last executing test programs: 3.652670498s ago: executing program 3 (id=34): r0 = openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000180)='/proc/thread-self/attr/exec\x00', 0x2, 0x0) write$selinux_attr(r0, &(0x7f0000000100)='system_u:object_r:hugetlbfs_t:s0\x00', 0x1d) mknod$loop(&(0x7f0000000140)='./file0\x00', 0xfff, 0x0) r1 = open$dir(&(0x7f0000000040)='.\x00', 0x0, 0x0) execveat(r1, &(0x7f0000000380)='./file0\x00', 0x0, 0x0, 0x0) 3.628276459s ago: executing program 3 (id=35): r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000040)=0x10, 0x4) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'veth0_to_team\x00', 0x0}) bind$xdp(r0, &(0x7f00000003c0)={0x2c, 0x2, r2, 0x0, r0}, 0x10) 3.61780478s ago: executing program 3 (id=36): mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000003, 0x2000006, 0x401d031, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_sock_diag(0x10, 0x3, 0x4) ioctl$sock_SIOCSIFVLAN_SET_VLAN_NAME_TYPE_CMD(r0, 0x8983, &(0x7f0000000000)={0x6, 'erspan0\x00', {0x1}, 0xdd3c}) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r1, 0x8983, &(0x7f0000000240)={0x0, 'bridge_slave_1\x00', {0x4}, 0x3ff8}) 3.60581874s ago: executing program 3 (id=37): r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCADDRT(r0, 0x890b, &(0x7f0000000000)={0x4000000, {0x2, 0x4e22}, {0x2, 0x200, @local}, {0x2, 0x0, @broadcast}, 0x2, 0x0, 0x0, 0x0, 0xfff8, 0x0, 0x0, 0x3}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r1, 0x8923, &(0x7f0000000000)={'dummy0\x00', @remote}) ioctl$sock_SIOCSIFBR(r0, 0x890c, &(0x7f0000000000)=@generic={0x0, 0x2, 0x2}) 3.544464153s ago: executing program 3 (id=38): r0 = syz_usb_connect$uac3(0x0, 0xa0, &(0x7f0000002440)=ANY=[@ANYBLOB="12011003000000403512100040000102030109028e000301002040080b0201012130c60904000000010130000a2401042a00ff0f0000132403050001020602028000000700100002000f24090202000000", @ANYRES16], &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac3(r0, 0x0, &(0x7f00000005c0)={0x44, &(0x7f0000000200)=ANY=[@ANYBLOB="200604000000e971ec7b"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000002240)={0x84, &(0x7f0000000180)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000dc0)={0x44, &(0x7f00000002c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 1.736387839s ago: executing program 3 (id=54): r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000240)=ANY=[@ANYBLOB="12010000020000402505a1a440000102030109025c0002010000000904000001020d0000052406000105240000000d240f0110000000000000000006241a0000000904010000020d00000904010102020d000009058202000202000009050302000200"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000340)={0x44, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x20, 0x80, 0x1c, {0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10}}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) 821.124991ms ago: executing program 0 (id=75): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NFC_CMD_GET_TARGET(r0, &(0x7f0000000100)={0x0, 0x49, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x0, 0x4, 0x70bd2a}, 0x14}}, 0x0) syz_genetlink_get_family_id$nfc(&(0x7f0000000140), r0) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000300), r0) sendmsg$NL802154_CMD_NEW_INTERFACE(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000001c0)={0x1c, r1, 0x1, 0x70bd2c, 0x25dfdbfd, {}, [@NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20040085}, 0x4004) 808.964092ms ago: executing program 0 (id=76): mkdir(&(0x7f0000000000)='./cgroup/../file0\x00', 0x0) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_type(r0, &(0x7f00000001c0), 0x2, 0x0) write$cgroup_type(r1, &(0x7f0000000180), 0x9) rmdir(&(0x7f0000000080)='./cgroup/../file0\x00') 795.230303ms ago: executing program 0 (id=77): r0 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x0, 0x1, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x1, 0xfe7f0000, 0x2000, &(0x7f0000000000/0x2000)=nil}) 739.276615ms ago: executing program 0 (id=78): r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) bind$bt_sco(r0, &(0x7f00000000c0), 0x8) listen(r0, 0x5) r1 = socket$inet_udp(0x2, 0x2, 0x0) close_range(r1, 0xffffffffffffffff, 0x0) 726.387346ms ago: executing program 0 (id=79): r0 = socket$inet(0x2, 0x2, 0x1) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e24, @empty}, 0x10) r1 = socket$inet(0x2, 0x2, 0x1) setsockopt$sock_int(r0, 0x1, 0x2, 0x0, 0x0) bind$inet(r1, &(0x7f0000000000)={0x2, 0x6e24, @dev={0xac, 0x14, 0x14, 0x39}}, 0x10) 713.008936ms ago: executing program 0 (id=80): r0 = syz_usb_connect$hid(0x0, 0x3f, &(0x7f0000000100)=ANY=[@ANYBLOB="12010000000000407f04ffff00000000000109022d000100000000090400000203000000092100000001221800090581030000000000090502034934"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150025ff0904a1010901a10075089102c0c0"], 0x0}, 0x0) r1 = syz_open_dev$hiddev(&(0x7f00000000c0), 0x0, 0x0) ioctl$HIDIOCSREPORT(r1, 0x400c4808, &(0x7f0000000400)={0x2, 0x100}) 437.470849ms ago: executing program 2 (id=93): capset(&(0x7f0000000080)={0x20071026}, &(0x7f00000003c0)={0x200000, 0x200000, 0x0, 0x0, 0x8, 0x1000004}) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x181) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x140) mount$overlay(0x0, &(0x7f0000000100)='./bus\x00', &(0x7f0000000440), 0x8, &(0x7f0000000080)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './cgroup'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) openat$dir(0xffffffffffffff9c, &(0x7f00000006c0)='./bus\x00', 0x490082, 0x8) 402.500661ms ago: executing program 2 (id=94): r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000000), 0x8) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000000), 0x8) close(0x3) 390.012252ms ago: executing program 2 (id=95): syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000000)=[@text32={0x20, &(0x7f0000000440)="d8df0f23b3b9ce000000b807000000ba000000000f301b8154fea900600000c4e28ddc8dcd000000c182fd3f0000c8b950020000b801000000ba00000000b9c50d0000b800c80000b8010000000f01d90f300fc79d53bf0000c4e16dd3010f2202", 0x52}], 0x0, 0x6, 0x0, 0x0) r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000b40)={&(0x7f0000000480)=ANY=[@ANYBLOB="280000001c0021ef00000000000000000700"], 0x28}, 0x1, 0x0, 0x0, 0x4000090}, 0x8010) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x9) sendmsg$nl_generic(r0, &(0x7f0000000240)={0x0, 0x0, 0x0}, 0x0) 330.658354ms ago: executing program 2 (id=98): mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffffffffe, 0x4031, 0xffffffffffffffff, 0x7542d000) r0 = userfaultfd(0x80001) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x40}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000688000/0x1000)=nil, 0x1000}, 0x4}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa04, &(0x7f0000000000)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1, 0x2}) 296.364506ms ago: executing program 2 (id=99): mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000500)={0x0, 0x0}, &(0x7f0000000180)=0xc) mount$bpf(0x0, 0x0, 0x0, 0x5805040, &(0x7f0000000100)={[{@uid={'uid', 0x3d, r1}}]}) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000000)='devpts\x00', 0x0, &(0x7f0000000100)) 275.639667ms ago: executing program 2 (id=100): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000000000406c256d0000000200000109022400010000000009040000010300000009210000000122050009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000000)={0x24, 0x0, 0x0, &(0x7f0000000ac0)=ANY=[@ANYBLOB="002205"], 0x0}, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000004500)={0x14, 0x0, &(0x7f0000004400)={0x0, 0x3, 0x2, @string={0x2}}, 0x0, 0x0}, 0x0) syz_usb_control_io(r0, &(0x7f0000000300)={0x2c, &(0x7f00000000c0)={0x40, 0x10, 0x12, {0x12, 0x8, "520da0c994c2a888b9b895443d220cc4"}}, 0x0, 0x0, &(0x7f0000000280)={0x20, 0x29, 0xf, {0xf, 0x29, 0x5, 0x60, 0xcb, 0x2, "c93b9cf6", "fccb1fe3"}}, 0x0}, 0x0) 205.44242ms ago: executing program 1 (id=103): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_CAP_X86_USER_SPACE_MSR(r1, 0x4068aea3, 0x0) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000080)={0x1, 0x0, [{0x4b564d05, 0x0, 0xfffffffffffffff9}]}) 117.985455ms ago: executing program 1 (id=104): r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x40082, 0x0) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f0000000140)) ioctl$PPPIOCSFLAGS1(r0, 0x40047459, &(0x7f00000000c0)=0x41) chmod(0x0, 0x23f) pwritev(r0, &(0x7f0000000040)=[{&(0x7f0000000180)="80fd02000040", 0x42}], 0x1, 0x0, 0x0) 69.196327ms ago: executing program 1 (id=105): mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) pipe(0x0) r0 = socket$xdp(0x2c, 0x3, 0x0) getsockopt$XDP_STATISTICS(r0, 0x11b, 0x8, 0x0, 0x0) 53.301568ms ago: executing program 1 (id=106): ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000300)={0x57, 0x0, 0xc, {0x0, 0x1}, {0x74, 0x2}, @ramp={0x101, 0x8, {0xd, 0x1, 0x207, 0xcc1}}}) r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0x0, 0x822b01) ioctl$EVIOCSMASK(r0, 0x40104593, &(0x7f0000001740)={0x0, 0x0, 0x0}) write$char_usb(r0, &(0x7f0000000040)="e2", 0xff0f) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) 36.748018ms ago: executing program 1 (id=107): r0 = openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r1 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x2}, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0, &(0x7f00000002c0)=0x0) r5 = syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0xc, 0x0, r0, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x3, 0x104}}}, &(0x7f0000000300)=0x0) r7 = syz_open_dev$ublk_chdev(&(0x7f0000002000), r5, 0x2) syz_ublk_setup_queues(r7, r6, &(0x7f0000000340)={0x0, 0x92d1, 0x400, 0x2, 0x165}, &(0x7f00000007c0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ec5, 0x8, 0x2, 0x2f8, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7dd8, 0x8, 0x1, 0x264, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xaa92, 0x8, 0x0, 0x67, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x97fb, 0x1000, 0x1, 0x38b}}], 0x4, &(0x7f0000001a40)={0x2e, 0x10, 0x0, r7, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x9}, 0x0, 0x0, '\x00', {0x0, 0x81c, 0x0, 0x0}}, &(0x7f0000001ac0)) 0s ago: executing program 1 (id=108): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000000)=@x86={0x66, 0x3, 0x9, 0x0, 0x80000001, 0xa2, 0x6, 0x1, 0xd, 0xf7, 0x1, 0x4, 0x0, 0xfffffffc, 0x4, 0x12, 0x7, 0x0, 0x4, '\x00', 0xb, 0x3}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000005c0)=[@text64={0x40, 0x0}], 0x1, 0x43, 0x0, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.187' (ED25519) to the list of known hosts. [ 21.329692][ T36] audit: type=1400 audit(1790051970.310:64): avc: denied { mounton } for pid=286 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 21.330960][ T286] cgroup: Unknown subsys name 'net' [ 21.352360][ T36] audit: type=1400 audit(1790051970.310:65): avc: denied { mount } for pid=286 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 21.379749][ T36] audit: type=1400 audit(1790051970.340:66): avc: denied { unmount } for pid=286 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 21.379955][ T286] cgroup: Unknown subsys name 'devices' [ 21.502947][ T286] cgroup: Unknown subsys name 'hugetlb' [ 21.508712][ T286] cgroup: Unknown subsys name 'rlimit' [ 21.601164][ T36] audit: type=1400 audit(1790051970.590:67): avc: denied { setattr } for pid=286 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 21.624572][ T36] audit: type=1400 audit(1790051970.590:68): avc: denied { mounton } for pid=286 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 21.649413][ T36] audit: type=1400 audit(1790051970.590:69): avc: denied { mount } for pid=286 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 21.658552][ T288] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 21.681373][ T36] audit: type=1400 audit(1790051970.670:70): avc: denied { relabelto } for pid=288 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.706830][ T36] audit: type=1400 audit(1790051970.670:71): avc: denied { write } for pid=288 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.746513][ T36] audit: type=1400 audit(1790051970.730:72): avc: denied { read } for pid=286 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.772157][ T36] audit: type=1400 audit(1790051970.730:73): avc: denied { open } for pid=286 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.772486][ T286] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 22.601082][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.608345][ T296] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.615527][ T296] bridge_slave_0: entered allmulticast mode [ 22.622033][ T296] bridge_slave_0: entered promiscuous mode [ 22.638610][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.645809][ T296] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.653175][ T296] bridge_slave_1: entered allmulticast mode [ 22.659358][ T296] bridge_slave_1: entered promiscuous mode [ 22.697013][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.704119][ T294] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.711293][ T294] bridge_slave_0: entered allmulticast mode [ 22.717487][ T294] bridge_slave_0: entered promiscuous mode [ 22.731690][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.738783][ T294] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.746065][ T294] bridge_slave_1: entered allmulticast mode [ 22.752394][ T294] bridge_slave_1: entered promiscuous mode [ 22.762298][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.769385][ T295] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.776735][ T295] bridge_slave_0: entered allmulticast mode [ 22.783228][ T295] bridge_slave_0: entered promiscuous mode [ 22.798683][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.805936][ T295] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.813109][ T295] bridge_slave_1: entered allmulticast mode [ 22.819301][ T295] bridge_slave_1: entered promiscuous mode [ 22.850500][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.857662][ T293] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.864935][ T293] bridge_slave_0: entered allmulticast mode [ 22.871189][ T293] bridge_slave_0: entered promiscuous mode [ 22.877675][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.884868][ T293] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.891981][ T293] bridge_slave_1: entered allmulticast mode [ 22.898331][ T293] bridge_slave_1: entered promiscuous mode [ 23.045628][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.052821][ T296] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.060173][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.067246][ T296] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.076603][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.083710][ T294] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.091037][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.098065][ T294] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.120632][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.128175][ T293] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.135477][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.142538][ T293] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.154869][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.161987][ T295] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.169264][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.176334][ T295] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.217299][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.224931][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.232420][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.239587][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.247890][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.255386][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.262776][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.269991][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.287799][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.294884][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.302642][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.309697][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.319599][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.326666][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.344276][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.351445][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.367458][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.374633][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.383779][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.391090][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.413474][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.420533][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.449410][ T294] veth0_vlan: entered promiscuous mode [ 23.455977][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.463033][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.495824][ T293] veth0_vlan: entered promiscuous mode [ 23.503295][ T294] veth1_macvtap: entered promiscuous mode [ 23.516617][ T296] veth0_vlan: entered promiscuous mode [ 23.538359][ T295] veth0_vlan: entered promiscuous mode [ 23.545303][ T293] veth1_macvtap: entered promiscuous mode [ 23.556842][ T296] veth1_macvtap: entered promiscuous mode [ 23.585344][ T295] veth1_macvtap: entered promiscuous mode [ 23.592688][ T294] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 23.689211][ T315] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 23.723043][ T332] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 23.761837][ T12] Bluetooth: hci0: Frame reassembly failed (-84) [ 23.816426][ T359] netlink: 24 bytes leftover after parsing attributes in process `syz.3.9'. [ 23.870005][ T365] overlayfs: overlay with incompat feature 'volatile' cannot be mounted [ 24.051180][ T31] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 24.203874][ T31] usb 2-1: Using ep0 maxpacket: 32 [ 24.210469][ T31] usb 2-1: config 0 has an invalid interface number: 67 but max is 0 [ 24.219431][ T31] usb 2-1: config 0 has no interface number 0 [ 24.227340][ T31] usb 2-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 24.236594][ T31] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 24.244969][ T31] usb 2-1: Product: syz [ 24.249298][ T31] usb 2-1: Manufacturer: syz [ 24.254195][ T31] usb 2-1: SerialNumber: syz [ 24.259953][ T31] usb 2-1: config 0 descriptor?? [ 24.266046][ T31] smsc95xx v2.0.0 [ 24.330838][ T310] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 24.481928][ T310] usb 4-1: config 0 interface 0 altsetting 8 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 24.492940][ T310] usb 4-1: config 0 interface 0 altsetting 8 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 24.505776][ T310] usb 4-1: config 0 interface 0 has no altsetting 0 [ 24.512436][ T310] usb 4-1: New USB device found, idVendor=04d8, idProduct=f002, bcdDevice= 0.00 [ 24.522616][ T310] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 24.534101][ T310] usb 4-1: config 0 descriptor?? [ 24.792821][ T12] Bluetooth: hci1: Frame reassembly failed (-84) [ 25.000978][ T310] hid-picolcd 0003:04D8:F002.0001: No report with id 0xf3 found [ 25.008829][ T310] hid-picolcd 0003:04D8:F002.0001: No report with id 0xf4 found [ 25.150553][ C0] hid-picolcd 0003:04D8:F002.0001: invalid size value (89) for picolcd raw event (0) [ 25.269965][ T31] smsc95xx 2-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -71 [ 25.280867][ T31] smsc95xx 2-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 25.290976][ T31] smsc95xx 2-1:0.67 (unnamed net_device) (uninitialized): Failed to write reg index 0x00000014: -71 [ 25.302884][ T31] smsc95xx 2-1:0.67: probe with driver smsc95xx failed with error -71 [ 25.312543][ T31] usb 2-1: USB disconnect, device number 2 [ 25.351597][ T310] usb 4-1: USB disconnect, device number 2 [ 25.800809][ T54] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 25.800866][ T388] Bluetooth: hci0: command 0x1003 tx timeout [ 25.913670][ T401] futex_wake_op: syz.2.26 tries to shift op by 144; fix this program [ 25.922037][ T401] futex_wake_op: syz.2.26 tries to shift op by 144; fix this program [ 25.991033][ T310] smpboot: CPU 1 is now offline [ 25.999529][ T409] smpboot: Booting Node 0 Processor 1 APIC 0x1 [ 26.079055][ T419] process 'syz.3.34' launched '/dev/fd/4/./file0' with NULL argv: empty string added [ 26.126162][ T425] ªªªªª»: renamed from dummy0 (while UP) [ 26.211067][ T9] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 26.270850][ T310] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 26.362067][ T9] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 26.373904][ T9] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 26.385017][ T9] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 26.394810][ T10] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 26.402771][ T9] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 26.415931][ T9] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 26.425095][ T9] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 26.434099][ T310] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 26.445565][ T310] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 26.445628][ T9] usb 2-1: config 0 descriptor?? [ 26.460931][ T310] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 26.474271][ T310] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 26.484429][ T310] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 26.493213][ T310] usb 3-1: config 0 descriptor?? [ 26.582095][ T10] usb 4-1: unable to get BOS descriptor or descriptor too short [ 26.590845][ T10] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 26.601277][ T10] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 26.611549][ T10] usb 4-1: New USB device found, idVendor=1235, idProduct=0010, bcdDevice= 0.40 [ 26.620704][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 26.628927][ T10] usb 4-1: Product: syz [ 26.633212][ T10] usb 4-1: Manufacturer: syz [ 26.637867][ T10] usb 4-1: SerialNumber: syz [ 26.644724][ T10] usb 4-1: selecting invalid altsetting 1 [ 26.650863][ T10] usb 4-1: unit 6 not found! [ 26.840822][ T353] Bluetooth: hci1: Opcode 0x1003 failed: -110 [ 26.841102][ T54] Bluetooth: hci1: command 0x1003 tx timeout [ 26.867657][ T36] kauditd_printk_skb: 88 callbacks suppressed [ 26.867677][ T36] audit: type=1400 audit(1790051975.850:162): avc: denied { watch watch_reads } for pid=430 comm="syz.0.39" path="/6" dev="tmpfs" ino=44 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 26.887965][ T9] plantronics 0003:047F:FFFF.0002: No inputs registered, leaving [ 26.907840][ T36] audit: type=1400 audit(1790051975.890:163): avc: denied { mount } for pid=432 comm="syz.0.40" name="/" dev="devpts" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:devpts_t tclass=filesystem permissive=1 [ 26.912449][ T310] plantronics 0003:047F:FFFF.0003: No inputs registered, leaving [ 26.940390][ T36] audit: type=1400 audit(1790051975.930:164): avc: denied { unmount } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:devpts_t tclass=filesystem permissive=1 [ 26.952570][ T435] rust_binder: 434:435 performed invalid weak decrement on ref [ 26.966145][ T36] audit: type=1400 audit(1790051975.930:165): avc: denied { read } for pid=434 comm="syz.0.41" name="binder0" dev="binder" ino=7 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 26.969641][ T9] plantronics 0003:047F:FFFF.0002: hiddev96,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.1-1/input0 [ 27.004581][ T310] plantronics 0003:047F:FFFF.0003: hiddev97,hidraw1: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.2-1/input0 [ 27.009021][ T36] audit: type=1400 audit(1790051975.930:166): avc: denied { open } for pid=434 comm="syz.0.41" path="/dev/binderfs/binder0" dev="binder" ino=7 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 27.046015][ T36] audit: type=1400 audit(1790051975.930:167): avc: denied { ioctl } for pid=434 comm="syz.0.41" path="/dev/binderfs/binder0" dev="binder" ino=7 ioctlcmd=0x620d scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 27.083377][ T36] audit: type=1400 audit(1790051975.940:168): avc: denied { set_context_mgr } for pid=434 comm="syz.0.41" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 27.103057][ T36] audit: type=1400 audit(1790051976.060:169): avc: denied { read write } for pid=438 comm="syz.0.42" name="ppp" dev="devtmpfs" ino=86 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 27.126626][ T36] audit: type=1400 audit(1790051976.060:170): avc: denied { open } for pid=438 comm="syz.0.42" path="/dev/ppp" dev="devtmpfs" ino=86 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 27.149607][ T36] audit: type=1400 audit(1790051976.060:171): avc: denied { ioctl } for pid=438 comm="syz.0.42" path="/dev/ppp" dev="devtmpfs" ino=86 ioctlcmd=0x743e scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 27.476994][ T10] usb 4-1: 2:0: failed to get current value for ch 0 (-71) [ 27.489337][ T10] snd-usb-audio 4-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 27.500021][ T10] usb 4-1: USB disconnect, device number 3 [ 27.512732][ T378] udevd[378]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 28.172930][ T466] SELinux: ebitmap: map size 764 does not match my size 64 (high bit was 0) [ 28.181922][ T466] SELinux: failed to load policy [ 28.230793][ T10] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 28.287479][ T476] program syz.0.60 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 28.323204][ T410] usb 3-1: USB disconnect, device number 2 [ 28.382253][ T10] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 28.400230][ T10] usb 4-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 28.427473][ T10] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 28.436831][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 28.445533][ T10] usb 4-1: Product: syz [ 28.449839][ T10] usb 4-1: Manufacturer: syz [ 28.454587][ T10] usb 4-1: SerialNumber: syz [ 28.483811][ T491] FAULT_INJECTION: forcing a failure. [ 28.483811][ T491] name failslab, interval 1, probability 0, space 0, times 1 [ 28.496930][ T491] CPU: 0 UID: 0 PID: 491 Comm: syz.0.67 Not tainted syzkaller #0 1e1e3c2f05ad74614550ef0faab423d4afe8f9f4 [ 28.496952][ T491] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 28.496966][ T491] Call Trace: [ 28.496970][ T491] [ 28.496978][ T491] __dump_stack+0x21/0x30 [ 28.497007][ T491] dump_stack_lvl+0x140/0x1c0 [ 28.497022][ T491] ? __cfi_dump_stack_lvl+0x10/0x10 [ 28.497037][ T491] ? __asan_memcpy+0x5a/0x80 [ 28.497049][ T491] dump_stack+0x19/0x20 [ 28.497062][ T491] should_fail_ex+0x3c2/0x510 [ 28.497075][ T491] should_failslab+0xac/0x100 [ 28.497088][ T491] kmem_cache_alloc_lru_noprof+0x44/0x410 [ 28.497102][ T491] ? shmem_alloc_inode+0x3b/0xd0 [ 28.497115][ T491] ? avc_has_perm_noaudit+0x26b/0x360 [ 28.497128][ T491] ? __cfi_shmem_alloc_inode+0x10/0x10 [ 28.497150][ T491] shmem_alloc_inode+0x3b/0xd0 [ 28.497164][ T491] ? __cfi_shmem_alloc_inode+0x10/0x10 [ 28.497177][ T491] alloc_inode+0x7a/0x270 [ 28.497192][ T491] ? __cfi__raw_spin_lock+0x10/0x10 [ 28.497203][ T491] new_inode+0x25/0x1e0 [ 28.497216][ T491] shmem_get_inode+0x352/0xc10 [ 28.497229][ T491] shmem_mknod+0x63/0x200 [ 28.497243][ T491] shmem_mkdir+0x3b/0x80 [ 28.497256][ T491] vfs_mkdir+0x591/0x810 [ 28.497270][ T491] do_mkdirat+0x240/0x530 [ 28.497284][ T491] ? __cfi_do_mkdirat+0x10/0x10 [ 28.497299][ T491] ? __kasan_check_write+0x18/0x20 [ 28.497310][ T491] ? getname_flags+0x203/0x6b0 [ 28.497322][ T491] ? __kasan_check_write+0x18/0x20 [ 28.497333][ T491] __x64_sys_mkdirat+0x8b/0xa0 [ 28.497348][ T491] x64_sys_call+0x2ba8/0x2ee0 [ 28.497369][ T491] do_syscall_64+0x57/0xf0 [ 28.497380][ T491] ? clear_bhb_loop+0x50/0xa0 [ 28.497395][ T491] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 28.497410][ T491] RIP: 0033:0x7f40b9b9e159 [ 28.497425][ T491] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 28.497434][ T491] RSP: 002b:00007f40ba9f3028 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 [ 28.497452][ T491] RAX: ffffffffffffffda RBX: 00007f40b9e25fa0 RCX: 00007f40b9b9e159 [ 28.497461][ T491] RDX: 00000000000001ff RSI: 0000200000000000 RDI: ffffffffffffff9c [ 28.497468][ T491] RBP: 00007f40b9c3506b R08: 0000000000000000 R09: 0000000000000000 [ 28.497475][ T491] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 28.497482][ T491] R13: 00007f40b9e26038 R14: 00007f40b9e25fa0 R15: 00007fffe184f878 [ 28.497491][ T491] [ 29.109504][ T524] input: syz1 as /devices/virtual/input/input6 [ 29.173673][ T9] usb 2-1: USB disconnect, device number 3 [ 29.228714][ T536] netlink: 36 bytes leftover after parsing attributes in process `syz.1.89'. [ 29.250786][ T410] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 29.294146][ T544] capability: warning: `syz.2.93' uses deprecated v2 capabilities in a way that may be insecure [ 29.306952][ T544] overlayfs: failed to create directory ./bus/work (errno: 13); mounting read-only [ 29.347485][ T548] netlink: 12 bytes leftover after parsing attributes in process `syz.2.95'. [ 29.365373][ T548] netlink: 12 bytes leftover after parsing attributes in process `syz.2.95'. [ 29.411779][ T410] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 29.432696][ T410] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 29.452870][ T410] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x2 has an invalid bInterval 0, changing to 7 [ 29.482135][ T410] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid maxpacket 9289, setting to 1024 [ 29.505543][ T410] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 29.525966][ T410] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 29.550220][ T410] usb 1-1: config 0 descriptor?? [ 29.555950][ T517] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 29.564417][ T10] cdc_ncm 4-1:1.0: bind() failure [ 29.572093][ T10] cdc_ncm 4-1:1.1: probe with driver cdc_ncm failed with error -71 [ 29.580438][ T10] cdc_mbim 4-1:1.1: probe with driver cdc_mbim failed with error -71 [ 29.590575][ T10] usb 4-1: USB disconnect, device number 4 [ 29.710897][ T9] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 29.726589][ T46] ------------[ cut here ]------------ [ 29.732188][ T46] WARNING: CPU: 1 PID: 46 at drivers/block/ublk_drv.c:1583 ublk_uring_cmd_cancel_fn+0x351/0x410 [ 29.742711][ T46] Modules linked in: [ 29.746644][ T46] CPU: 1 UID: 0 PID: 46 Comm: kworker/u8:2 Not tainted syzkaller #0 1e1e3c2f05ad74614550ef0faab423d4afe8f9f4 [ 29.758268][ T46] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 29.768405][ T46] Workqueue: iou_exit io_ring_exit_work [ 29.774041][ T46] RIP: 0010:ublk_uring_cmd_cancel_fn+0x351/0x410 [ 29.780501][ T46] Code: 5d e9 93 3c 53 02 cc e8 5d 05 33 fe 0f 0b eb e3 e8 54 05 33 fe 0f 0b eb da e8 4b 05 33 fe 0f 0b e9 4d fe ff ff e8 3f 05 33 fe <0f> 0b eb c5 44 89 e1 80 e1 07 fe c1 38 c1 0f 8c 0a fd ff ff 4c 89 [ 29.800315][ T46] RSP: 0018:ffffc900002ff990 EFLAGS: 00010293 [ 29.806535][ T46] RAX: ffffffff83547531 RBX: 1ffff11023713d6d RCX: ffff88810ba40000 [ 29.814568][ T46] RDX: 0000000000000000 RSI: 000000000000005d RDI: 0000000000000104 [ 29.822699][ T46] RBP: ffffc900002ff9e0 R08: 0000000000000003 R09: 0000000000000004 [ 29.830699][ T46] R10: 0000000000000000 R11: ffffffff83546510 R12: ffff88811b97b900 [ 29.838718][ T46] R13: ffff88811b89eb40 R14: ffff88811510d8a8 R15: ffff88811510d8b8 [ 29.846727][ T46] FS: 0000000000000000(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 29.855693][ T46] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 29.862431][ T46] CR2: 00007fcd5cff4fd8 CR3: 00000001000ba000 CR4: 00000000003526b0 [ 29.870430][ T46] Call Trace: [ 29.871935][ T9] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 29.873775][ T46] [ 29.885953][ T9] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 29.887805][ T46] ublk_ch_uring_cmd+0x6f/0xa0 [ 29.887840][ T46] io_uring_try_cancel_uring_cmd+0x196/0x280 [ 29.898563][ T9] usb 3-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 29.902412][ T46] io_uring_try_cancel_requests+0x4d6/0x5b5 [ 29.902448][ T46] ? io_uring_cancel_generic+0x6eb/0x6eb [ 29.908858][ T9] usb 3-1: New USB device strings: Mfr=2, Product=0, SerialNumber=0 [ 29.917679][ T46] io_ring_exit_work+0x23d/0x83b [ 29.917718][ T46] ? __cfi_io_ring_exit_work+0x10/0x10 [ 29.924260][ T9] usb 3-1: Manufacturer: syz [ 29.929303][ T46] ? __kasan_check_write+0x18/0x20 [ 29.929338][ T46] ? kick_pool+0xb9/0x540 [ 29.942030][ T9] usb 3-1: config 0 descriptor?? [ 29.942356][ T46] process_scheduled_works+0x7f4/0x1060 [ 29.972444][ T46] worker_thread+0xc99/0x13f0 [ 29.977148][ T46] kthread+0x2c4/0x360 [ 29.981279][ T46] ? __cfi_worker_thread+0x10/0x10 [ 29.985486][ T410] plantronics 0003:047F:FFFF.0004: unknown main item tag 0x0 [ 29.986400][ T46] ? __cfi_kthread+0x10/0x10 [ 29.986430][ T46] ret_from_fork+0x64/0xa0 [ 29.996384][ T410] plantronics 0003:047F:FFFF.0004: unknown main item tag 0x0 [ 29.998453][ T46] ? __cfi_kthread+0x10/0x10 [ 29.998486][ T46] ret_from_fork_asm+0x1a/0x30 [ 30.003208][ T410] plantronics 0003:047F:FFFF.0004: unknown main item tag 0x0 [ 30.010367][ T46] [ 30.010382][ T46] ---[ end trace 0000000000000000 ]--- [ 30.035989][ T410] plantronics 0003:047F:FFFF.0004: unknown main item tag 0x0 [ 30.043844][ T410] plantronics 0003:047F:FFFF.0004: No inputs registered, leaving [ 30.062551][ T410] plantronics 0003:047F:FFFF.0004: hiddev96,hidraw0: USB HID v0.00 Joystick [HID 047f:ffff] on usb-dummy_hcd.0-1/input0 [ 30.301961][ T410] usb 1-1: USB disconnect, device number 2 [ 30.757173][ T9] input: syz Pen as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/0003:256C:006D.0005/input/input7 [ 30.778447][ T9] input: syz Pad as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/0003:256C:006D.0005/input/input8 [ 30.791855][ T9] input: syz Touch Strip as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/0003:256C:006D.0005/input/input9 [ 30.805180][ T9] input: syz Dial as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/0003:256C:006D.0005/input/input10 [ 30.831647][ T9] uclogic 0003:256C:006D.0005: input,hidraw0: USB HID v0.00 Keypad [syz] on usb-dummy_hcd.2-1/input0 [ 30.996801][ T9] usb 3-1: USB disconnect, device number 3