last executing test programs: 11.479179019s ago: executing program 1 (id=399): socket$nl_generic(0x10, 0x3, 0x10) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./file0\x00', 0x39) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x404, &(0x7f0000002140)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}}) statx(0xffffffffffffff9c, &(0x7f0000000640)='./file0/file1\x00', 0x1000, 0x100, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='./file0/file1\x00', 0x880cc2, 0x20) r1 = syz_ublk_setup_io_uring(0x19, &(0x7f0000000040)={0x0, 0x2d72, 0x0, 0xfffffffd, 0x1ef}, &(0x7f0000000100)=0x0, 0x0, &(0x7f00000002c0)=0x0) syz_ublk_add_dev(r1, r2, 0x0, r3, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = dup(r5) syz_ublk_setup_queues(r6, r4, &(0x7f0000000180)={0x0, 0x1, 0x0, 0x200007, 0x255}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x2000, 0x2100, 0x10000004, 0x0, r6}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x11e0, 0x8801, 0x2, 0x134}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf911, 0x0, 0x0, 0x1f0, 0x0, r6}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xac1b, 0x2, 0x2, 0x250}}], 0x1, &(0x7f0000000340)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x1, {}, 0x1f, 0x0, '\x00', {0xfff6, 0x630, 0x0, 0x0}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x6, 0x0, &(0x7f0000000000)='GPL\x00', 0x9, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x94) bind$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x10000000}, 0x1c) 8.915336889s ago: executing program 0 (id=403): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0xfc5cd7921c2c19c4, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, 0x0) chdir(&(0x7f0000000080)='./file1\x00') r0 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) setpgid(r0, r0) setpgid(0x0, r0) open_tree(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x80001) 7.958019417s ago: executing program 0 (id=404): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x50) bpf$MAP_LOOKUP_BATCH(0x19, &(0x7f0000000800)={0x0, &(0x7f0000000cc0)=""/129, 0x0, 0x0, 0x6c, r0}, 0x38) 7.927135337s ago: executing program 1 (id=405): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000003c0)='cpuacct.stat\x00', 0x26e1, 0x0) close(r0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)) sendmsg$nl_xfrm(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x33fe0}}, 0x0) sendmsg$ETHTOOL_MSG_PAUSE_SET(r0, &(0x7f0000000500)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000400)={0xa0, 0x0, 0x4, 0x70bd26, 0x25dfdbfb, {}, [@ETHTOOL_A_PAUSE_RX={0x15, 0x3, 0x1}, @ETHTOOL_A_PAUSE_AUTONEG={0x5, 0x2, 0x1}, @ETHTOOL_A_PAUSE_RX={0x5, 0x3, 0x1}, @ETHTOOL_A_PAUSE_AUTONEG, @ETHTOOL_A_PAUSE_HEADER={0x68, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vxcan1\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_bond\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0xfffffffffffffdaf}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}]}, 0xa0}, 0x1, 0x0, 0x0, 0x1}, 0x4000080) 7.245398512s ago: executing program 0 (id=406): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/test\x00', 0x777) openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x2, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.cpu/test/memory.oom_control\x00', 0x2, 0x0) write(r0, &(0x7f0000000200)='1', 0x1) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) write(r1, &(0x7f0000000280)='0', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracing\x00', 0x1ff) socket$nl_netfilter(0x10, 0x3, 0xc) mount(0x0, &(0x7f00000002c0)='./tracing\x00', &(0x7f00000000c0)='tracefs\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r2, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) socket$inet6(0xa, 0x1, 0x0) r3 = socket$inet(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r3, 0x0, 0x40, &(0x7f00000002c0)=@mangle={'mangle\x00', 0x1f, 0x6, 0x390, 0x0, 0x130, 0x1c8, 0x260, 0x2f8, 0x98, 0x130, 0x1c8, 0x260, 0x2f8, 0x6, 0x0, {[{{@uncond, 0x0, 0x70, 0x98}, @ECN={0x28, 'ECN\x00', 0x0, {0x1, 0x1}}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x3f0) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r4 = fsmount(0xffffffffffffffff, 0x0, 0x0) r5 = openat$cgroup_pressure(r4, &(0x7f00000000c0)='memory.pressure\x00', 0x2, 0x0) read(r5, &(0x7f0000000100)=""/43, 0x2b) socket$inet_tcp(0x2, 0x1, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet_tcp(0x2, 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./tracing/instances/inst1\x00', 0x1ff) 7.115483583s ago: executing program 1 (id=407): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000000c0)=0x7) r1 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_ADD_MFC_PROXY(r1, 0x0, 0xd2, &(0x7f0000000040)={@remote, @loopback, 0xffffffffffffffff, "2e80866ae35e9536b92a1a2c3acb799aec0f49e403255faccedb2eba65891a7a", 0x8001, 0x8, 0xe, 0x88}, 0x3c) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee6, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r2, 0x89f6, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000000)={'syztnl1\x00', 0x0, 0x0, 0x0, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @remote, @broadcast}}}}) r3 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/profiling', 0xa0042, 0x0) write$FUSE_NOTIFY_DELETE(r3, &(0x7f0000000440)=ANY=[@ANYBLOB='k'], 0x2a) futex(0x0, 0x7, 0x0, 0x0, 0x0, 0x2) 5.127155039s ago: executing program 0 (id=408): r0 = openat$fb0(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$FBIOPUT_VSCREENINFO(r0, 0x4601, 0x0) 3.864809529s ago: executing program 0 (id=409): socket$nl_generic(0x10, 0x3, 0x10) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./file0\x00', 0x39) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x404, &(0x7f0000002140)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}}) statx(0xffffffffffffff9c, &(0x7f0000000640)='./file0/file1\x00', 0x1000, 0x100, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='./file0/file1\x00', 0x880cc2, 0x20) r1 = syz_ublk_setup_io_uring(0x19, &(0x7f0000000040)={0x0, 0x2d72, 0x0, 0xfffffffd, 0x1ef}, &(0x7f0000000100)=0x0, 0x0, &(0x7f00000002c0)=0x0) syz_ublk_add_dev(r1, r2, 0x0, r3, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = dup(r5) syz_ublk_setup_queues(r6, r4, &(0x7f0000000180)={0x0, 0x1, 0x0, 0x200007, 0x255}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x2000, 0x2100, 0x10000004, 0x0, r6}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x11e0, 0x8801, 0x2, 0x134}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf911, 0x0, 0x0, 0x1f0, 0x0, r6}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xac1b, 0x2, 0x2, 0x250}}], 0x1, &(0x7f0000000340)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x1, {}, 0x1f, 0x0, '\x00', {0xfff6, 0x630, 0x0, 0x0}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x6, 0x0, &(0x7f0000000000)='GPL\x00', 0x9, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x94) bind$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x10000000}, 0x1c) 1.709647976s ago: executing program 1 (id=410): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB], 0x50) bpf$MAP_LOOKUP_BATCH(0x19, &(0x7f0000000800)={0x0, &(0x7f0000000cc0)=""/129, 0x0, 0x0, 0x6c, r0}, 0x38) 994.199642ms ago: executing program 1 (id=411): r0 = socket$can_j1939(0x1d, 0x2, 0x7) r1 = socket$igmp(0x2, 0x3, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000380)={'vxcan0\x00', 0x0}) bind$can_j1939(r0, &(0x7f0000000340)={0x1d, r2, 0x0, {0x2, 0x1, 0x6}, 0x1}, 0x18) sendmmsg(r0, &(0x7f0000005800)=[{{0x0, 0x0, &(0x7f00000013c0)=[{&(0x7f0000000100)="ff", 0x1}, {0x0}], 0x2}}], 0x1, 0x24000006) 559.665815ms ago: executing program 0 (id=412): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/test\x00', 0x777) openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x2, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.cpu/test/memory.oom_control\x00', 0x2, 0x0) write(r0, &(0x7f0000000200)='1', 0x1) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) write(r1, &(0x7f0000000280)='0', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracing\x00', 0x1ff) socket$nl_netfilter(0x10, 0x3, 0xc) mount(0x0, &(0x7f00000002c0)='./tracing\x00', &(0x7f00000000c0)='tracefs\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r2, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) socket$inet6(0xa, 0x1, 0x0) r3 = socket$inet(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r3, 0x0, 0x40, &(0x7f00000002c0)=@mangle={'mangle\x00', 0x1f, 0x6, 0x390, 0x0, 0x130, 0x1c8, 0x260, 0x2f8, 0x98, 0x130, 0x1c8, 0x260, 0x2f8, 0x6, 0x0, {[{{@uncond, 0x0, 0x70, 0x98}, @ECN={0x28, 'ECN\x00', 0x0, {0x1, 0x1}}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x3f0) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r4 = fsmount(0xffffffffffffffff, 0x0, 0x0) r5 = openat$cgroup_pressure(r4, &(0x7f00000000c0)='memory.pressure\x00', 0x2, 0x0) read(r5, &(0x7f0000000100)=""/43, 0x2b) socket$inet_tcp(0x2, 0x1, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet_tcp(0x2, 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./tracing/instances/inst1\x00', 0x1ff) 0s ago: executing program 1 (id=413): mremap(&(0x7f0000ceb000/0x2000)=nil, 0x2000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) r0 = socket$netlink(0x10, 0x3, 0xb) sendmsg$BATADV_CMD_SET_MESH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000340)=ANY=[@ANYBLOB="cf"], 0x1c}, 0x1, 0x0, 0x0, 0x20804}, 0x44800) kernel console output (not intermixed with test programs): Warning: Permanently added '[localhost]:33872' (ED25519) to the list of known hosts. [ 241.150070][ T30] audit: type=1400 audit(240.850:86): avc: denied { name_bind } for pid=3382 comm="sshd-session" src=30002 scontext=system_u:system_r:sshd_t tcontext=system_u:object_r:unreserved_port_t tclass=tcp_socket permissive=1 [ 241.709755][ T30] audit: type=1400 audit(241.410:87): avc: denied { execute } for pid=3383 comm="sh" name="syz-executor" dev="vda" ino=1867 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:etc_runtime_t tclass=file permissive=1 [ 241.719755][ T30] audit: type=1400 audit(241.420:88): avc: denied { execute_no_trans } for pid=3383 comm="sh" path="/syz-executor" dev="vda" ino=1867 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:etc_runtime_t tclass=file permissive=1 [ 249.248013][ T30] audit: type=1400 audit(248.950:89): avc: denied { mounton } for pid=3383 comm="syz-executor" path="/syzcgroup/unified" dev="vda" ino=1868 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 249.304371][ T30] audit: type=1400 audit(249.000:90): avc: denied { mount } for pid=3383 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 249.356876][ T3383] cgroup: Unknown subsys name 'net' [ 249.422056][ T30] audit: type=1400 audit(249.120:91): avc: denied { unmount } for pid=3383 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 249.829304][ T3383] cgroup: Unknown subsys name 'cpuset' [ 249.885379][ T3383] cgroup: Unknown subsys name 'rlimit' [ 250.195236][ T30] audit: type=1400 audit(249.890:92): avc: denied { setattr } for pid=3383 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=704 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 250.200190][ T30] audit: type=1400 audit(249.900:93): avc: denied { mounton } for pid=3383 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 250.209065][ T30] audit: type=1400 audit(249.900:94): avc: denied { mount } for pid=3383 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 250.822150][ T3385] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 250.831828][ T30] audit: type=1400 audit(250.530:95): avc: denied { relabelto } for pid=3385 comm="mkswap" name="swap-file" dev="vda" ino=1871 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 250.837720][ T30] audit: type=1400 audit(250.540:96): avc: denied { write } for pid=3385 comm="mkswap" path="/swap-file" dev="vda" ino=1871 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" Setting up swapspace version 1, size = 127995904 bytes [ 250.940988][ T30] audit: type=1400 audit(250.640:97): avc: denied { read } for pid=3383 comm="syz-executor" name="swap-file" dev="vda" ino=1871 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 250.950202][ T30] audit: type=1400 audit(250.650:98): avc: denied { open } for pid=3383 comm="syz-executor" path="/swap-file" dev="vda" ino=1871 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 250.997981][ T3383] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 279.797945][ T30] audit: type=1400 audit(279.500:99): avc: denied { execmem } for pid=3386 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 279.947686][ T30] audit: type=1400 audit(279.650:100): avc: denied { read } for pid=3388 comm="syz-executor" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 279.957719][ T30] audit: type=1400 audit(279.660:101): avc: denied { open } for pid=3388 comm="syz-executor" path="net:[4026531833]" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 279.974831][ T30] audit: type=1400 audit(279.670:102): avc: denied { mounton } for pid=3388 comm="syz-executor" path="/" dev="vda" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 280.020105][ T30] audit: type=1400 audit(279.720:103): avc: denied { module_request } for pid=3388 comm="syz-executor" kmod="netdev-nr0" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 280.505052][ T30] audit: type=1400 audit(280.200:104): avc: denied { sys_module } for pid=3388 comm="syz-executor" capability=16 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 288.510649][ T3388] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 288.556029][ T3388] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 289.276214][ T3390] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 289.296178][ T3390] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 291.909486][ T3388] hsr_slave_0: entered promiscuous mode [ 291.929563][ T3388] hsr_slave_1: entered promiscuous mode [ 292.419168][ T3390] hsr_slave_0: entered promiscuous mode [ 292.432463][ T3390] hsr_slave_1: entered promiscuous mode [ 292.442803][ T3390] debugfs: 'hsr0' already exists in 'hsr' [ 292.450832][ T3390] Cannot create hsr debugfs directory [ 294.953964][ T30] audit: type=1400 audit(294.650:105): avc: denied { create } for pid=3388 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 294.970090][ T30] audit: type=1400 audit(294.670:106): avc: denied { write } for pid=3388 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 294.990257][ T30] audit: type=1400 audit(294.690:107): avc: denied { read } for pid=3388 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 295.048207][ T3388] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 295.171735][ T3388] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 295.199996][ T3388] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 295.258762][ T3388] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 295.274755][ T3388] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 295.314964][ T3388] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 295.342385][ T3388] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 295.385240][ T3388] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 296.085718][ T3390] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 296.132822][ T3390] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 296.142605][ T3390] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 296.189238][ T3390] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 296.197376][ T3390] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 296.244066][ T3390] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 296.256321][ T3390] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 296.281936][ T3390] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 298.811386][ T3388] 8021q: adding VLAN 0 to HW filter on device bond0 [ 299.869122][ T3390] 8021q: adding VLAN 0 to HW filter on device bond0 [ 312.517208][ T3390] veth0_vlan: entered promiscuous mode [ 312.583837][ T3388] veth0_vlan: entered promiscuous mode [ 312.718422][ T3390] veth1_vlan: entered promiscuous mode [ 312.788121][ T3388] veth1_vlan: entered promiscuous mode [ 313.301760][ T3390] veth0_macvtap: entered promiscuous mode [ 313.457346][ T3390] veth1_macvtap: entered promiscuous mode [ 313.487776][ T3388] veth0_macvtap: entered promiscuous mode [ 313.582966][ T3388] veth1_macvtap: entered promiscuous mode [ 314.347396][ T2170] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 314.356477][ T205] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 314.378306][ T42] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 314.408428][ T42] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 314.466954][ T2170] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 314.467966][ T2170] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 314.507552][ T205] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 314.577763][ T205] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 315.219690][ T30] audit: type=1400 audit(314.920:108): avc: denied { mounton } for pid=3390 comm="syz-executor" path="/syzkaller.3kjEDE/syz-tmp" dev="vda" ino=1876 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 315.250575][ T30] audit: type=1400 audit(314.950:109): avc: denied { mount } for pid=3390 comm="syz-executor" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 315.309874][ T30] audit: type=1400 audit(315.000:110): avc: denied { mounton } for pid=3390 comm="syz-executor" path="/syzkaller.3kjEDE/syz-tmp/newroot/dev" dev="tmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 315.350095][ T30] audit: type=1400 audit(315.050:111): avc: denied { mount } for pid=3390 comm="syz-executor" name="/" dev="proc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 315.422216][ T30] audit: type=1400 audit(315.110:112): avc: denied { mounton } for pid=3390 comm="syz-executor" path="/syzkaller.3kjEDE/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 315.465246][ T30] audit: type=1400 audit(315.160:113): avc: denied { mounton } for pid=3390 comm="syz-executor" path="/syzkaller.3kjEDE/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=4016 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1 [ 315.582523][ T30] audit: type=1400 audit(315.280:114): avc: denied { unmount } for pid=3390 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 315.687628][ T30] audit: type=1400 audit(315.380:115): avc: denied { mounton } for pid=3390 comm="syz-executor" path="/dev/gadgetfs" dev="devtmpfs" ino=1548 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=dir permissive=1 [ 315.764182][ T30] audit: type=1400 audit(315.460:116): avc: denied { mount } for pid=3390 comm="syz-executor" name="/" dev="gadgetfs" ino=4017 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=filesystem permissive=1 [ 315.976712][ T30] audit: type=1400 audit(315.670:117): avc: denied { mount } for pid=3390 comm="syz-executor" name="/" dev="binder" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 316.511569][ T3388] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 319.256594][ T1002] usb 1-1: new full-speed USB device number 2 using dummy_hcd [ 319.562522][ T1002] usb 1-1: unable to get BOS descriptor or descriptor too short [ 319.578197][ T1002] usb 1-1: not running at top speed; connect to a high speed hub [ 319.581632][ T1002] usb 1-1: New USB device found, idVendor=046d, idProduct=c286, bcdDevice= 0.40 [ 319.601978][ T1002] usb 1-1: config 1 interface 0 has no altsetting 0 [ 319.662861][ T1002] usb 1-1: string descriptor 0 read error: -22 [ 319.670534][ T1002] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 320.228982][ T30] kauditd_printk_skb: 8 callbacks suppressed [ 320.229774][ T30] audit: type=1400 audit(319.930:126): avc: denied { ioctl } for pid=3540 comm="syz.1.2" path="socket:[4033]" dev="sockfs" ino=4033 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 321.467118][ T3550] block nbd0: not configured, cannot reconfigure [ 321.760974][ T1002] hid-generic 0003:046D:C286.0001: unknown main item tag 0x2 [ 321.767330][ T1002] hid-generic 0003:046D:C286.0001: unknown main item tag 0x0 [ 321.769702][ T1002] hid-generic 0003:046D:C286.0001: unknown main item tag 0x0 [ 321.787027][ T1002] hid-generic 0003:046D:C286.0001: unknown main item tag 0x0 [ 321.791178][ T1002] hid-generic 0003:046D:C286.0001: unknown main item tag 0x0 [ 321.794515][ T1002] hid-generic 0003:046D:C286.0001: unknown main item tag 0x0 [ 321.796520][ T1002] hid-generic 0003:046D:C286.0001: unknown main item tag 0x0 [ 321.799100][ T1002] hid-generic 0003:046D:C286.0001: unknown main item tag 0x0 [ 321.801005][ T1002] hid-generic 0003:046D:C286.0001: unknown main item tag 0x0 [ 321.802920][ T1002] hid-generic 0003:046D:C286.0001: unknown main item tag 0x0 [ 322.356320][ T30] audit: type=1400 audit(322.050:127): avc: denied { create } for pid=3551 comm="syz.0.4" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 322.406962][ T30] audit: type=1400 audit(322.100:128): avc: denied { setopt } for pid=3551 comm="syz.0.4" lport=2 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 322.811570][ T3554] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 322.839478][ T3554] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 322.890904][ T3554] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 322.920279][ T3554] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 323.190946][ T1002] input: HID 046d:c286 as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/0003:046D:C286.0001/input/input1 [ 323.205626][ T3554] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 323.227302][ T3554] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 323.309623][ T1002] hid-generic 0003:046D:C286.0001: offset (39) exceeds report_count (19) [ 323.310098][ T1002] hid-generic 0003:046D:C286.0001: offset (25) exceeds report_count (19) [ 323.709280][ T1002] hid-generic 0003:046D:C286.0001: input,hidraw0: USB HID v0.0a Keyboard [HID 046d:c286] on usb-dummy_hcd.0-1/input0 [ 323.835093][ T1002] usb 1-1: USB disconnect, device number 2 [ 324.040414][ T3557] netlink: 24 bytes leftover after parsing attributes in process `syz.1.6'. [ 324.107468][ T3557] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=65535 sclass=netlink_route_socket pid=3557 comm=syz.1.6 [ 324.141861][ T3557] netlink: 24 bytes leftover after parsing attributes in process `syz.1.6'. [ 324.165565][ T3557] Zero length message leads to an empty skb [ 324.645721][ T3560] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 324.682214][ T3560] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 325.662470][ T30] audit: type=1400 audit(325.360:129): avc: denied { create } for pid=3562 comm="syz.1.8" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 325.695082][ T30] audit: type=1400 audit(325.390:130): avc: denied { write } for pid=3562 comm="syz.1.8" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 325.699836][ T3558] fido_id[3558]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.0/usb1/report_descriptor': No such file or directory [ 325.801382][ T3564] xt_nfacct: accounting object `syz0' does not exist [ 325.901270][ T1002] usb 1-1: new full-speed USB device number 3 using dummy_hcd [ 326.285937][ T1002] usb 1-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 326.380887][ T1002] usb 1-1: config 0 interface 0 altsetting 255 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 326.384713][ T1002] usb 1-1: config 0 interface 0 altsetting 255 endpoint 0x8F has invalid wMaxPacketSize 0 [ 326.397202][ T1002] usb 1-1: config 0 interface 0 has no altsetting 0 [ 326.457819][ T1002] usb 1-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 326.464385][ T1002] usb 1-1: Product: syz [ 326.468732][ T1002] usb 1-1: Manufacturer: syz [ 326.471979][ T1002] usb 1-1: SerialNumber: syz [ 326.579671][ T1002] usb 1-1: config 0 descriptor?? [ 326.781301][ T1002] usb 1-1: selecting invalid altsetting 0 [ 327.162587][ T30] audit: type=1400 audit(326.860:131): avc: denied { prog_load } for pid=3551 comm="syz.0.4" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 327.184166][ T30] audit: type=1400 audit(326.870:132): avc: denied { bpf } for pid=3551 comm="syz.0.4" capability=39 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 327.247214][ T30] audit: type=1400 audit(326.930:133): avc: denied { perfmon } for pid=3551 comm="syz.0.4" capability=38 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 327.465639][ T30] audit: type=1400 audit(327.160:134): avc: denied { name_bind } for pid=3551 comm="syz.0.4" src=20002 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=tcp_socket permissive=1 [ 327.471060][ T30] audit: type=1400 audit(327.170:135): avc: denied { node_bind } for pid=3551 comm="syz.0.4" saddr=::1 src=20002 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 327.769003][ T29] usb 1-1: USB disconnect, device number 3 [ 329.600275][ T3576] netlink: 24 bytes leftover after parsing attributes in process `syz.1.11'. [ 329.614476][ T3576] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=65535 sclass=netlink_route_socket pid=3576 comm=syz.1.11 [ 329.714776][ T29] usb 1-1: new low-speed USB device number 4 using dummy_hcd [ 329.902578][ T29] usb 1-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 330.058835][ T29] usb 1-1: config 0 has no interfaces? [ 330.059544][ T29] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 330.127781][ T3578] oom_control is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 330.191891][ T29] usb 1-1: config 0 descriptor?? [ 330.356476][ T30] audit: type=1400 audit(330.050:136): avc: denied { mount } for pid=3577 comm="syz.1.12" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 330.520192][ T3578] UDC core: USB Gadget filesystem: couldn't find an available UDC [ 330.602037][ T3578] ip_tables: iptables: counters copy to user failed while replacing table [ 330.677002][ T3574] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 330.738718][ T3574] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 330.765280][ T30] audit: type=1400 audit(330.460:137): avc: denied { read write } for pid=3577 comm="syz.1.12" name="fuse" dev="devtmpfs" ino=92 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 330.769114][ T30] audit: type=1400 audit(330.460:138): avc: denied { open } for pid=3577 comm="syz.1.12" path="/dev/fuse" dev="devtmpfs" ino=92 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 330.805617][ T806] usb 1-1: USB disconnect, device number 4 [ 330.902773][ T30] audit: type=1400 audit(330.600:139): avc: denied { search } for pid=3577 comm="syz.1.12" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 330.904389][ T30] audit: type=1400 audit(330.600:140): avc: denied { search } for pid=3577 comm="syz.1.12" name="instances" dev="tracefs" ino=82 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 330.987080][ T30] audit: type=1400 audit(330.680:141): avc: denied { write search } for pid=3577 comm="syz.1.12" name="instances" dev="tracefs" ino=82 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 330.997304][ T30] audit: type=1400 audit(330.700:142): avc: denied { add_name } for pid=3577 comm="syz.1.12" name="inst1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 331.009080][ T30] audit: type=1400 audit(330.700:143): avc: denied { create } for pid=3577 comm="syz.1.12" name="inst1" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:tracefs_t tclass=dir permissive=1 [ 331.568585][ T806] usb 1-1: new full-speed USB device number 5 using dummy_hcd [ 331.990167][ T806] usb 1-1: New USB device found, idVendor=045e, idProduct=0284, bcdDevice=a4.8f [ 331.998681][ T3563] udevd[3563]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 332.080416][ T806] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 332.086187][ T806] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFC, changing to 0x8C [ 332.090522][ T806] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8C has an invalid bInterval 0, changing to 10 [ 332.095365][ T806] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8C has invalid maxpacket 108, setting to 64 [ 332.104918][ T806] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 332.555161][ T806] usb 1-1: string descriptor 0 read error: -22 [ 332.558594][ T806] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 332.794802][ T806] usb 1-1: config 0 descriptor?? [ 333.302930][ T806] usb 1-1: USB disconnect, device number 5 [ 334.820677][ T3578] Could not create tracefs 'trace_pipe_raw' entry [ 335.249341][ T3578] Could not create tracefs 'stats' entry [ 335.694953][ T3578] Could not create tracefs 'buffer_size_kb' entry [ 335.941622][ T3578] Could not create tracefs 'free_buffer' entry [ 336.301802][ T3578] Could not create tracefs 'trace_marker' entry [ 336.488419][ T3578] Could not create tracefs 'trace_marker_raw' entry [ 336.822465][ T3578] Could not create tracefs 'buffer_percent' entry [ 337.087577][ T3578] Could not create tracefs 'syscall_user_buf_size' entry [ 337.225209][ T3578] Could not create tracefs 'tracing_on' entry [ 337.405445][ T3578] Could not create tracefs 'error_log' entry [ 337.572699][ T3578] Could not create tracefs 'test_nop_accept' entry [ 337.594993][ T3578] ERROR: Failed to create trace option: test_nop_accept [ 337.786392][ T3578] Could not create tracefs 'test_nop_refuse' entry [ 337.938047][ T30] audit: type=1400 audit(337.640:144): avc: denied { create } for pid=3586 comm="syz.0.14" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 337.950652][ T30] audit: type=1400 audit(337.650:145): avc: denied { unmount } for pid=3390 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=filesystem permissive=1 [ 337.976838][ T30] audit: type=1400 audit(337.680:146): avc: denied { write } for pid=3586 comm="syz.0.14" path="socket:[5127]" dev="sockfs" ino=5127 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 338.007106][ T30] audit: type=1400 audit(337.710:147): avc: denied { unmount } for pid=3390 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 338.062547][ T30] audit: type=1400 audit(337.760:148): avc: denied { read write } for pid=3390 comm="syz-executor" name="loop1" dev="devtmpfs" ino=639 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 338.077971][ T30] audit: type=1400 audit(337.780:149): avc: denied { open } for pid=3390 comm="syz-executor" path="/dev/loop1" dev="devtmpfs" ino=639 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 338.097444][ T30] audit: type=1400 audit(337.790:150): avc: denied { ioctl } for pid=3390 comm="syz-executor" path="/dev/loop1" dev="devtmpfs" ino=639 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 338.594603][ T3591] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=65535 sclass=netlink_route_socket pid=3591 comm=syz.0.16 [ 339.086602][ T3594] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 339.117140][ T3594] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 339.171580][ T3594] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 339.181417][ T30] audit: type=1400 audit(338.880:151): avc: denied { create } for pid=3593 comm="syz.0.18" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 339.189994][ T3594] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 339.235351][ T30] audit: type=1400 audit(338.930:152): avc: denied { connect } for pid=3593 comm="syz.0.18" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 339.316926][ T30] audit: type=1400 audit(339.020:153): avc: denied { ioctl } for pid=3593 comm="syz.0.18" path="socket:[5140]" dev="sockfs" ino=5140 ioctlcmd=0x5411 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 339.456984][ T3594] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 339.491145][ T3594] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 340.689421][ T3597] gadgetfs: bound to dummy_udc driver [ 340.787699][ T3597] ip_tables: iptables: counters copy to user failed while replacing table [ 341.026027][ T29] usb 1-1: new full-speed USB device number 6 using dummy_hcd [ 341.028057][ C1] gadgetfs: connected [ 341.057368][ T29] gadgetfs: disconnected [ 341.239084][ T3596] gadgetfs: suspended from state 2 [ 341.286440][ T29] usb 1-1: device descriptor read/all, error -71 [ 342.991041][ T30] audit: type=1400 audit(342.680:154): avc: denied { watch_mount watch_reads } for pid=3604 comm="syz.0.23" path="/9" dev="tmpfs" ino=61 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 343.335715][ T3607] netlink: 64 bytes leftover after parsing attributes in process `syz.1.24'. [ 343.574177][ T30] audit: type=1400 audit(343.270:155): avc: denied { name_bind } for pid=3605 comm="syz.1.24" src=20000 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=udp_socket permissive=1 [ 343.618646][ T30] audit: type=1400 audit(343.320:156): avc: denied { ioctl } for pid=3605 comm="syz.1.24" path="socket:[4182]" dev="sockfs" ino=4182 ioctlcmd=0x8914 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 343.619573][ T3607] syzkaller1: entered promiscuous mode [ 343.620094][ T3607] syzkaller1: entered allmulticast mode [ 345.338397][ T3613] gadgetfs: bound to dummy_udc driver [ 345.401519][ T3613] ip_tables: iptables: counters copy to user failed while replacing table [ 345.705829][ T3535] usb 1-1: new full-speed USB device number 8 using dummy_hcd [ 345.707310][ C0] gadgetfs: connected [ 345.714893][ T3535] gadgetfs: disconnected [ 346.680498][ T30] audit: type=1400 audit(346.380:157): avc: denied { create } for pid=3618 comm="syz.0.30" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_rdma_socket permissive=1 [ 346.737501][ T30] audit: type=1400 audit(346.400:158): avc: denied { write } for pid=3618 comm="syz.0.30" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_rdma_socket permissive=1 [ 348.506467][ T3627] socket: no more sockets [ 349.872051][ T3627] socket: no more sockets [ 350.269581][ T3627] socket: no more sockets [ 350.807174][ T3627] socket: no more sockets [ 351.272563][ T3627] socket: no more sockets [ 351.521701][ T3627] socket: no more sockets [ 351.790936][ T3627] socket: no more sockets [ 352.764120][ T30] audit: type=1400 audit(352.460:159): avc: denied { append } for pid=3640 comm="syz.1.37" name="loop5" dev="devtmpfs" ino=643 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 352.929634][ T30] audit: type=1400 audit(352.630:160): avc: denied { mounton } for pid=3640 comm="syz.1.37" path="/19/file0" dev="tmpfs" ino=116 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 354.185384][ T30] audit: type=1400 audit(353.880:161): avc: denied { unmount } for pid=3390 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=filesystem permissive=1 [ 354.366431][ T3645] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=65535 sclass=netlink_route_socket pid=3645 comm=syz.0.38 [ 355.954787][ T30] audit: type=1400 audit(355.650:162): avc: denied { create } for pid=3651 comm="syz.1.41" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 358.732966][ T30] audit: type=1400 audit(358.430:163): avc: denied { map_create } for pid=3666 comm="syz.1.48" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 358.770677][ T30] audit: type=1400 audit(358.470:164): avc: denied { map_read map_write } for pid=3666 comm="syz.1.48" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 364.331673][ T30] audit: type=1400 audit(364.020:165): avc: denied { create } for pid=3691 comm="syz.1.58" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 364.394288][ T30] audit: type=1400 audit(364.090:166): avc: denied { setopt } for pid=3691 comm="syz.1.58" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 364.519006][ T3692] gadgetfs: bound to dummy_udc driver [ 364.539842][ T30] audit: type=1400 audit(364.240:167): avc: denied { ioctl } for pid=3691 comm="syz.1.58" path="socket:[5341]" dev="sockfs" ino=5341 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 364.563847][ T30] audit: type=1400 audit(364.260:168): avc: denied { write } for pid=3691 comm="syz.1.58" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 364.800544][ T3690] gadgetfs: suspended from state 2 [ 364.809463][ T3535] usb 1-1: new full-speed USB device number 9 using dummy_hcd [ 365.975407][ T30] audit: type=1400 audit(365.680:169): avc: denied { create } for pid=3695 comm="syz.0.60" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 365.997422][ T30] audit: type=1400 audit(365.700:170): avc: denied { ioctl } for pid=3695 comm="syz.0.60" path="socket:[5361]" dev="sockfs" ino=5361 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 366.004099][ T30] audit: type=1400 audit(365.700:171): avc: denied { bind } for pid=3695 comm="syz.0.60" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 366.036119][ T30] audit: type=1400 audit(365.740:172): avc: denied { connect } for pid=3695 comm="syz.0.60" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 366.041151][ T30] audit: type=1400 audit(365.740:173): avc: denied { write } for pid=3695 comm="syz.0.60" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 367.340507][ C0] vcan0: j1939_tp_rxtimer: 0x00000000e85d5a4d: rx timeout, send abort [ 367.350390][ C0] vcan0: j1939_xtp_rx_abort_one: 0x00000000e85d5a4d: 0x20000: (3) A timeout occurred and this is the connection abort to close the session. [ 367.379954][ T30] audit: type=1400 audit(367.060:174): avc: denied { read } for pid=3183 comm="syslogd" name="log" dev="vda" ino=1857 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 367.790588][ T3701] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 369.140334][ T3707] gadgetfs: bound to dummy_udc driver [ 372.529261][ T3716] syzkaller0: entered promiscuous mode [ 372.530018][ T3716] syzkaller0: entered allmulticast mode [ 374.295227][ T3720] gadgetfs: bound to dummy_udc driver [ 378.586612][ T3742] gadgetfs: bound to dummy_udc driver [ 378.866151][ T23] usb 1-1: new full-speed USB device number 10 using dummy_hcd [ 378.871025][ C1] gadgetfs: connected [ 378.881217][ T23] gadgetfs: disconnected [ 379.041718][ T3741] gadgetfs: suspended from state 2 [ 379.056655][ T23] usb 1-1: device descriptor read/all, error -71 [ 379.600639][ T3747] xt_time: unknown flags 0x68 [ 380.085771][ T30] kauditd_printk_skb: 8 callbacks suppressed [ 380.086758][ T30] audit: type=1400 audit(379.770:183): avc: denied { prog_run } for pid=3746 comm="syz.1.77" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 380.332810][ T3748] netlink: 4 bytes leftover after parsing attributes in process `syz.1.77'. [ 381.536495][ T3748] hsr_slave_1 (unregistering): left promiscuous mode [ 383.711350][ T3759] socket: no more sockets [ 384.311343][ T3759] socket: no more sockets [ 384.762176][ T3759] socket: no more sockets [ 385.147306][ T3759] socket: no more sockets [ 385.318249][ T3759] socket: no more sockets [ 385.471905][ T3759] socket: no more sockets [ 389.396366][ T3783] gadgetfs: bound to dummy_udc driver [ 389.658391][ T3782] gadgetfs: suspended from state 2 [ 389.716595][ T1002] usb 1-1: new full-speed USB device number 12 using dummy_hcd [ 394.560691][ T3804] block nbd0: not configured, cannot reconfigure [ 397.638567][ T30] audit: type=1400 audit(397.340:184): avc: denied { create } for pid=3817 comm="syz.0.103" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 397.681522][ T30] audit: type=1400 audit(397.370:185): avc: denied { ioctl } for pid=3817 comm="syz.0.103" path="socket:[4618]" dev="sockfs" ino=4618 ioctlcmd=0x89e0 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 397.711538][ T30] audit: type=1400 audit(397.410:186): avc: denied { write } for pid=3817 comm="syz.0.103" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 399.204568][ T3827] Driver unsupported XDP return value 0 on prog (id 7) dev N/A, expect packet loss! [ 404.106796][ T3840] gadgetfs: bound to dummy_udc driver [ 404.172722][ T3840] ip_tables: iptables: counters copy to user failed while replacing table [ 404.364727][ T30] audit: type=1400 audit(404.060:187): avc: denied { search } for pid=3838 comm="syz.0.113" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 404.371661][ T30] audit: type=1400 audit(404.070:188): avc: denied { search } for pid=3838 comm="syz.0.113" name="instances" dev="tracefs" ino=82 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 404.397688][ T3535] usb 1-1: new full-speed USB device number 13 using dummy_hcd [ 404.400775][ C0] gadgetfs: connected [ 404.408382][ T3535] gadgetfs: disconnected [ 404.501910][ T3838] gadgetfs: suspended from state 2 [ 404.777682][ T3535] usb 1-1: device not accepting address 13, error -71 [ 405.436443][ T3845] netlink: 60 bytes leftover after parsing attributes in process `syz.1.116'. [ 405.486093][ T3845] netlink: 60 bytes leftover after parsing attributes in process `syz.1.116'. [ 405.545698][ T3845] netlink: 60 bytes leftover after parsing attributes in process `syz.1.116'. [ 409.047791][ T30] audit: type=1400 audit(408.740:189): avc: denied { create } for pid=3855 comm="syz.1.122" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 409.522730][ T3857] ip_tables: iptables: counters copy to user failed while replacing table [ 410.107756][ T3860] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 410.108863][ T3860] IPv6: NLM_F_CREATE should be set when creating new route [ 410.109570][ T3860] IPv6: NLM_F_CREATE should be set when creating new route [ 410.109988][ T3860] IPv6: NLM_F_CREATE should be set when creating new route [ 411.052475][ T3866] netlink: 'syz.0.126': attribute type 29 has an invalid length. [ 413.317989][ T3872] ip_tables: iptables: counters copy to user failed while replacing table [ 415.769126][ T3885] ip_tables: iptables: counters copy to user failed while replacing table [ 416.150950][ T30] audit: type=1400 audit(415.850:190): avc: denied { create } for pid=3888 comm="syz.0.137" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 420.369281][ T3904] ip_tables: iptables: counters copy to user failed while replacing table [ 424.021596][ T3914] ip_tables: iptables: counters copy to user failed while replacing table [ 427.329699][ T3930] netlink: 60 bytes leftover after parsing attributes in process `syz.0.153'. [ 427.339602][ T3930] netlink: 60 bytes leftover after parsing attributes in process `syz.0.153'. [ 427.351010][ T3930] netlink: 60 bytes leftover after parsing attributes in process `syz.0.153'. [ 428.256145][ T3935] ip_tables: iptables: counters copy to user failed while replacing table [ 430.265995][ T3944] netlink: 60 bytes leftover after parsing attributes in process `syz.1.155'. [ 430.295778][ T3939] netlink: 60 bytes leftover after parsing attributes in process `syz.1.155'. [ 430.318800][ T3942] netlink: 60 bytes leftover after parsing attributes in process `syz.1.155'. [ 431.641437][ T3948] socket: no more sockets [ 432.180659][ T3948] socket: no more sockets [ 432.411636][ T3948] socket: no more sockets [ 432.829216][ T3948] socket: no more sockets [ 433.311352][ T3948] socket: no more sockets [ 433.572691][ T3948] socket: no more sockets [ 433.779237][ T3948] socket: no more sockets [ 433.904326][ T30] audit: type=1400 audit(433.600:191): avc: denied { create } for pid=3956 comm="syz.0.164" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 434.012037][ T30] audit: type=1400 audit(433.710:192): avc: denied { write } for pid=3956 comm="syz.0.164" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 436.292320][ T3970] ip_tables: iptables: counters copy to user failed while replacing table [ 438.441249][ T30] audit: type=1400 audit(438.140:193): avc: denied { mount } for pid=3980 comm="syz.1.173" name="/" dev="devtmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 438.460290][ T30] audit: type=1400 audit(438.160:194): avc: denied { read write } for pid=3980 comm="syz.1.173" name="control" dev="devtmpfs" ino=712 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 438.470861][ T30] audit: type=1400 audit(438.170:195): avc: denied { open } for pid=3980 comm="syz.1.173" path="/83/dev/mapper/control" dev="devtmpfs" ino=712 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 438.505033][ T30] audit: type=1400 audit(438.200:196): avc: denied { ioctl } for pid=3980 comm="syz.1.173" path="/83/dev/mapper/control" dev="devtmpfs" ino=712 ioctlcmd=0xfd03 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 438.654935][ T30] audit: type=1400 audit(438.350:197): avc: denied { allowed } for pid=3981 comm="syz.0.174" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 438.688246][ T30] audit: type=1400 audit(438.390:198): avc: denied { create } for pid=3981 comm="syz.0.174" anonclass=[io_uring] scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 438.739802][ T30] audit: type=1400 audit(438.440:199): avc: denied { map } for pid=3981 comm="syz.0.174" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=5926 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 438.758367][ T30] audit: type=1400 audit(438.440:200): avc: denied { read write } for pid=3981 comm="syz.0.174" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=5926 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 438.957255][ T30] kauditd_printk_skb: 1 callbacks suppressed [ 438.958030][ T30] audit: type=1400 audit(438.660:202): avc: denied { map } for pid=3981 comm="syz.0.174" path="socket:[5927]" dev="sockfs" ino=5927 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tcp_socket permissive=1 [ 439.706072][ T3987] socket: no more sockets [ 440.211167][ T3987] socket: no more sockets [ 440.358800][ T3987] socket: no more sockets [ 440.677725][ T3987] socket: no more sockets [ 441.058011][ T3987] socket: no more sockets [ 441.188731][ T3987] socket: no more sockets [ 441.277903][ T3987] socket: no more sockets [ 443.647792][ T4004] netlink: 60 bytes leftover after parsing attributes in process `syz.1.179'. [ 443.709308][ T4004] netlink: 60 bytes leftover after parsing attributes in process `syz.1.179'. [ 443.742032][ T4004] netlink: 60 bytes leftover after parsing attributes in process `syz.1.179'. [ 444.408631][ T4007] socket: no more sockets [ 444.632488][ T4007] socket: no more sockets [ 444.702696][ T4007] socket: no more sockets [ 444.870272][ T4007] socket: no more sockets [ 445.011601][ T4007] socket: no more sockets [ 445.078665][ T4007] socket: no more sockets [ 445.144616][ T4007] socket: no more sockets [ 447.616723][ T4019] socket: no more sockets [ 447.810345][ T4019] socket: no more sockets [ 448.399943][ T4019] socket: no more sockets [ 448.561439][ T4019] socket: no more sockets [ 449.077522][ T4019] socket: no more sockets [ 449.350045][ T4019] socket: no more sockets [ 451.709158][ T4035] net_ratelimit: 2 callbacks suppressed [ 451.715112][ T4035] socket: no more sockets [ 452.638096][ T4035] socket: no more sockets [ 452.839790][ T4035] socket: no more sockets [ 453.157337][ T4035] socket: no more sockets [ 453.628768][ T4035] socket: no more sockets [ 453.959779][ T4035] socket: no more sockets [ 454.090004][ T4035] socket: no more sockets [ 457.312443][ T4053] netlink: 1047 bytes leftover after parsing attributes in process `syz.1.198'. [ 458.671959][ T4059] gadgetfs: bound to dummy_udc driver [ 458.812366][ T4059] ip_tables: iptables: counters copy to user failed while replacing table [ 458.956397][ T3536] usb 1-1: new full-speed USB device number 15 using dummy_hcd [ 458.957544][ C0] gadgetfs: connected [ 458.958767][ T3536] gadgetfs: disconnected [ 463.672431][ T4079] socket: no more sockets [ 464.677635][ T4079] socket: no more sockets [ 464.946249][ T4079] socket: no more sockets [ 465.607629][ T4079] socket: no more sockets [ 466.259555][ T4079] socket: no more sockets [ 466.432682][ T4079] socket: no more sockets [ 466.640731][ T4079] socket: no more sockets [ 471.058115][ T4107] gadgetfs: bound to dummy_udc driver [ 471.098320][ T4107] ip_tables: iptables: counters copy to user failed while replacing table [ 472.151853][ T30] audit: type=1400 audit(471.850:203): avc: denied { create } for pid=4112 comm="syz.0.219" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 472.260418][ T30] audit: type=1400 audit(471.920:204): avc: denied { accept } for pid=4112 comm="syz.0.219" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 472.305646][ T30] audit: type=1400 audit(472.000:205): avc: denied { ioctl } for pid=4112 comm="syz.0.219" path="socket:[5115]" dev="sockfs" ino=5115 ioctlcmd=0x89a0 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 472.896119][ T30] audit: type=1400 audit(472.590:206): avc: denied { sqpoll } for pid=4112 comm="syz.0.219" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 473.026532][ T30] audit: type=1400 audit(472.730:207): avc: denied { write } for pid=4112 comm="syz.0.219" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 473.095063][ T30] audit: type=1400 audit(472.790:208): avc: denied { ioctl } for pid=4117 comm="syz.1.221" path="/dev/fuse" dev="devtmpfs" ino=92 ioctlcmd=0xe502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 473.970025][ T4123] gadgetfs: bound to dummy_udc driver [ 474.050329][ T4123] ip_tables: iptables: counters copy to user failed while replacing table [ 474.219502][ T4121] gadgetfs: suspended from state 2 [ 474.227415][ T3536] usb 1-1: new full-speed USB device number 16 using dummy_hcd [ 477.269204][ T4140] socket: no more sockets [ 478.128294][ T4140] socket: no more sockets [ 478.258255][ T4140] socket: no more sockets [ 478.547756][ T4140] socket: no more sockets [ 478.906313][ T30] audit: type=1400 audit(478.600:209): avc: denied { read write } for pid=4144 comm="syz.0.232" name="kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 478.910068][ T30] audit: type=1400 audit(478.600:210): avc: denied { open } for pid=4144 comm="syz.0.232" path="/dev/kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 478.918989][ T30] audit: type=1400 audit(478.620:211): avc: denied { ioctl } for pid=4144 comm="syz.0.232" path="/dev/kvm" dev="devtmpfs" ino=84 ioctlcmd=0xae01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 479.007954][ T4140] socket: no more sockets [ 479.173034][ T4140] socket: no more sockets [ 479.447164][ T4140] socket: no more sockets [ 481.512893][ T4157] gadgetfs: bound to dummy_udc driver [ 481.728032][ T4157] ip_tables: iptables: counters copy to user failed while replacing table [ 481.837123][ T3536] usb 1-1: new full-speed USB device number 17 using dummy_hcd [ 481.838698][ C0] gadgetfs: connected [ 481.839605][ T3536] gadgetfs: disconnected [ 485.336341][ T4172] socket: no more sockets [ 486.256759][ T4172] socket: no more sockets [ 486.426600][ T4172] socket: no more sockets [ 486.712543][ T4172] socket: no more sockets [ 486.927891][ T4172] socket: no more sockets [ 487.101395][ T4172] socket: no more sockets [ 487.202606][ T4172] socket: no more sockets [ 490.165058][ T4192] socket: no more sockets [ 490.797120][ T4192] socket: no more sockets [ 490.919092][ T4192] socket: no more sockets [ 491.327408][ T4192] socket: no more sockets [ 491.789741][ T4192] socket: no more sockets [ 492.068260][ T4192] socket: no more sockets [ 492.317891][ T4192] socket: no more sockets [ 494.937450][ T4209] socket: no more sockets [ 495.837700][ T4209] socket: no more sockets [ 496.059745][ T4209] socket: no more sockets [ 496.482303][ T4209] socket: no more sockets [ 496.910896][ T4209] socket: no more sockets [ 497.155538][ T4209] socket: no more sockets [ 497.389768][ T4209] socket: no more sockets [ 497.434264][ T29] usb 1-1: new high-speed USB device number 18 using dummy_hcd [ 497.656025][ T29] usb 1-1: Using ep0 maxpacket: 16 [ 497.796074][ T29] usb 1-1: unable to get BOS descriptor or descriptor too short [ 497.797050][ T29] usb 1-1: New USB device found, idVendor=10b8, idProduct=1f98, bcdDevice=f2.f3 [ 497.915051][ T29] usb 1-1: config 6 has an invalid interface number: 40 but max is 0 [ 497.915924][ T29] usb 1-1: config 6 has no interface number 0 [ 498.046810][ T29] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 498.047390][ T29] usb 1-1: Product: syz [ 498.047506][ T29] usb 1-1: Manufacturer: syz [ 498.047604][ T29] usb 1-1: SerialNumber: syz [ 498.524892][ T29] rndis_host 1-1:6.40: rndis: master #0/0000000000000000 slave #1/0000000000000000 [ 498.740767][ T29] usb 1-1: USB disconnect, device number 18 [ 499.017588][ T3539] udevd[3539]: setting owner of /dev/bus/usb/001/018 to uid=0, gid=0 failed: No such file or directory [ 500.782861][ T4224] socket: no more sockets [ 500.915046][ T4224] socket: no more sockets [ 501.246733][ T4224] socket: no more sockets [ 501.551799][ T4224] socket: no more sockets [ 501.750389][ T4224] socket: no more sockets [ 502.000443][ T4224] socket: no more sockets [ 511.231377][ T4277] socket: no more sockets [ 511.538226][ T4277] socket: no more sockets [ 511.574827][ T30] audit: type=1400 audit(511.270:212): avc: denied { read write } for pid=4282 comm="syz.0.298" name="mice" dev="devtmpfs" ino=707 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 511.575878][ T30] audit: type=1400 audit(511.270:213): avc: denied { open } for pid=4282 comm="syz.0.298" path="/dev/input/mice" dev="devtmpfs" ino=707 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 511.614636][ T30] audit: type=1400 audit(511.300:214): avc: denied { ioctl } for pid=4282 comm="syz.0.298" path="/dev/input/mice" dev="devtmpfs" ino=707 ioctlcmd=0x5409 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 512.247079][ T4277] socket: no more sockets [ 512.699649][ T4277] socket: no more sockets [ 512.992237][ T4277] socket: no more sockets [ 513.316531][ T4277] socket: no more sockets [ 515.786970][ T4299] gadgetfs: bound to dummy_udc driver [ 515.864057][ T4299] ip_tables: iptables: counters copy to user failed while replacing table [ 518.634782][ T4311] gadgetfs: bound to dummy_udc driver [ 518.749664][ T4311] ip_tables: iptables: counters copy to user failed while replacing table [ 518.937574][ T1002] usb 1-1: new full-speed USB device number 20 using dummy_hcd [ 518.939300][ C0] gadgetfs: connected [ 518.940713][ T1002] gadgetfs: disconnected [ 521.461065][ T4325] gadgetfs: bound to dummy_udc driver [ 521.588054][ T4325] ip_tables: iptables: counters copy to user failed while replacing table [ 521.767347][ T3534] usb 1-1: new full-speed USB device number 21 using dummy_hcd [ 521.775556][ C1] gadgetfs: connected [ 521.777577][ T3534] gadgetfs: disconnected [ 521.892480][ T4323] gadgetfs: suspended from state 2 [ 522.154925][ T3534] usb 1-1: device not accepting address 21, error -71 [ 522.798892][ T4332] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 522.821531][ T4332] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 525.237742][ T4344] gadgetfs: bound to dummy_udc driver [ 525.327643][ T4344] ip_tables: iptables: counters copy to user failed while replacing table [ 525.536023][ T806] usb 1-1: new full-speed USB device number 23 using dummy_hcd [ 525.539073][ C0] gadgetfs: connected [ 525.543008][ T806] gadgetfs: disconnected [ 525.706056][ T4343] gadgetfs: suspended from state 2 [ 525.726615][ T806] usb 1-1: device descriptor read/all, error -71 [ 526.112872][ T4346] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 526.132524][ T4346] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 530.436655][ T4358] gadgetfs: bound to dummy_udc driver [ 530.648861][ T4358] ip_tables: iptables: counters copy to user failed while replacing table [ 530.716735][ T805] usb 1-1: new full-speed USB device number 25 using dummy_hcd [ 530.718852][ C1] gadgetfs: connected [ 530.719052][ T4360] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 530.720823][ T805] gadgetfs: disconnected [ 530.768858][ T4360] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 530.916277][ C1] gadgetfs: connected [ 530.947591][ T805] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a0, bcdDevice= 1.00 [ 530.962399][ T805] usb 1-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 530.981251][ T805] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 531.079063][ T4356] gadgetfs: suspended from state 3 [ 531.102144][ T4356] gadgetfs: disconnected [ 531.436615][ T805] usb 1-1: can't set config #1, error -71 [ 531.559843][ T805] usb 1-1: USB disconnect, device number 25 [ 533.149636][ T30] audit: type=1400 audit(532.850:215): avc: denied { read } for pid=4365 comm="syz.0.338" name="card1" dev="devtmpfs" ino=619 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 533.184635][ T30] audit: type=1400 audit(532.880:216): avc: denied { open } for pid=4365 comm="syz.0.338" path="/dev/dri/card1" dev="devtmpfs" ino=619 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 533.236818][ T30] audit: type=1400 audit(532.940:217): avc: denied { ioctl } for pid=4365 comm="syz.0.338" path="/dev/dri/card1" dev="devtmpfs" ino=619 ioctlcmd=0x640d scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 540.929664][ T4395] gadgetfs: bound to dummy_udc driver [ 541.072423][ T4395] ip_tables: iptables: counters copy to user failed while replacing table [ 541.269240][ T805] usb 1-1: new full-speed USB device number 26 using dummy_hcd [ 541.272119][ C1] gadgetfs: connected [ 541.285626][ T805] gadgetfs: disconnected [ 544.152575][ T4406] gadgetfs: bound to dummy_udc driver [ 544.227089][ T4406] ip_tables: iptables: counters copy to user failed while replacing table [ 547.255897][ T4422] gadgetfs: bound to dummy_udc driver [ 547.291743][ T4422] ip_tables: iptables: counters copy to user failed while replacing table [ 547.958956][ T30] audit: type=1400 audit(547.640:218): avc: denied { read } for pid=4424 comm="syz.0.365" name="fb0" dev="devtmpfs" ino=620 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 547.960145][ T30] audit: type=1400 audit(547.660:219): avc: denied { open } for pid=4424 comm="syz.0.365" path="/dev/fb0" dev="devtmpfs" ino=620 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 548.016183][ T30] audit: type=1400 audit(547.700:220): avc: denied { ioctl } for pid=4424 comm="syz.0.365" path="/dev/fb0" dev="devtmpfs" ino=620 ioctlcmd=0x4601 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 549.475252][ T4432] gadgetfs: bound to dummy_udc driver [ 549.586452][ T4432] ip_tables: iptables: counters copy to user failed while replacing table [ 549.775940][ T3536] usb 1-1: new full-speed USB device number 28 using dummy_hcd [ 549.777577][ C0] gadgetfs: connected [ 549.790658][ T3536] gadgetfs: disconnected [ 549.937095][ T4431] gadgetfs: suspended from state 2 [ 550.155246][ T3536] usb 1-1: device not accepting address 28, error -71 [ 552.341974][ T4446] gadgetfs: bound to dummy_udc driver [ 552.428438][ T4446] ip_tables: iptables: counters copy to user failed while replacing table [ 552.645314][ T29] usb 1-1: new full-speed USB device number 30 using dummy_hcd [ 552.648015][ C1] gadgetfs: connected [ 552.651712][ T29] gadgetfs: disconnected [ 555.166608][ T4460] gadgetfs: bound to dummy_udc driver [ 555.210030][ T4460] ip_tables: iptables: counters copy to user failed while replacing table [ 558.410013][ T4474] socket: no more sockets [ 559.158149][ T4474] socket: no more sockets [ 559.288040][ T4474] socket: no more sockets [ 559.542553][ T4474] socket: no more sockets [ 559.787870][ T4474] socket: no more sockets [ 559.915603][ T4474] socket: no more sockets [ 559.986327][ T4474] socket: no more sockets [ 562.442769][ T4493] gadgetfs: bound to dummy_udc driver [ 562.479598][ T4493] ip_tables: iptables: counters copy to user failed while replacing table [ 565.339473][ T4503] gadgetfs: bound to dummy_udc driver [ 565.426694][ T4503] ip_tables: iptables: counters copy to user failed while replacing table [ 565.557220][ T4502] gadgetfs: suspended from state 2 [ 565.629800][ T1002] usb 1-1: new full-speed USB device number 32 using dummy_hcd [ 566.931969][ T4509] No control pipe specified [ 569.169879][ T4517] udc dummy_udc.0: failed to start USB Gadget filesystem: -12 [ 569.170839][ T4517] gadgetfs gadget.0: probe with driver gadgetfs failed with error -12 [ 569.246107][ T4517] UDC core: USB Gadget filesystem: couldn't find an available UDC [ 575.718259][ T4533] ================================================================== [ 575.718979][ T4533] BUG: KASAN: slab-use-after-free in _raw_spin_lock_irq+0x54/0x78 [ 575.719102][ T4533] Read of size 1 at addr ffff00001715b818 by task syz.0.412/4533 [ 575.719155][ T4533] [ 575.719352][ T4533] CPU: 1 UID: 0 PID: 4533 Comm: syz.0.412 Tainted: G W syzkaller #0 PREEMPT [ 575.719429][ T4533] Tainted: [W]=WARN [ 575.719452][ T4533] Hardware name: linux,dummy-virt (DT) [ 575.719497][ T4533] Call trace: [ 575.719559][ T4533] show_stack+0x18/0x24 (C) [ 575.719625][ T4533] dump_stack_lvl+0x7c/0xb0 [ 575.719673][ T4533] print_report+0x18c/0x4e8 [ 575.719719][ T4533] kasan_report+0xb8/0x15c [ 575.719786][ T4533] __kasan_check_byte+0x54/0x74 [ 575.719882][ T4533] lock_acquire+0x248/0x44c [ 575.719963][ T4533] _raw_spin_lock_irq+0x54/0x78 [ 575.720007][ T4533] gadget_dev_open+0x3c/0x164 [ 575.720059][ T4533] do_dentry_open+0x37c/0xfe8 [ 575.720105][ T4533] vfs_open+0x5c/0x300 [ 575.720193][ T4533] path_openat+0x12d4/0x1e40 [ 575.720263][ T4533] do_file_open+0x18c/0x380 [ 575.720355][ T4533] do_sys_openat2+0xdc/0x180 [ 575.720408][ T4533] __arm64_sys_openat+0x134/0x1e0 [ 575.720456][ T4533] invoke_syscall+0x74/0x240 [ 575.720505][ T4533] el0_svc_common.constprop.0+0xac/0x230 [ 575.720551][ T4533] do_el0_svc+0x40/0x58 [ 575.720596][ T4533] el0_svc+0x58/0x2a4 [ 575.720639][ T4533] el0t_64_sync_handler+0xa0/0xe4 [ 575.720733][ T4533] el0t_64_sync+0x198/0x19c [ 575.720935][ T4533] [ 575.720994][ T4533] Allocated by task 3390: [ 575.721271][ T4533] kasan_save_stack+0x3c/0x70 [ 575.721403][ T4533] kasan_save_track+0x20/0x3c [ 575.721446][ T4533] kasan_save_alloc_info+0x40/0x5c [ 575.721486][ T4533] __kasan_kmalloc+0xb8/0xc0 [ 575.721520][ T4533] __kmalloc_cache_noprof+0x308/0x628 [ 575.721570][ T4533] gadgetfs_fill_super+0x1b0/0x380 [ 575.721609][ T4533] get_tree_single+0xb0/0x158 [ 575.721646][ T4533] gadgetfs_get_tree+0x18/0x24 [ 575.721683][ T4533] vfs_get_tree+0x74/0x280 [ 575.721722][ T4533] fc_mount+0x18/0x19c [ 575.721762][ T4533] path_mount+0x6d8/0x1830 [ 575.721796][ T4533] __arm64_sys_mount+0x318/0x3dc [ 575.721938][ T4533] invoke_syscall+0x74/0x240 [ 575.721990][ T4533] el0_svc_common.constprop.0+0xac/0x230 [ 575.722029][ T4533] do_el0_svc+0x40/0x58 [ 575.722085][ T4533] el0_svc+0x58/0x2a4 [ 575.722161][ T4533] el0t_64_sync_handler+0xa0/0xe4 [ 575.722199][ T4533] el0t_64_sync+0x198/0x19c [ 575.722277][ T4533] [ 575.722345][ T4533] Freed by task 4515: [ 575.722401][ T4533] kasan_save_stack+0x3c/0x70 [ 575.722446][ T4533] kasan_save_track+0x20/0x3c [ 575.722581][ T4533] kasan_save_free_info+0x4c/0x80 [ 575.722665][ T4533] __kasan_slab_free+0x5c/0x88 [ 575.722703][ T4533] kfree+0x2e8/0x750 [ 575.722740][ T4533] put_dev+0xa4/0xe0 [ 575.722780][ T4533] dev_release+0xd4/0x174 [ 575.722818][ T4533] __fput+0x2d0/0x980 [ 575.722856][ T4533] ____fput+0x14/0x20 [ 575.722912][ T4533] task_work_run+0x134/0x238 [ 575.723029][ T4533] exit_to_user_mode_loop+0x190/0x1c8 [ 575.723082][ T4533] el0_svc+0x244/0x2a4 [ 575.723153][ T4533] el0t_64_sync_handler+0xa0/0xe4 [ 575.723227][ T4533] el0t_64_sync+0x198/0x19c [ 575.723310][ T4533] [ 575.723405][ T4533] The buggy address belongs to the object at ffff00001715b800 [ 575.723405][ T4533] which belongs to the cache kmalloc-1k of size 1024 [ 575.723501][ T4533] The buggy address is located 24 bytes inside of [ 575.723501][ T4533] freed 1024-byte region [ffff00001715b800, ffff00001715bc00) [ 575.723546][ T4533] [ 575.723634][ T4533] The buggy address belongs to the physical page: [ 575.724347][ T4533] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff000017158000 pfn:0x57158 [ 575.724611][ T4533] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 575.724705][ T4533] flags: 0x1ffc00000000240(workingset|head|node=0|zone=0|lastcpupid=0x7ff) [ 575.725259][ T4533] page_type: f5(slab) [ 575.725721][ T4533] raw: 01ffc00000000240 ffff00000e001dc0 fffffdffc04c1610 fffffdffc03bc210 [ 575.725793][ T4533] raw: ffff000017158000 0000000000100007 00000000f5000000 0000000000000000 [ 575.725936][ T4533] head: 01ffc00000000240 ffff00000e001dc0 fffffdffc04c1610 fffffdffc03bc210 [ 575.725984][ T4533] head: ffff000017158000 0000000000100007 00000000f5000000 0000000000000000 [ 575.726017][ T4533] head: 01ffc00000000003 fffffdffc05c5601 00000000ffffffff 00000000ffffffff [ 575.726049][ T4533] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 575.726113][ T4533] page dumped because: kasan: bad access detected [ 575.726157][ T4533] [ 575.726208][ T4533] Memory state around the buggy address: [ 575.726503][ T4533] ffff00001715b700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 575.726633][ T4533] ffff00001715b780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 575.726703][ T4533] >ffff00001715b800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 575.726764][ T4533] ^ [ 575.726807][ T4533] ffff00001715b880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 575.726836][ T4533] ffff00001715b900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 575.726973][ T4533] ================================================================== [ 575.727114][ T4533] Disabling lock debugging due to kernel taint [ 575.727384][ T4533] ------------[ cut here ]------------ [ 575.727429][ T4533] UBSAN: array-index-out-of-bounds in kernel/locking/qspinlock.h:68:9 [ 575.727671][ T4533] index 1830 is out of range for type 'long unsigned int [8]' [ 575.727734][ T4533] CPU: 1 UID: 0 PID: 4533 Comm: syz.0.412 Tainted: G B W syzkaller #0 PREEMPT [ 575.727790][ T4533] Tainted: [B]=BAD_PAGE, [W]=WARN [ 575.727811][ T4533] Hardware name: linux,dummy-virt (DT) [ 575.727834][ T4533] Call trace: [ 575.727853][ T4533] show_stack+0x18/0x24 (C) [ 575.727914][ T4533] dump_stack_lvl+0x7c/0xb0 [ 575.727959][ T4533] dump_stack+0x1c/0x28 [ 575.728054][ T4533] ubsan_epilogue+0x10/0x44 [ 575.728128][ T4533] __ubsan_handle_out_of_bounds+0xa0/0xc4 [ 575.728179][ T4533] queued_spin_lock_slowpath+0xf0c/0xfa0 [ 575.728225][ T4533] do_raw_spin_lock+0x258/0x308 [ 575.728269][ T4533] _raw_spin_lock_irq+0x5c/0x78 [ 575.728310][ T4533] gadget_dev_open+0x3c/0x164 [ 575.728353][ T4533] do_dentry_open+0x37c/0xfe8 [ 575.728463][ T4533] vfs_open+0x5c/0x300 [ 575.728515][ T4533] path_openat+0x12d4/0x1e40 [ 575.728558][ T4533] do_file_open+0x18c/0x380 [ 575.728600][ T4533] do_sys_openat2+0xdc/0x180 [ 575.728642][ T4533] __arm64_sys_openat+0x134/0x1e0 [ 575.728685][ T4533] invoke_syscall+0x74/0x240 [ 575.728729][ T4533] el0_svc_common.constprop.0+0xac/0x230 [ 575.728773][ T4533] do_el0_svc+0x40/0x58 [ 575.728857][ T4533] el0_svc+0x58/0x2a4 [ 575.728907][ T4533] el0t_64_sync_handler+0xa0/0xe4 [ 575.728950][ T4533] el0t_64_sync+0x198/0x19c [ 575.729016][ T4533] ---[ end trace ]--- [ 575.730391][ T4533] Unable to handle kernel paging request at virtual address ffff80008777b0a0 [ 575.730523][ T4533] KASAN: probably user-memory-access in range [0x000000043bbd8500-0x000000043bbd8507] [ 575.730595][ T4533] Mem abort info: [ 575.730620][ T4533] ESR = 0x0000000096000047 [ 575.730704][ T4533] EC = 0x25: DABT (current EL), IL = 32 bits [ 575.730787][ T4533] SET = 0, FnV = 0 [ 575.730821][ T4533] EA = 0, S1PTW = 0 [ 575.730863][ T4533] FSC = 0x07: level 3 translation fault [ 575.730915][ T4533] Data abort info: [ 575.730944][ T4533] ISV = 0, ISS = 0x00000047, ISS2 = 0x00000000 [ 575.731005][ T4533] CM = 0, WnR = 1, TnD = 0, TagAccess = 0 [ 575.731044][ T4533] GCS = 0, Overlay = 0, DirtyBit = 0 [ 575.731156][ T4533] swapper pgtable: 4k pages, 48-bit VAs, pgdp=0000000047695000 [ 575.731219][ T4533] [ffff80008777b0a0] pgd=0000000000000000, p4d=100000004dd69003, pud=100000004dd6a003, pmd=100000004dd6d003, pte=0000000000000000 [ 575.731925][ T4533] Internal error: Oops: 0000000096000047 [#1] SMP [ 575.756076][ T4533] Modules linked in: [ 575.756309][ T4533] CPU: 1 UID: 0 PID: 4533 Comm: syz.0.412 Tainted: G B W syzkaller #0 PREEMPT [ 575.756585][ T4533] Tainted: [B]=BAD_PAGE, [W]=WARN [ 575.756729][ T4533] Hardware name: linux,dummy-virt (DT) [ 575.756878][ T4533] pstate: 000000c5 (nzcv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 575.757140][ T4533] pc : queued_spin_lock_slowpath+0x97c/0xfa0 [ 575.757334][ T4533] lr : queued_spin_lock_slowpath+0xf0c/0xfa0 [ 575.757512][ T4533] sp : ffff8000a0fd7600 [ 575.757646][ T4533] x29: ffff8000a0fd76b0 x28: ffff00006bfb6088 x27: ffff80008777b0a0 [ 575.757966][ T4533] x26: 1fffe00002e2b700 x25: ffff00006bfb6080 x24: 0000000000000000 [ 575.758306][ T4533] x23: 0000000000000000 x22: 1ffff000141faec6 x21: ffff8000877c7ee0 [ 575.758644][ T4533] x20: ffff00006bfb6080 x19: ffff00001715b800 x18: 0000000000000000 [ 575.758933][ T4533] x17: 363a682e6b636f6c x16: 6e697073712f676e x15: 0000000000000002 [ 575.759198][ T4533] x14: 0000000000000000 x13: 0000000000000001 x12: ffff700011269431 [ 575.759504][ T4533] x11: 1ffff00011269430 x10: ffff700011269430 x9 : dfff800000000000 [ 575.759791][ T4533] x8 : 0000000000000003 x7 : 0000000000000001 x6 : ffff700011269430 [ 575.760084][ T4533] x5 : 1ffff00010eef614 x4 : 0000000000000000 x3 : ffff800080222324 [ 575.760398][ T4533] x2 : ffff80008934a180 x1 : 0000000000000000 x0 : ffff80008777b0a0 [ 575.760775][ T4533] Call trace: [ 575.761060][ T4533] queued_spin_lock_slowpath+0x97c/0xfa0 (P) [ 575.761398][ T4533] do_raw_spin_lock+0x258/0x308 [ 575.761704][ T4533] _raw_spin_lock_irq+0x5c/0x78 [ 575.762063][ T4533] gadget_dev_open+0x3c/0x164 [ 575.762380][ T4533] do_dentry_open+0x37c/0xfe8 [ 575.762716][ T4533] vfs_open+0x5c/0x300 [ 575.763139][ T4533] path_openat+0x12d4/0x1e40 [ 575.763455][ T4533] do_file_open+0x18c/0x380 [ 575.763748][ T4533] do_sys_openat2+0xdc/0x180 [ 575.764090][ T4533] __arm64_sys_openat+0x134/0x1e0 [ 575.764413][ T4533] invoke_syscall+0x74/0x240 [ 575.764618][ T4533] el0_svc_common.constprop.0+0xac/0x230 [ 575.764793][ T4533] do_el0_svc+0x40/0x58 [ 575.764952][ T4533] el0_svc+0x58/0x2a4 [ 575.765150][ T4533] el0t_64_sync_handler+0xa0/0xe4 [ 575.765329][ T4533] el0t_64_sync+0x198/0x19c [ 575.765765][ T4533] Code: d343fc05 38e468a4 35002b04 d2800018 (f8216b79) [ 575.766786][ T4533] ---[ end trace 0000000000000000 ]--- [ 575.767477][ T4533] Kernel panic - not syncing: Oops: Fatal exception [ 575.768128][ T4533] SMP: stopping secondary CPUs [ 575.769591][ T4533] Kernel Offset: disabled [ 575.769804][ T4533] CPU features: 0x0,40400002,00340020,00100000,0800821b [ 575.770199][ T4533] Memory Limit: none [ 575.771314][ T4533] Rebooting in 86400 seconds.. VM DIAGNOSIS: 07:14:47 Registers: info registers vcpu 0 CPU#0 PC=ffff8000850db4e0 X00=ffff00001756b050 X01=0000000000000007 X02=1ffff00010efb38d X03=0000000000000000 X04=1fffe00003a20856 X05=0000000000000000 X06=1fffe00004354a4a X07=1fffe00004354a49 X08=ffff8000877c7000 X09=1fffe00004354a4a X10=0000000000000000 X11=0202e340052c0685 X12=1fffe00004354a68 X13=c0ede6d3b72b4c5e X14=f80116009cba0f02 X15=1850ebc0162d7b9a X16=711f00004ac3ffff X17=765a9cf5f6e71c44 X18=ffff00006bf7d268 X19=0000000000000062 X20=ffff00001d1042bc X21=ffff00001d104280 X22=0000000000000000 X23=0000000000000000 X24=ffff00001756b050 X25=ffff00001d1042bc X26=1fffe00003a20857 X27=0000000000000004 X28=ffff00001d1042b8 X29=ffff80008db973b0 X30=ffff800085089b9c SP=ffff80008db973b0 PSTATE=80000005 N--- EL1h FPCR=00000000 FPSR=00000000 Q00=6966696e752f7075:6f7267637a79732f Q01=7a79732f64656966:696e752f70756f72 Q02=0000000000000002:0000000000000000 Q03=00ff000000000000:0000000000000000 Q04=0000000000000000:0f00000000000000 Q05=0000000000000002:0000000000000002 Q06=0000ffff8f1d65b0:0000ffff8f1d6590 Q07=0000ffff8f1d65a8:0000ffff8f1d6578 Q08=0000000000000000:0000000000000000 Q09=0000000000000000:0000000000000000 Q10=0000000000000000:0000000000000000 Q11=0000000000000000:0000000000000000 Q12=0000000000000000:0000000000000000 Q13=0000000000000000:0000000000000000 Q14=0000000000000000:0000000000000000 Q15=0000000000000000:0000000000000000 Q16=0000000000000000:0000000000000000 Q17=0000000000000000:0000000000000000 Q18=0000000000000000:0000000000000000 Q19=0000000000000000:0000000000000000 Q20=0000000000000000:0000000000000000 Q21=0000000000000000:0000000000000000 Q22=bb448243222c92da:e3914ed4e87380b0 Q23=43788d6f07084f17:4508b00c6052a10f Q24=b20fae707afde253:388e9c6c4fa85ca0 Q25=8e9f894b2581e79e:20c883c9819d5c97 Q26=57c93d417f4d0394:89cd11f6992873d1 Q27=6b69be1163cb6500:a4ac85c293540e63 Q28=6edc4d3a2914b135:d8e9c869e2695c88 Q29=0000000000000000:0009000700030001 Q30=ffffff80ffffffd8:0000ffffde44b130 Q31=0000ffffde44b160:0000ffffde44b160 info registers vcpu 1 CPU#1 PC=ffff8000803eb0fc X00=ffff800088121880 X01=ffff800085db4d00 X02=0000000000000000 X03=1ffff00011024305 X04=ffff700011024311 X05=ffff800088121880 X06=ffff7000141fad74 X07=0000000000000001 X08=0000000000000003 X09=dfff800000000000 X10=ffff7000141fad74 X11=1ffff000141fad74 X12=ffff7000141fad75 X13=205d333335345420 X14=0000000000000000 X15=0000000000000000 X16=0000000000000000 X17=0000000000000000 X18=0000000000000083 X19=ffff00000efe6080 X20=ffff80008db8d030 X21=ffff8000881215c0 X22=ffff8000a0fd6e60 X23=0000000000000000 X24=ffff00000efe62f0 X25=ffff00000efe6080 X26=ffff8000a0fd6e80 X27=ffff8000881217e0 X28=ffff8000a0fd6e60 X29=ffff8000a0fd6c20 X30=ffff800081ec5fc8 SP=ffff8000a0fd6c20 PSTATE=600000c5 -ZC- EL1h FPCR=00000000 FPSR=00000000 Q00=2525252525252525:2525252525252525 Q01=657461636f6c6c61:0000000000000075 Q02=0000ffffa89d6580:0000ffffa89d65c0 Q03=0000000000000000:ffffffffffffff00 Q04=0000000000000000:00000000fffffff0 Q05=0000ffffa89d65b0:0000ffffa89d6590 Q06=0000ffffa89d65b0:0000ffffa89d6590 Q07=0000ffffa89d65a8:0000ffffa89d6578 Q08=0000000000000000:0000000000000000 Q09=0000000000000000:0000000000000000 Q10=0000000000000000:0000000000000000 Q11=0000000000000000:0000000000000000 Q12=0000000000000000:0000000000000000 Q13=0000000000000000:0000000000000000 Q14=0000000000000000:0000000000000000 Q15=0000000000000000:0000000000000000 Q16=0000000000000000:0000000000000000 Q17=0000000000000000:0000000000000000 Q18=0000000000000000:0000000000000000 Q19=0000000000000000:0000000000000000 Q20=0000000000000000:0000000000000000 Q21=0000000000000000:0000000000000000 Q22=bb448243222c92da:e3914ed4e87380b0 Q23=43788d6f07084f17:4508b00c6052a10f Q24=b20fae707afde253:388e9c6c4fa85ca0 Q25=8e9f894b2581e79e:20c883c9819d5c97 Q26=57c93d417f4d0394:89cd11f6992873d1 Q27=6b69be1163cb6500:a4ac85c293540e63 Q28=6edc4d3a2914b135:d8e9c869e2695c88 Q29=0000000000000000:0009000700030001 Q30=ffffff80ffffffd8:0000ffffa9581ac0 Q31=0000ffffa9581af0:0000ffffa9581af0