last executing test programs: 1.678649781s ago: executing program 1 (id=193): r0 = syz_create_resource$binfmt(&(0x7f0000000040)='./file1\x00') r1 = openat$binfmt(0xffffffffffffff9c, r0, 0x42, 0x1ff) close(r1) close(0xffffffffffffffff) execveat$binfmt(0xffffffffffffff9c, r0, &(0x7f00000001c0)={[], 0xfffffffffffffffe}, &(0x7f0000000200), 0x0) 1.610248714s ago: executing program 1 (id=195): r0 = userfaultfd(0x80001) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000140)={0xaa, 0x4a4}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000180)={{&(0x7f0000000000/0xc00000)=nil, 0xc00000}, 0x3}) ioctl$UFFDIO_COPY(r0, 0xc028aa05, &(0x7f0000000000)={&(0x7f00001c4000/0x3000)=nil, &(0x7f0000000000/0xc00000)=nil, 0x3000, 0x0, 0x2}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) 1.565955436s ago: executing program 1 (id=196): r0 = syz_open_procfs(0x0, &(0x7f0000000700)='mounts\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x2c) mount$tmpfs(0x0, &(0x7f00000003c0)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='huge=always']) pread64(r0, &(0x7f0000002180)=""/9, 0xfdc5, 0x4ac) symlinkat(0x0, 0xffffffffffffffff, 0x0) 1.565523336s ago: executing program 1 (id=198): socket$key(0xf, 0x3, 0x2) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x3) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000001040)={0x1, 0x0, [{0xc0011022, 0x0, 0x8}]}) 1.520494288s ago: executing program 1 (id=201): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)={0x1c, 0x1, 0x4, 0x101, 0x0, 0x0, {0x1, 0x0, 0x400}, [@NFULA_CFG_CMD={0x5, 0x1, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x60000081}, 0x800) sendmsg$NFULNL_MSG_CONFIG(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)={0x1c, 0x1, 0x4, 0x5, 0x0, 0x0, {0x3, 0x0, 0x10}, [@NFULA_CFG_CMD={0x5, 0x1, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0x26088888) close(0x3) 1.445930461s ago: executing program 1 (id=202): r0 = syz_usb_connect$uac1(0x0, 0x72, &(0x7f0000000140)=ANY=[@ANYBLOB="12010102000000400c200b1040000102030109026000030103a0020904000000010100000a240102000a000201020904010000010200000904010101010200000905010910000206000725010c0040000904020000010201010200000905820900020303100725010c08ff030000000000005d0a17d0cf765f6b8f6a010c57924e234b27e9a7bfb147f06f15d90efcb5c15864aded1010658d2faa4089a030a11da1c0bc7acf4578505d0a639d283ae28a8a49a9c6c8ed51c66d28da4deadd4708749c884088c7ec204ffe00468455c85af3a2d8672ad962b24ad69ec151656910ed829a5c81f6f5b64767c02d0a87ca2d3e703a244cfd4cbc5921206ccba9b5cb4f3cb98453791dfc3b8c1ad084e56de4f5172e490898d66589eda41e346731c394ebb0ce201b7c5ccaf132949c15b857933c20ff7e33723b3a41f651bc6385cdd6606b94ef7071582f43869fde414698d5e9288d9d29d3405f"], &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x4c}) socket$inet_tcp(0x2, 0x1, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, &(0x7f00000006c0)={0x44, 0x0, 0x0, &(0x7f0000000540)={0x0, 0x8, 0x1}, &(0x7f0000000580)={0x20, 0x81, 0x1, "e0"}, 0x0, 0x0, 0x0, 0x0}) 926.020906ms ago: executing program 0 (id=213): r0 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f0000000080)={0x0, &(0x7f0000000200)=[@rdmsr={0x66, 0x18, {0x400000b4}}], 0x18}) ioctl$KVM_RUN(r3, 0xae80, 0x0) 757.580424ms ago: executing program 0 (id=216): openat(0xffffffffffffff9c, 0x0, 0x40040, 0x6ab858183a7ef6ba) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/module/kernel/parameters/panic\x00', 0x0, 0x0) read(r0, &(0x7f0000000400)=""/100, 0x64) 689.776657ms ago: executing program 0 (id=218): r0 = userfaultfd(0x80001) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000100)={0xaa, 0x268}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000040)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f076bbee9, 0x8031, r0, 0x28f43000) read(r0, &(0x7f0000000540)=""/157, 0x9d) 627.08571ms ago: executing program 3 (id=219): r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0xc0802, 0x0) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f00000000c0)) ioctl$PPPIOCSMAXCID(r0, 0x40047451, &(0x7f0000000200)=0x8) ioctl$PPPIOCSFLAGS1(r0, 0x40047459, &(0x7f0000000100)=0x2000004) pwritev(r0, &(0x7f00000003c0)=[{&(0x7f00000004c0)="00214717a7070000000003060000000000000000aaa6721d5874f72cf86d73d32f46380feb56a29357215d78fc44fac3f44d", 0x32}], 0x1, 0x73a, 0x1) 538.300024ms ago: executing program 3 (id=220): r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_IPV6_HOPOPTS(r0, 0x29, 0x36, &(0x7f0000000040)=ANY=[], 0x8) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @mcast2, 0x7}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080)='bridge0\x00', 0x10) sendto$inet6(r0, &(0x7f0000000c80)="1a189c005b17ba0041", 0x9, 0x20004084, 0x0, 0x0) 487.375297ms ago: executing program 3 (id=222): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)=ANY=[@ANYBLOB="6401000010000100feffffff00010000fc00000000000000000000000000000164010101000000000000000000000000000107144e230005000000003a000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ff020000000000000000000000000001000004d46c000000ac14143f000000000000000000000000000000000000000092010000000000000600000000000000ffff0000000000001c250800000000000200000000000000f8ffffffffffffff0000000000000000ffffffffffffffff00000000000000001f00000000000000feffffffffffffff02000000fcffffff000000002abd700004350000020001002000000000000000480003006465666c6174650000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000b000600000008001800400000000a001000010000000000000008000b000600000008000c"], 0x164}, 0x1, 0x0, 0x0, 0x8801}, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="640000000001010400000000141a000002000000240001801400018008000100e000000108000200e00000010c00028005000100000000002400028014000180080001000000000008000200ac1e00010c00028005000100000000000800074000000001"], 0x64}, 0x1, 0x0, 0x0, 0x5}, 0x8080) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[@ANYBLOB="a80000000201010400000000141a000002000000240001801400018008000100e000000108000200e00000010c000280050001"], 0xa8}}, 0x0) 465.070998ms ago: executing program 2 (id=223): r0 = syz_open_dev$loop(&(0x7f0000000500), 0xee8, 0x5042) r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/fscaps', 0x20940, 0x1e2) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f0000000140)={r1, 0x0, {0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x5, 0x4, "6fa715e63fee9cb07f3c19ed0c04afcaba06f6d9584488da0162d4cc7030ec4f7b9ab89b3e19b47b6669f6bdb9c400", "8bc975aabbbbe9d3edb0e98d330e6fe3bce73919393417ab6c4d1d0000f0c29b3c717d7f74bc429cc009000000a4584203143a0b9705fb16b600", "666f1d5f5c43005b310134ce9a6d0369862b72c1f9f4980a2346c4dd62ad8050", [0x3, 0x61fe]}}) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000480)=[{0x6, 0x0, 0x0, 0x7ffffffb}]}) close_range(r2, 0xffffffffffffffff, 0x0) 379.489682ms ago: executing program 2 (id=224): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000540)='./binderfs/binder0\x00', 0x802, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x10000000000) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a, 0xfffffffffffffffd}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x98, 0x0, &(0x7f00000002c0)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x68, 0x0, &(0x7f0000000b40)={@ptr={0x70742a85, 0xfffffffe, 0x0, 0x0, 0x1, 0x2}, @ptr={0x70742a85, 0x0, 0x0, 0x0, 0x1, 0x15}, @flat=@weak_binder}, 0x0}, 0x1000}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000100)={0x30, 0x30, 0x30}}, 0x1000}], 0x0, 0x0, 0x0}) 303.951265ms ago: executing program 3 (id=225): mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000f, 0x204031, 0xffffffffffffffff, 0x7c778000) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='net/vlan/vlan1\x00') r0 = socket(0x2, 0x2, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') ioctl$sock_SIOCSIFVLAN_DEL_VLAN_CMD(r0, 0x8983, &(0x7f0000000000)={0x1, 'vlan1\x00', {}, 0x5832}) 231.997358ms ago: executing program 3 (id=226): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x40000, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_X86_SETUP_MCE(r2, 0x4008ae9c, &(0x7f0000000040)={0x1, 0x1, 0x6}) ioctl$KVM_GET_MSRS_cpu(r2, 0xc008ae88, &(0x7f0000000140)={0x1, 0x0, [{0x282, 0x0, 0x8}]}) 207.5709ms ago: executing program 2 (id=227): socket$inet6(0xa, 0x2, 0x0) openat$sysfs(0xffffffffffffff9c, 0x0, 0x82802, 0xf) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x11, 0x3, 0x0) setsockopt$packet_int(r0, 0x107, 0x9, &(0x7f0000000200)=0xec, 0x4) 117.898924ms ago: executing program 0 (id=228): r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) connect$inet(r0, &(0x7f0000000480)={0x2, 0x4e23, @multicast2}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000002c0)={{{@in6=@dev={0xfe, 0x80, '\x00', 0x4}, @in=@private=0xa010100, 0x0, 0x7, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x4000004, 0x0, 0xfffffffffffffffc, 0x0, 0x400000006}, {0x0, 0x0, 0x400000000, 0x4}, 0x0, 0x0, 0x1, 0x0, 0x0, 0x3}, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x0, 0x32}, 0x0, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 0x0, 0xb7, 0x2, 0xfffffffe}}, 0xe8) write(r0, 0x0, 0x0) 117.711114ms ago: executing program 2 (id=229): r0 = fsopen(&(0x7f0000000140)='debugfs\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0xd) setuid(0xee01) fchdir(r1) 117.571954ms ago: executing program 0 (id=230): r0 = userfaultfd(0x80001) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000080)={0xaa, 0x79}) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x3ed4, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000040)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) 104.752635ms ago: executing program 3 (id=231): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x80102, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f0000000380)={0x0, 0x0, @pic={0x4e, 0x5, 0xad, 0x4, 0x9, 0x6, 0x8, 0x3, 0xff, 0x1, 0x17, 0x1, 0x2, 0xc, 0x66, 0x3}}) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f0000000600)={0x1, 0x0, @pic={0x9, 0xc0, 0x5, 0x6, 0x7f, 0x1, 0x1, 0x9, 0x1, 0xff, 0x2, 0x58, 0x7, 0xc0, 0x84, 0x7}}) 85.073776ms ago: executing program 2 (id=232): r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e23, 0x9, @mcast2, 0x4}, 0x1c) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000080)=0x5b5, 0x4) write(r0, 0x0, 0x0) recvfrom(r0, 0x0, 0x0, 0x2021, 0x0, 0x0) 2.32301ms ago: executing program 0 (id=233): r0 = socket$can_bcm(0x1d, 0x2, 0x2) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x41, &(0x7f0000000480)=0x1e18, 0x4) connect$can_bcm(r0, &(0x7f00000005c0), 0x10) recvmmsg(r0, &(0x7f0000001080)=[{{0x0, 0x0, 0x0}}], 0x1, 0x10002, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="050000007f0000000000010000000000", @ANYRES64=0x0, @ANYRES64=0x2710], 0x48}}, 0x0) 0s ago: executing program 2 (id=234): r0 = socket$igmp6(0xa, 0x3, 0x2) r1 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) ioctl$sock_inet6_SIOCSIFADDR(r0, 0x8916, &(0x7f0000000440)={@ipv4={'\x00', '\xff\xff', @rand_addr=0x64010100}, 0x80, r2}) ioctl$sock_inet6_SIOCDIFADDR(r0, 0x8936, &(0x7f0000000140)={@loopback={0x0, 0xffff64010100}, 0x80, r2}) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.18' (ED25519) to the list of known hosts. [ 29.691607][ T36] audit: type=1400 audit(1789541449.880:64): avc: denied { mounton } for pid=286 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 29.694876][ T286] cgroup: Unknown subsys name 'net' [ 29.714435][ T36] audit: type=1400 audit(1789541449.880:65): avc: denied { mount } for pid=286 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 29.741826][ T36] audit: type=1400 audit(1789541449.910:66): avc: denied { unmount } for pid=286 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 29.742335][ T286] cgroup: Unknown subsys name 'devices' [ 29.849923][ T286] cgroup: Unknown subsys name 'hugetlb' [ 29.855660][ T286] cgroup: Unknown subsys name 'rlimit' [ 29.971852][ T36] audit: type=1400 audit(1789541450.160:67): avc: denied { setattr } for pid=286 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 29.995062][ T36] audit: type=1400 audit(1789541450.160:68): avc: denied { mounton } for pid=286 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 30.019888][ T36] audit: type=1400 audit(1789541450.160:69): avc: denied { mount } for pid=286 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 30.044147][ T288] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 30.053090][ T36] audit: type=1400 audit(1789541450.240:70): avc: denied { relabelto } for pid=288 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 30.078681][ T36] audit: type=1400 audit(1789541450.240:71): avc: denied { write } for pid=288 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 30.112760][ T36] audit: type=1400 audit(1789541450.300:72): avc: denied { read } for pid=286 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 30.138513][ T36] audit: type=1400 audit(1789541450.300:73): avc: denied { open } for pid=286 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 30.139500][ T286] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 31.409820][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.417027][ T293] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.437834][ T293] bridge_slave_0: entered allmulticast mode [ 31.444371][ T293] bridge_slave_0: entered promiscuous mode [ 31.453529][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.460858][ T293] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.468116][ T293] bridge_slave_1: entered allmulticast mode [ 31.474588][ T293] bridge_slave_1: entered promiscuous mode [ 31.609255][ T298] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.616340][ T298] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.623761][ T298] bridge_slave_0: entered allmulticast mode [ 31.630273][ T298] bridge_slave_0: entered promiscuous mode [ 31.640329][ T298] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.647401][ T298] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.654537][ T298] bridge_slave_1: entered allmulticast mode [ 31.660943][ T298] bridge_slave_1: entered promiscuous mode [ 31.699027][ T297] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.706477][ T297] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.713841][ T297] bridge_slave_0: entered allmulticast mode [ 31.720228][ T297] bridge_slave_0: entered promiscuous mode [ 31.726465][ T299] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.733563][ T299] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.740684][ T299] bridge_slave_0: entered allmulticast mode [ 31.746931][ T299] bridge_slave_0: entered promiscuous mode [ 31.753562][ T299] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.760658][ T299] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.767963][ T299] bridge_slave_1: entered allmulticast mode [ 31.774256][ T299] bridge_slave_1: entered promiscuous mode [ 31.789107][ T297] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.796184][ T297] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.803356][ T297] bridge_slave_1: entered allmulticast mode [ 31.809688][ T297] bridge_slave_1: entered promiscuous mode [ 31.815880][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.823041][ T293] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.830425][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.837484][ T293] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.973672][ T299] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.980778][ T299] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.988103][ T299] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.995178][ T299] bridge0: port 1(bridge_slave_0) entered forwarding state [ 32.008510][ T298] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.015587][ T298] bridge0: port 2(bridge_slave_1) entered forwarding state [ 32.022908][ T298] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.029974][ T298] bridge0: port 1(bridge_slave_0) entered forwarding state [ 32.047517][ T297] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.054622][ T297] bridge0: port 2(bridge_slave_1) entered forwarding state [ 32.061942][ T297] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.069015][ T297] bridge0: port 1(bridge_slave_0) entered forwarding state [ 32.080474][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 32.088330][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 32.095707][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 32.103127][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 32.110580][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 32.118289][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 32.125514][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 32.132925][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 32.148453][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.155522][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 32.166959][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.174052][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 32.222643][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.229751][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 32.237477][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.244574][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 32.267049][ T293] veth0_vlan: entered promiscuous mode [ 32.275355][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.282442][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 32.299463][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.306522][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 32.314134][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.321181][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 32.329086][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.336125][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 32.364049][ T293] veth1_macvtap: entered promiscuous mode [ 32.414588][ T298] veth0_vlan: entered promiscuous mode [ 32.424115][ T293] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 32.440293][ T297] veth0_vlan: entered promiscuous mode [ 32.448477][ T299] veth0_vlan: entered promiscuous mode [ 32.467171][ T299] veth1_macvtap: entered promiscuous mode [ 32.477974][ T297] veth1_macvtap: entered promiscuous mode [ 32.501634][ T298] veth1_macvtap: entered promiscuous mode [ 32.617135][ T330] SELinux: security_context_str_to_sid (system_u) failed with errno=-22 [ 32.654621][ T332] netlink: 'syz.0.7': attribute type 4 has an invalid length. [ 32.662206][ T332] netlink: 17 bytes leftover after parsing attributes in process `syz.0.7'. [ 32.671955][ T332] netlink: 'syz.0.7': attribute type 27 has an invalid length. [ 32.681188][ T332] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 32.712150][ T338] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 32.738077][ T9] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 32.887843][ T319] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 32.911171][ T9] usb 2-1: config 1 interface 0 altsetting 127 bulk endpoint 0x81 has invalid maxpacket 64 [ 32.921563][ T9] usb 2-1: config 1 interface 0 altsetting 127 bulk endpoint 0x2 has invalid maxpacket 32 [ 32.931825][ T9] usb 2-1: config 1 interface 0 has no altsetting 0 [ 32.940797][ T9] usb 2-1: New USB device found, idVendor=0bda, idProduct=8150, bcdDevice= 0.40 [ 32.950967][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 32.959123][ T9] usb 2-1: Product: syz [ 32.963303][ T9] usb 2-1: Manufacturer: syz [ 32.968328][ T9] usb 2-1: SerialNumber: syz [ 32.979589][ T311] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 32.990766][ T311] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 33.016582][ T346] netlink: 4 bytes leftover after parsing attributes in process `syz.0.12'. [ 33.039151][ T319] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 7 [ 33.049899][ T319] usb 4-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 33.065117][ T319] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 33.074951][ T319] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 33.083570][ T319] usb 4-1: Product: syz [ 33.088405][ T319] usb 4-1: Manufacturer: syz [ 33.095543][ T319] usb 4-1: SerialNumber: syz [ 33.103497][ T335] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 33.314488][ T319] usblp 4-1:1.0: usblp0: USB Unidirectional printer dev 2 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 33.356293][ T357] netlink: 108 bytes leftover after parsing attributes in process `syz.2.17'. [ 33.399001][ T317] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 33.515540][ C1] usblp0: nonzero write bulk status received: -71 [ 33.522888][ T313] usb 4-1: USB disconnect, device number 2 [ 33.530672][ T313] usblp0: removed [ 33.559148][ T317] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 33.569408][ T317] usb 1-1: config 0 has no interfaces? [ 33.574948][ T317] usb 1-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 33.584293][ T317] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 33.593488][ T317] usb 1-1: config 0 descriptor?? [ 33.604181][ T363] kvm: kvm [362]: vcpu0, guest rIP: 0x55d80 Unhandled WRMSR(0xc0010006) = 0x10001000001 [ 33.803760][ T317] usb 1-1: USB disconnect, device number 2 [ 34.010305][ T9] (unnamed net_device) (uninitialized): Assigned a random MAC address: 52:71:3b:e1:1a:b6 [ 34.022412][ T9] rtl8150 2-1:1.0: eth1: rtl8150 is detected [ 34.031434][ T9] usb 2-1: USB disconnect, device number 2 [ 34.183199][ T388] tun0: tun_chr_ioctl cmd 1074025675 [ 34.189469][ T388] tun0: persist enabled [ 34.196179][ T388] tun0: tun_chr_ioctl cmd 1074025675 [ 34.201835][ T388] tun0: persist enabled [ 34.237061][ T393] capability: warning: `syz.3.33' uses 32-bit capabilities (legacy support in use) [ 34.490179][ T409] bridge0: port 2(bridge_slave_1) entered disabled state [ 34.497405][ T409] netlink: 'syz.2.42': attribute type 1 has an invalid length. [ 34.505117][ T409] netlink: 9 bytes leftover after parsing attributes in process `syz.2.42'. [ 34.571194][ T419] batadv_slave_1: entered promiscuous mode [ 34.583920][ T416] batadv_slave_1: left promiscuous mode [ 34.629254][ T428] input: syz0 as /devices/virtual/input/input4 [ 34.659121][ T436] overlayfs: "xino" feature enabled using 2 upper inode bits. [ 34.700527][ T442] ======================================================= [ 34.700527][ T442] WARNING: The mand mount option has been deprecated and [ 34.700527][ T442] and is ignored by this kernel. Remove the mand [ 34.700527][ T442] option from the mount to silence this warning. [ 34.700527][ T442] ======================================================= [ 34.759445][ T446] overlayfs: workdir and upperdir must reside under the same mount [ 34.776552][ T36] kauditd_printk_skb: 87 callbacks suppressed [ 34.776568][ T36] audit: type=1400 audit(1789541454.960:161): avc: denied { read } for pid=444 comm="syz.2.57" name="usbmon7" dev="devtmpfs" ino=112 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 34.816834][ T36] audit: type=1400 audit(1789541454.960:162): avc: denied { open } for pid=444 comm="syz.2.57" path="/dev/usbmon7" dev="devtmpfs" ino=112 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 34.841140][ T36] audit: type=1400 audit(1789541455.000:163): avc: denied { ioctl } for pid=444 comm="syz.2.57" path="/dev/usbmon7" dev="devtmpfs" ino=112 ioctlcmd=0x9207 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 34.866333][ T36] audit: type=1400 audit(1789541455.000:164): avc: denied { unmount } for pid=298 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 34.899217][ T36] audit: type=1400 audit(1789541455.000:165): avc: denied { connect } for pid=448 comm="syz.3.58" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 34.936379][ T36] audit: type=1400 audit(1789541455.120:166): avc: denied { setopt } for pid=452 comm="syz.3.60" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 34.966609][ T36] audit: type=1400 audit(1789541455.150:167): avc: denied { setopt } for pid=452 comm="syz.3.60" lport=136 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 35.017740][ T36] audit: type=1400 audit(1789541455.150:168): avc: denied { write } for pid=454 comm="syz.2.61" name="ptp0" dev="devtmpfs" ino=196 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 35.072401][ T36] audit: type=1400 audit(1789541455.150:169): avc: denied { open } for pid=454 comm="syz.2.61" path="/dev/ptp0" dev="devtmpfs" ino=196 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 35.125161][ T36] audit: type=1400 audit(1789541455.180:170): avc: denied { ioctl } for pid=454 comm="syz.2.61" path="/dev/ptp0" dev="devtmpfs" ino=196 ioctlcmd=0x3d06 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 35.219969][ T481] rust_binder: 478:481 inc_ref_done called when no active inc_refs [ 35.268845][ T486] rust_binder: 483:486 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 35.515921][ T313] smpboot: CPU 1 is now offline [ 35.570343][ T512] netlink: 16 bytes leftover after parsing attributes in process `syz.0.87'. [ 35.609113][ T515] FAULT_INJECTION: forcing a failure. [ 35.609113][ T515] name failslab, interval 1, probability 0, space 0, times 1 [ 35.662867][ T515] CPU: 0 UID: 0 PID: 515 Comm: syz.3.89 Not tainted syzkaller #0 59ddfa31286c0993fe0730f15c0a18803f31b842 [ 35.662891][ T515] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/08/2026 [ 35.662908][ T515] Call Trace: [ 35.662913][ T515] [ 35.662920][ T515] __dump_stack+0x21/0x30 [ 35.662953][ T515] dump_stack_lvl+0x140/0x1c0 [ 35.662976][ T515] ? __cfi_dump_stack_lvl+0x10/0x10 [ 35.662999][ T515] ? __cfi___switch_to+0x10/0x10 [ 35.663023][ T515] dump_stack+0x19/0x20 [ 35.663044][ T515] should_fail_ex+0x3c2/0x510 [ 35.663063][ T515] should_failslab+0xac/0x100 [ 35.663084][ T515] kmem_cache_alloc_noprof+0x42/0x410 [ 35.663100][ T515] ? vm_area_dup+0x3f/0x560 [ 35.663118][ T515] vm_area_dup+0x3f/0x560 [ 35.663134][ T515] ? __split_vma+0x1b8/0xc10 [ 35.663151][ T515] __split_vma+0x1ce/0xc10 [ 35.663167][ T515] ? __sched_text_start+0x10/0x10 [ 35.663183][ T515] ? plist_add+0x4d4/0x570 [ 35.663207][ T515] ? vms_gather_munmap_vmas+0xd90/0xd90 [ 35.663226][ T515] ? __cfi___futex_queue+0x10/0x10 [ 35.663247][ T515] ? can_vma_merge_left+0x184/0x4b0 [ 35.663270][ T515] vma_modify+0x60c/0x1540 [ 35.663290][ T515] vma_modify_flags+0x182/0x1c0 [ 35.663310][ T515] mprotect_fixup+0x432/0x8d0 [ 35.663330][ T515] ? __cfi_selinux_file_mprotect+0x10/0x10 [ 35.663349][ T515] ? __cfi_mprotect_fixup+0x10/0x10 [ 35.663370][ T515] ? bpf_lsm_file_mprotect+0xd/0x20 [ 35.663395][ T515] do_mprotect_pkey+0xa85/0xe50 [ 35.663419][ T515] ? prot_none_test+0x30/0x30 [ 35.663439][ T515] ? mutex_unlock+0x90/0x240 [ 35.663458][ T515] ? fput+0x1a4/0x230 [ 35.663481][ T515] ? __kasan_check_write+0x18/0x20 [ 35.663497][ T515] ? fpregs_restore_userregs+0x11c/0x260 [ 35.663517][ T515] __x64_sys_mprotect+0x84/0xa0 [ 35.663538][ T515] x64_sys_call+0x2590/0x2ee0 [ 35.663553][ T515] do_syscall_64+0x57/0xf0 [ 35.663566][ T515] ? clear_bhb_loop+0x50/0xa0 [ 35.663585][ T515] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 35.663604][ T515] RIP: 0033:0x7ff61279e159 [ 35.663620][ T515] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 35.663633][ T515] RSP: 002b:00007ff613652028 EFLAGS: 00000246 ORIG_RAX: 000000000000000a [ 35.663655][ T515] RAX: ffffffffffffffda RBX: 00007ff612a25fa0 RCX: 00007ff61279e159 [ 35.663667][ T515] RDX: 0000000000000001 RSI: 000000000000f000 RDI: 0000200000000000 [ 35.663678][ T515] RBP: 00007ff61283506b R08: 0000000000000000 R09: 0000000000000000 [ 35.663687][ T515] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 35.663697][ T515] R13: 00007ff612a26038 R14: 00007ff612a25fa0 R15: 00007ffd96ac5988 [ 35.663710][ T515] [ 35.942862][ T313] usb 3-1: new full-speed USB device number 2 using dummy_hcd [ 36.019254][ T526] netlink: 'syz.3.94': attribute type 27 has an invalid length. [ 36.028720][ T526] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 36.057638][ T528] rust_binder: 527:528 error while translating object: EPERM [ 36.065163][ T528] rust_binder: Failure in copy_transaction_data: EPERM [ 36.065206][ T528] rust_binder: 527:528 transaction call to 527:0 failed EPERM, code 0 size 80-24 [ 36.214290][ T9] rust_binder: 527: undelivered TRANSACTION_ERROR: 29201 [ 36.240400][ T313] usb 3-1: config 0 interface 0 altsetting 4 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 36.313206][ T313] usb 3-1: config 0 interface 0 has no altsetting 0 [ 36.334843][ T313] usb 3-1: New USB device found, idVendor=04f2, idProduct=0418, bcdDevice= 0.00 [ 36.362511][ T313] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 36.383315][ T313] usb 3-1: config 0 descriptor?? [ 36.423571][ T563] process 'syz.3.112' launched './file0' with NULL argv: empty string added [ 36.456688][ T563] Invalid argument reading file caps for ./file0 [ 36.605087][ T578] kvm: MONITOR instruction emulated as NOP! [ 36.717752][ T315] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 36.820322][ T313] chicony 0003:04F2:0418.0001: unknown main item tag 0x0 [ 36.828401][ T313] chicony 0003:04F2:0418.0001: unknown main item tag 0x0 [ 36.836441][ T313] chicony 0003:04F2:0418.0001: unknown main item tag 0x0 [ 36.847741][ T313] chicony 0003:04F2:0418.0001: unknown main item tag 0x0 [ 36.867743][ T313] chicony 0003:04F2:0418.0001: unknown main item tag 0x0 [ 36.887778][ T9] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 36.896167][ T315] usb 1-1: config 1 has an invalid descriptor of length 97, skipping remainder of the config [ 36.909583][ T313] chicony 0003:04F2:0418.0001: unknown main item tag 0x0 [ 36.919095][ T602] batadv_slave_1: entered promiscuous mode [ 36.924995][ T315] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 36.934159][ T313] chicony 0003:04F2:0418.0001: unknown main item tag 0x0 [ 36.941524][ T602] batadv_slave_1: left promiscuous mode [ 36.948087][ T315] usb 1-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 36.960280][ T313] chicony 0003:04F2:0418.0001: hidraw0: USB HID vf.ff Device [HID 04f2:0418] on usb-dummy_hcd.2-1/input0 [ 36.977265][ T315] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 36.995436][ T315] usb 1-1: SerialNumber: syz [ 37.033768][ T313] usb 3-1: USB disconnect, device number 2 [ 37.074870][ T9] usb 2-1: config 0 has no interfaces? [ 37.087842][ T9] usb 2-1: New USB device found, idVendor=0af0, idProduct=7a05, bcdDevice=f6.00 [ 37.102356][ T9] usb 2-1: New USB device strings: Mfr=0, Product=2, SerialNumber=3 [ 37.115906][ T9] usb 2-1: Product: syz [ 37.120412][ T9] usb 2-1: SerialNumber: syz [ 37.129532][ T609] loop8: detected capacity change from 0 to 7 [ 37.135885][ T9] usb 2-1: config 0 descriptor?? [ 37.228389][ T315] usb 1-1: 0:2 : does not exist [ 37.243455][ T315] usb 1-1: USB disconnect, device number 3 [ 37.262070][ T336] udevd[336]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 37.387520][ T628] netlink: 'syz.3.142': attribute type 6 has an invalid length. [ 37.556572][ T583] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 37.575656][ T583] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 37.592529][ T9] usb 2-1: USB disconnect, device number 3 [ 37.677805][ T315] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 37.827283][ T660] netlink: 44 bytes leftover after parsing attributes in process `syz.0.157'. [ 37.839136][ T315] usb 4-1: Using ep0 maxpacket: 16 [ 37.848850][ T660] netlink: 43 bytes leftover after parsing attributes in process `syz.0.157'. [ 37.863548][ T315] usb 4-1: config 0 has an invalid interface number: 251 but max is 0 [ 37.878511][ T660] netlink: 'syz.0.157': attribute type 6 has an invalid length. [ 37.886202][ T315] usb 4-1: config 0 has no interface number 0 [ 37.899893][ T315] usb 4-1: config 0 interface 251 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 16 [ 37.911457][ T660] netlink: 'syz.0.157': attribute type 5 has an invalid length. [ 37.927855][ T660] netlink: 43 bytes leftover after parsing attributes in process `syz.0.157'. [ 37.938505][ T315] usb 4-1: config 0 interface 251 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 64 [ 37.954168][ T666] overlayfs: workdir and upperdir must reside under the same mount [ 37.971254][ T315] usb 4-1: New USB device found, idVendor=0b95, idProduct=172a, bcdDevice=f7.f4 [ 37.994792][ T315] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 38.012984][ T315] usb 4-1: Product: syz [ 38.028289][ T315] usb 4-1: Manufacturer: syz [ 38.032909][ T315] usb 4-1: SerialNumber: syz [ 38.054561][ T673] syz.0.163 (673): drop_caches: 0 [ 38.061049][ T315] usb 4-1: config 0 descriptor?? [ 38.072394][ T634] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 38.091039][ T634] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 38.287765][ T313] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 38.309942][ T634] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 38.334102][ T634] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 38.451165][ T313] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 38.491250][ T313] usb 3-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 1024 [ 38.543615][ T313] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 38.578786][ T313] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 38.598050][ T9] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 38.614657][ T313] usb 3-1: Product: syz [ 38.629835][ T9] hid-generic 0000:0000:0000.0002: hidraw0: HID v0.00 Device [syz1] on syz0 [ 38.647747][ T313] usb 3-1: Manufacturer: syz [ 38.658190][ T313] usb 3-1: SerialNumber: syz [ 38.688609][ T313] cdc_mbim 3-1:1.0: skipping garbage [ 38.729573][ T711] SELinux: policydb table sizes (768,9) do not match mine (8,9) [ 38.747521][ T711] SELinux: failed to load policy [ 38.889132][ T674] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 38.965493][ T315] asix 4-1:0.251 (unnamed net_device) (uninitialized): invalid PHY address: 177 [ 39.176307][ T315] usb 4-1: USB disconnect, device number 3 [ 39.475120][ T790] sd 0:0:1:0: PR command failed: 1026 [ 39.480632][ T790] sd 0:0:1:0: Sense Key : 0x5 [current] [ 39.486354][ T790] sd 0:0:1:0: ASC=0x20 ASCQ=0x0 [ 39.525015][ T674] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 39.541615][ T313] cdc_mbim 3-1:1.0: setting rx_max = 16384 [ 39.577756][ T649] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 39.735392][ T649] usb 2-1: unable to get BOS descriptor or descriptor too short [ 39.753681][ T313] cdc_mbim 3-1:1.0: setting tx_max = 184 [ 39.769282][ T649] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 39.780087][ T313] cdc_mbim 3-1:1.0: cdc-wdm0: USB WDM device [ 39.813335][ T313] wwan wwan0: port wwan0mbim0 attached [ 39.819955][ T649] usb 2-1: string descriptor 0 read error: -22 [ 39.826165][ T649] usb 2-1: New USB device found, idVendor=200c, idProduct=100b, bcdDevice= 0.40 [ 39.855852][ T313] cdc_mbim 3-1:1.0 wwan0: register 'cdc_mbim' at usb-dummy_hcd.2-1, CDC MBIM, 96:ec:b1:54:65:a1 [ 39.901569][ T649] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 39.918408][ T36] kauditd_printk_skb: 91 callbacks suppressed [ 39.918422][ T36] audit: type=1400 audit(1789541460.110:262): avc: denied { search } for pid=148 comm="dhcpcd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 39.956744][ T313] usb 3-1: USB disconnect, device number 3 [ 39.969996][ T313] cdc_mbim 3-1:1.0 wwan0: unregister 'cdc_mbim' usb-dummy_hcd.2-1, CDC MBIM [ 40.020606][ T36] audit: type=1400 audit(1789541460.110:263): avc: denied { read } for pid=148 comm="dhcpcd" name="n16" dev="tmpfs" ino=1282 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 40.052708][ T313] wwan wwan0: port wwan0mbim0 disconnected [ 40.137655][ T36] audit: type=1400 audit(1789541460.110:264): avc: denied { open } for pid=148 comm="dhcpcd" path="/run/udev/data/n16" dev="tmpfs" ino=1282 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 40.215644][ T36] audit: type=1400 audit(1789541460.110:265): avc: denied { getattr } for pid=148 comm="dhcpcd" path="/run/udev/data/n16" dev="tmpfs" ino=1282 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 40.352214][ T36] audit: type=1400 audit(1789541460.260:266): avc: denied { read } for pid=815 comm="dhcpcd-run-hook" name="resolv.conf" dev="tmpfs" ino=426 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 40.380881][ T840] netlink: 68 bytes leftover after parsing attributes in process `syz.3.222'. [ 40.471303][ T847] rust_binder: Failure in copy_transaction_data: EINVAL [ 40.471326][ T847] rust_binder: 846:847 transaction async to 846:0 failed EINVAL, code 0 size 0-24 [ 40.487653][ T36] audit: type=1400 audit(1789541460.260:267): avc: denied { open } for pid=815 comm="dhcpcd-run-hook" path="/run/dhcpcd/hook-state/resolv.conf" dev="tmpfs" ino=426 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 40.567745][ T313] rust_binder: 846: undelivered TRANSACTION_COMPLETE [ 40.576229][ T649] usb 2-1: current rate 48096 is different from the runtime rate 48000 [ 40.597322][ T313] rust_binder: 846: undelivered TRANSACTION_ERROR: 29201 [ 40.627011][ T36] audit: type=1400 audit(1789541460.260:268): avc: denied { getattr } for pid=815 comm="dhcpcd-run-hook" path="/run/dhcpcd/hook-state/resolv.conf" dev="tmpfs" ino=426 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 40.784053][ T313] usb 2-1: USB disconnect, device number 4 [ 40.791316][ T36] audit: type=1400 audit(1789541460.460:269): avc: denied { write } for pid=812 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=425 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 40.821371][ T313] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000004: 0000 [#1] PREEMPT SMP KASAN PTI [ 40.833986][ T313] KASAN: null-ptr-deref in range [0x0000000000000020-0x0000000000000027] [ 40.842400][ T313] CPU: 0 UID: 0 PID: 313 Comm: kworker/0:2 Not tainted syzkaller #0 59ddfa31286c0993fe0730f15c0a18803f31b842 [ 40.854046][ T313] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/08/2026 [ 40.864104][ T313] Workqueue: usb_hub_wq hub_event [ 40.869154][ T313] RIP: 0010:klist_remove+0x15e/0x330 [ 40.874457][ T313] Code: be 00 00 00 00 00 fc ff df 43 80 3c 34 00 74 08 48 89 df e8 64 98 44 fc 4c 8b 3b 49 83 e7 fe 49 8d 7f 20 48 89 f8 48 c1 e8 03 <42> 80 3c 30 00 74 05 e8 46 98 44 fc 49 8b 47 20 48 89 44 24 18 4c [ 40.894067][ T313] RSP: 0018:ffffc9000b6ef600 EFLAGS: 00010202 [ 40.900135][ T313] RAX: 0000000000000004 RBX: ffff88810cf68e48 RCX: dffffc0000000000 [ 40.908114][ T313] RDX: ffffc9000bffc000 RSI: 0000000000003826 RDI: 0000000000000020 [ 40.916089][ T313] RBP: ffffc9000b6ef6e8 R08: 0000000000000003 R09: 0000000000000004 [ 40.924060][ T313] R10: dffffc0000000000 R11: fffff520016ddeb0 R12: 1ffff110219ed1c9 [ 40.932036][ T313] R13: 1ffff920016ddec4 R14: dffffc0000000000 R15: 0000000000000000 [ 40.940093][ T313] FS: 0000000000000000(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 40.949023][ T313] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 40.955611][ T313] CR2: 00007fe3625556c8 CR3: 0000000107242000 CR4: 00000000003526b0 [ 40.963593][ T313] Call Trace: [ 40.966875][ T313] [ 40.969810][ T313] ? devres_release_all+0x342/0x3c0 [ 40.975015][ T313] ? __cfi_klist_remove+0x10/0x10 [ 40.980047][ T313] ? usb_unbind_interface+0x857/0xa40 [ 40.985438][ T313] device_release_driver_internal+0x739/0x830 [ 40.991508][ T313] device_release_driver+0x1d/0x30 [ 40.996690][ T313] bus_remove_device+0x34f/0x370 [ 41.001660][ T313] device_del+0x583/0xcf0 [ 41.006028][ T313] ? __cfi_device_del+0x10/0x10 [ 41.010880][ T313] ? __kasan_check_write+0x18/0x20 [ 41.015999][ T313] usb_disable_device+0x3af/0x770 [ 41.021038][ T313] usb_disconnect+0x331/0x950 [ 41.025734][ T313] hub_event+0x1ad5/0x4360 [ 41.030164][ T313] ? __cfi__raw_spin_lock_irq+0x10/0x10 [ 41.035725][ T313] ? _raw_spin_unlock_irq+0x45/0x70 [ 41.040928][ T313] ? process_srcu+0x794/0x1570 [ 41.045709][ T313] ? __cfi_hub_event+0x10/0x10 [ 41.050485][ T313] ? pwq_dec_nr_in_flight+0x943/0xba0 [ 41.055949][ T313] ? _raw_spin_lock_irq+0x93/0x120 [ 41.061060][ T313] ? __cfi__raw_spin_lock_irq+0x10/0x10 [ 41.066616][ T313] ? kick_pool+0xad/0x540 [ 41.070960][ T313] process_scheduled_works+0x7f4/0x1060 [ 41.076512][ T313] worker_thread+0xc99/0x13f0 [ 41.081191][ T313] ? __cfi_set_cpus_allowed_ptr+0x10/0x10 [ 41.086917][ T313] ? __kasan_check_read+0x15/0x20 [ 41.091945][ T313] kthread+0x2c4/0x360 [ 41.096031][ T313] ? __cfi_worker_thread+0x10/0x10 [ 41.101321][ T313] ? __cfi_kthread+0x10/0x10 [ 41.105914][ T313] ret_from_fork+0x64/0xa0 [ 41.110338][ T313] ? __cfi_kthread+0x10/0x10 [ 41.114937][ T313] ret_from_fork_asm+0x1a/0x30 [ 41.119715][ T313] [ 41.122753][ T313] Modules linked in: [ 41.126870][ T313] ---[ end trace 0000000000000000 ]--- [ 41.143037][ T36] audit: type=1400 audit(1789541460.460:270): avc: denied { add_name } for pid=812 comm="dhcpcd-run-hook" name="resolv.conf.wwan0.link" scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 41.165445][ T36] audit: type=1400 audit(1789541460.460:271): avc: denied { create } for pid=812 comm="dhcpcd-run-hook" name="resolv.conf.wwan0.link" scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 41.247015][ T313] RIP: 0010:klist_remove+0x15e/0x330 [ 41.252408][ T313] Code: be 00 00 00 00 00 fc ff df 43 80 3c 34 00 74 08 48 89 df e8 64 98 44 fc 4c 8b 3b 49 83 e7 fe 49 8d 7f 20 48 89 f8 48 c1 e8 03 <42> 80 3c 30 00 74 05 e8 46 98 44 fc 49 8b 47 20 48 89 44 24 18 4c [ 41.272208][ T313] RSP: 0018:ffffc9000b6ef600 EFLAGS: 00010202 [ 41.278406][ T313] RAX: 0000000000000004 RBX: ffff88810cf68e48 RCX: dffffc0000000000 [ 41.286440][ T313] RDX: ffffc9000bffc000 RSI: 0000000000003826 RDI: 0000000000000020 [ 41.294572][ T313] RBP: ffffc9000b6ef6e8 R08: 0000000000000003 R09: 0000000000000004 [ 41.302743][ T313] R10: dffffc0000000000 R11: fffff520016ddeb0 R12: 1ffff110219ed1c9 [ 41.310848][ T313] R13: 1ffff920016ddec4 R14: dffffc0000000000 R15: 0000000000000000 [ 41.318962][ T313] FS: 0000000000000000(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 41.328015][ T313] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 41.334656][ T313] CR2: 00007ffecf7700f8 CR3: 000000010c3ec000 CR4: 00000000003526b0 [ 41.342807][ T313] Kernel panic - not syncing: Fatal exception [ 41.348935][ T313] Kernel Offset: disabled [ 41.353269][ T313] Rebooting in 86400 seconds..