230 [ 117.427940][ T6737] ? errseq_sample+0x51/0x70 [ 117.427962][ T6737] ? file_init_path+0x48e/0x670 [ 117.427996][ T6737] ? __x64_sys_futex+0x34f/0x4d0 [ 117.428016][ T6737] ? __x64_sys_futex+0x358/0x4d0 [ 117.428037][ T6737] ? __sys_socket+0xac/0x260 [ 117.428058][ T6737] ? xfd_validate_state+0x129/0x190 [ 117.428079][ T6737] ? __x64_sys_bpf+0xce/0x140 [ 117.428093][ T6737] __x64_sys_bpf+0xce/0x140 [ 117.428110][ T6737] ? do_syscall_64+0xae/0x790 [ 117.428128][ T6737] do_syscall_64+0x123/0x790 [ 117.428148][ T6737] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 117.428164][ T6737] RIP: 0033:0x7f0c5a59e159 [ 117.428178][ T6737] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 117.428192][ T6737] RSP: 002b:00007f0c5b450028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 117.428207][ T6737] RAX: ffffffffffffffda RBX: 00007f0c5a825fa0 RCX: 00007f0c5a59e159 [ 117.428218][ T6737] RDX: 0000000000000038 RSI: 0000200000000240 RDI: 000000000000001a [ 117.428228][ T6737] RBP: 00007f0c5a635024 R08: 0000000000000000 R09: 0000000000000000 [ 117.428237][ T6737] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 117.428247][ T6737] R13: 00007f0c5a826038 R14: 00007f0c5a825fa0 R15: 00007ffc27d8cf78 [ 117.428269][ T6737] [ 117.439608][ T6737] memory: usage 96kB, limit 96kB, failcnt 107 [ 117.439624][ T6737] memory+swap: usage 96kB, limit 9007199254740988kB, failcnt 0 [ 117.439635][ T6737] kmem: usage 96kB, limit 9007199254740988kB, failcnt 0 [ 117.439644][ T6737] Memory cgroup stats for /syz2/test: [ 117.439934][ T6737] cache 0 [ 117.439942][ T6737] rss 0 [ 117.439948][ T6737] rss_huge 0 [ 117.439954][ T6737] shmem 0 [ 117.439959][ T6737] mapped_file 0 [ 117.439965][ T6737] dirty 0 [ 117.439987][ T6737] writeback 0 [ 117.439993][ T6737] workingset_refault_anon 0 [ 117.439999][ T6737] workingset_refault_file 0 [ 117.440006][ T6737] swap 0 [ 117.440011][ T6737] swapcached 0 [ 117.440016][ T6737] pgpgin 14 [ 117.440021][ T6737] pgpgout 14 [ 117.440027][ T6737] pgfault 16 [ 117.440032][ T6737] pgmajfault 0 [ 117.440038][ T6737] inactive_anon 0 [ 117.440043][ T6737] active_anon 0 [ 117.440049][ T6737] inactive_file 0 [ 117.440055][ T6737] active_file 0 [ 117.440061][ T6737] unevictable 0 [ 117.440066][ T6737] hierarchical_memory_limit 98304 [ 117.440073][ T6737] hierarchical_memsw_limit 9223372036854771712 [ 117.440080][ T6737] total_cache 0 [ 117.440085][ T6737] total_rss 0 [ 117.440090][ T6737] total_rss_huge 0 [ 117.440095][ T6737] total_shmem 0 [ 117.440101][ T6737] total_mapped_file 0 [ 117.440123][ T6737] total_dirty 0 [ 117.440130][ T6737] total_writeback 0 [ 117.440135][ T6737] total_workingset_refault_anon 0 [ 117.440142][ T6737] total_workingset_refault_file 0 [ 117.440148][ T6737] total_swap 0 [ 117.440154][ T6737] total_swapcached 0 [ 117.440159][ T6737] total_pgpgin 14 [ 117.440165][ T6737] total_pgpgout 14 [ 117.440171][ T6737] total_pgfault 16 [ 117.440176][ T6737] total_pgmajfault 0 [ 117.440182][ T6737] total_inactive_anon 0 [ 117.440188][ T6737] total_active_anon 0 [ 117.440194][ T6737] total_inactive_file 0 [ 117.440200][ T6737] total_active_file 0 [ 117.440205][ T6737] total_unevictable 0 [ 117.440211][ T6737] anon_cost 0 [ 117.440217][ T6737] file_cost 0 [ 117.440223][ T6737] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0-1,oom_memcg=/syz2/test,task_memcg=/syz2/test,task=syz.2.347,pid=6736,uid=0 [ 117.441670][ T6737] Memory cgroup out of memory: Killed process 6736 (syz.2.347) total-vm:102312kB, anon-rss:1424kB, file-rss:22864kB, shmem-rss:5340kB, UID:0 pgtables:156kB oom_score_adj:1000 [ 117.548315][ T5701] usb 1-1: new high-speed USB device number 26 using dummy_hcd [ 117.588215][ T5701] usb 1-1: device descriptor read/8, error -71 [ 117.628862][ T6716] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 117.629179][ T6716] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 117.630363][ T6716] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 117.630647][ T6716] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 117.633423][ T6716] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 117.633717][ T6716] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 117.698521][ T5701] usb usb1-port1: unable to enumerate USB device [ 117.813467][ T2299] plfxlc 2-1:251.0: Firmware Version: 0 [ 117.813509][ T2299] plfxlc 2-1:251.0: Unit type is station [ 118.097714][ T30] audit: type=1400 audit(1788493725.120:316): avc: denied { prog_load } for pid=6741 comm="syz.3.350" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 118.547682][ T2299] plfxlc 2-1:251.0: vendor command failed (-71) [ 118.547717][ T2299] plfxlc 2-1:251.0: FPGA download failed (-22) [ 118.585705][ T6757] syzkaller0: entered promiscuous mode [ 118.585750][ T6757] syzkaller0: entered allmulticast mode [ 118.699107][ T5588] usb 5-1: new high-speed USB device number 25 using dummy_hcd [ 118.827699][ T5588] usb 5-1: device descriptor read/64, error -71 [ 119.069011][ T5588] usb 5-1: new high-speed USB device number 26 using dummy_hcd [ 119.149097][ T30] audit: type=1400 audit(1788493726.190:317): avc: denied { connect } for pid=6766 comm="syz.2.357" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 119.208000][ T5588] usb 5-1: device descriptor read/64, error -71 [ 119.318252][ T5588] usb usb5-port1: attempt power cycle [ 119.657708][ T5588] usb 5-1: new high-speed USB device number 27 using dummy_hcd [ 119.680237][ T5588] usb 5-1: device descriptor read/8, error -71 [ 119.918839][ T5588] usb 5-1: new high-speed USB device number 28 using dummy_hcd [ 119.945018][ T5588] usb 5-1: device descriptor read/8, error -71 [ 120.031423][ T6776] syz.0.359 invoked oom-killer: gfp_mask=0x442dc0(GFP_KERNEL_ACCOUNT|__GFP_ZERO|__GFP_NOWARN|__GFP_COMP), order=1, oom_score_adj=1000 [ 120.031488][ T6776] CPU: 1 UID: 0 PID: 6776 Comm: syz.0.359 Not tainted syzkaller #0 PREEMPT(full) [ 120.031511][ T6776] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 120.031522][ T6776] Call Trace: [ 120.031528][ T6776] [ 120.031534][ T6776] dump_stack_lvl+0x100/0x190 [ 120.031563][ T6776] dump_header+0xfb/0x606 [ 120.031584][ T6776] oom_kill_process.cold+0xd/0x380 [ 120.031605][ T6776] out_of_memory+0x340/0x14f0 [ 120.031629][ T6776] ? __pfx_out_of_memory+0x10/0x10 [ 120.031655][ T6776] mem_cgroup_out_of_memory+0xc6/0x130 [ 120.031673][ T6776] ? __pfx_mem_cgroup_out_of_memory+0x10/0x10 [ 120.031687][ T6776] ? find_held_lock+0x2b/0x80 [ 120.031712][ T6776] ? do_raw_spin_unlock+0x145/0x1e0 [ 120.031732][ T6776] ? _raw_spin_unlock+0x28/0x50 [ 120.031759][ T6776] try_charge_memcg+0x783/0xf60 [ 120.031787][ T6776] ? __pfx_try_charge_memcg+0x10/0x10 [ 120.031808][ T6776] ? find_held_lock+0x2b/0x80 [ 120.031828][ T6776] ? rcu_read_unlock+0x17/0x60 [ 120.031849][ T6776] ? rcu_read_unlock+0x17/0x60 [ 120.031880][ T6776] obj_cgroup_charge_pages+0x22/0x1d0 [ 120.031906][ T6776] __memcg_kmem_charge_page+0x1c4/0x4d0 [ 120.031933][ T6776] __alloc_frozen_pages_noprof+0x534/0x3300 [ 120.031959][ T6776] ? __pfx_stack_trace_save+0x10/0x10 [ 120.031984][ T6776] ? stack_depot_save_flags+0x27/0x9f0 [ 120.032001][ T6776] ? arch_stack_walk+0xa6/0xf0 [ 120.032019][ T6776] ? inat_get_opcode_attribute+0xf/0x60 [ 120.032047][ T6776] ? kasan_save_stack+0x3f/0x50 [ 120.032063][ T6776] ? kasan_save_stack+0x30/0x50 [ 120.032079][ T6776] ? kasan_save_track+0x14/0x30 [ 120.032095][ T6776] ? __kasan_kmalloc+0xaa/0xb0 [ 120.032109][ T6776] ? __kvmalloc_node_noprof+0x35b/0x9b0 [ 120.032126][ T6776] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 120.032152][ T6776] ? do_syscall_64+0x123/0x790 [ 120.032191][ T6776] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 120.032216][ T6776] ? policy_nodemask+0xed/0x4f0 [ 120.032237][ T6776] alloc_pages_mpol+0x201/0x550 [ 120.032258][ T6776] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 120.032279][ T6776] ? io_check_coalesce_buffer+0x655/0x8a0 [ 120.032305][ T6776] alloc_pages_noprof+0x1a/0x160 [ 120.032330][ T6776] io_create_region+0x8fe/0xdc0 [ 120.032357][ T6776] ? __pfx_io_create_region+0x10/0x10 [ 120.032376][ T6776] ? rcu_is_watching+0x13/0xc0 [ 120.032396][ T6776] ? cap_capable+0x107/0x430 [ 120.032420][ T6776] ? bpf_lsm_capable+0x9/0x10 [ 120.032442][ T6776] ? security_capable+0x80/0x260 [ 120.032465][ T6776] io_uring_setup.cold+0x12b3/0x1cde [ 120.032493][ T6776] ? __pfx_io_uring_setup+0x10/0x10 [ 120.032508][ T6776] ? find_held_lock+0x2b/0x80 [ 120.032547][ T6776] ? xfd_validate_state+0x129/0x190 [ 120.032571][ T6776] __x64_sys_io_uring_setup+0xc2/0x170 [ 120.032589][ T6776] do_syscall_64+0x123/0x790 [ 120.032610][ T6776] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 120.032629][ T6776] RIP: 0033:0x7fe317d9e159 [ 120.032645][ T6776] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 120.032661][ T6776] RSP: 002b:00007fe318c3cfb8 EFLAGS: 00000206 ORIG_RAX: 00000000000001a9 [ 120.032678][ T6776] RAX: ffffffffffffffda RBX: 0000200000000340 RCX: 00007fe317d9e159 [ 120.032689][ T6776] RDX: 0000200000000080 RSI: 0000200000000340 RDI: 0000000000000023 [ 120.032699][ T6776] RBP: 00007fe317e35024 R08: 0000000000000000 R09: 0000000000000000 [ 120.032709][ T6776] R10: 0000200000000140 R11: 0000000000000206 R12: 0000200000000080 [ 120.032717][ T6776] R13: 0000200000000140 R14: 00002000000001c0 R15: 00007fff0ad2f1b8 [ 120.032737][ T6776] [ 120.048278][ T6776] memory: usage 96kB, limit 96kB, failcnt 55 [ 120.048295][ T6776] memory+swap: usage 96kB, limit 9007199254740988kB, failcnt 0 [ 120.048307][ T6776] kmem: usage 96kB, limit 9007199254740988kB, failcnt 0 [ 120.048317][ T6776] Memory cgroup stats for /syz0/test: [ 120.048432][ T6776] cache 0 [ 120.048440][ T6776] rss 0 [ 120.048445][ T6776] rss_huge 0 [ 120.048451][ T6776] shmem 0 [ 120.048457][ T6776] mapped_file 0 [ 120.048463][ T6776] dirty 0 [ 120.048469][ T6776] writeback 0 [ 120.048475][ T6776] workingset_refault_anon 0 [ 120.048481][ T6776] workingset_refault_file 0 [ 120.048489][ T6776] swap 0 [ 120.048494][ T6776] swapcached 0 [ 120.048500][ T6776] pgpgin 0 [ 120.048506][ T6776] pgpgout 0 [ 120.048512][ T6776] pgfault 11 [ 120.048518][ T6776] pgmajfault 0 [ 120.048525][ T6776] inactive_anon 0 [ 120.048531][ T6776] active_anon 0 [ 120.048537][ T6776] inactive_file 0 [ 120.048542][ T6776] active_file 0 [ 120.048547][ T6776] unevictable 0 [ 120.048553][ T6776] hierarchical_memory_limit 98304 [ 120.048559][ T6776] hierarchical_memsw_limit 9223372036854771712 [ 120.048566][ T6776] total_cache 0 [ 120.048571][ T6776] total_rss 0 [ 120.048577][ T6776] total_rss_huge 0 [ 120.048583][ T6776] total_shmem 0 [ 120.048588][ T6776] total_mapped_file 0 [ 120.048594][ T6776] total_dirty 0 [ 120.048599][ T6776] total_writeback 0 [ 120.048605][ T6776] total_workingset_refault_anon 0 [ 120.048611][ T6776] total_workingset_refault_file 0 [ 120.048617][ T6776] total_swap 0 [ 120.048623][ T6776] total_swapcached 0 [ 120.048629][ T6776] total_pgpgin 0 [ 120.048634][ T6776] total_pgpgout 0 [ 120.048640][ T6776] total_pgfault 11 [ 120.048645][ T6776] total_pgmajfault 0 [ 120.048651][ T6776] total_inactive_anon 0 [ 120.048657][ T6776] total_active_anon 0 [ 120.048662][ T6776] total_inactive_file 0 [ 120.048669][ T6776] total_active_file 0 [ 120.048675][ T6776] total_unevictable 0 [ 120.048680][ T6776] anon_cost 0 [ 120.048686][ T6776] file_cost 0 [ 120.048692][ T6776] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0-1,oom_memcg=/syz0/test,task_memcg=/syz0/test,task=syz.0.359,pid=6774,uid=0 [ 120.048844][ T6776] Memory cgroup out of memory: Killed process 6774 (syz.0.359) total-vm:102312kB, anon-rss:1420kB, file-rss:22800kB, shmem-rss:5340kB, UID:0 pgtables:160kB oom_score_adj:1000 [ 120.050161][ T5588] usb usb5-port1: unable to enumerate USB device [ 120.670606][ T5701] usb 1-1: new high-speed USB device number 27 using dummy_hcd [ 120.823823][ T5701] usb 1-1: Using ep0 maxpacket: 16 [ 120.824333][ T5701] usb 1-1: New USB device found, idVendor=0bda, idProduct=0138, bcdDevice=30.12 [ 120.825158][ T5701] usb 1-1: config 166 has an invalid interface number: 177 but max is 1 [ 120.825179][ T5701] usb 1-1: config 166 has an invalid interface number: 34 but max is 1 [ 120.825194][ T5701] usb 1-1: config 166 has no interface number 0 [ 120.825208][ T5701] usb 1-1: config 166 has no interface number 1 [ 120.825242][ T5701] usb 1-1: config 166 interface 177 altsetting 4 has an invalid descriptor for endpoint zero, skipping [ 120.825259][ T5701] usb 1-1: config 166 interface 177 altsetting 4 has an invalid descriptor for endpoint zero, skipping [ 120.825285][ T5701] usb 1-1: config 166 interface 34 altsetting 1 has a duplicate endpoint with address 0x9, skipping [ 120.825304][ T5701] usb 1-1: config 166 interface 34 altsetting 1 has an endpoint descriptor with address 0xA6, changing to 0x86 [ 120.825322][ T5701] usb 1-1: config 166 interface 34 altsetting 1 endpoint 0x86 has invalid maxpacket 23105, setting to 1024 [ 120.825341][ T5701] usb 1-1: config 166 interface 34 altsetting 1 bulk endpoint 0x86 has invalid maxpacket 1024 [ 120.825359][ T5701] usb 1-1: config 166 interface 34 altsetting 1 endpoint 0x85 has an invalid bInterval 0, changing to 7 [ 120.825378][ T5701] usb 1-1: config 166 interface 34 altsetting 1 endpoint 0x85 has invalid wMaxPacketSize 0 [ 120.825395][ T5701] usb 1-1: config 166 interface 34 altsetting 1 has 5 endpoint descriptors, different from the interface descriptor's value: 4 [ 120.825414][ T5701] usb 1-1: config 166 interface 177 has no altsetting 0 [ 120.825428][ T5701] usb 1-1: config 166 interface 34 has no altsetting 0 [ 120.827048][ T5701] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 120.827067][ T5701] usb 1-1: Product: syz [ 120.827079][ T5701] usb 1-1: Manufacturer: syz [ 120.827091][ T5701] usb 1-1: SerialNumber: syz [ 120.987707][ T5588] usb 3-1: new high-speed USB device number 18 using dummy_hcd [ 121.062941][ T5701] ums-realtek 1-1:166.177: USB Mass Storage device detected [ 121.139425][ T5588] usb 3-1: Using ep0 maxpacket: 16 [ 121.143189][ T5588] usb 3-1: New USB device found, idVendor=2ef5, idProduct=000a, bcdDevice=c5.7a [ 121.150852][ T5588] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 121.150875][ T5588] usb 3-1: Product: syz [ 121.150888][ T5588] usb 3-1: Manufacturer: syz [ 121.150900][ T5588] usb 3-1: SerialNumber: syz [ 121.267043][ T5701] ums-realtek 1-1:166.34: USB Mass Storage device detected [ 121.382412][ T5588] plfxlc 3-1:251.0: Firmware Version: 0 [ 121.382464][ T5588] plfxlc 3-1:251.0: Unit type is station [ 121.525759][ T5701] ums-realtek 1-1:166.34: probe with driver ums-realtek failed with error -5 [ 121.677085][ T5701] uvcvideo 1-1:166.34: Found UVC 0.00 device syz (0bda:0138) [ 121.677141][ T5701] uvcvideo 1-1:166.34: No valid video chain found. [ 121.885883][ T5726] usb 1-1: USB disconnect, device number 27 [ 121.889005][ T48] usb 5-1: new high-speed USB device number 29 using dummy_hcd [ 122.017906][ T48] usb 5-1: device descriptor read/64, error -71 [ 122.260829][ T48] usb 5-1: new high-speed USB device number 30 using dummy_hcd [ 122.292328][ T2299] plfxlc 2-1:251.0: pureLifi:Device error [ 122.302625][ T2299] plfxlc 2-1:251.0: probe with driver plfxlc failed with error -22 [ 122.321073][ T2299] usb 2-1: USB disconnect, device number 14 [ 122.376685][ T6764] bridge0: port 2(bridge_slave_1) entered disabled state [ 122.388857][ T48] usb 5-1: device descriptor read/64, error -71 [ 122.498353][ T48] usb usb5-port1: attempt power cycle [ 122.532868][ T6764] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 122.547515][ T6764] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 122.798840][ T228] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 122.798888][ T228] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 122.798920][ T228] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 122.798951][ T228] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 122.838714][ T48] usb 5-1: new high-speed USB device number 31 using dummy_hcd [ 122.860206][ T48] usb 5-1: device descriptor read/8, error -71 [ 123.098761][ T48] usb 5-1: new high-speed USB device number 32 using dummy_hcd [ 123.117756][ T5588] plfxlc 3-1:251.0: vendor command failed (-71) [ 123.117798][ T5588] plfxlc 3-1:251.0: FPGA download failed (-22) [ 123.118156][ T48] usb 5-1: device descriptor read/8, error -71 [ 123.168703][ T5726] usb 4-1: new high-speed USB device number 16 using dummy_hcd [ 123.230781][ T48] usb usb5-port1: unable to enumerate USB device [ 123.250802][ T5588] plfxlc 3-1:251.0: pureLifi:Device error [ 123.250844][ T5588] plfxlc 3-1:251.0: probe with driver plfxlc failed with error -22 [ 123.264656][ T5588] usb 3-1: USB disconnect, device number 18 [ 123.299595][ T5726] usb 4-1: device descriptor read/64, error -71 [ 123.331121][ T6811] netlink: 4 bytes leftover after parsing attributes in process `syz.0.370'. [ 123.537773][ T5726] usb 4-1: new high-speed USB device number 17 using dummy_hcd [ 123.588055][ T5588] usb 3-1: new high-speed USB device number 19 using dummy_hcd [ 123.667697][ T5726] usb 4-1: device descriptor read/64, error -71 [ 123.737749][ T5588] usb 3-1: Using ep0 maxpacket: 16 [ 123.778037][ T5726] usb usb4-port1: attempt power cycle [ 123.847742][ T5588] usb 3-1: device descriptor read/all, error -71 [ 124.128048][ T5726] usb 4-1: new high-speed USB device number 18 using dummy_hcd [ 124.148315][ T5726] usb 4-1: device descriptor read/8, error -71 [ 124.279694][ T6816] syz.0.372 invoked oom-killer: gfp_mask=0x442dc0(GFP_KERNEL_ACCOUNT|__GFP_ZERO|__GFP_NOWARN|__GFP_COMP), order=1, oom_score_adj=1000 [ 124.279755][ T6816] CPU: 1 UID: 0 PID: 6816 Comm: syz.0.372 Not tainted syzkaller #0 PREEMPT(full) [ 124.279777][ T6816] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 124.279787][ T6816] Call Trace: [ 124.279793][ T6816] [ 124.279800][ T6816] dump_stack_lvl+0x100/0x190 [ 124.279828][ T6816] dump_header+0xfb/0x606 [ 124.279849][ T6816] oom_kill_process.cold+0xd/0x380 [ 124.279869][ T6816] out_of_memory+0x340/0x14f0 [ 124.279894][ T6816] ? __pfx_out_of_memory+0x10/0x10 [ 124.279919][ T6816] mem_cgroup_out_of_memory+0xc6/0x130 [ 124.279937][ T6816] ? __pfx_mem_cgroup_out_of_memory+0x10/0x10 [ 124.279952][ T6816] ? find_held_lock+0x2b/0x80 [ 124.279978][ T6816] ? do_raw_spin_unlock+0x145/0x1e0 [ 124.279998][ T6816] ? _raw_spin_unlock+0x28/0x50 [ 124.280024][ T6816] try_charge_memcg+0x783/0xf60 [ 124.280050][ T6816] ? __pfx_try_charge_memcg+0x10/0x10 [ 124.280075][ T6816] ? find_held_lock+0x2b/0x80 [ 124.280097][ T6816] ? rcu_read_unlock+0x17/0x60 [ 124.280120][ T6816] ? rcu_read_unlock+0x17/0x60 [ 124.280151][ T6816] obj_cgroup_charge_pages+0x22/0x1d0 [ 124.280177][ T6816] __memcg_kmem_charge_page+0x1c4/0x4d0 [ 124.280206][ T6816] __alloc_frozen_pages_noprof+0x534/0x3300 [ 124.280234][ T6816] ? __pfx_stack_trace_save+0x10/0x10 [ 124.280259][ T6816] ? stack_depot_save_flags+0x27/0x9f0 [ 124.280279][ T6816] ? arch_stack_walk+0xa6/0xf0 [ 124.280298][ T6816] ? inat_get_opcode_attribute+0xf/0x60 [ 124.280326][ T6816] ? kasan_save_stack+0x3f/0x50 [ 124.280342][ T6816] ? kasan_save_stack+0x30/0x50 [ 124.280358][ T6816] ? kasan_save_track+0x14/0x30 [ 124.280375][ T6816] ? __kasan_kmalloc+0xaa/0xb0 [ 124.280392][ T6816] ? __kvmalloc_node_noprof+0x35b/0x9b0 [ 124.280410][ T6816] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 124.280435][ T6816] ? do_syscall_64+0x123/0x790 [ 124.280476][ T6816] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 124.280496][ T6816] ? policy_nodemask+0xed/0x4f0 [ 124.280518][ T6816] alloc_pages_mpol+0x201/0x550 [ 124.280544][ T6816] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 124.280570][ T6816] alloc_pages_noprof+0x1a/0x160 [ 124.280592][ T6816] io_create_region+0x8fe/0xdc0 [ 124.280618][ T6816] ? __pfx_io_create_region+0x10/0x10 [ 124.280638][ T6816] ? rcu_is_watching+0x13/0xc0 [ 124.280662][ T6816] ? cap_capable+0x107/0x430 [ 124.280687][ T6816] ? bpf_lsm_capable+0x9/0x10 [ 124.280709][ T6816] ? security_capable+0x80/0x260 [ 124.280732][ T6816] io_uring_setup.cold+0x10f9/0x1cde [ 124.280750][ T6816] ? lock_acquire+0x1d1/0x380 [ 124.280766][ T6816] ? avc_has_perm_noaudit+0x56/0x3b0 [ 124.280786][ T6816] ? __pfx_io_uring_setup+0x10/0x10 [ 124.280800][ T6816] ? find_held_lock+0x2b/0x80 [ 124.280837][ T6816] ? xfd_validate_state+0x129/0x190 [ 124.280855][ T6816] ? arch_syscall_is_vdso_sigreturn+0xb6/0x200 [ 124.280878][ T6816] __x64_sys_io_uring_setup+0xc2/0x170 [ 124.280896][ T6816] do_syscall_64+0x123/0x790 [ 124.280915][ T6816] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 124.280932][ T6816] RIP: 0033:0x7fe317d9e159 [ 124.280947][ T6816] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 124.280963][ T6816] RSP: 002b:00007fe318c5dfb8 EFLAGS: 00000206 ORIG_RAX: 00000000000001a9 [ 124.280980][ T6816] RAX: ffffffffffffffda RBX: 0000200000000340 RCX: 00007fe317d9e159 [ 124.280990][ T6816] RDX: 0000200000000080 RSI: 0000200000000340 RDI: 0000000000000023 [ 124.281001][ T6816] RBP: 00007fe317e35024 R08: 0000000000000000 R09: 0000000000000000 [ 124.281011][ T6816] R10: 0000200000000140 R11: 0000000000000206 R12: 0000200000000080 [ 124.281021][ T6816] R13: 0000200000000140 R14: 00002000000001c0 R15: 00007fff0ad2f1b8 [ 124.281043][ T6816] [ 124.281060][ T6816] memory: usage 92kB, limit 96kB, failcnt 203 [ 124.281070][ T6816] memory+swap: usage 92kB, limit 9007199254740988kB, failcnt 0 [ 124.281080][ T6816] kmem: usage 92kB, limit 9007199254740988kB, failcnt 0 [ 124.281090][ T6816] Memory cgroup stats for /syz0/test: [ 124.281221][ T6816] cache 0 [ 124.281229][ T6816] rss 0 [ 124.281235][ T6816] rss_huge 0 [ 124.281241][ T6816] shmem 0 [ 124.281247][ T6816] mapped_file 0 [ 124.281253][ T6816] dirty 0 [ 124.281259][ T6816] writeback 0 [ 124.281265][ T6816] workingset_refault_anon 0 [ 124.281272][ T6816] workingset_refault_file 0 [ 124.281279][ T6816] swap 0 [ 124.281284][ T6816] swapcached 0 [ 124.281291][ T6816] pgpgin 8 [ 124.281297][ T6816] pgpgout 8 [ 124.281303][ T6816] pgfault 22 [ 124.281309][ T6816] pgmajfault 0 [ 124.281314][ T6816] inactive_anon 0 [ 124.281320][ T6816] active_anon 0 [ 124.281325][ T6816] inactive_file 0 [ 124.281332][ T6816] active_file 0 [ 124.281337][ T6816] unevictable 0 [ 124.281343][ T6816] hierarchical_memory_limit 98304 [ 124.281349][ T6816] hierarchical_memsw_limit 9223372036854771712 [ 124.281356][ T6816] total_cache 0 [ 124.281362][ T6816] total_rss 0 [ 124.281367][ T6816] total_rss_huge 0 [ 124.281373][ T6816] total_shmem 0 [ 124.281379][ T6816] total_mapped_file 0 [ 124.281385][ T6816] total_dirty 0 [ 124.281391][ T6816] total_writeback 0 [ 124.281396][ T6816] total_workingset_refault_anon 0 [ 124.281403][ T6816] total_workingset_refault_file 0 [ 124.281409][ T6816] total_swap 0 [ 124.281415][ T6816] total_swapcached 0 [ 124.281420][ T6816] total_pgpgin 8 [ 124.281426][ T6816] total_pgpgout 8 [ 124.281431][ T6816] total_pgfault 22 [ 124.281437][ T6816] total_pgmajfault 0 [ 124.281443][ T6816] total_inactive_anon 0 [ 124.281449][ T6816] total_active_anon 0 [ 124.281455][ T6816] total_inactive_file 0 [ 124.281460][ T6816] total_active_file 0 [ 124.281466][ T6816] total_unevictable 0 [ 124.281472][ T6816] anon_cost 0 [ 124.281478][ T6816] file_cost 0 [ 124.281484][ T6816] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0-1,oom_memcg=/syz0/test,task_memcg=/syz0/test,task=syz.0.372,pid=6815,uid=0 [ 124.283685][ T6816] Memory cgroup out of memory: Killed process 6815 (syz.0.372) total-vm:102312kB, anon-rss:1420kB, file-rss:22928kB, shmem-rss:5340kB, UID:0 pgtables:160kB oom_score_adj:1000 [ 124.369547][ T48] usb 2-1: new high-speed USB device number 15 using dummy_hcd [ 124.388730][ T5726] usb 4-1: new high-speed USB device number 19 using dummy_hcd [ 124.408687][ T5726] usb 4-1: device descriptor read/8, error -71 [ 124.518009][ T5726] usb usb4-port1: unable to enumerate USB device [ 124.518348][ T48] usb 2-1: Using ep0 maxpacket: 16 [ 124.519431][ T48] usb 2-1: New USB device found, idVendor=0bda, idProduct=0138, bcdDevice=30.12 [ 124.520267][ T48] usb 2-1: config 166 has an invalid interface number: 177 but max is 1 [ 124.520288][ T48] usb 2-1: config 166 has an invalid interface number: 34 but max is 1 [ 124.520305][ T48] usb 2-1: config 166 has no interface number 0 [ 124.520320][ T48] usb 2-1: config 166 has no interface number 1 [ 124.520362][ T48] usb 2-1: config 166 interface 177 altsetting 4 has an invalid descriptor for endpoint zero, skipping [ 124.520380][ T48] usb 2-1: config 166 interface 177 altsetting 4 has an invalid descriptor for endpoint zero, skipping [ 124.520407][ T48] usb 2-1: config 166 interface 34 altsetting 1 has a duplicate endpoint with address 0x9, skipping [ 124.520428][ T48] usb 2-1: config 166 interface 34 altsetting 1 has an endpoint descriptor with address 0xA6, changing to 0x86 [ 124.520449][ T48] usb 2-1: config 166 interface 34 altsetting 1 endpoint 0x86 has invalid maxpacket 23105, setting to 1024 [ 124.520469][ T48] usb 2-1: config 166 interface 34 altsetting 1 bulk endpoint 0x86 has invalid maxpacket 1024 [ 124.520489][ T48] usb 2-1: config 166 interface 34 altsetting 1 endpoint 0x85 has an invalid bInterval 0, changing to 7 [ 124.520508][ T48] usb 2-1: config 166 interface 34 altsetting 1 endpoint 0x85 has invalid wMaxPacketSize 0 [ 124.520526][ T48] usb 2-1: config 166 interface 34 altsetting 1 has 5 endpoint descriptors, different from the interface descriptor's value: 4 [ 124.520548][ T48] usb 2-1: config 166 interface 177 has no altsetting 0 [ 124.520564][ T48] usb 2-1: config 166 interface 34 has no altsetting 0 [ 124.522237][ T48] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 124.522256][ T48] usb 2-1: Product: syz [ 124.522269][ T48] usb 2-1: Manufacturer: syz [ 124.522281][ T48] usb 2-1: SerialNumber: syz [ 124.741823][ T48] ums-realtek 2-1:166.177: USB Mass Storage device detected [ 124.945784][ T48] ums-realtek 2-1:166.34: USB Mass Storage device detected [ 124.982410][ T6836] netlink: 24 bytes leftover after parsing attributes in process `syz.4.380'. [ 124.982603][ T6836] netlink: 24 bytes leftover after parsing attributes in process `syz.4.380'. [ 125.221524][ T48] ums-realtek 2-1:166.34: probe with driver ums-realtek failed with error -5 [ 125.353640][ T48] uvcvideo 2-1:166.34: Found UVC 0.00 device syz (0bda:0138) [ 125.353700][ T48] uvcvideo 2-1:166.34: No valid video chain found. [ 125.556903][ T6854] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 125.589830][ T48] usb 2-1: USB disconnect, device number 15 [ 125.755891][ T6860] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 126.019818][ T30] audit: type=1400 audit(1788493733.050:318): avc: denied { prog_run } for pid=6862 comm="syz.3.389" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 126.401930][ T6874] netlink: 52 bytes leftover after parsing attributes in process `syz.3.393'. [ 126.418571][ T6874] netlink: 52 bytes leftover after parsing attributes in process `syz.3.393'. [ 126.516721][ T6879] netlink: 24 bytes leftover after parsing attributes in process `syz.4.394'. [ 126.516907][ T6879] netlink: 24 bytes leftover after parsing attributes in process `syz.4.394'. [ 126.667731][ T5726] usb 4-1: new high-speed USB device number 20 using dummy_hcd [ 126.820764][ T5726] usb 4-1: unable to get BOS descriptor or descriptor too short [ 126.820819][ T5726] usb 4-1: New USB device found, idVendor=100d, idProduct=3342, bcdDevice=99.ba [ 126.821617][ T5726] usb 4-1: config 8 has an invalid interface number: 129 but max is 1 [ 126.821637][ T5726] usb 4-1: config 8 has an invalid interface number: 158 but max is 1 [ 126.821653][ T5726] usb 4-1: config 8 has no interface number 0 [ 126.821667][ T5726] usb 4-1: config 8 has no interface number 1 [ 126.821702][ T5726] usb 4-1: config 8 interface 158 has no altsetting 0 [ 126.830298][ T5726] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 126.830321][ T5726] usb 4-1: Product: syz [ 126.830333][ T5726] usb 4-1: Manufacturer: syz [ 126.830346][ T5726] usb 4-1: SerialNumber: syz [ 127.078849][ T5726] cxacru 4-1:8.129: cxacru_bind: interface has incorrect endpoints [ 127.078964][ T5726] cxacru 4-1:8.129: usbatm_usb_probe: bind failed: -19! [ 127.085569][ T5726] cxacru 4-1:8.158: cxacru_bind: interface has incorrect endpoints [ 127.085657][ T5726] cxacru 4-1:8.158: usbatm_usb_probe: bind failed: -19! [ 127.093202][ T5726] usb 4-1: USB disconnect, device number 20 [ 127.332385][ T1308] ieee802154 phy0 wpan0: encryption failed: -22 [ 127.332466][ T1308] ieee802154 phy1 wpan1: encryption failed: -22 [ 127.397882][ T48] usb 5-1: new full-speed USB device number 33 using dummy_hcd [ 127.550694][ T48] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 127.560820][ T48] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 65535, setting to 64 [ 127.571891][ T48] usb 5-1: config 1 interface 1 altsetting 1 endpoint 0x82 has invalid maxpacket 1024, setting to 64 [ 127.571921][ T48] usb 5-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid maxpacket 512, setting to 64 [ 127.595481][ T48] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 127.603605][ T48] usb 5-1: Product: syz [ 127.603626][ T48] usb 5-1: Manufacturer: syz [ 127.603640][ T48] usb 5-1: SerialNumber: syz [ 127.634618][ T48] cdc_mbim 5-1:1.0: skipping garbage [ 127.835796][ T6895] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 127.836130][ T6895] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 128.167020][ T6871] tipc: Enabling of bearer rejected, failed to enable media [ 128.296843][ T30] audit: type=1400 audit(1788493735.330:319): avc: denied { read write } for pid=6894 comm="syz.4.396" name="vhost-net" dev="devtmpfs" ino=1271 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 128.297208][ T30] audit: type=1400 audit(1788493735.330:320): avc: denied { open } for pid=6894 comm="syz.4.396" path="/dev/vhost-net" dev="devtmpfs" ino=1271 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 128.442193][ T30] audit: type=1400 audit(1788493735.480:321): avc: denied { mmap_zero } for pid=6917 comm="syz.1.406" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=memprotect permissive=1 [ 128.500220][ T6918] bridge0: port 2(bridge_slave_1) entered disabled state [ 128.552279][ T30] audit: type=1326 audit(1788493735.590:322): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6920 comm="syz.1.407" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f2fc899e159 code=0x0 [ 128.604932][ T6918] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 128.615394][ T6918] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 128.637881][ T5700] usb 4-1: new high-speed USB device number 21 using dummy_hcd [ 128.697754][ T61] netdevsim netdevsim0 netdevsim0: unset [0, 0] type 1 family 0 port 2816 - 0 [ 128.697803][ T61] netdevsim netdevsim0 netdevsim0: unset [0, 1] type 1 family 0 port 8472 - 0 [ 128.697825][ T61] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 128.697871][ T61] netdevsim netdevsim0 netdevsim1: unset [0, 0] type 1 family 0 port 2816 - 0 [ 128.697891][ T61] netdevsim netdevsim0 netdevsim1: unset [0, 1] type 1 family 0 port 8472 - 0 [ 128.697910][ T61] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 128.697936][ T61] netdevsim netdevsim0 netdevsim2: unset [0, 0] type 1 family 0 port 2816 - 0 [ 128.697955][ T61] netdevsim netdevsim0 netdevsim2: unset [0, 1] type 1 family 0 port 8472 - 0 [ 128.697975][ T61] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 128.698017][ T61] netdevsim netdevsim0 netdevsim3: unset [0, 0] type 1 family 0 port 2816 - 0 [ 128.698037][ T61] netdevsim netdevsim0 netdevsim3: unset [0, 1] type 1 family 0 port 8472 - 0 [ 128.698062][ T61] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 128.766361][ T6924] syzkaller0: entered promiscuous mode [ 128.766380][ T6924] syzkaller0: entered allmulticast mode [ 128.800337][ T5700] usb 4-1: Using ep0 maxpacket: 8 [ 128.827061][ T5700] usb 4-1: unable to get BOS descriptor or descriptor too short [ 128.827116][ T5700] usb 4-1: New USB device found, idVendor=2b73, idProduct=0023, bcdDevice= 0.40 [ 128.848553][ T5700] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 128.856629][ T5700] usb 4-1: Product: syz [ 128.861303][ T5700] usb 4-1: Manufacturer: syz [ 128.865947][ T5700] usb 4-1: SerialNumber: syz [ 128.879125][ T5700] usb 4-1: Audio class v2/v3 interfaces need an interface association [ 128.914624][ T5700] snd-usb-audio 4-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 128.955881][ T5614] udevd[5614]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 128.995128][ T30] audit: type=1400 audit(1788493736.030:323): avc: denied { mount } for pid=6925 comm="syz.2.409" name="/" dev="sysfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 129.007725][ T5726] usb 1-1: new high-speed USB device number 28 using dummy_hcd [ 129.027932][ T30] audit: type=1400 audit(1788493736.070:324): avc: denied { mount } for pid=6925 comm="syz.2.409" name="/" dev="devtmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 129.072453][ T6926] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 129.087121][ T5588] usb 4-1: USB disconnect, device number 21 [ 129.138482][ T30] audit: type=1400 audit(1788493736.170:325): avc: denied { unmount } for pid=5606 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 129.140754][ T30] audit: type=1400 audit(1788493736.180:326): avc: denied { unmount } for pid=5606 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 129.158905][ T5726] usb 1-1: New USB device found, idVendor=1a86, idProduct=7522, bcdDevice=35.36 [ 129.161453][ T5726] usb 1-1: config index 0 descriptor too short (expected 79, got 18) [ 129.161476][ T5726] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 129.161492][ T5726] usb 1-1: config 0 has no interfaces? [ 129.163466][ T5726] usb 1-1: New USB device strings: Mfr=241, Product=2, SerialNumber=3 [ 129.163503][ T5726] usb 1-1: Product: syz [ 129.163516][ T5726] usb 1-1: Manufacturer: syz [ 129.163528][ T5726] usb 1-1: SerialNumber: syz [ 129.165902][ T5726] usb 1-1: config 0 descriptor?? [ 129.356545][ T6930] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 129.370818][ T5726] usb 1-1: USB disconnect, device number 28 [ 129.413050][ T6932] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 129.506395][ T6935] netlink: 16402 bytes leftover after parsing attributes in process `syz.1.412'. [ 129.507073][ T6934] netlink: 16402 bytes leftover after parsing attributes in process `syz.1.412'. [ 130.152655][ T48] cdc_mbim 5-1:1.0: failed GET_NTB_PARAMETERS [ 130.152723][ T48] cdc_mbim 5-1:1.0: bind() failure [ 130.170983][ T48] cdc_ncm 5-1:1.1: CDC Union missing and no IAD found [ 130.184050][ T48] cdc_ncm 5-1:1.1: bind() failure [ 130.201856][ T48] usb 5-1: USB disconnect, device number 33 [ 130.488244][ T5789] usb 3-1: new high-speed USB device number 21 using dummy_hcd [ 130.638605][ T5789] usb 3-1: New USB device found, idVendor=0572, idProduct=cafe, bcdDevice= 1.00 [ 130.640489][ T5789] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 130.640529][ T5789] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 130.670955][ T5789] cxacru 3-1:1.0: usbatm_usb_probe: bind failed: -19! [ 130.848314][ T48] usb 2-1: new high-speed USB device number 16 using dummy_hcd [ 130.867667][ T5789] usb 3-1: USB disconnect, device number 21 [ 131.002288][ T30] audit: type=1400 audit(1788493738.040:327): avc: denied { bind } for pid=6972 comm="syz.0.429" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 131.039087][ T48] usb 2-1: Using ep0 maxpacket: 8 [ 131.044708][ T48] usb 2-1: New USB device found, idVendor=2833, idProduct=0201, bcdDevice=2a.d5 [ 131.054837][ T48] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 131.054891][ T48] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 131.062414][ T30] audit: type=1400 audit(1788493738.100:328): avc: denied { create } for pid=6974 comm="syz.0.430" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 131.070716][ T30] audit: type=1400 audit(1788493738.110:329): avc: denied { connect } for pid=6974 comm="syz.0.430" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 131.128351][ T48] usb 2-1: config 0 descriptor?? [ 131.136361][ T48] uvcvideo 2-1:0.0: Found UVC 0.00 device (2833:0201) [ 131.144135][ T48] uvcvideo 2-1:0.0: No valid video chain found. [ 131.287109][ T30] audit: type=1400 audit(1788493738.320:330): avc: denied { read } for pid=6982 comm="syz.3.434" name="usbmon7" dev="devtmpfs" ino=736 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 131.287391][ T30] audit: type=1400 audit(1788493738.320:331): avc: denied { open } for pid=6982 comm="syz.3.434" path="/dev/usbmon7" dev="devtmpfs" ino=736 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 131.293115][ T30] audit: type=1400 audit(1788493738.330:332): avc: denied { ioctl } for pid=6982 comm="syz.3.434" path="/dev/usbmon7" dev="devtmpfs" ino=736 ioctlcmd=0x9203 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 131.363939][ T5786] usb 2-1: USB disconnect, device number 16 [ 131.377754][ T5789] usb 5-1: new low-speed USB device number 34 using dummy_hcd [ 131.394547][ T6985] syzkaller0: entered promiscuous mode [ 131.400244][ T6985] syzkaller0: entered allmulticast mode [ 131.455668][ T6989] netlink: 24 bytes leftover after parsing attributes in process `syz.0.436'. [ 131.455803][ T6989] netlink: 24 bytes leftover after parsing attributes in process `syz.0.436'. [ 131.527371][ T6993] netlink: 16 bytes leftover after parsing attributes in process `syz.2.439'. [ 131.530637][ T5789] usb 5-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 131.531462][ T5789] usb 5-1: config 0 has an invalid interface number: 1 but max is 0 [ 131.531480][ T5789] usb 5-1: config 0 has no interface number 0 [ 131.531508][ T5789] usb 5-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 131.531529][ T5789] usb 5-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid maxpacket 159, setting to 8 [ 131.531560][ T5789] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 131.534831][ T5789] usb 5-1: config 0 descriptor?? [ 131.535347][ T6977] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 131.544910][ T5789] iowarrior 5-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 131.657771][ T48] usb 4-1: new high-speed USB device number 22 using dummy_hcd [ 131.722494][ T30] audit: type=1400 audit(1788493738.760:333): avc: denied { ioctl } for pid=6994 comm="syz.2.440" path="/dev/vhost-vsock" dev="devtmpfs" ino=1272 ioctlcmd=0xaf01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 131.748343][ T10] usb 1-1: new high-speed USB device number 29 using dummy_hcd [ 131.772498][ T5789] usb 5-1: USB disconnect, device number 34 [ 131.838181][ T48] usb 4-1: New USB device found, idVendor=1a86, idProduct=7522, bcdDevice=35.36 [ 131.839002][ T48] usb 4-1: config index 0 descriptor too short (expected 77, got 18) [ 131.839022][ T48] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 131.839036][ T48] usb 4-1: config 0 has no interfaces? [ 131.840911][ T48] usb 4-1: New USB device strings: Mfr=241, Product=2, SerialNumber=3 [ 131.840932][ T48] usb 4-1: Product: syz [ 131.840944][ T48] usb 4-1: Manufacturer: syz [ 131.840956][ T48] usb 4-1: SerialNumber: syz [ 131.848579][ T48] usb 4-1: config 0 descriptor?? [ 131.888774][ T10] usb 1-1: device descriptor read/64, error -71 [ 132.055675][ T48] usb 4-1: USB disconnect, device number 22 [ 132.127851][ T10] usb 1-1: new high-speed USB device number 30 using dummy_hcd [ 132.258942][ T10] usb 1-1: device descriptor read/64, error -71 [ 132.314484][ T7012] netlink: 8 bytes leftover after parsing attributes in process `syz.4.447'. [ 132.371237][ T10] usb usb1-port1: attempt power cycle [ 132.375906][ T7014] netlink: 24 bytes leftover after parsing attributes in process `syz.2.448'. [ 132.376060][ T7014] netlink: 24 bytes leftover after parsing attributes in process `syz.2.448'. [ 132.402817][ T7016] netlink: 16 bytes leftover after parsing attributes in process `syz.4.449'. [ 132.404443][ T7016] bridge0: port 1(bridge_slave_0) entered disabled state [ 132.477831][ T5726] usb 2-1: new high-speed USB device number 17 using dummy_hcd [ 132.520454][ T7021] netlink: 16402 bytes leftover after parsing attributes in process `syz.2.451'. [ 132.629970][ T5726] usb 2-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 132.641439][ T5726] usb 2-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 132.641484][ T5726] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 132.641503][ T5726] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 132.641532][ T5726] usb 2-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 132.642844][ T5726] usb 2-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 132.642863][ T5726] usb 2-1: Product: syz [ 132.642876][ T5726] usb 2-1: Manufacturer: syz [ 132.658348][ T5726] cdc_wdm 2-1:1.0: skipping garbage [ 132.658367][ T5726] cdc_wdm 2-1:1.0: skipping garbage [ 132.658377][ T5726] cdc_wdm 2-1:1.0: skipping garbage [ 132.658393][ T5726] cdc_wdm 2-1:1.0: probe with driver cdc_wdm failed with error -22 [ 132.697755][ T48] usb 5-1: new high-speed USB device number 35 using dummy_hcd [ 132.729385][ T10] usb 1-1: new high-speed USB device number 31 using dummy_hcd [ 132.758348][ T10] usb 1-1: device descriptor read/8, error -71 [ 132.860806][ T48] usb 5-1: New USB device found, idVendor=0dba, idProduct=1000, bcdDevice= 0.40 [ 132.863066][ T48] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 132.863088][ T48] usb 5-1: config 1 has 0 interfaces, different from the descriptor's value: 3 [ 132.866086][ T48] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 132.866108][ T48] usb 5-1: Product: syz [ 132.866119][ T48] usb 5-1: Manufacturer: syz [ 132.866132][ T48] usb 5-1: SerialNumber: syz [ 132.877764][ T5726] usb 2-1: USB disconnect, device number 17 [ 133.037690][ T10] usb 1-1: new high-speed USB device number 32 using dummy_hcd [ 133.058247][ T10] usb 1-1: device descriptor read/8, error -71 [ 133.167939][ T10] usb usb1-port1: unable to enumerate USB device [ 133.177781][ T5789] usb 3-1: new high-speed USB device number 22 using dummy_hcd [ 133.240357][ T48] usb 5-1: USB disconnect, device number 35 [ 133.327668][ T5789] usb 3-1: Using ep0 maxpacket: 8 [ 133.333581][ T5789] usb 3-1: New USB device found, idVendor=06cd, idProduct=0202, bcdDevice=c3.d4 [ 133.334976][ T5789] usb 3-1: unable to read config index 0 descriptor/start: -61 [ 133.335001][ T5789] usb 3-1: can't read configurations, error -61 [ 133.407901][ T5726] usb 2-1: new high-speed USB device number 18 using dummy_hcd [ 133.457780][ T5789] usb 3-1: new high-speed USB device number 23 using dummy_hcd [ 133.579241][ T5726] usb 2-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 133.589952][ T5726] usb 2-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 133.589987][ T5726] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 133.590005][ T5726] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 133.590037][ T5726] usb 2-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 133.609326][ T5789] usb 3-1: Using ep0 maxpacket: 8 [ 133.632740][ T5789] usb 3-1: New USB device found, idVendor=06cd, idProduct=0202, bcdDevice=c3.d4 [ 133.649849][ T5726] usb 2-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 133.649889][ T5726] usb 2-1: Product: syz [ 133.649903][ T5726] usb 2-1: Manufacturer: syz [ 133.670015][ T5789] usb 3-1: unable to read config index 0 descriptor/start: -61 [ 133.671369][ T5726] cdc_wdm 2-1:1.0: skipping garbage [ 133.671383][ T5726] cdc_wdm 2-1:1.0: skipping garbage [ 133.671393][ T5726] cdc_wdm 2-1:1.0: skipping garbage [ 133.671410][ T5726] cdc_wdm 2-1:1.0: probe with driver cdc_wdm failed with error -22 [ 133.683076][ T5789] usb 3-1: can't read configurations, error -61 [ 133.702080][ T5789] usb usb3-port1: attempt power cycle [ 133.877091][ T5726] usb 2-1: USB disconnect, device number 18 [ 134.047728][ T5789] usb 3-1: new high-speed USB device number 24 using dummy_hcd [ 134.068135][ T5789] usb 3-1: Using ep0 maxpacket: 8 [ 134.073570][ T5789] usb 3-1: New USB device found, idVendor=06cd, idProduct=0202, bcdDevice=c3.d4 [ 134.074811][ T5789] usb 3-1: unable to read config index 0 descriptor/start: -61 [ 134.074837][ T5789] usb 3-1: can't read configurations, error -61 [ 134.197736][ T5789] usb 3-1: new high-speed USB device number 25 using dummy_hcd [ 134.218219][ T5789] usb 3-1: Using ep0 maxpacket: 8 [ 134.218749][ T5789] usb 3-1: New USB device found, idVendor=06cd, idProduct=0202, bcdDevice=c3.d4 [ 134.220148][ T5789] usb 3-1: unable to read config index 0 descriptor/start: -61 [ 134.220173][ T5789] usb 3-1: can't read configurations, error -61 [ 134.220436][ T5789] usb usb3-port1: unable to enumerate USB device [ 134.623668][ T7061] syzkaller0: entered promiscuous mode [ 134.623699][ T7061] syzkaller0: entered allmulticast mode [ 134.888350][ T5588] usb 4-1: new high-speed USB device number 23 using dummy_hcd [ 135.049587][ T5588] usb 4-1: New USB device found, idVendor=1a86, idProduct=7522, bcdDevice=35.36 [ 135.059733][ T5588] usb 4-1: config index 0 descriptor too short (expected 78, got 18) [ 135.059771][ T5588] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 135.059802][ T5588] usb 4-1: config 0 has no interfaces? [ 135.085087][ T5588] usb 4-1: New USB device strings: Mfr=241, Product=2, SerialNumber=3 [ 135.093564][ T5588] usb 4-1: Product: syz [ 135.093586][ T5588] usb 4-1: Manufacturer: syz [ 135.093601][ T5588] usb 4-1: SerialNumber: syz [ 135.109169][ T5588] usb 4-1: config 0 descriptor?? [ 135.217723][ T10] usb 5-1: new full-speed USB device number 36 using dummy_hcd [ 135.321790][ T5588] usb 4-1: USB disconnect, device number 23 [ 135.368350][ T10] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 135.369210][ T10] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 65535, setting to 64 [ 135.369243][ T10] usb 5-1: config 1 interface 1 altsetting 1 endpoint 0x82 has invalid maxpacket 1024, setting to 64 [ 135.369264][ T10] usb 5-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid maxpacket 512, setting to 64 [ 135.371449][ T10] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 135.371468][ T10] usb 5-1: Product: syz [ 135.371480][ T10] usb 5-1: Manufacturer: syz [ 135.371493][ T10] usb 5-1: SerialNumber: syz [ 135.379240][ T10] cdc_mbim 5-1:1.0: skipping garbage [ 135.515065][ T7071] syz.0.468 invoked oom-killer: gfp_mask=0x442dc0(GFP_KERNEL_ACCOUNT|__GFP_ZERO|__GFP_NOWARN|__GFP_COMP), order=1, oom_score_adj=1000 [ 135.515151][ T7071] CPU: 0 UID: 0 PID: 7071 Comm: syz.0.468 Not tainted syzkaller #0 PREEMPT(full) [ 135.515176][ T7071] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 135.515186][ T7071] Call Trace: [ 135.515193][ T7071] [ 135.515199][ T7071] dump_stack_lvl+0x100/0x190 [ 135.515228][ T7071] dump_header+0xfb/0x606 [ 135.515250][ T7071] oom_kill_process.cold+0xd/0x380 [ 135.515271][ T7071] out_of_memory+0x340/0x14f0 [ 135.515295][ T7071] ? __pfx_out_of_memory+0x10/0x10 [ 135.515321][ T7071] mem_cgroup_out_of_memory+0xc6/0x130 [ 135.515339][ T7071] ? __pfx_mem_cgroup_out_of_memory+0x10/0x10 [ 135.515354][ T7071] ? find_held_lock+0x2b/0x80 [ 135.515387][ T7071] ? do_raw_spin_unlock+0x145/0x1e0 [ 135.515408][ T7071] ? _raw_spin_unlock+0x28/0x50 [ 135.515438][ T7071] try_charge_memcg+0x783/0xf60 [ 135.515466][ T7071] ? __pfx_try_charge_memcg+0x10/0x10 [ 135.515488][ T7071] ? find_held_lock+0x2b/0x80 [ 135.515510][ T7071] ? rcu_read_unlock+0x17/0x60 [ 135.515534][ T7071] ? rcu_read_unlock+0x17/0x60 [ 135.515562][ T7071] obj_cgroup_charge_pages+0x22/0x1d0 [ 135.515586][ T7071] __memcg_kmem_charge_page+0x1c4/0x4d0 [ 135.515615][ T7071] __alloc_frozen_pages_noprof+0x534/0x3300 [ 135.515643][ T7071] ? __pfx_stack_trace_save+0x10/0x10 [ 135.515667][ T7071] ? stack_depot_save_flags+0x27/0x9f0 [ 135.515684][ T7071] ? arch_stack_walk+0xa6/0xf0 [ 135.515703][ T7071] ? inat_get_opcode_attribute+0xf/0x60 [ 135.515730][ T7071] ? kasan_save_stack+0x3f/0x50 [ 135.515747][ T7071] ? kasan_save_stack+0x30/0x50 [ 135.515762][ T7071] ? kasan_save_track+0x14/0x30 [ 135.515777][ T7071] ? __kasan_kmalloc+0xaa/0xb0 [ 135.515792][ T7071] ? __kvmalloc_node_noprof+0x35b/0x9b0 [ 135.515809][ T7071] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 135.515835][ T7071] ? do_syscall_64+0x123/0x790 [ 135.515875][ T7071] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 135.515895][ T7071] ? policy_nodemask+0xed/0x4f0 [ 135.515917][ T7071] alloc_pages_mpol+0x201/0x550 [ 135.515938][ T7071] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 135.515964][ T7071] alloc_pages_noprof+0x1a/0x160 [ 135.515987][ T7071] io_create_region+0x8fe/0xdc0 [ 135.516012][ T7071] ? __pfx_io_create_region+0x10/0x10 [ 135.516031][ T7071] ? rcu_is_watching+0x13/0xc0 [ 135.516051][ T7071] ? cap_capable+0x107/0x430 [ 135.516075][ T7071] ? bpf_lsm_capable+0x9/0x10 [ 135.516095][ T7071] ? security_capable+0x80/0x260 [ 135.516118][ T7071] io_uring_setup.cold+0x10f9/0x1cde [ 135.516137][ T7071] ? lock_acquire+0x1d1/0x380 [ 135.516153][ T7071] ? avc_has_perm_noaudit+0x56/0x3b0 [ 135.516172][ T7071] ? __pfx_io_uring_setup+0x10/0x10 [ 135.516187][ T7071] ? find_held_lock+0x2b/0x80 [ 135.516224][ T7071] ? xfd_validate_state+0x129/0x190 [ 135.516242][ T7071] ? arch_syscall_is_vdso_sigreturn+0xb6/0x200 [ 135.516266][ T7071] __x64_sys_io_uring_setup+0xc2/0x170 [ 135.516283][ T7071] do_syscall_64+0x123/0x790 [ 135.516303][ T7071] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 135.516321][ T7071] RIP: 0033:0x7fe317d9e159 [ 135.516336][ T7071] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 135.516351][ T7071] RSP: 002b:00007fe318c5dfb8 EFLAGS: 00000206 ORIG_RAX: 00000000000001a9 [ 135.516370][ T7071] RAX: ffffffffffffffda RBX: 0000200000000340 RCX: 00007fe317d9e159 [ 135.516387][ T7071] RDX: 0000200000000080 RSI: 0000200000000340 RDI: 0000000000000023 [ 135.516397][ T7071] RBP: 00007fe317e35024 R08: 0000000000000000 R09: 0000000000000000 [ 135.516407][ T7071] R10: 0000200000000140 R11: 0000000000000206 R12: 0000200000000080 [ 135.516417][ T7071] R13: 0000200000000140 R14: 00002000000001c0 R15: 00007fff0ad2f1b8 [ 135.516440][ T7071] [ 135.516507][ T7071] memory: usage 96kB, limit 96kB, failcnt 299 [ 135.516518][ T7071] memory+swap: usage 96kB, limit 9007199254740988kB, failcnt 0 [ 135.516530][ T7071] kmem: usage 96kB, limit 9007199254740988kB, failcnt 0 [ 135.516540][ T7071] Memory cgroup stats for /syz0/test: [ 135.516672][ T7071] cache 0 [ 135.516679][ T7071] rss 0 [ 135.516685][ T7071] rss_huge 0 [ 135.516690][ T7071] shmem 0 [ 135.516696][ T7071] mapped_file 0 [ 135.516701][ T7071] dirty 0 [ 135.516707][ T7071] writeback 0 [ 135.516713][ T7071] workingset_refault_anon 0 [ 135.516720][ T7071] workingset_refault_file 0 [ 135.516727][ T7071] swap 0 [ 135.516750][ T7071] swapcached 0 [ 135.516756][ T7071] pgpgin 16 [ 135.516762][ T7071] pgpgout 16 [ 135.516768][ T7071] pgfault 32 [ 135.516775][ T7071] pgmajfault 0 [ 135.516781][ T7071] inactive_anon 0 [ 135.516787][ T7071] active_anon 0 [ 135.516793][ T7071] inactive_file 0 [ 135.516800][ T7071] active_file 0 [ 135.516806][ T7071] unevictable 0 [ 135.516812][ T7071] hierarchical_memory_limit 98304 [ 135.516819][ T7071] hierarchical_memsw_limit 9223372036854771712 [ 135.516826][ T7071] total_cache 0 [ 135.516831][ T7071] total_rss 0 [ 135.516837][ T7071] total_rss_huge 0 [ 135.516842][ T7071] total_shmem 0 [ 135.516848][ T7071] total_mapped_file 0 [ 135.516854][ T7071] total_dirty 0 [ 135.516860][ T7071] total_writeback 0 [ 135.516866][ T7071] total_workingset_refault_anon 0 [ 135.516890][ T7071] total_workingset_refault_file 0 [ 135.516897][ T7071] total_swap 0 [ 135.516902][ T7071] total_swapcached 0 [ 135.516908][ T7071] total_pgpgin 16 [ 135.516913][ T7071] total_pgpgout 16 [ 135.516919][ T7071] total_pgfault 32 [ 135.516925][ T7071] total_pgmajfault 0 [ 135.516931][ T7071] total_inactive_anon 0 [ 135.516937][ T7071] total_active_anon 0 [ 135.516943][ T7071] total_inactive_file 0 [ 135.516948][ T7071] total_active_file 0 [ 135.516954][ T7071] total_unevictable 0 [ 135.516960][ T7071] anon_cost 0 [ 135.516965][ T7071] file_cost 0 [ 135.516971][ T7071] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0-1,oom_memcg=/syz0/test,task_memcg=/syz0/test,task=syz.0.468,pid=7070,uid=0 [ 135.517083][ T7071] Memory cgroup out of memory: Killed process 7070 (syz.0.468) total-vm:102312kB, anon-rss:1420kB, file-rss:22928kB, shmem-rss:5340kB, UID:0 pgtables:160kB oom_score_adj:1000 [ 135.591389][ T7068] raw-gadget.2 gadget.4: fail, usb_ep_enable returned -22 [ 135.591490][ T7068] raw-gadget.2 gadget.4: fail, usb_ep_enable returned -22 [ 135.900663][ T5786] usb 2-1: new high-speed USB device number 19 using dummy_hcd [ 136.053713][ T5786] usb 2-1: New USB device found, idVendor=0dba, idProduct=1000, bcdDevice= 0.40 [ 136.056428][ T5786] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 136.056448][ T5786] usb 2-1: config 1 has 0 interfaces, different from the descriptor's value: 3 [ 136.058535][ T5786] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 136.058555][ T5786] usb 2-1: Product: syz [ 136.058566][ T5786] usb 2-1: Manufacturer: syz [ 136.058577][ T5786] usb 2-1: SerialNumber: syz [ 136.092586][ T10] cdc_mbim 5-1:1.0: failed GET_NTB_PARAMETERS [ 136.092652][ T10] cdc_mbim 5-1:1.0: bind() failure [ 136.139825][ T10] cdc_ncm 5-1:1.1: CDC Union missing and no IAD found [ 136.139865][ T10] cdc_ncm 5-1:1.1: bind() failure [ 136.167873][ T10] usb 5-1: USB disconnect, device number 36 [ 136.241200][ T30] audit: type=1400 audit(1788493743.280:334): avc: denied { setopt } for pid=7082 comm="syz.3.473" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 136.276094][ T7080] syzkaller0: entered promiscuous mode [ 136.282200][ T7080] syzkaller0: entered allmulticast mode [ 136.345329][ T7086] __nla_validate_parse: 3 callbacks suppressed [ 136.351678][ T7086] netlink: 16 bytes leftover after parsing attributes in process `syz.1.469'. [ 136.484075][ T30] audit: type=1400 audit(1788493743.520:335): avc: denied { write } for pid=7090 comm="syz.0.475" name="iommu" dev="devtmpfs" ino=624 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 136.507063][ T30] audit: type=1400 audit(1788493743.520:336): avc: denied { open } for pid=7090 comm="syz.0.475" path="/dev/iommu" dev="devtmpfs" ino=624 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 136.507125][ T30] audit: type=1400 audit(1788493743.540:337): avc: denied { ioctl } for pid=7090 comm="syz.0.475" path="/dev/iommu" dev="devtmpfs" ino=624 ioctlcmd=0x3b81 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 136.530481][ T30] audit: type=1400 audit(1788493743.550:338): avc: denied { read } for pid=7090 comm="syz.0.475" name="raw-gadget" dev="devtmpfs" ino=814 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 136.678785][ T5786] usb 2-1: USB disconnect, device number 19 [ 136.748654][ T10] usb 1-1: new high-speed USB device number 33 using dummy_hcd [ 136.907910][ T10] usb 1-1: New USB device found, idVendor=2040, idProduct=4900, bcdDevice=4d.8b [ 136.919086][ T10] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 136.919151][ T10] usb 1-1: config 0 has no interfaces? [ 136.919179][ T10] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 136.921149][ T10] usb 1-1: config 0 descriptor?? [ 137.007736][ T48] usb 4-1: new high-speed USB device number 24 using dummy_hcd [ 137.158313][ T48] usb 4-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice=8b.40 [ 137.169447][ T48] usb 4-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 137.169499][ T48] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 137.169525][ T48] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 137.169546][ T48] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 137.215497][ T48] usb 4-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 137.223657][ T48] usb 4-1: Manufacturer: syz [ 137.230467][ T48] usb 4-1: config 0 descriptor?? [ 137.655349][ T48] appleir 0003:05AC:8243.0008: unknown main item tag 0x0 [ 137.682704][ T48] appleir 0003:05AC:8243.0008: hiddev0,hidraw0: USB HID v0.00 Device [syz] on usb-dummy_hcd.3-1/input0 [ 137.905666][ T7120] syzkaller0: entered promiscuous mode [ 137.912592][ T7120] syzkaller0: entered allmulticast mode [ 138.177687][ T48] usb 3-1: new high-speed USB device number 26 using dummy_hcd [ 138.191406][ T7124] dvmrp0: entered allmulticast mode [ 138.278134][ T7126] syzkaller0: entered promiscuous mode [ 138.284017][ T7126] syzkaller0: entered allmulticast mode [ 138.338202][ T48] usb 3-1: New USB device found, idVendor=1a86, idProduct=7522, bcdDevice=35.36 [ 138.348417][ T48] usb 3-1: config index 0 descriptor too short (expected 82, got 18) [ 138.356621][ T48] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 138.366296][ T7128] netlink: 24 bytes leftover after parsing attributes in process `syz.1.487'. [ 138.366411][ T7128] netlink: 24 bytes leftover after parsing attributes in process `syz.1.487'. [ 138.367919][ T48] usb 3-1: config 0 has no interfaces? [ 138.395634][ T48] usb 3-1: New USB device strings: Mfr=241, Product=2, SerialNumber=3 [ 138.395672][ T48] usb 3-1: Product: syz [ 138.395697][ T48] usb 3-1: Manufacturer: syz [ 138.395713][ T48] usb 3-1: SerialNumber: syz [ 138.421102][ T48] usb 3-1: config 0 descriptor?? [ 138.637539][ T5726] usb 3-1: USB disconnect, device number 26 [ 138.727791][ T10] usb 2-1: new high-speed USB device number 20 using dummy_hcd [ 138.828109][ T48] usb 5-1: new high-speed USB device number 37 using dummy_hcd [ 138.878256][ T10] usb 2-1: New USB device found, idVendor=04fc, idProduct=504a, bcdDevice=43.02 [ 138.890585][ T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 138.890619][ T10] usb 2-1: Product: syz [ 138.890632][ T10] usb 2-1: Manufacturer: syz [ 138.890645][ T10] usb 2-1: SerialNumber: syz [ 138.892688][ T10] usb 2-1: config 0 descriptor?? [ 138.899427][ T10] gspca_main: sunplus-2.14.0 probing 04fc:504a [ 139.011876][ T48] usb 5-1: New USB device found, idVendor=0dba, idProduct=1000, bcdDevice= 0.40 [ 139.022607][ T48] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 139.033203][ T48] usb 5-1: config 1 has 0 interfaces, different from the descriptor's value: 3 [ 139.044893][ T48] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 139.053105][ T48] usb 5-1: Product: syz [ 139.053126][ T48] usb 5-1: Manufacturer: syz [ 139.053139][ T48] usb 5-1: SerialNumber: syz [ 139.326975][ T7140] netlink: 16 bytes leftover after parsing attributes in process `syz.4.490'. [ 139.346124][ T7141] netlink: 4 bytes leftover after parsing attributes in process `syz.2.491'. [ 139.546968][ T5789] usb 1-1: USB disconnect, device number 33 [ 139.630390][ T48] usb 5-1: USB disconnect, device number 37 [ 139.789416][ T5726] usb 4-1: USB disconnect, device number 24 [ 139.819177][ T10] gspca_sunplus: reg_w_riv err -110 [ 139.819255][ T10] sunplus 2-1:0.0: probe with driver sunplus failed with error -110 [ 140.057102][ T30] audit: type=1400 audit(1788493747.090:339): avc: denied { unlink } for pid=7157 comm="syz.2.498" name="#1" dev="tmpfs" ino=556 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 140.094719][ T30] audit: type=1400 audit(1788493747.130:340): avc: denied { mount } for pid=7157 comm="syz.2.498" name="/" dev="overlay" ino=551 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 140.496975][ T7170] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 140.596043][ T5726] usb 2-1: USB disconnect, device number 20 [ 140.821781][ T30] audit: type=1400 audit(1788493747.860:341): avc: denied { read } for pid=7181 comm="syz.3.506" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 140.847945][ T5789] usb 5-1: new high-speed USB device number 38 using dummy_hcd [ 141.000349][ T5789] usb 5-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 141.000427][ T5789] usb 5-1: too many configurations: 9, using maximum allowed: 8 [ 141.001629][ T5789] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 141.002193][ T5789] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 141.002217][ T5789] usb 5-1: config 0 interface 0 has no altsetting 0 [ 141.003457][ T5789] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 141.003508][ T5789] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 141.003529][ T5789] usb 5-1: config 0 interface 0 has no altsetting 0 [ 141.004768][ T5789] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 141.004965][ T5789] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 141.005159][ T5789] usb 5-1: config 0 interface 0 has no altsetting 0 [ 141.007402][ T5789] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 141.007438][ T5789] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 141.007459][ T5789] usb 5-1: config 0 interface 0 has no altsetting 0 [ 141.008827][ T5789] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 141.008860][ T5789] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 141.008881][ T5789] usb 5-1: config 0 interface 0 has no altsetting 0 [ 141.009925][ T5789] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 141.009964][ T5789] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 141.009989][ T5789] usb 5-1: config 0 interface 0 has no altsetting 0 [ 141.010816][ T5789] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 141.010853][ T5789] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 141.010876][ T5789] usb 5-1: config 0 interface 0 has no altsetting 0 [ 141.011711][ T5789] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 141.011744][ T5789] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 141.011765][ T5789] usb 5-1: config 0 interface 0 has no altsetting 0 [ 141.016272][ T5789] usb 5-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 141.016299][ T5789] usb 5-1: Product: syz [ 141.016311][ T5789] usb 5-1: Manufacturer: syz [ 141.016323][ T5789] usb 5-1: SerialNumber: syz [ 141.022159][ T5789] usb 5-1: config 0 descriptor?? [ 141.044424][ T5789] yurex 5-1:0.0: USB YUREX device now attached to Yurex #0 [ 141.342907][ T30] audit: type=1400 audit(1788493748.380:342): avc: denied { getopt } for pid=7187 comm="syz.2.507" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 141.770895][ T5726] usb 2-1: new high-speed USB device number 21 using dummy_hcd [ 141.927691][ T5726] usb 2-1: Using ep0 maxpacket: 16 [ 141.933596][ T5726] usb 2-1: New USB device found, idVendor=2ef5, idProduct=000a, bcdDevice=c5.7a [ 141.945327][ T7199] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 141.966241][ T5726] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 141.966279][ T5726] usb 2-1: Product: syz [ 141.966309][ T5726] usb 2-1: Manufacturer: syz [ 141.966327][ T5726] usb 2-1: SerialNumber: syz [ 142.206134][ T5726] plfxlc 2-1:251.0: Firmware Version: 0 [ 142.212274][ T5726] plfxlc 2-1:251.0: Unit type is station [ 142.468771][ T5726] plfxlc 2-1:251.0: vendor command failed (-71) [ 142.475131][ T5726] plfxlc 2-1:251.0: FPGA download failed (-22) [ 142.497927][ T7218] 9pnet_virtio: no channels available for device ./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa [ 142.527697][ T48] usb 4-1: new high-speed USB device number 25 using dummy_hcd [ 142.549254][ T7218] @0Ù: renamed from bond_slave_1 (while UP) [ 142.644970][ T5726] plfxlc 2-1:251.0: pureLifi:Device error [ 142.645025][ T5726] plfxlc 2-1:251.0: probe with driver plfxlc failed with error -22 [ 142.653094][ T5726] usb 2-1: USB disconnect, device number 21 [ 142.715339][ T48] usb 4-1: Using ep0 maxpacket: 16 [ 142.720509][ T48] usb 4-1: unable to get BOS descriptor or descriptor too short [ 142.720547][ T48] usb 4-1: New USB device found, idVendor=1aca, idProduct=b28e, bcdDevice=92.32 [ 142.722880][ T48] usb 4-1: config 13 has an invalid descriptor of length 0, skipping remainder of the config [ 142.722902][ T48] usb 4-1: config 13 has 0 interfaces, different from the descriptor's value: 1 [ 142.724553][ T48] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 142.724572][ T48] usb 4-1: Product: syz [ 142.724584][ T48] usb 4-1: Manufacturer: syz [ 142.724596][ T48] usb 4-1: SerialNumber: syz [ 142.950025][ T48] usb 4-1: USB disconnect, device number 25 [ 142.979972][ T5726] usb 2-1: new high-speed USB device number 22 using dummy_hcd [ 143.127670][ T5726] usb 2-1: Using ep0 maxpacket: 16 [ 143.128242][ T5726] usb 2-1: New USB device found, idVendor=2ef5, idProduct=000a, bcdDevice=c5.7a [ 143.131880][ T5726] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 143.131900][ T5726] usb 2-1: Product: syz [ 143.131911][ T5726] usb 2-1: Manufacturer: syz [ 143.131924][ T5726] usb 2-1: SerialNumber: syz [ 143.208989][ T7226] socket: no more sockets [ 143.317869][ C0] usb 5-1: yurex_control_callback - control failed: -2 [ 143.318088][ C0] usb 5-1: yurex_control_callback - control failed: -32 [ 143.321001][ T48] usb 5-1: USB disconnect, device number 38 [ 143.328527][ T48] yurex 5-1:0.0: USB YUREX #0 now disconnected [ 143.349332][ T7191] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 143.354880][ T7191] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 143.357405][ T7191] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 143.359519][ T7191] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 143.363755][ T7191] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 143.364092][ T7191] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 143.374887][ T5726] plfxlc 2-1:251.0: Firmware Version: 0 [ 143.374921][ T5726] plfxlc 2-1:251.0: Unit type is station [ 143.540434][ T7233] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 143.599561][ T5726] plfxlc 2-1:251.0: vendor command failed (-71) [ 143.599600][ T5726] plfxlc 2-1:251.0: FPGA download failed (-22) [ 143.683268][ T7241] netlink: 24 bytes leftover after parsing attributes in process `syz.3.529'. [ 143.683383][ T7241] netlink: 24 bytes leftover after parsing attributes in process `syz.3.529'. [ 143.706937][ T5726] plfxlc 2-1:251.0: pureLifi:Device error [ 143.706979][ T5726] plfxlc 2-1:251.0: probe with driver plfxlc failed with error -22 [ 143.713855][ T5726] usb 2-1: USB disconnect, device number 22 [ 143.768843][ T7243] i2c i2c-0: dtv_property_process_set: SET cmd 0x00000000 undefined [ 143.887920][ T5789] usb 3-1: new full-speed USB device number 27 using dummy_hcd [ 144.038889][ T5789] usb 3-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 144.050123][ T5789] usb 3-1: config 0 has an invalid interface number: 8 but max is 0 [ 144.058415][ T5789] usb 3-1: config 0 has no interface number 0 [ 144.058480][ T5789] usb 3-1: config 0 interface 8 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 144.079519][ T5789] usb 3-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 144.087767][ T5789] usb 3-1: Product: syz [ 144.092018][ T5789] usb 3-1: SerialNumber: syz [ 144.101188][ T5789] usb 3-1: config 0 descriptor?? [ 144.111991][ T5789] usbhid 3-1:0.8: couldn't find an input interrupt endpoint [ 144.206769][ T7259] syzkaller0: entered promiscuous mode [ 144.206796][ T7259] syzkaller0: entered allmulticast mode [ 144.338813][ T5789] usb 3-1: USB disconnect, device number 27 [ 144.890708][ T7265] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 144.987942][ T7269] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 145.102379][ T7269] md: could not open device unknown-block(1,0). [ 145.142197][ T7277] netlink: 8 bytes leftover after parsing attributes in process `syz.4.544'. [ 145.196477][ T7279] netlink: 124 bytes leftover after parsing attributes in process `syz.1.545'. [ 145.226727][ T7269] md: pers->run() failed ... [ 145.372479][ T30] audit: type=1400 audit(1700006400.290:343): avc: denied { listen } for pid=7288 comm="syz.4.549" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 145.518108][ T30] audit: type=1400 audit(1700006400.440:344): avc: denied { bind } for pid=7296 comm="syz.4.553" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 145.567679][ T5789] usb 3-1: new high-speed USB device number 28 using dummy_hcd [ 145.724349][ T5789] usb 3-1: unable to get BOS descriptor or descriptor too short [ 145.724417][ T5789] usb 3-1: New USB device found, idVendor=100d, idProduct=3342, bcdDevice=99.ba [ 145.725255][ T5789] usb 3-1: config 8 has an invalid interface number: 129 but max is 1 [ 145.725275][ T5789] usb 3-1: config 8 has an invalid interface number: 158 but max is 1 [ 145.725291][ T5789] usb 3-1: config 8 has no interface number 0 [ 145.725305][ T5789] usb 3-1: config 8 has no interface number 1 [ 145.725403][ T5789] usb 3-1: config 8 interface 158 has no altsetting 0 [ 145.727032][ T5789] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 145.727051][ T5789] usb 3-1: Product: syz [ 145.727063][ T5789] usb 3-1: Manufacturer: syz [ 145.727075][ T5789] usb 3-1: SerialNumber: syz [ 145.974874][ T5789] cxacru 3-1:8.129: cxacru_bind: interface has incorrect endpoints [ 145.974981][ T5789] cxacru 3-1:8.129: usbatm_usb_probe: bind failed: -19! [ 145.986216][ T5789] cxacru 3-1:8.158: cxacru_bind: interface has incorrect endpoints [ 145.988185][ T5789] cxacru 3-1:8.158: usbatm_usb_probe: bind failed: -19! [ 145.998644][ T5789] usb 3-1: USB disconnect, device number 28 [ 146.189980][ T7311] netlink: 60 bytes leftover after parsing attributes in process `syz.0.558'. [ 146.234200][ T7314] devtmpfs: Cannot change global quota limit on remount [ 146.234304][ T30] audit: type=1400 audit(1700006401.150:345): avc: denied { remount } for pid=7312 comm="syz.4.559" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 146.441735][ T7325] bridge0: port 2(bridge_slave_1) entered disabled state [ 146.473227][ T7325] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 146.476586][ T7325] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 146.558038][ T61] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 146.558091][ T61] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 146.558118][ T61] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 146.558143][ T61] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 146.599953][ T7329] netlink: 16402 bytes leftover after parsing attributes in process `syz.2.565'. [ 146.610556][ T7328] netlink: 16402 bytes leftover after parsing attributes in process `syz.2.565'. [ 146.643323][ T30] audit: type=1400 audit(1700006401.560:346): avc: denied { mount } for pid=7330 comm="syz.4.566" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 146.665834][ T30] audit: type=1400 audit(1700006401.560:347): avc: denied { search } for pid=7330 comm="syz.4.566" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 146.665878][ T30] audit: type=1400 audit(1700006401.560:348): avc: denied { search } for pid=7330 comm="syz.4.566" name="instances" dev="tracefs" ino=4165 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 146.665914][ T30] audit: type=1400 audit(1700006401.560:349): avc: denied { write search } for pid=7330 comm="syz.4.566" name="instances" dev="tracefs" ino=4165 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 146.665950][ T30] audit: type=1400 audit(1700006401.570:350): avc: denied { add_name } for pid=7330 comm="syz.4.566" name="inst1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 146.665984][ T30] audit: type=1400 audit(1700006401.570:351): avc: denied { create } for pid=7330 comm="syz.4.566" name="inst1" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:tracefs_t tclass=dir permissive=1 [ 146.666058][ T5726] usb 1-1: new full-speed USB device number 34 using dummy_hcd [ 146.859284][ T5726] usb 1-1: not running at top speed; connect to a high speed hub [ 146.859327][ T5726] usb 1-1: New USB device found, idVendor=06cd, idProduct=0135, bcdDevice= 1.00 [ 146.877415][ T5726] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 146.877469][ T5726] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 146.877504][ T5726] usb 1-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 6 [ 146.877541][ T5726] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 146.936310][ T5726] keyspan 1-1:1.0: Keyspan 2 port adapter converter detected [ 146.949659][ T5726] keyspan 1-1:1.0: found no endpoint descriptor for endpoint 84 [ 146.957784][ T5726] keyspan 1-1:1.0: found no endpoint descriptor for endpoint 2 [ 146.969990][ T5726] usb 1-1: Keyspan 2 port adapter converter now attached to ttyUSB0 [ 146.980122][ T5726] keyspan 1-1:1.0: found no endpoint descriptor for endpoint 88 [ 146.989021][ T5726] keyspan 1-1:1.0: found no endpoint descriptor for endpoint 6 [ 147.003050][ T5726] usb 1-1: Keyspan 2 port adapter converter now attached to ttyUSB1 [ 147.015002][ T7331] Could not create tracefs 'print-parent' entry [ 147.043204][ T7331] Could not create tracefs 'sym-offset' entry [ 147.081475][ T7331] Could not create tracefs 'sym-addr' entry [ 147.093274][ T7331] Could not create tracefs 'verbose' entry [ 147.103129][ T7331] Could not create tracefs 'raw' entry [ 147.113171][ T7331] Could not create tracefs 'hex' entry [ 147.122820][ T7331] Could not create tracefs 'bin' entry [ 147.143973][ T7331] Could not create tracefs 'block' entry [ 147.174436][ T7331] Could not create tracefs 'fields' entry [ 147.205250][ T7331] Could not create tracefs 'annotate' entry [ 147.245561][ T7331] Could not create tracefs 'userstacktrace' entry [ 147.288890][ T7331] Could not create tracefs 'sym-userobj' entry [ 147.310290][ T7331] Could not create tracefs 'context-info' entry [ 147.329866][ T7331] Could not create tracefs 'latency-format' entry [ 147.346463][ T7331] Could not create tracefs 'record-tgid' entry [ 147.363969][ T7331] Could not create tracefs 'overwrite' entry [ 147.381415][ T7331] Could not create tracefs 'disable_on_free' entry [ 147.397760][ T7331] Could not create tracefs 'irq-info' entry [ 147.414951][ T7331] Could not create tracefs 'markers' entry [ 147.430941][ T7331] Could not create tracefs 'event-fork' entry [ 147.450392][ T7331] Could not create tracefs 'trace_printk_dest' entry [ 147.468340][ T7331] Could not create tracefs 'copy_trace_marker' entry [ 147.486444][ T7331] Could not create tracefs 'pause-on-trace' entry [ 147.509397][ T5789] usb 1-1: USB disconnect, device number 34 [ 147.540823][ T5789] keyspan_2 ttyUSB0: Keyspan 2 port adapter converter now disconnected from ttyUSB0 [ 147.565825][ T7331] Could not create tracefs 'hash-ptr' entry [ 147.570943][ T5789] keyspan_2 ttyUSB1: Keyspan 2 port adapter converter now disconnected from ttyUSB1 [ 147.571505][ T5789] keyspan 1-1:1.0: device disconnected [ 147.602368][ T7331] Could not create tracefs 'bitmask-list' entry [ 147.629930][ T7331] Could not create tracefs 'stacktrace' entry [ 147.645591][ T7331] ERROR: Could not create tracefs directory 'per_cpu/0' [ 147.683440][ T7345] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 147.685554][ T7331] Could not create tracefs 'free_buffer' entry [ 147.700719][ T7331] Could not create tracefs 'trace_marker' entry [ 147.715021][ T7331] Could not create tracefs 'trace_marker_raw' entry [ 147.726309][ T7331] Could not create tracefs 'buffer_percent' entry [ 147.735561][ T7331] Could not create tracefs 'syscall_user_buf_size' entry [ 147.737873][ T7345] md: array md0 already has disks! [ 147.745143][ T7331] Could not create tracefs 'tracing_on' entry [ 147.753880][ T7331] Could not create tracefs 'error_log' entry [ 147.767313][ T7331] Could not create tracefs 'test_nop_accept' entry [ 147.767348][ T7331] ERROR: Failed to create trace option: test_nop_accept [ 147.778053][ T7331] Could not create tracefs 'test_nop_refuse' entry [ 147.806379][ T30] audit: type=1400 audit(1700006402.720:352): avc: denied { unmount } for pid=5600 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 147.828460][ T5726] usb 4-1: new high-speed USB device number 26 using dummy_hcd [ 147.881020][ T7345] md/raid1:md0: active with 1 out of 2 mirrors [ 147.892694][ T7345] md0: detected capacity change from 0 to 8192 [ 147.904406][ T7350] md_update_sb: can't update sb for read-only array md0 [ 147.987058][ T7354] bridge_slave_0: left allmulticast mode [ 147.987103][ T7354] bridge_slave_0: left promiscuous mode [ 147.993025][ T5726] usb 4-1: Using ep0 maxpacket: 16 [ 148.006570][ T7354] bridge0: port 1(bridge_slave_0) entered disabled state [ 148.006746][ T7355] md: recover of RAID array md0 [ 148.020181][ T5726] usb 4-1: unable to get BOS descriptor or descriptor too short [ 148.020237][ T5726] usb 4-1: New USB device found, idVendor=1aca, idProduct=b28e, bcdDevice=92.32 [ 148.040577][ T5726] usb 4-1: config 13 has an invalid interface number: 50 but max is 0 [ 148.040617][ T5726] usb 4-1: config 13 has an invalid descriptor of length 0, skipping remainder of the config [ 148.040646][ T5726] usb 4-1: config 13 has no interface number 0 [ 148.040685][ T5726] usb 4-1: config 13 interface 50 altsetting 167 bulk endpoint 0x88 has invalid maxpacket 16 [ 148.040708][ T5726] usb 4-1: config 13 interface 50 altsetting 167 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 148.040747][ T5726] usb 4-1: config 13 interface 50 has no altsetting 0 [ 148.090565][ T7354] bridge_slave_1: left allmulticast mode [ 148.090589][ T7354] bridge_slave_1: left promiscuous mode [ 148.090756][ T7354] bridge0: port 2(bridge_slave_1) entered disabled state [ 148.116815][ T5726] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 148.116850][ T5726] usb 4-1: Product: syz [ 148.116875][ T5726] usb 4-1: Manufacturer: syz [ 148.116891][ T5726] usb 4-1: SerialNumber: syz [ 148.141910][ T7341] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 148.142678][ T7354] bond1: (slave veth0_to_bond): Releasing backup interface [ 148.142696][ T7354] bond1: (slave veth0_to_bond): the permanent HWaddr of slave - aa:aa:aa:aa:aa:1d - is still in use by bond - set the HWaddr of slave to a different address to avoid conflicts [ 148.182390][ T30] audit: type=1400 audit(1700006403.100:353): avc: denied { mount } for pid=7358 comm="syz.2.576" name="/" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=filesystem permissive=1 [ 148.211035][ T7355] md: md0: recover done. [ 148.221398][ T7354] bond0: (slave bond_slave_0): Releasing backup interface [ 148.255793][ T30] audit: type=1400 audit(1700006403.170:354): avc: denied { unmount } for pid=5606 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=filesystem permissive=1 [ 148.256414][ T7354] bond0: (slave bond_slave_1): Releasing backup interface [ 148.294948][ T7354] team0: Port device team_slave_0 removed [ 148.314197][ T7354] team0: Port device team_slave_1 removed [ 148.320775][ T7354] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 148.341880][ T7354] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 148.363753][ T7354] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 148.385844][ T5726] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 148.385900][ T5726] usb 4-1: MIDIStreaming interface descriptor not found [ 148.460447][ T5726] usb 4-1: USB disconnect, device number 26 [ 148.631197][ T5856] udevd[5856]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:13.50/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 148.710490][ T7382] tipc: Started in network mode [ 148.715529][ T7382] tipc: Node identity 4aeba83836ee, cluster identity 4711 [ 148.723013][ T7382] tipc: Enabled bearer , priority 0 [ 148.731963][ T7382] tipc: Resetting bearer [ 148.765729][ T7386] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 148.777381][ T7381] tipc: Disabling bearer [ 148.802767][ T30] audit: type=1400 audit(1700006403.720:355): avc: denied { create } for pid=7387 comm="syz.0.587" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 148.827960][ T7386] md: couldn't update array info. -22 [ 148.878752][ T7386] md: could not open device unknown-block(1,1). [ 148.878821][ T7386] md: md_import_device returned -16 [ 148.927861][ T48] usb 3-1: new high-speed USB device number 29 using dummy_hcd [ 149.018070][ T7399] netlink: 124 bytes leftover after parsing attributes in process `syz.4.592'. [ 149.088603][ T48] usb 3-1: New USB device found, idVendor=2040, idProduct=4900, bcdDevice=4d.8b [ 149.099768][ T48] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 149.110156][ T48] usb 3-1: config 0 has no interfaces? [ 149.110184][ T48] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 149.133499][ T48] usb 3-1: config 0 descriptor?? [ 149.167957][ T7407] FAULT_INJECTION: forcing a failure. [ 149.167957][ T7407] name failslab, interval 1, probability 0, space 0, times 1 [ 149.167997][ T7407] CPU: 1 UID: 0 PID: 7407 Comm: syz.3.596 Not tainted syzkaller #0 PREEMPT(full) [ 149.168014][ T7407] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 149.168025][ T7407] Call Trace: [ 149.168032][ T7407] [ 149.168039][ T7407] dump_stack_lvl+0x100/0x190 [ 149.168072][ T7407] should_fail_ex.cold+0x5/0xa [ 149.168097][ T7407] should_failslab+0xc2/0x120 [ 149.168119][ T7407] __kmalloc_noprof+0xfc/0x840 [ 149.168136][ T7407] ? tc_setup_action+0x16e/0xac0 [ 149.168162][ T7407] ? flow_action_cookie_create+0x21/0x80 [ 149.168194][ T7407] flow_action_cookie_create+0x21/0x80 [ 149.168221][ T7407] tc_setup_action+0x22e/0xac0 [ 149.168246][ T7407] ? lock_acquire+0x1d1/0x380 [ 149.168276][ T7407] ? tcf_mpls_offload_act_setup+0x3a9/0xb10 [ 149.168294][ T7407] ? __pfx_tc_setup_action+0x10/0x10 [ 149.168319][ T7407] ? __local_bh_enable_ip+0xa5/0x120 [ 149.168340][ T7407] tcf_action_offload_add_ex+0x38c/0x7b0 [ 149.168366][ T7407] ? __pfx_tcf_action_offload_add_ex+0x10/0x10 [ 149.168412][ T7407] ? tcf_action_fill_size+0x110/0x340 [ 149.168437][ T7407] ? tcf_action_fill_size+0x110/0x340 [ 149.168468][ T7407] tcf_action_init+0x679/0xa60 [ 149.168491][ T7407] ? __pfx_tcf_action_init+0x10/0x10 [ 149.168506][ T7407] ? find_held_lock+0x2b/0x80 [ 149.168567][ T7407] ? __lock_acquire+0x4c5/0x1ec0 [ 149.168586][ T7407] tcf_action_add+0xed/0x5c0 [ 149.168605][ T7407] ? __pfx_tcf_action_add+0x10/0x10 [ 149.168650][ T7407] ? __nla_parse+0x40/0x60 [ 149.168679][ T7407] tc_ctl_action+0x2e3/0x470 [ 149.168696][ T7407] ? __pfx_tc_ctl_action+0x10/0x10 [ 149.168719][ T7407] ? __pfx_tc_ctl_action+0x10/0x10 [ 149.168736][ T7407] rtnetlink_rcv_msg+0x3c9/0xe90 [ 149.168754][ T7407] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 149.168773][ T7407] ? __lock_acquire+0x4c5/0x1ec0 [ 149.168789][ T7407] ? __netlink_lookup+0xa9/0x900 [ 149.168812][ T7407] netlink_rcv_skb+0x159/0x420 [ 149.168834][ T7407] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 149.168850][ T7407] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 149.168882][ T7407] ? netlink_deliver_tap+0x1ae/0xcc0 [ 149.168906][ T7407] netlink_unicast+0x585/0x850 [ 149.168936][ T7407] ? __pfx_netlink_unicast+0x10/0x10 [ 149.168967][ T7407] netlink_sendmsg+0x8b0/0xda0 [ 149.168995][ T7407] ? __pfx_netlink_sendmsg+0x10/0x10 [ 149.169021][ T7407] ? selinux_socket_sendmsg+0x198/0x2f0 [ 149.169049][ T7407] ____sys_sendmsg+0xa4d/0xbe0 [ 149.169068][ T7407] ? __pfx_netlink_sendmsg+0x10/0x10 [ 149.169093][ T7407] ? __pfx_____sys_sendmsg+0x10/0x10 [ 149.169125][ T7407] ___sys_sendmsg+0x190/0x1e0 [ 149.169149][ T7407] ? __pfx____sys_sendmsg+0x10/0x10 [ 149.169171][ T7407] ? futex_wait+0x11e/0x370 [ 149.169208][ T7407] ? find_held_lock+0x2b/0x80 [ 149.169247][ T7407] __sys_sendmsg+0x160/0x210 [ 149.169282][ T7407] ? __pfx___sys_sendmsg+0x10/0x10 [ 149.169320][ T7407] do_syscall_64+0x123/0x790 [ 149.169344][ T7407] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 149.169363][ T7407] RIP: 0033:0x7f811739e159 [ 149.169379][ T7407] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 149.169397][ T7407] RSP: 002b:00007f8118182028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 149.169417][ T7407] RAX: ffffffffffffffda RBX: 00007f8117625fa0 RCX: 00007f811739e159 [ 149.169431][ T7407] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 0000000000000004 [ 149.169441][ T7407] RBP: 00007f8117435024 R08: 0000000000000000 R09: 0000000000000000 [ 149.169451][ T7407] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 149.169462][ T7407] R13: 00007f8117626038 R14: 00007f8117625fa0 R15: 00007ffc156275a8 [ 149.169485][ T7407] [ 149.387685][ T5789] usb 2-1: new high-speed USB device number 23 using dummy_hcd [ 149.542786][ T5789] usb 2-1: Using ep0 maxpacket: 8 [ 149.543333][ T5789] usb 2-1: New USB device found, idVendor=06cd, idProduct=0202, bcdDevice=c3.d4 [ 149.544157][ T5789] usb 2-1: config index 0 descriptor too short (expected 6427, got 27) [ 149.544175][ T5789] usb 2-1: config 0 has an invalid interface number: 21 but max is 0 [ 149.544197][ T5789] usb 2-1: config 0 has an invalid descriptor of length 255, skipping remainder of the config [ 149.544212][ T5789] usb 2-1: config 0 has no interface number 0 [ 149.544240][ T5789] usb 2-1: config 0 interface 21 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 149.545439][ T5789] usb 2-1: New USB device strings: Mfr=78, Product=1, SerialNumber=0 [ 149.545457][ T5789] usb 2-1: Product: syz [ 149.545469][ T5789] usb 2-1: Manufacturer: syz [ 149.556972][ T5789] usb 2-1: config 0 descriptor?? [ 149.715185][ T7419] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 149.747861][ T7419] md: couldn't update array info. -22 [ 149.797792][ T7419] md: could not open device unknown-block(1,1). [ 149.797858][ T7419] md: md_import_device returned -16 [ 149.908110][ T48] usb 4-1: new high-speed USB device number 27 using dummy_hcd [ 149.944293][ T5789] usb 2-1: USB disconnect, device number 23 [ 150.057676][ T48] usb 4-1: Using ep0 maxpacket: 8 [ 150.062045][ T48] usb 4-1: unable to get BOS descriptor or descriptor too short [ 150.062083][ T48] usb 4-1: New USB device found, idVendor=2b73, idProduct=0023, bcdDevice= 0.40 [ 150.065391][ T48] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 150.065413][ T48] usb 4-1: Product: syz [ 150.065425][ T48] usb 4-1: Manufacturer: syz [ 150.065438][ T48] usb 4-1: SerialNumber: syz [ 150.124074][ T48] usb 4-1: Audio class v2/v3 interfaces need an interface association [ 150.205709][ T48] snd-usb-audio 4-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 150.273472][ T5614] udevd[5614]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 150.319229][ T48] usb 4-1: USB disconnect, device number 27 [ 150.644465][ T7444] syzkaller0: entered promiscuous mode [ 150.647865][ T7444] syzkaller0: entered allmulticast mode [ 150.928632][ T7458] fuse: Bad value for 'fd' [ 151.712729][ T48] usb 3-1: USB disconnect, device number 29 [ 151.721951][ T7467] tipc: Enabling of bearer rejected, failed to enable media [ 152.917735][ T7451] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 152.917763][ T52] Bluetooth: hci0: command 0x0c1a tx timeout [ 153.809972][ T7451] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 153.810180][ T7451] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 153.810292][ T7451] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 153.810394][ T7451] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 153.948284][ T30] kauditd_printk_skb: 7 callbacks suppressed [ 153.948320][ T30] audit: type=1400 audit(1700006408.870:363): avc: denied { mount } for pid=7484 comm="syz.0.623" name="/" dev="securityfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=filesystem permissive=1 [ 153.960827][ T7485] ima: policy update failed [ 153.961068][ T30] audit: type=1802 audit(1700006408.870:364): pid=7485 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=policy_update cause=failed comm="syz.0.623" res=0 errno=0 [ 153.968458][ T7487] warning: `syz.1.624' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 154.037039][ T30] audit: type=1400 audit(1700006408.950:365): avc: denied { unmount } for pid=5599 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=filesystem permissive=1 [ 154.181693][ T30] audit: type=1400 audit(1700006409.100:366): avc: denied { connect } for pid=7498 comm="syz.0.631" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 154.233654][ T30] audit: type=1400 audit(1700006409.150:367): avc: denied { setopt } for pid=7498 comm="syz.0.631" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 154.296111][ T30] audit: type=1400 audit(1700006409.210:368): avc: denied { write } for pid=7503 comm="syz.2.632" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_rdma_socket permissive=1 [ 154.325549][ T7504] smbdirect: ib_dev[s`z1]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 154.340208][ T7504] smbdirect: ib_dev[s`z1]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 154.357261][ T7504] smbdirect: ib_dev[s`z1]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 154.371608][ T7504] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 154.376831][ T7493] socket: no more sockets [ 154.389838][ T7504] infiniband s`z1: RDMA CMA: cma_listen_on_dev, error -98 [ 154.428230][ T48] usb 4-1: new high-speed USB device number 28 using dummy_hcd [ 154.588235][ T48] usb 4-1: New USB device found, idVendor=04fc, idProduct=504a, bcdDevice=43.02 [ 154.590652][ T48] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 154.590674][ T48] usb 4-1: Product: syz [ 154.590686][ T48] usb 4-1: Manufacturer: syz [ 154.590698][ T48] usb 4-1: SerialNumber: syz [ 154.592848][ T48] usb 4-1: config 0 descriptor?? [ 154.595330][ T48] gspca_main: sunplus-2.14.0 probing 04fc:504a [ 154.707759][ T5726] usb 3-1: new full-speed USB device number 30 using dummy_hcd [ 154.799883][ T30] audit: type=1400 audit(1700006409.720:369): avc: denied { read write } for pid=7499 comm="syz.3.630" name="sg0" dev="devtmpfs" ino=900 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 154.823939][ T30] audit: type=1400 audit(1700006409.720:370): avc: denied { open } for pid=7499 comm="syz.3.630" path="/dev/sg0" dev="devtmpfs" ino=900 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 154.823978][ T30] audit: type=1400 audit(1700006409.720:371): avc: denied { ioctl } for pid=7499 comm="syz.3.630" path="/dev/sg0" dev="devtmpfs" ino=900 ioctlcmd=0x5393 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 154.879439][ T5726] usb 3-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 154.880327][ T5726] usb 3-1: config 0 has an invalid interface number: 8 but max is 0 [ 154.880346][ T5726] usb 3-1: config 0 has no interface number 0 [ 154.880373][ T5726] usb 3-1: config 0 interface 8 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 154.881637][ T5726] usb 3-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 154.881655][ T5726] usb 3-1: Product: syz [ 154.881666][ T5726] usb 3-1: SerialNumber: syz [ 154.884080][ T5726] usb 3-1: config 0 descriptor?? [ 154.887318][ T5726] usbhid 3-1:0.8: couldn't find an input interrupt endpoint [ 154.998353][ T52] Bluetooth: hci3: command 0x0c1a tx timeout [ 155.089983][ T5726] usb 3-1: USB disconnect, device number 30 [ 155.231197][ T7518] tipc: Enabling of bearer rejected, failed to enable media [ 155.507913][ T48] gspca_sunplus: reg_w_riv err -110 [ 155.507986][ T48] sunplus 4-1:0.0: probe with driver sunplus failed with error -110 [ 155.730970][ T7531] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 155.786419][ T7534] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 155.799942][ T7534] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 155.887677][ T52] Bluetooth: hci1: command 0x0c1a tx timeout [ 155.887733][ T5603] Bluetooth: hci2: command 0x0c1a tx timeout [ 156.837736][ T5603] Bluetooth: hci0: command 0x0c1a tx timeout [ 156.837814][ T7512] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 157.153532][ T7538] socket: no more sockets [ 157.223283][ T7542] netlink: 16 bytes leftover after parsing attributes in process `syz.2.643'. [ 157.740671][ T7512] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 157.741685][ T7512] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 157.741864][ T7512] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 157.742704][ T7512] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 157.822338][ T5786] usb 4-1: USB disconnect, device number 28 [ 157.837210][ T7550] netlink: 44 bytes leftover after parsing attributes in process `syz.0.647'. [ 158.001826][ T7555] udc dummy_udc.1: failed to start USB Gadget filesystem: -12 [ 158.010098][ T7555] gadgetfs gadget.1: probe with driver gadgetfs failed with error -12 [ 158.045874][ T7555] udc dummy_udc.2: failed to start USB Gadg ** replaying previous printk message ** [ 158.045874][ T7555] udc dummy_udc.2: failed to start USB Gadget filesystem: -12 [ 158.045923][ T7555] gadgetfs gadget.2: probe with driver gadgetfs failed with error -12 [ 158.048675][ T7555] ================================================================== [ 158.048688][ T7555] BUG: KASAN: slab-use-after-free in gadgetfs_bind+0x82e/0x890 [ 158.048713][ T7555] Write of size 8 at addr ffff88807c6e18c0 by task syz.2.646/7555 [ 158.048727][ T7555] [ 158.048734][ T7555] CPU: 0 UID: 0 PID: 7555 Comm: syz.2.646 Not tainted syzkaller #0 PREEMPT(full) [ 158.048753][ T7555] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 158.048763][ T7555] Call Trace: [ 158.048768][ T7555] [ 158.048775][ T7555] dump_stack_lvl+0x100/0x190 [ 158.048797][ T7555] print_report+0x13d/0x4b0 [ 158.048820][ T7555] ? __virt_addr_valid+0x239/0x430 [ 158.048838][ T7555] ? gadgetfs_bind+0x82e/0x890 [ 158.048857][ T7555] kasan_report+0xdf/0x1c0 [ 158.048877][ T7555] ? gadgetfs_bind+0x82e/0x890 [ 158.048898][ T7555] gadgetfs_bind+0x82e/0x890 [ 158.048918][ T7555] ? kernfs_create_link+0x1bd/0x240 [ 158.048936][ T7555] gadget_bind_driver+0x28c/0xbf0 [ 158.048959][ T7555] ? __pfx_dummy_udc_set_speed+0x10/0x10 [ 158.048979][ T7555] ? __pfx_gadget_bind_driver+0x10/0x10 [ 158.049002][ T7555] really_probe+0x241/0xa60 [ 158.049019][ T7555] __driver_probe_device+0x210/0x460 [ 158.049034][ T7555] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 158.049051][ T7555] driver_probe_device+0x4a/0x140 [ 158.049066][ T7555] __driver_attach+0x21f/0x5b0 [ 158.049081][ T7555] ? __pfx___driver_attach+0x10/0x10 [ 158.049096][ T7555] bus_for_each_dev+0x13e/0x1d0 [ 158.049115][ T7555] ? __pfx_bus_for_each_dev+0x10/0x10 [ 158.049135][ T7555] ? bus_add_driver+0x2b5/0x5b0 [ 158.049158][ T7555] bus_add_driver+0x305/0x5b0 [ 158.049180][ T7555] driver_register+0x1e2/0x360 [ 158.049197][ T7555] usb_gadget_register_driver_owner+0x132/0x210 [ 158.049221][ T7555] dev_config+0xdce/0x1610 [ 158.049240][ T7555] ? ksys_write+0xc0/0x250 [ 158.049254][ T7555] ? __pfx_dev_config+0x10/0x10 [ 158.049275][ T7555] vfs_write+0x2aa/0x1050 [ 158.049298][ T7555] ? __pfx_dev_config+0x10/0x10 [ 158.049316][ T7555] ? lock_acquire+0x1d1/0x380 [ 158.049333][ T7555] ? __fget_files+0x34/0x3d0 [ 158.049350][ T7555] ? __pfx_vfs_write+0x10/0x10 [ 158.049373][ T7555] ? find_held_lock+0x2b/0x80 [ 158.049394][ T7555] ? __fget_files+0x215/0x3d0 [ 158.049413][ T7555] ? __fget_files+0x21f/0x3d0 [ 158.049432][ T7555] ksys_write+0x12a/0x250 [ 158.049446][ T7555] ? __pfx_ksys_write+0x10/0x10 [ 158.049463][ T7555] do_syscall_64+0x123/0x790 [ 158.049481][ T7555] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 158.049498][ T7555] RIP: 0033:0x7f0c5a59e159 [ 158.049512][ T7555] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 158.049527][ T7555] RSP: 002b:00007f0c5b450028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 158.049543][ T7555] RAX: ffffffffffffffda RBX: 00007f0c5a825fa0 RCX: 00007f0c5a59e159 [ 158.049555][ T7555] RDX: 000000000000001f RSI: 0000200000000400 RDI: 0000000000000006 [ 158.049571][ T7555] RBP: 00007f0c5a635024 R08: 0000000000000000 R09: 0000000000000000 [ 158.049581][ T7555] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 158.049591][ T7555] R13: 00007f0c5a826038 R14: 00007f0c5a825fa0 R15: 00007ffc27d8cf78 [ 158.049607][ T7555] [ 158.049613][ T7555] [ 158.049616][ T7555] Allocated by task 5606: [ 158.049624][ T7555] kasan_save_stack+0x30/0x50 [ 158.049639][ T7555] kasan_save_track+0x14/0x30 [ 158.049653][ T7555] __kasan_kmalloc+0xaa/0xb0 [ 158.049667][ T7555] __kmalloc_cache_noprof+0x2f8/0x6d0 [ 158.049687][ T7555] gadgetfs_fill_super+0x1da/0x430 [ 158.049704][ T7555] get_tree_single+0xe2/0x190 [ 158.049717][ T7555] vfs_get_tree+0x92/0x320 [ 158.049735][ T7555] path_mount+0x7d0/0x24c0 [ 158.049753][ T7555] __x64_sys_mount+0x293/0x310 [ 158.049771][ T7555] do_syscall_64+0x123/0x790 [ 158.049786][ T7555] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 158.049800][ T7555] [ 158.049803][ T7555] Freed by task 7555: [ 158.049810][ T7555] kasan_save_stack+0x30/0x50 [ 158.049824][ T7555] kasan_save_track+0x14/0x30 [ 158.049838][ T7555] kasan_save_free_info+0x3b/0x70 [ 158.049857][ T7555] __kasan_slab_free+0x5f/0x80 [ 158.049872][ T7555] kfree+0x22b/0x6d0 [ 158.049890][ T7555] put_dev+0xb4/0xd0 [ 158.049905][ T7555] gadgetfs_bind+0x6bc/0x890 [ 158.049922][ T7555] gadget_bind_driver+0x28c/0xbf0 [ 158.049942][ T7555] really_probe+0x241/0xa60 [ 158.049953][ T7555] __driver_probe_device+0x210/0x460 [ 158.049969][ T7555] driver_probe_device+0x4a/0x140 [ 158.049982][ T7555] __driver_attach+0x21f/0x5b0 [ 158.049995][ T7555] bus_for_each_dev+0x13e/0x1d0 [ 158.050012][ T7555] bus_add_driver+0x305/0x5b0 [ 158.050031][ T7555] driver_register+0x1e2/0x360 [ 158.050046][ T7555] usb_gadget_register_driver_owner+0x132/0x210 [ 158.050067][ T7555] dev_config+0xdce/0x1610 [ 158.050084][ T7555] vfs_write+0x2aa/0x1050 [ 158.050104][ T7555] ksys_write+0x12a/0x250 [ 158.050116][ T7555] do_syscall_64+0x123/0x790 [ 158.050131][ T7555] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 158.050145][ T7555] [ 158.050148][ T7555] The buggy address belongs to the object at ffff88807c6e1800 [ 158.050148][ T7555] which belongs to the cache kmalloc-1k of size 1024 [ 158.050160][ T7555] The buggy address is located 192 bytes inside of [ 158.050160][ T7555] freed 1024-byte region [ffff88807c6e1800, ffff88807c6e1c00) [ 158.050175][ T7555] [ 158.050179][ T7555] The buggy address belongs to the physical page: [ 158.050186][ T7555] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88807c6e4800 pfn:0x7c6e0 [ 158.050201][ T7555] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 158.050213][ T7555] flags: 0xfff00000000240(workingset|head|node=0|zone=1|lastcpupid=0x7ff) [ 158.050229][ T7555] page_type: f5(slab) [ 158.050243][ T7555] raw: 00fff00000000240 ffff88801c02edc0 ffffea0000b8d810 ffffea000078fe10 [ 158.050257][ T7555] raw: ffff88807c6e4800 0000000000100008 00000000f5000000 0000000000000000 [ 158.050271][ T7555] head: 00fff00000000240 ffff88801c02edc0 ffffea0000b8d810 ffffea000078fe10 [ 158.050285][ T7555] head: ffff88807c6e4800 0000000000100008 00000000f5000000 0000000000000000 [ 158.050299][ T7555] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 158.050312][ T7555] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 158.050321][ T7555] page dumped because: kasan: bad access detected [ 158.050328][ T7555] page_owner tracks the page as allocated [ 158.050333][ T7555] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5715, tgid 5715 (kworker/0:5), ts 63403494224 [ 158.050357][ T7555] post_alloc_hook+0xfd/0x120 [ 158.050376][ T7555] get_page_from_freelist+0x110d/0x35d0 [ 158.050398][ T7555] __alloc_frozen_pages_noprof+0x2eb/0x3300 [ 158.050419][ T7555] new_slab+0xa9/0x6e0 [ 158.050438][ T7555] refill_objects+0xe3/0x410 [ 158.050458][ T7555] __pcs_replace_empty_main+0x35e/0x650 [ 158.050478][ T7555] __kmalloc_noprof+0x67c/0x840 [ 158.050491][ T7555] ___neigh_create+0x1532/0x2940 [ 158.050508][ T7555] ip6_finish_output2+0x1052/0x1d50 [ 158.050530][ T7555] __ip6_finish_output+0x357/0xdf0 [ 158.050543][ T7555] ip6_output+0x2aa/0xa60 [ 158.050555][ T7555] NF_HOOK.constprop.0+0x115/0x5a0 [ 158.050574][ T7555] mld_sendpack+0x8f7/0xec0 [ 158.050588][ T7555] mld_ifc_work+0x75a/0xc10 [ 158.050602][ T7555] process_one_work+0xac7/0x1b10 [ 158.050623][ T7555] worker_thread+0x5ef/0xe50 [ 158.050643][ T7555] page last free pid 5606 tgid 5606 ts 63376488678 stack trace: [ 158.050653][ T7555] __free_frozen_pages+0x79f/0x10f0 [ 158.050671][ T7555] qlist_free_all+0x47/0xf0 [ 158.050684][ T7555] kasan_quarantine_reduce+0x1a0/0x1f0 [ 158.050698][ T7555] __kasan_slab_alloc+0x69/0x90 [ 158.050713][ T7555] kmem_cache_alloc_noprof+0x269/0x6a0 [ 158.050727][ T7555] do_getname_kernel+0x5d/0x250 [ 158.050744][ T7555] kern_path+0x1f/0x50 [ 158.050757][ T7555] tomoyo_mount_acl+0x685/0x8b0 [ 158.050780][ T7555] tomoyo_mount_permission+0x214/0x460 [ 158.050801][ T7555] security_sb_mount+0xdd/0x270 [ 158.050833][ T7555] path_mount+0x158/0x24c0 [ 158.050851][ T7555] __x64_sys_mount+0x293/0x310 [ 158.050870][ T7555] do_syscall_64+0x123/0x790 [ 158.050885][ T7555] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 158.050900][ T7555] [ 158.050904][ T7555] Memory state around the buggy address: [ 158.050911][ T7555] ffff88807c6e1780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 158.050922][ T7555] ffff88807c6e1800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 158.050932][ T7555] >ffff88807c6e1880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 158.050940][ T7555] ^ [ 158.050948][ T7555] ffff88807c6e1900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 158.050959][ T7555] ffff88807c6e1980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 158.050967][ T7555] ================================================================== [ 158.051118][ T7555] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 158.926905][ T7555] CPU: 0 UID: 0 PID: 7555 Comm: syz.2.646 Not tainted syzkaller #0 PREEMPT(full) [ 158.936107][ T7555] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 158.946206][ T7555] Call Trace: [ 158.949495][ T7555] [ 158.952430][ T7555] dump_stack_lvl+0x100/0x190 [ 158.957126][ T7555] vpanic+0x553/0x970 [ 158.961130][ T7555] ? __pfx_vpanic+0x10/0x10 [ 158.965645][ T7555] ? mark_held_locks+0x40/0x70 [ 158.970480][ T7555] ? gadgetfs_bind+0x82e/0x890 [ 158.975334][ T7555] panic+0xd1/0xe0 [ 158.979059][ T7555] ? __pfx_panic+0x10/0x10 [ 158.983468][ T7555] ? gadgetfs_bind+0x82e/0x890 [ 158.988258][ T7555] ? preempt_schedule_common+0x3c/0xb0 [ 158.993742][ T7555] check_panic_on_warn.cold+0x19/0x34 [ 158.999138][ T7555] end_report.part.0+0x3a/0x90 [ 159.003920][ T7555] kasan_report.cold+0xe/0x18 [ 159.008589][ T7555] ? gadgetfs_bind+0x82e/0x890 [ 159.013356][ T7555] gadgetfs_bind+0x82e/0x890 [ 159.018285][ T7555] ? kernfs_create_link+0x1bd/0x240 [ 159.023471][ T7555] gadget_bind_driver+0x28c/0xbf0 [ 159.028504][ T7555] ? __pfx_dummy_udc_set_speed+0x10/0x10 [ 159.034215][ T7555] ? __pfx_gadget_bind_driver+0x10/0x10 [ 159.039753][ T7555] really_probe+0x241/0xa60 [ 159.044247][ T7555] __driver_probe_device+0x210/0x460 [ 159.049543][ T7555] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 159.055339][ T7555] driver_probe_device+0x4a/0x140 [ 159.060371][ T7555] __driver_attach+0x21f/0x5b0 [ 159.065139][ T7555] ? __pfx___driver_attach+0x10/0x10 [ 159.070585][ T7555] bus_for_each_dev+0x13e/0x1d0 [ 159.075458][ T7555] ? __pfx_bus_for_each_dev+0x10/0x10 [ 159.080822][ T7555] ? bus_add_driver+0x2b5/0x5b0 [ 159.085683][ T7555] bus_add_driver+0x305/0x5b0 [ 159.090359][ T7555] driver_register+0x1e2/0x360 [ 159.095115][ T7555] usb_gadget_register_driver_owner+0x132/0x210 [ 159.101700][ T7555] dev_config+0xdce/0x1610 [ 159.106128][ T7555] ? ksys_write+0xc0/0x250 [ 159.110806][ T7555] ? __pfx_dev_config+0x10/0x10 [ 159.115659][ T7555] vfs_write+0x2aa/0x1050 [ 159.119983][ T7555] ? __pfx_dev_config+0x10/0x10 [ 159.124820][ T7555] ? lock_acquire+0x1d1/0x380 [ 159.129482][ T7555] ? __fget_files+0x34/0x3d0 [ 159.134055][ T7555] ? __pfx_vfs_write+0x10/0x10 [ 159.138833][ T7555] ? find_held_lock+0x2b/0x80 [ 159.143516][ T7555] ? __fget_files+0x215/0x3d0 [ 159.148196][ T7555] ? __fget_files+0x21f/0x3d0 [ 159.152868][ T7555] ksys_write+0x12a/0x250 [ 159.157180][ T7555] ? __pfx_ksys_write+0x10/0x10 [ 159.162016][ T7555] do_syscall_64+0x123/0x790 [ 159.166709][ T7555] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 159.172593][ T7555] RIP: 0033:0x7f0c5a59e159 [ 159.176996][ T7555] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 159.196592][ T7555] RSP: 002b:00007f0c5b450028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 159.204991][ T7555] RAX: ffffffffffffffda RBX: 00007f0c5a825fa0 RCX: 00007f0c5a59e159 [ 159.212961][ T7555] RDX: 000000000000001f RSI: 0000200000000400 RDI: 0000000000000006 [ 159.220924][ T7555] RBP: 00007f0c5a635024 R08: 0000000000000000 R09: 0000000000000000 [ 159.228888][ T7555] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 159.237045][ T7555] R13: 00007f0c5a826038 R14: 00007f0c5a825fa0 R15: 00007ffc27d8cf78 [ 159.245009][ T7555] [ 159.248324][ T7555] Kernel Offset: disabled [ 159.252725][ T7555] Rebooting in 86400 seconds..