last executing test programs: 19.12996602s ago: executing program 0 (id=1): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f00000004c0)=ANY=[@ANYBLOB="1201410130f56920ac05190272f00102030109021b000120001000090455070103490200090582030004"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000580)={0x84, &(0x7f0000000000)=ANY=[@ANYBLOB="f6ffd1"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x43, &(0x7f00000000c0)) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x44, &(0x7f0000001080)={[{0x3d, 0x4e00, "55361d2b560a57179f6b96424ed17bbc68cbdc2b32c0f9d733301d05d33747c6bc49cedefe48211a28792ee6bbaabfe0ca71725e962b5ab196a0f4ccee"}]}) syz_open_dev$evdev(0x0, 0x52, 0x410180) 16.097859894s ago: executing program 0 (id=41): r0 = syz_ublk_setup_io_uring(0x155a, &(0x7f0000000500)={0x0, 0xa355, 0x80, 0x2, 0x15a}, &(0x7f0000000100)=0x0, &(0x7f0000000440)=0x0, &(0x7f00000000c0)=0x0) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000200)={0x2e, 0x34, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x5}}}, &(0x7f0000000480)=0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x4000002, 0x14032, 0xffffffffffffffff, 0x0) r7 = dup(r6) syz_ublk_setup_queues(r7, r5, 0x0, &(0x7f0000000580)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x295e, 0xc000, 0x6, 0x2f0, 0x0, r7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xffffed7c, 0x80, 0x10000004, 0x143, 0x0, r7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf90f, 0x2000, 0x20003}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x8256, 0x2, 0x1, 0x1eb}}], 0x1, &(0x7f00000003c0)={0x2e, 0x8, 0x0, r7, 0xc0107520, 0x0, 0x0, 0x700, 0x0, {}, 0x1f, r4, '\x00', {0x0, 0x8004, 0x0, 0x0}}, 0x0) 15.77475768s ago: executing program 0 (id=42): socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000000)='\x00', 0x1}], 0x1}, 0x49cf75490397e68f) recvmsg$unix(r0, &(0x7f0000000b00)={0x0, 0x0, 0x0}, 0x41) gettid() sendmsg$unix(r1, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000440)=[{&(0x7f0000000100)="f1092b82", 0x4}], 0x1, 0x0, 0x0, 0x10}, 0x1) ioctl$SIOCSIFHWADDR(r0, 0x8905, &(0x7f0000000340)={'ip6_vti0\x00', @dev={'\xaa\xaa\xaa\xaa\xaa', 0x34}}) 15.77432655s ago: executing program 0 (id=44): r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r0) prctl$PR_SET_SECCOMP(0x16, 0x1, 0x0) socket$packet(0x11, 0x3, 0x300) ptrace(0x10, r0) ptrace$setsig(0x4203, r0, 0x4, &(0x7f0000000480)={0x2c, 0x6, 0x5}) 15.384811778s ago: executing program 3 (id=50): unshare(0x60000600) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000440)={'tunl0\x00', &(0x7f0000000480)={'syztnl0\x00', 0x0, 0x700, 0x8, 0x4000006, 0x8, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x64, 0x0, 0x9, 0x4, 0x0, @empty, @broadcast}}}}) r1 = socket(0x10, 0x803, 0x0) sendto(r1, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x804, 0x0, 0x0) recvmmsg(r1, &(0x7f0000002180)=[{{0x0, 0x0, 0x0}, 0x9}, {{0x0, 0x0, 0x0}, 0xffffffff}, {{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000002f40)=""/4096, 0x1000}, {&(0x7f0000000780)=""/221, 0xdd}, {&(0x7f0000000600)=""/277, 0x115}, {&(0x7f0000000540)=""/164, 0xa4}, {&(0x7f0000000980)=""/216, 0xd8}, {&(0x7f00000003c0)=""/92, 0x5c}, {&(0x7f0000000880)=""/242, 0xf2}, {&(0x7f0000000240)=""/102, 0x66}, {&(0x7f0000000a80)=""/88, 0x58}], 0x9}, 0x6}], 0x3, 0x40002000, 0x0) 15.306051932s ago: executing program 0 (id=52): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000006c0)=ANY=[@ANYBLOB="800000000001010400000000141a000002000000240001801400018008000100e000000108000200e00000010c00028005000100000000002400028014000180080001000000000008000200ac1e00010c000280050001000000000008000740000000011c00108008000140000000000800024000000000080003"], 0x80}}, 0xc800) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) openat$zero(0xffffffffffffff9c, &(0x7f0000000140), 0x2a4282, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/keys\x00', 0x0, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB="380000000301019e"], 0x38}}, 0x0) 15.269723434s ago: executing program 32 (id=52): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000006c0)=ANY=[@ANYBLOB="800000000001010400000000141a000002000000240001801400018008000100e000000108000200e00000010c00028005000100000000002400028014000180080001000000000008000200ac1e00010c000280050001000000000008000740000000011c00108008000140000000000800024000000000080003"], 0x80}}, 0xc800) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) openat$zero(0xffffffffffffff9c, &(0x7f0000000140), 0x2a4282, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/keys\x00', 0x0, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB="380000000301019e"], 0x38}}, 0x0) 15.203091137s ago: executing program 3 (id=56): r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r0, 0xaf01, 0x0) r1 = eventfd2(0x1, 0x80001) ioctl$VHOST_SET_VRING_ERR(r0, 0x4008af22, &(0x7f00000001c0)={0x0, r1}) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x8, 0x94, 0x7fff0000}]}) close_range(r2, 0xffffffffffffffff, 0x0) 15.058426474s ago: executing program 3 (id=59): r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x4, @tid=r0}, &(0x7f0000000000)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) recvmmsg(r1, &(0x7f0000007080)=[{{0x0, 0x0, 0x0}, 0x2}], 0x1, 0x20, 0x0) 15.013908886s ago: executing program 3 (id=61): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text64={0x40, 0x0}], 0x1, 0xe4, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000440)={0x1, 0x0, [{0x484, 0x0, 0x3}]}) 14.905892851s ago: executing program 3 (id=63): mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./mysys\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./mysys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/pci/devices/0000:00:05.0/resource0\x00', 0x2, 0x0) mmap(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x3, 0x11, r0, 0x4000) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) 14.852140494s ago: executing program 3 (id=65): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000100)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) write$tun(r0, &(0x7f0000000200)={@val={0x0, 0x22f0}, @void, @eth={@broadcast, @multicast, @val={@void}, {@ipv4={0x800, @udp={{0x5, 0x4, 0x2, 0x7, 0x2c, 0x64, 0x0, 0x8, 0x11, 0x0, @empty, @multicast1}, {0x4e22, 0x4e23, 0x18, 0x0, @wg=@data={0x4, 0x10001, 0x1}}}}}}}, 0x42) 6.494130581s ago: executing program 2 (id=179): r0 = fsopen(&(0x7f0000000400)='configfs\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x82) fchdir(r1) r2 = openat$dir(0xffffffffffffff9c, &(0x7f0000000580)='.\x00', 0xa880, 0x97) getdents64(r2, &(0x7f0000000280)=""/189, 0xbd) 6.434144234s ago: executing program 2 (id=180): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000180)={0x24, 0x0, 0x0, &(0x7f00000001c0)={0x0, 0x22, 0xf, {[@main=@item_012={0x0, 0x0, 0xb}, @main=@item_4={0x3, 0x0, 0x8, "62966124"}, @global=@item_012={0x1, 0x1, 0x8, "f5"}, @global=@item_012={0x1, 0x1, 0x7, "86"}, @main=@item_4={0x3, 0x0, 0xb, "4070f43f"}]}}, 0x0}, 0x0) r1 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f00000004c0)={0x2c, 0x0, 0x0, 0x0, &(0x7f0000000440)={0x20, 0x1, 0x2, "e654"}, 0x0}) ioctl$HIDIOCGCOLLECTIONINDEX(r1, 0x40184810, 0x0) 3.762206521s ago: executing program 2 (id=206): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000140)={0xa, 0x4e23, 0x0, @empty}, 0x1c) listen(r0, 0x16) accept$inet6(r0, 0x0, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) sendto$inet(r1, 0x0, 0x0, 0x200408d4, &(0x7f00000002c0)={0x2, 0x4e23, @empty}, 0x10) 3.042218785s ago: executing program 1 (id=219): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', @multicast}) write$tun(r0, &(0x7f0000000200)=ANY=[@ANYBLOB="0a0090000180c200000300000000000086dd6926d08d00003a"], 0x52) 2.902186132s ago: executing program 1 (id=223): openat(0xffffffffffffff9c, &(0x7f0000000440)='./file1\x00', 0x42, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file2\x00', 0x0) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f00000000c0)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file2'}}], [], 0x2c}) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000400)='./file0/file1\x00', 0x40, 0x83) fsync(r0) 2.902098532s ago: executing program 2 (id=224): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002000000406a053b030000000000010902220001010080320904000001030000000921110100012217000705810340"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022170000000600ff0901a10185020901150026ff00750895098102c0"], 0x0}, 0x0) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$hidraw(&(0x7f0000000000), 0x15e, 0xc0000) syz_usb_ep_write(r0, 0x81, 0x4, &(0x7f0000000000)="02c08120") 2.901971862s ago: executing program 1 (id=225): socket$inet_tcp(0x2, 0x1, 0x0) r0 = socket$igmp(0x2, 0x3, 0x2) r1 = socket$igmp(0x2, 0x3, 0x2) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f00000000c0)='veth1_to_team\x00', 0x10) sendto$inet(r1, 0x0, 0x0, 0x4, &(0x7f0000000080)={0x2, 0x4c1e, @multicast1}, 0x10) ioctl$sock_SIOCINQ(r0, 0x541b, &(0x7f0000000680)) 2.866648334s ago: executing program 1 (id=227): mmap$IORING_OFF_SQ_RING(0x0, 0xc, 0x2000002, 0x401d031, 0xffffffffffffffff, 0x0) r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000180)={0x24, 0x0, 0x0, &(0x7f00000001c0)={0x0, 0x22, 0xf, {[@main=@item_012={0x0, 0x0, 0xb}, @local=@item_4={0x3, 0x2, 0x1, "45501821"}, @global=@item_012={0x1, 0x1, 0x8, "f5"}, @global=@item_012={0x1, 0x1, 0x7, "86"}, @main=@item_4={0x3, 0x0, 0xb, "4070f43f"}]}}, 0x0}, 0x0) r1 = syz_open_dev$hiddev(&(0x7f0000000080), 0x0, 0x0) ioctl$HIDIOCGUSAGE(r1, 0xc018480b, 0x0) 2.722161871s ago: executing program 4 (id=228): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0xe0, 0xf, 0x7fff7ffc}]}) close_range(r1, 0xffffffffffffffff, 0x3f00000000000000) r2 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup.cpu/memory.force_empty\x00', 0x2, 0x80) write(r2, &(0x7f00000002c0)='0', 0x1) 2.676862292s ago: executing program 4 (id=229): r0 = socket$unix(0x1, 0x3, 0x0) bind$unix(r0, &(0x7f0000000100)=@abs={0x1, 0x0, 0x4e20}, 0x6e) r1 = socket$unix(0x1, 0x2, 0x0) bind$unix(r1, &(0x7f0000000100)=@abs={0x1, 0x0, 0x4e20}, 0x1c) r2 = socket$unix(0x1, 0x3, 0x0) bind$unix(r2, &(0x7f0000003000)=@abs={0x1, 0x0, 0x4e20}, 0x6e) 2.663722953s ago: executing program 4 (id=230): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="1201000000000040de28421100000000000109022400010000000009040000010300000009210000000122050009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000140)={0x2c, &(0x7f00000000c0)=ANY=[@ANYBLOB="000085000000854eb1"], 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) r1 = syz_open_dev$hidraw(&(0x7f0000000000), 0x0, 0x81) write(r1, &(0x7f0000000900)="0aaf", 0x2000) 1.066118389s ago: executing program 2 (id=231): capset(&(0x7f0000000100)={0x20071026}, 0x0) r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r0) readv(0xffffffffffffffff, &(0x7f0000000200)=[{&(0x7f0000000100)=""/35, 0x23}], 0x1) ptrace$setregs(0xd, r0, 0x2, &(0x7f0000000180)) ptrace$cont(0x21, r0, 0x80000001, 0x4) 1.05917745s ago: executing program 2 (id=232): r0 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x40, 0x458, 0x5005, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0xf0, 0x7e, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x0, 0x2, 0x0, {0x9, 0x21, 0x7ffd, 0x0, 0x1, {0x22, 0xeb}}, {{{0x9, 0x5, 0x81, 0x3, 0x10, 0xfc}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, 0x0, &(0x7f00000001c0)={0x0, 0x22, 0x371, {0x9}}}, &(0x7f0000000080)={0xffffffffffffffeb, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = syz_open_dev$evdev(&(0x7f00000000c0), 0x40, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYRESDEC=r1], 0x40}, 0x1, 0x0, 0x0, 0x4001}, 0x4000801) ioctl$EVIOCGKEYCODE_V2(r1, 0x80284504, &(0x7f0000000040)=""/95) 164.860902ms ago: executing program 1 (id=233): write$binfmt_script(0xffffffffffffffff, &(0x7f0000000080), 0x4) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./sys/class/thermal/cooling_device0/cur_state\x00', 0x1, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) write(r0, &(0x7f0000000080)='-', 0x1) 93.752235ms ago: executing program 4 (id=234): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f00000000c0)=0x6, 0x4) setsockopt$packet_rx_ring(r0, 0x107, 0x5, &(0x7f0000000040)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x770, 0x0, 0xbabd}, 0x1c) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'bridge0\x00', 0x0}) sendto$packet(r1, &(0x7f0000000640)="280320000a00140000007ef506be", 0xe, 0x400c010, &(0x7f0000000080)={0x11, 0x5, r2, 0x1, 0x5, 0x6, @random="76caa646ae4c"}, 0x14) 93.594035ms ago: executing program 4 (id=235): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup(r0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) write$tun(r2, &(0x7f0000000340)=ANY=[@ANYBLOB="083c86dd00011100046000313b0c6eec00be60302bfffe8000000000000000000000000000aaff02000000000000000000000000000183a474"], 0xfdef) 93.499985ms ago: executing program 1 (id=236): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000240)={0x1, &(0x7f0000000200)=[{0x6, 0xff, 0x7, 0x7fc00002}]}) membarrier(0x10, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r0, 0xc0502100, &(0x7f0000000300)={0x0}) r2 = socket$nl_audit(0x10, 0x3, 0x9) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r0, 0xc0502100, &(0x7f0000000440)) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r0, 0x40182103, &(0x7f0000000080)={r1, 0x3, r2, 0x3, 0x80000}) 0s ago: executing program 4 (id=237): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff) open$dir(&(0x7f00000003c0)='./config/usb_gadget/g1\x00', 0x10000, 0x18) rmdir(&(0x7f00000002c0)='./config/usb_gadget/g1\x00') syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.16' (ED25519) to the list of known hosts. [ 20.662891][ T36] audit: type=1400 audit(1789176542.330:64): avc: denied { mounton } for pid=286 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 20.664094][ T286] cgroup: Unknown subsys name 'net' [ 20.685779][ T36] audit: type=1400 audit(1789176542.330:65): avc: denied { mount } for pid=286 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 20.713197][ T36] audit: type=1400 audit(1789176542.360:66): avc: denied { unmount } for pid=286 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 20.713388][ T286] cgroup: Unknown subsys name 'devices' [ 20.839669][ T286] cgroup: Unknown subsys name 'hugetlb' [ 20.845314][ T286] cgroup: Unknown subsys name 'rlimit' [ 20.957835][ T36] audit: type=1400 audit(1789176542.630:67): avc: denied { setattr } for pid=286 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 20.981285][ T36] audit: type=1400 audit(1789176542.630:68): avc: denied { mounton } for pid=286 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 20.990067][ T288] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 21.006267][ T36] audit: type=1400 audit(1789176542.630:69): avc: denied { mount } for pid=286 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 21.037904][ T36] audit: type=1400 audit(1789176542.690:70): avc: denied { relabelto } for pid=288 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.063561][ T36] audit: type=1400 audit(1789176542.690:71): avc: denied { write } for pid=288 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.096461][ T36] audit: type=1400 audit(1789176542.760:72): avc: denied { read } for pid=286 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.122136][ T36] audit: type=1400 audit(1789176542.760:73): avc: denied { open } for pid=286 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.122359][ T286] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 21.987922][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.994996][ T293] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.002299][ T293] bridge_slave_0: entered allmulticast mode [ 22.008611][ T293] bridge_slave_0: entered promiscuous mode [ 22.016344][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.023485][ T293] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.030779][ T293] bridge_slave_1: entered allmulticast mode [ 22.036944][ T293] bridge_slave_1: entered promiscuous mode [ 22.062841][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.069933][ T294] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.077030][ T294] bridge_slave_0: entered allmulticast mode [ 22.083385][ T294] bridge_slave_0: entered promiscuous mode [ 22.094090][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.101200][ T294] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.108325][ T294] bridge_slave_1: entered allmulticast mode [ 22.114521][ T294] bridge_slave_1: entered promiscuous mode [ 22.146841][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.153943][ T296] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.161074][ T296] bridge_slave_0: entered allmulticast mode [ 22.167250][ T296] bridge_slave_0: entered promiscuous mode [ 22.176508][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.183883][ T296] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.190994][ T296] bridge_slave_1: entered allmulticast mode [ 22.197154][ T296] bridge_slave_1: entered promiscuous mode [ 22.238782][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.245863][ T295] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.252993][ T295] bridge_slave_0: entered allmulticast mode [ 22.259279][ T295] bridge_slave_0: entered promiscuous mode [ 22.271466][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.278556][ T295] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.285663][ T295] bridge_slave_1: entered allmulticast mode [ 22.292022][ T295] bridge_slave_1: entered promiscuous mode [ 22.407002][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.414097][ T294] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.421421][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.428467][ T294] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.440371][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.447427][ T296] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.454714][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.461763][ T296] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.493611][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.500712][ T293] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.508009][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.515128][ T293] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.523766][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.531268][ T295] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.538598][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.545624][ T295] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.577067][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.584526][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.592812][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.600177][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.607314][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.614623][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.622022][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.629467][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.652692][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.659798][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.670750][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.677834][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.710454][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.717515][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.725418][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.732492][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.740842][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.747940][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.755397][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.762475][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.769948][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.776966][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.784642][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.791690][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.835155][ T296] veth0_vlan: entered promiscuous mode [ 22.849624][ T294] veth0_vlan: entered promiscuous mode [ 22.864687][ T295] veth0_vlan: entered promiscuous mode [ 22.882479][ T294] veth1_macvtap: entered promiscuous mode [ 22.895807][ T293] veth0_vlan: entered promiscuous mode [ 22.905127][ T296] veth1_macvtap: entered promiscuous mode [ 22.912549][ T295] veth1_macvtap: entered promiscuous mode [ 22.959632][ T293] veth1_macvtap: entered promiscuous mode [ 22.973067][ T296] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 23.075131][ T327] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 23.094496][ T328] netlink: 'syz.3.7': attribute type 27 has an invalid length. [ 23.275060][ T336] netlink: 36 bytes leftover after parsing attributes in process `syz.2.10'. [ 23.319528][ T31] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 23.479578][ T31] usb 1-1: Using ep0 maxpacket: 32 [ 23.496911][ T31] usb 1-1: config 32 has an invalid interface number: 85 but max is 0 [ 23.508665][ T31] usb 1-1: config 32 has no interface number 0 [ 23.521132][ T31] usb 1-1: config 32 interface 85 altsetting 7 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 23.534031][ T31] usb 1-1: config 32 interface 85 has no altsetting 0 [ 23.543519][ T31] usb 1-1: New USB device found, idVendor=05ac, idProduct=0219, bcdDevice=f0.72 [ 23.553113][ T31] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 23.561325][ T31] usb 1-1: Product: syz [ 23.565528][ T31] usb 1-1: Manufacturer: syz [ 23.571537][ T31] usb 1-1: SerialNumber: syz [ 23.620299][ T368] program syz.2.24 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 23.625484][ T367] SELinux: failed to load policy [ 23.667625][ T9] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 23.818750][ T9] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 23.830125][ T9] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 23.840512][ T9] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 23.848647][ T385] kvm: kvm [384]: vcpu3, guest rIP: 0x913b Unhandled WRMSR(0x11e) = 0x0 [ 23.856692][ T9] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 23.874721][ T9] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 23.890619][ T9] usb 2-1: config 0 descriptor?? [ 24.247665][ T66] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 24.307591][ T9] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0 [ 24.307591][ T311] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 24.322764][ T9] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0 [ 24.330403][ T9] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0 [ 24.338218][ T9] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0 [ 24.345624][ T9] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0 [ 24.353097][ T9] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0 [ 24.360520][ T9] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0 [ 24.368079][ T9] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0 [ 24.375474][ T9] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0 [ 24.382971][ T9] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0 [ 24.390509][ T9] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0 [ 24.398083][ T9] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0 [ 24.405469][ T9] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0 [ 24.413806][ T9] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0 [ 24.421281][ T9] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0 [ 24.429090][ T66] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 24.440115][ T9] plantronics 0003:047F:FFFF.0001: No inputs registered, leaving [ 24.447902][ T66] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 24.457608][ T311] usb 4-1: Using ep0 maxpacket: 32 [ 24.458045][ T66] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 24.464569][ T311] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 24.476193][ T66] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 24.494664][ T311] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 24.495820][ T9] plantronics 0003:047F:FFFF.0001: hiddev96,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.1-1/input0 [ 24.510074][ T311] usb 4-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 24.521884][ T66] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 24.528127][ T311] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 24.535533][ T66] usb 3-1: config 0 descriptor?? [ 24.556635][ T311] usb 4-1: config 0 descriptor?? [ 24.569214][ T311] hub 4-1:0.0: USB hub found [ 24.595604][ T45] usb 2-1: USB disconnect, device number 2 [ 24.765617][ T311] hub 4-1:0.0: 1 port detected [ 24.955204][ T66] plantronics 0003:047F:FFFF.0002: No inputs registered, leaving [ 24.964324][ T66] plantronics 0003:047F:FFFF.0002: hiddev96,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.2-1/input0 [ 25.347643][ T66] usb 2-1: new full-speed USB device number 3 using dummy_hcd [ 25.381875][ T311] hub 4-1:0.0: activate --> -90 [ 25.498740][ T66] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 25.509899][ T66] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 512, setting to 64 [ 25.520843][ T66] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x82 has invalid maxpacket 512, setting to 64 [ 25.531703][ T66] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid maxpacket 512, setting to 64 [ 25.544276][ T66] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 25.553405][ T66] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 25.561456][ T66] usb 2-1: Product: syz [ 25.565629][ T66] usb 2-1: Manufacturer: syz [ 25.570253][ T66] usb 2-1: SerialNumber: syz [ 25.575940][ T411] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 25.783750][ T9] usb 4-1: USB disconnect, device number 2 [ 25.785721][ T411] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 25.797488][ T411] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 26.046741][ T31] usb 1-1: USB disconnect, device number 2 [ 26.065091][ T36] kauditd_printk_skb: 65 callbacks suppressed [ 26.065110][ T36] audit: type=1400 audit(1789176547.730:139): avc: denied { map } for pid=413 comm="syz.0.41" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=4611 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 26.096792][ T36] audit: type=1400 audit(1789176547.730:140): avc: denied { read write } for pid=413 comm="syz.0.41" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=4611 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 26.122744][ T36] audit: type=1400 audit(1789176547.740:141): avc: denied { map } for pid=413 comm="syz.0.41" path="socket:[4612]" dev="sockfs" ino=4612 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tcp_socket permissive=1 [ 26.145655][ T36] audit: type=1400 audit(1789176547.740:142): avc: denied { cmd } for pid=413 comm="iou-wrk-414" path="socket:[4612]" dev="sockfs" ino=4612 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 26.277654][ C1] plantronics 0003:047F:FFFF.0002: usb_submit_urb(ctrl) failed: -1 [ 26.352793][ T36] audit: type=1326 audit(1789176548.020:143): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=429 comm="syz.0.44" exe="/root/ci2-android-6-12-rust/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fe27c79e159 code=0x0 [ 26.407402][ T411] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 26.414954][ T411] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 26.516459][ T36] audit: type=1400 audit(1789176548.180:144): avc: denied { name_bind } for pid=435 comm="syz.3.45" src=20000 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=udp_socket permissive=1 [ 26.566162][ T438] kvm: kvm [437]: vcpu2, guest rIP: 0x9135 Unhandled WRMSR(0x11e) = 0x0 [ 26.627733][ T66] cdc_ncm 2-1:1.0: MAC-Address: 42:42:42:42:42:42 [ 26.634312][ T66] cdc_ncm 2-1:1.0: dwNtbInMaxSize=16 is too small. Using 2048 [ 26.641847][ T66] cdc_ncm 2-1:1.0: setting rx_max = 2048 [ 26.721347][ T36] audit: type=1400 audit(1789176548.390:145): avc: denied { execute } for pid=441 comm="syz.3.47" name="file1" dev="tmpfs" ino=95 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 26.808699][ T450] syzkaller1: entered promiscuous mode [ 26.814264][ T450] syzkaller1: entered allmulticast mode [ 26.824048][ T66] cdc_ncm 2-1:1.0: setting tx_max = 88 [ 26.833904][ T309] bridge_slave_1: left allmulticast mode [ 26.840373][ T309] bridge_slave_1: left promiscuous mode [ 26.846030][ T309] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.854033][ T309] bridge_slave_0: left allmulticast mode [ 26.859919][ T309] bridge_slave_0: left promiscuous mode [ 26.874431][ T309] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.950226][ T66] cdc_ncm 2-1:1.0 usb0: register 'cdc_ncm' at usb-dummy_hcd.1-1, CDC NCM (NO ZLP), 42:42:42:42:42:42 [ 26.976138][ T36] audit: type=1400 audit(1789176548.640:146): avc: denied { read write } for pid=457 comm="syz.3.56" name="vhost-vsock" dev="devtmpfs" ino=200 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 27.002562][ T66] usb 2-1: USB disconnect, device number 3 [ 27.012430][ T66] cdc_ncm 2-1:1.0 usb0: unregister 'cdc_ncm' usb-dummy_hcd.1-1, CDC NCM (NO ZLP) [ 27.026754][ T309] veth1_macvtap: left promiscuous mode [ 27.033270][ T36] audit: type=1400 audit(1789176548.640:147): avc: denied { open } for pid=457 comm="syz.3.56" path="/dev/vhost-vsock" dev="devtmpfs" ino=200 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 27.044006][ T309] veth0_vlan: left promiscuous mode [ 27.061403][ T36] audit: type=1400 audit(1789176548.640:148): avc: denied { ioctl } for pid=457 comm="syz.3.56" path="/dev/vhost-vsock" dev="devtmpfs" ino=200 ioctlcmd=0xaf01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 27.062787][ T31] usb 3-1: USB disconnect, device number 2 [ 27.181575][ T469] netlink: 'syz.2.60': attribute type 4 has an invalid length. [ 27.218215][ T476] netlink: 4 bytes leftover after parsing attributes in process `syz.2.62'. [ 27.236407][ T462] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.244574][ T462] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.251820][ T462] bridge_slave_0: entered allmulticast mode [ 27.260897][ T462] bridge_slave_0: entered promiscuous mode [ 27.268076][ T462] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.276439][ T462] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.285369][ T462] bridge_slave_1: entered allmulticast mode [ 27.293251][ T462] bridge_slave_1: entered promiscuous mode [ 27.376709][ T462] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.383856][ T462] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.391269][ T462] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.398345][ T462] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.470883][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.479389][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.495394][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.502557][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.529044][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.536202][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.609105][ T462] veth0_vlan: entered promiscuous mode [ 27.637610][ T462] veth1_macvtap: entered promiscuous mode [ 27.646658][ T493] netlink: 32 bytes leftover after parsing attributes in process `syz.2.69'. [ 27.930051][ T401] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 28.089157][ T401] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 28.100269][ T401] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 28.110362][ T401] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 28.132038][ T401] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 28.146550][ T401] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 28.158188][ T401] usb 2-1: config 0 descriptor?? [ 28.457011][ T552] 9pnet: p9_errstr2errno: server reported unknown error 0x0 [ 28.577375][ T401] plantronics 0003:047F:FFFF.0003: No inputs registered, leaving [ 28.608376][ T401] plantronics 0003:047F:FFFF.0003: hiddev96,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.1-1/input0 [ 28.657020][ T563] syzkaller1: entered promiscuous mode [ 28.673021][ T563] syzkaller1: entered allmulticast mode [ 29.532416][ T31] rust_binder: 564: undelivered death notification, 0000000000000000 [ 29.609026][ T576] FAULT_INJECTION: forcing a failure. [ 29.609026][ T576] name fail_page_alloc, interval 1, probability 0, space 0, times 1 [ 29.622623][ T576] CPU: 1 UID: 0 PID: 576 Comm: syz.4.102 Not tainted syzkaller #0 238002c42480d657f84ffff3a67e0b81dcf43858 [ 29.622659][ T576] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 29.622670][ T576] Call Trace: [ 29.622676][ T576] [ 29.622684][ T576] __dump_stack+0x21/0x30 [ 29.622730][ T576] dump_stack_lvl+0x140/0x1c0 [ 29.622759][ T576] ? __cfi_dump_stack_lvl+0x10/0x10 [ 29.622786][ T576] ? stack_trace_save+0xaa/0x100 [ 29.622811][ T576] ? stack_depot_save_flags+0x38/0x800 [ 29.622838][ T576] dump_stack+0x19/0x20 [ 29.622863][ T576] should_fail_ex+0x3c2/0x510 [ 29.622910][ T576] should_fail_alloc_page+0xec/0x110 [ 29.622937][ T576] __alloc_pages_noprof+0x1c0/0x7e0 [ 29.622967][ T576] ? __cfi___alloc_pages_noprof+0x10/0x10 [ 29.622999][ T576] ? io_alloc_hash_table+0x52/0x160 [ 29.623021][ T576] ___kmalloc_large_node+0x81/0x220 [ 29.623042][ T576] ? io_alloc_hash_table+0x52/0x160 [ 29.623061][ T576] __kmalloc_large_node_noprof+0x1e/0xd0 [ 29.623082][ T576] ? io_alloc_hash_table+0x52/0x160 [ 29.623101][ T576] __kmalloc_noprof+0x326/0x510 [ 29.623122][ T576] ? __kasan_kmalloc+0x96/0xb0 [ 29.623148][ T576] io_alloc_hash_table+0x52/0x160 [ 29.623167][ T576] io_ring_ctx_alloc+0xd1/0x1dc0 [ 29.623187][ T576] ? do_futex+0x32a/0x510 [ 29.623212][ T576] io_uring_create+0x2e0/0x13f0 [ 29.623231][ T576] ? __kasan_check_write+0x18/0x20 [ 29.623253][ T576] __se_sys_io_uring_setup+0x2a4/0x2b0 [ 29.623282][ T576] ? __se_sys_futex+0x13c/0x320 [ 29.623307][ T576] ? __x64_sys_io_uring_setup+0x80/0x80 [ 29.623337][ T576] ? __kasan_check_write+0x18/0x20 [ 29.623357][ T576] __x64_sys_io_uring_setup+0x5f/0x80 [ 29.623385][ T576] x64_sys_call+0x22c0/0x2ee0 [ 29.623405][ T576] do_syscall_64+0x57/0xf0 [ 29.623433][ T576] ? clear_bhb_loop+0x50/0xa0 [ 29.623456][ T576] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 29.623495][ T576] RIP: 0033:0x7fc91979e159 [ 29.623530][ T576] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 29.623547][ T576] RSP: 002b:00007fc91a698fb8 EFLAGS: 00000206 ORIG_RAX: 00000000000001a9 [ 29.623572][ T576] RAX: ffffffffffffffda RBX: 0000200000000500 RCX: 00007fc91979e159 [ 29.623587][ T576] RDX: 0000000000000000 RSI: 0000200000000500 RDI: 000000000000126b [ 29.623602][ T576] RBP: 00007fc91983503b R08: 0000000000000000 R09: 0000000000000000 [ 29.623616][ T576] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 29.623630][ T576] R13: 0000000000000000 R14: 0000000000000000 R15: 00007ffca47ee798 [ 29.623648][ T576] [ 29.880668][ C0] plantronics 0003:047F:FFFF.0003: usb_submit_urb(ctrl) failed: -1 [ 29.984240][ T585] syzkaller1: entered promiscuous mode [ 29.990106][ T585] syzkaller1: entered allmulticast mode [ 30.108303][ T592] syzkaller1: entered promiscuous mode [ 30.113853][ T592] syzkaller1: entered allmulticast mode [ 30.272590][ T595] kvm: kvm [594]: vcpu0, guest rIP: 0x9114 Unhandled WRMSR(0xc2) = 0x9d00 [ 30.297784][ T595] kvm: kvm [594]: vcpu0, guest rIP: 0x9114 Unhandled WRMSR(0xc1) = 0x9d00 [ 30.730580][ T401] usb 2-1: USB disconnect, device number 4 [ 30.746806][ T620] netlink: 'syz.4.121': attribute type 27 has an invalid length. [ 30.867621][ T401] usb 2-1: new full-speed USB device number 5 using dummy_hcd [ 30.963453][ T634] netlink: 'syz.4.127': attribute type 3 has an invalid length. [ 30.971451][ T634] netlink: 8 bytes leftover after parsing attributes in process `syz.4.127'. [ 31.028736][ T401] usb 2-1: config 0 interface 0 altsetting 13 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 31.041753][ T401] usb 2-1: config 0 interface 0 has no altsetting 0 [ 31.048674][ T401] usb 2-1: New USB device found, idVendor=1e7d, idProduct=3232, bcdDevice= 0.00 [ 31.057808][ T401] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 31.071396][ T401] usb 2-1: config 0 descriptor?? [ 31.127654][ T10] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 31.230994][ T36] kauditd_printk_skb: 39 callbacks suppressed [ 31.231012][ T36] audit: type=1400 audit(1789176552.900:188): avc: denied { create } for pid=645 comm="syz.4.133" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 31.259260][ T36] audit: type=1400 audit(1789176552.930:189): avc: denied { bind } for pid=645 comm="syz.4.133" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 31.259894][ T646] Bluetooth: ISO socket layer initialized [ 31.284923][ T10] usb 3-1: Using ep0 maxpacket: 8 [ 31.315246][ T36] audit: type=1400 audit(1789176552.930:190): avc: denied { write } for pid=645 comm="syz.4.133" path="socket:[6271]" dev="sockfs" ino=6271 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 31.323225][ T648] netlink: 'syz.4.134': attribute type 9 has an invalid length. [ 31.338929][ T10] usb 3-1: config 179 has an invalid interface number: 65 but max is 0 [ 31.368588][ T10] usb 3-1: config 179 has no interface number 0 [ 31.382013][ T10] usb 3-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 31.382140][ T36] audit: type=1400 audit(1789176552.960:191): avc: denied { setopt } for pid=645 comm="syz.4.133" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 31.410852][ T10] usb 3-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 31.433907][ T36] audit: type=1400 audit(1789176552.980:192): avc: denied { ioctl } for pid=647 comm="syz.4.134" path="socket:[5883]" dev="sockfs" ino=5883 ioctlcmd=0x8955 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 31.437615][ T10] usb 3-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 31.465554][ T36] audit: type=1400 audit(1789176553.100:193): avc: denied { unlink } for pid=651 comm="syz.4.136" name="#3" dev="tmpfs" ino=216 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 31.507934][ T401] ryos 0003:1E7D:3232.0004: hidraw0: USB HID v10.01 Device [HID 1e7d:3232] on usb-dummy_hcd.1-1/input0 [ 31.519146][ T10] usb 3-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 31.550935][ T10] usb 3-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 31.564387][ T10] usb 3-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 31.576612][ T10] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 31.592821][ T627] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 31.709761][ T10] usb 2-1: USB disconnect, device number 5 [ 31.827619][ T401] input: Generic X-Box pad as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:179.65/input/input4 [ 31.847109][ T36] audit: type=1400 audit(1789176553.510:194): avc: denied { read } for pid=95 comm="acpid" name="event3" dev="devtmpfs" ino=471 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 31.893058][ T36] audit: type=1400 audit(1789176553.510:195): avc: denied { open } for pid=95 comm="acpid" path="/dev/input/event3" dev="devtmpfs" ino=471 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 31.929432][ T36] audit: type=1400 audit(1789176553.510:196): avc: denied { ioctl } for pid=95 comm="acpid" path="/dev/input/event3" dev="devtmpfs" ino=471 ioctlcmd=0x4520 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 31.954770][ T36] audit: type=1400 audit(1789176553.550:197): avc: denied { write } for pid=662 comm="syz.4.140" name="rtc0" dev="devtmpfs" ino=195 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 32.026362][ T10] usb 3-1: USB disconnect, device number 3 [ 32.032295][ C0] xpad 3-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 32.032334][ C0] xpad 3-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 32.058209][ T10] xpad 3-1:179.65: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -19 [ 33.364716][ T700] syzkaller1: entered promiscuous mode [ 33.370736][ T700] syzkaller1: entered allmulticast mode [ 33.388903][ T702] syzkaller1: entered promiscuous mode [ 33.394495][ T702] syzkaller1: entered allmulticast mode [ 33.443914][ T704] input: syz1 as /devices/virtual/input/input5 [ 33.498131][ T710] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 33.512118][ T710] team_slave_0: entered promiscuous mode [ 33.524372][ T708] team_slave_0: left promiscuous mode [ 33.897605][ T31] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 34.047590][ T31] usb 3-1: Using ep0 maxpacket: 16 [ 34.054093][ T31] usb 3-1: config 0 interface 0 altsetting 5 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 34.065399][ T31] usb 3-1: config 0 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 34.080477][ T31] usb 3-1: config 0 interface 0 has no altsetting 0 [ 34.087202][ T31] usb 3-1: New USB device found, idVendor=0b05, idProduct=18c6, bcdDevice= 0.00 [ 34.096662][ T31] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 34.105748][ T31] usb 3-1: config 0 descriptor?? [ 34.496067][ T732] netlink: 'syz.4.170': attribute type 32 has an invalid length. [ 34.520520][ T31] input: HID 0b05:18c6 as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/0003:0B05:18C6.0005/input/input6 [ 34.553360][ T734] input: syz1 as /devices/virtual/input/input7 [ 34.553471][ T31] hid-generic 0003:0B05:18C6.0005: input,hiddev96,hidraw0: USB HID v0.00 Device [HID 0b05:18c6] on usb-dummy_hcd.2-1/input0 [ 34.723337][ T743] SELinux: Context system_u: is not valid (left unmapped). [ 34.827631][ T10] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 34.988562][ T10] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 34.999602][ T10] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 35.010579][ T10] usb 2-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 35.019754][ T10] usb 2-1: New USB device strings: Mfr=2, Product=0, SerialNumber=0 [ 35.027934][ T10] usb 2-1: Manufacturer: syz [ 35.033934][ T10] usb 2-1: config 0 descriptor?? [ 35.074247][ T45] usb 3-1: USB disconnect, device number 4 [ 35.117592][ T31] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 35.278742][ T31] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 35.289812][ T31] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 35.299919][ T31] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x2 has an invalid bInterval 0, changing to 7 [ 35.310984][ T31] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 35.320235][ T31] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 35.329377][ T31] usb 5-1: config 0 descriptor?? [ 35.739911][ T31] plantronics 0003:047F:FFFF.0007: No inputs registered, leaving [ 35.752228][ T31] plantronics 0003:047F:FFFF.0007: hiddev96,hidraw0: USB HID v0.00 Joystick [HID 047f:ffff] on usb-dummy_hcd.4-1/input0 [ 35.937589][ T401] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 35.998080][ T399] usb 5-1: USB disconnect, device number 2 [ 36.043854][ T10] uclogic 0003:256C:006D.0006: failed retrieving string descriptor #100: -71 [ 36.054579][ T10] uclogic 0003:256C:006D.0006: failed retrieving pen parameters: -71 [ 36.062829][ T10] uclogic 0003:256C:006D.0006: failed probing pen v1 parameters: -71 [ 36.071127][ T10] uclogic 0003:256C:006D.0006: failed probing parameters: -71 [ 36.078763][ T10] uclogic 0003:256C:006D.0006: probe with driver uclogic failed with error -71 [ 36.091510][ T10] usb 2-1: USB disconnect, device number 6 [ 36.101028][ T350] udevd[350]: setting owner of /dev/bus/usb/002/006 to uid=0, gid=0 failed: No such file or directory [ 36.113420][ T401] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 36.124532][ T401] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 36.137661][ T401] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 36.152276][ T401] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 36.163726][ T401] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 36.173958][ T401] usb 3-1: config 0 descriptor?? [ 36.559819][ T36] kauditd_printk_skb: 28 callbacks suppressed [ 36.559838][ T36] audit: type=1400 audit(1789176558.230:224): avc: denied { read append } for pid=762 comm="syz.4.182" name="rnullb0" dev="devtmpfs" ino=31 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 36.601906][ T401] plantronics 0003:047F:FFFF.0008: No inputs registered, leaving [ 36.604331][ T36] audit: type=1400 audit(1789176558.230:225): avc: denied { open } for pid=762 comm="syz.4.182" path="/dev/rnullb0" dev="devtmpfs" ino=31 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 36.632980][ T36] audit: type=1400 audit(1789176558.230:226): avc: denied { map } for pid=762 comm="syz.4.182" path="/dev/rnullb0" dev="devtmpfs" ino=31 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 36.661940][ T401] plantronics 0003:047F:FFFF.0008: hiddev96,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.2-1/input0 [ 36.810515][ T776] syzkaller1: entered promiscuous mode [ 36.822616][ T776] syzkaller1: entered allmulticast mode [ 37.537025][ T784] syzkaller1: entered promiscuous mode [ 37.542663][ T784] syzkaller1: entered allmulticast mode [ 37.644001][ T789] netlink: 4 bytes leftover after parsing attributes in process `syz.4.192'. [ 37.771709][ T36] audit: type=1400 audit(1789176559.440:227): avc: denied { read write } for pid=792 comm="syz.4.194" name="control" dev="devtmpfs" ino=198 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 37.807789][ C0] plantronics 0003:047F:FFFF.0008: usb_submit_urb(ctrl) failed: -1 [ 37.819746][ T36] audit: type=1400 audit(1789176559.440:228): avc: denied { open } for pid=792 comm="syz.4.194" path="/67/dev/mapper/control" dev="devtmpfs" ino=198 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 37.853827][ T36] audit: type=1400 audit(1789176559.520:229): avc: denied { create } for pid=795 comm="syz.1.195" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 37.875313][ T36] audit: type=1400 audit(1789176559.520:230): avc: denied { setopt } for pid=795 comm="syz.1.195" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 37.897503][ T36] audit: type=1400 audit(1789176559.540:231): avc: denied { create } for pid=798 comm="syz.4.197" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 37.926921][ T36] audit: type=1400 audit(1789176559.560:232): avc: denied { ioctl } for pid=798 comm="syz.4.197" path="socket:[7330]" dev="sockfs" ino=7330 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 37.964322][ T36] audit: type=1400 audit(1789176559.560:233): avc: denied { connect } for pid=798 comm="syz.4.197" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 38.116478][ T808] futex_wake_op: syz.4.201 tries to shift op by 144; fix this program [ 38.125246][ T808] futex_wake_op: syz.4.201 tries to shift op by 144; fix this program [ 38.138007][ T810] veth1_to_bond: entered promiscuous mode [ 38.157639][ T810] netlink: 148 bytes leftover after parsing attributes in process `syz.1.202'. [ 38.169945][ T810] veth1_to_bond (unregistering): left promiscuous mode [ 38.333014][ T818] netlink: 'syz.1.205': attribute type 4 has an invalid length. [ 38.356712][ T818] netlink: 'syz.1.205': attribute type 4 has an invalid length. [ 38.408246][ T825] FAULT_INJECTION: forcing a failure. [ 38.408246][ T825] name failslab, interval 1, probability 0, space 0, times 0 [ 38.427115][ T825] CPU: 0 UID: 0 PID: 825 Comm: syz.4.209 Not tainted syzkaller #0 238002c42480d657f84ffff3a67e0b81dcf43858 [ 38.427149][ T825] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 38.427162][ T825] Call Trace: [ 38.427169][ T825] [ 38.427176][ T825] __dump_stack+0x21/0x30 [ 38.427211][ T825] dump_stack_lvl+0x140/0x1c0 [ 38.427240][ T825] ? __cfi_dump_stack_lvl+0x10/0x10 [ 38.427270][ T825] dump_stack+0x19/0x20 [ 38.427297][ T825] should_fail_ex+0x3c2/0x510 [ 38.427323][ T825] should_failslab+0xac/0x100 [ 38.427350][ T825] kmem_cache_alloc_noprof+0x42/0x410 [ 38.427372][ T825] ? fcntl_setlk+0xb4/0x10a0 [ 38.427395][ T825] ? __cfi_futex_wake_mark+0x10/0x10 [ 38.427414][ T825] fcntl_setlk+0xb4/0x10a0 [ 38.427434][ T825] ? avc_has_perm_noaudit+0x26b/0x360 [ 38.427459][ T825] ? __asan_memcpy+0x5a/0x80 [ 38.427479][ T825] ? avc_has_perm_noaudit+0x289/0x360 [ 38.427504][ T825] ? avc_has_perm+0x155/0x240 [ 38.427532][ T825] ? __cfi_fcntl_setlk+0x10/0x10 [ 38.427554][ T825] ? __cfi_avc_has_perm+0x10/0x10 [ 38.427579][ T825] ? __kasan_check_write+0x18/0x20 [ 38.427601][ T825] do_fcntl+0x8c2/0x1580 [ 38.427625][ T825] ? __cfi_selinux_file_fcntl+0x10/0x10 [ 38.427647][ T825] ? check_fcntl_cmd+0xb0/0xb0 [ 38.427675][ T825] ? bpf_lsm_file_fcntl+0xd/0x20 [ 38.427702][ T825] ? security_file_fcntl+0x3e/0x110 [ 38.427723][ T825] __se_sys_fcntl+0xe4/0x180 [ 38.427746][ T825] __x64_sys_fcntl+0x7f/0xa0 [ 38.427768][ T825] x64_sys_call+0x1cb3/0x2ee0 [ 38.427786][ T825] do_syscall_64+0x57/0xf0 [ 38.427804][ T825] ? clear_bhb_loop+0x50/0xa0 [ 38.427828][ T825] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 38.427851][ T825] RIP: 0033:0x7fc91979e159 [ 38.427867][ T825] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 38.427883][ T825] RSP: 002b:00007fc91a699028 EFLAGS: 00000246 ORIG_RAX: 0000000000000048 [ 38.427906][ T825] RAX: ffffffffffffffda RBX: 00007fc919a25fa0 RCX: 00007fc91979e159 [ 38.427931][ T825] RDX: 0000200000004240 RSI: 0000000000000006 RDI: 0000000000000003 [ 38.427945][ T825] RBP: 00007fc91983503b R08: 0000000000000000 R09: 0000000000000000 [ 38.427957][ T825] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 38.427969][ T825] R13: 00007fc919a26038 R14: 00007fc919a25fa0 R15: 00007ffca47ee798 [ 38.427986][ T825] [ 38.671947][ T10] usb 3-1: USB disconnect, device number 5 [ 39.059380][ T849] sd 0:0:1:0: PR command failed: 1026 [ 39.075437][ T849] sd 0:0:1:0: Sense Key : 0x5 [current] [ 39.083812][ T849] sd 0:0:1:0: ASC=0x20 ASCQ=0x0 [ 39.099023][ T851] syzkaller1: entered promiscuous mode [ 39.122457][ T851] syzkaller1: entered allmulticast mode [ 39.467597][ T45] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 39.537645][ T399] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 39.648638][ T45] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 39.660596][ T45] usb 3-1: New USB device found, idVendor=056a, idProduct=033b, bcdDevice= 0.00 [ 39.669954][ T45] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 39.689623][ T399] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 39.707627][ T399] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 39.719462][ T399] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 39.733340][ T10] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 39.741260][ T399] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 39.750906][ T399] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 39.760926][ T399] usb 2-1: config 0 descriptor?? [ 39.908704][ T10] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 39.919792][ T10] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 39.929999][ T10] usb 5-1: New USB device found, idVendor=28de, idProduct=1142, bcdDevice= 0.00 [ 39.939316][ T10] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 39.957986][ T10] usb 5-1: config 0 descriptor?? [ 40.086565][ T45] wacom 0003:056A:033B.0009: Unknown device_type for 'HID 056a:033b'. Assuming pen. [ 40.107131][ T45] wacom 0003:056A:033B.0009: hidraw0: USB HID v1.11 Device [HID 056a:033b] on usb-dummy_hcd.2-1/input0 [ 40.129076][ T45] input: Wacom Intuos S 2 Pen as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/0003:056A:033B.0009/input/input9 [ 40.174785][ T399] plantronics 0003:047F:FFFF.000A: No inputs registered, leaving [ 40.192613][ T399] plantronics 0003:047F:FFFF.000A: hiddev96,hidraw1: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.1-1/input0 [ 40.367093][ T10] hid-steam 0003:28DE:1142.000B: unknown main item tag 0x0 [ 40.374689][ T10] hid-steam 0003:28DE:1142.000B: : USB HID v0.00 Device [HID 28de:1142] on usb-dummy_hcd.4-1/input0 [ 40.437693][ T10] hid-steam 0003:28DE:1142.000B: Steam wireless receiver connected [ 40.445653][ T10] hid-steam 0003:28DE:1142.000B: No HID_FEATURE_REPORT submitted - nothing to read [ 40.456572][ T10] hid-steam 0003:28DE:1142.000C: unknown main item tag 0x0 [ 40.467741][ T10] hid-steam 0003:28DE:1142.000C: hidraw2: USB HID v0.00 Device [HID 28de:1142] on usb-dummy_hcd.4-1/input0 [ 40.528778][ T45] usb 3-1: USB disconnect, device number 6 [ 41.061301][ T881] capability: warning: `syz.2.231' uses deprecated v2 capabilities in a way that may be insecure [ 41.349124][ T31] usb 3-1: new full-speed USB device number 7 using dummy_hcd [ 41.467707][ C1] plantronics 0003:047F:FFFF.000A: usb_submit_urb(ctrl) failed: -1 [ 41.508673][ T31] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 41.537659][ T31] usb 3-1: New USB device found, idVendor=0458, idProduct=5005, bcdDevice= 0.00 [ 41.546756][ T31] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 41.570071][ T31] usb 3-1: config 0 descriptor?? [ 42.017502][ T31] input: HID 0458:5005 as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/0003:0458:5005.000D/input/input12 [ 42.032339][ T31] input: HID 0458:5005 as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/0003:0458:5005.000D/input/input13 [ 42.074518][ T31] kye 0003:0458:5005.000D: input,hiddev97,hidraw0: USB HID v7f.fd Device [HID 0458:5005] on usb-dummy_hcd.2-1/input0 [ 42.164997][ T36] kauditd_printk_skb: 9 callbacks suppressed [ 42.165016][ T36] audit: type=1400 audit(1789176563.830:243): avc: denied { add_name } for pid=894 comm="syz.4.237" name="g1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 42.192814][ T36] audit: type=1400 audit(1789176563.830:244): avc: denied { create } for pid=894 comm="syz.4.237" name="g1" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:configfs_t tclass=dir permissive=1 [ 42.213218][ T895] BUG: scheduling while atomic: syz.4.237/895/0x00000002 [ 42.220340][ T895] Modules linked in: [ 42.224284][ T895] CPU: 1 UID: 0 PID: 895 Comm: syz.4.237 Not tainted syzkaller #0 238002c42480d657f84ffff3a67e0b81dcf43858 [ 42.224316][ T895] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 42.224329][ T895] Call Trace: [ 42.224336][ T895] [ 42.224344][ T895] __dump_stack+0x21/0x30 [ 42.224379][ T895] dump_stack_lvl+0x140/0x1c0 [ 42.224411][ T895] ? __cfi_dump_stack_lvl+0x10/0x10 [ 42.224442][ T895] dump_stack+0x19/0x20 [ 42.224470][ T895] __schedule_bug+0x12b/0x200 [ 42.224493][ T895] ? find_proxy_task+0x2460/0x2460 [ 42.224515][ T895] ? kernel_text_address+0xa9/0xe0 [ 42.224551][ T895] ? __kernel_text_address+0x11/0x40 [ 42.224578][ T895] ? unwind_get_return_address+0x51/0x90 [ 42.224603][ T895] ? __cfi_stack_trace_consume_entry+0x10/0x10 [ 42.224627][ T895] __schedule+0xb85/0x20b0 [ 42.224650][ T895] ? stack_trace_save+0xaa/0x100 [ 42.224674][ T895] ? __sched_text_start+0x10/0x10 [ 42.224694][ T895] ? __kasan_check_read+0x15/0x20 [ 42.224714][ T895] ? rwsem_spin_on_owner+0xa4/0x3b0 [ 42.224743][ T895] ? __kasan_check_write+0x18/0x20 [ 42.224764][ T895] ? _raw_spin_lock_irq+0x93/0x120 [ 42.224783][ T895] ? __cfi__raw_spin_lock_irq+0x10/0x10 [ 42.224803][ T895] schedule+0xc5/0x240 [ 42.224824][ T895] schedule_preempt_disabled+0x14/0x30 [ 42.224847][ T895] rwsem_down_write_slowpath+0x5c9/0x1b60 [ 42.224878][ T895] ? rwsem_down_read_slowpath+0x14c0/0x14c0 [ 42.224904][ T895] ? try_to_wake_up+0x111a/0x1fd0 [ 42.224928][ T895] ? __kasan_check_write+0x18/0x20 [ 42.224948][ T895] ? wake_q_add_safe+0x29/0x100 [ 42.224967][ T895] ? __cfi_try_to_wake_up+0x10/0x10 [ 42.224990][ T895] ? rwsem_mark_wake+0x507/0x770 [ 42.225019][ T895] ? rwsem_read_trylock+0x275/0x5a0 [ 42.225046][ T895] ? wake_up_q+0x10a/0x1c0 [ 42.225064][ T895] ? downgrade_write+0x470/0x470 [ 42.225094][ T895] down_write+0x163/0x2b0 [ 42.225118][ T895] ? __cfi_down_write+0x10/0x10 [ 42.225141][ T895] ? down_read+0x7f/0xe0 [ 42.225166][ T895] ? __cfi_down_read+0x10/0x10 [ 42.225192][ T895] kernfs_remove_by_name_ns+0x8c/0x180 [ 42.225221][ T895] sysfs_unmerge_group+0xd7/0x130 [ 42.225245][ T895] dpm_sysfs_remove+0x8a/0xd0 [ 42.225273][ T895] device_del+0x241/0xcf0 [ 42.225293][ T895] ? __cfi_class_find_device+0x10/0x10 [ 42.225316][ T895] ? __cfi_device_del+0x10/0x10 [ 42.225334][ T895] ? __kasan_check_write+0x18/0x20 [ 42.225354][ T895] ? kobject_put+0x1cc/0x2a0 [ 42.225373][ T895] device_destroy+0xb0/0x100 [ 42.225393][ T895] ? __cfi_device_destroy+0x10/0x10 [ 42.225413][ T895] ? __kasan_check_write+0x18/0x20 [ 42.225434][ T895] android_device_destroy+0x118/0x180 [ 42.225464][ T895] gadgets_drop+0x1d/0x30 [ 42.225484][ T895] ? __cfi_gadgets_drop+0x10/0x10 [ 42.225505][ T895] configfs_rmdir+0x8b7/0x9b0 [ 42.225533][ T895] vfs_rmdir+0x3de/0x560 [ 42.225570][ T895] do_rmdir+0x29a/0x590 [ 42.225598][ T895] ? __cfi_do_rmdir+0x10/0x10 [ 42.225626][ T895] ? __kasan_check_write+0x18/0x20 [ 42.225667][ T895] __x64_sys_rmdir+0x4b/0x60 [ 42.225695][ T895] x64_sys_call+0xaf7/0x2ee0 [ 42.225715][ T895] do_syscall_64+0x57/0xf0 [ 42.225733][ T895] ? clear_bhb_loop+0x50/0xa0 [ 42.225757][ T895] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 42.225780][ T895] RIP: 0033:0x7fc91979e159 [ 42.225798][ T895] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 42.225815][ T895] RSP: 002b:00007fc91a699028 EFLAGS: 00000246 ORIG_RAX: 0000000000000054 [ 42.225838][ T895] RAX: ffffffffffffffda RBX: 00007fc919a25fa0 RCX: 00007fc91979e159 [ 42.225854][ T895] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00002000000002c0 [ 42.225867][ T895] RBP: 00007fc91983503b R08: 0000000000000000 R09: 0000000000000000 [ 42.225880][ T895] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 42.225893][ T895] R13: 00007fc919a26038 R14: 00007fc919a25fa0 R15: 00007ffca47ee798 [ 42.225910][ T895] [ 42.257959][ T401] usb 5-1: USB disconnect, device number 3 [ 42.260048][ T895] ------------[ cut here ]------------ [ 42.288310][ T401] hid-steam 0003:28DE:1142.000B: Steam wireless receiver disconnected [ 42.288907][ T895] WARNING: CPU: 1 PID: 895 at lib/stackdepot.c:635 stack_depot_save_flags+0x266/0x800 [ 42.322002][ T36] audit: type=1400 audit(1789176563.880:245): avc: denied { remove_name } for pid=894 comm="syz.4.237" name="g1" dev="configfs" ino=7643 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 42.325666][ T895] Modules linked in: [ 42.339229][ T36] audit: type=1400 audit(1789176563.880:246): avc: denied { rmdir } for pid=894 comm="syz.4.237" name="g1" dev="configfs" ino=7643 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 42.341256][ T895] [ 42.700167][ T895] CPU: 1 UID: 0 PID: 895 Comm: syz.4.237 Tainted: G W syzkaller #0 238002c42480d657f84ffff3a67e0b81dcf43858 [ 42.713183][ T895] Tainted: [W]=WARN [ 42.717027][ T895] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 42.727150][ T895] RIP: 0010:stack_depot_save_flags+0x266/0x800 [ 42.733390][ T895] Code: 48 83 3d f4 00 dc 05 00 0f 84 00 04 00 00 48 c7 45 c0 00 00 00 00 48 89 d3 65 8b 05 0c 42 1e 7d 4d 89 d7 a9 00 00 f0 00 74 2d <0f> 0b 48 c7 45 c8 00 00 00 00 9c 8f 45 c8 4c 8b 6d c8 fa 48 c7 c7 [ 42.753072][ T895] RSP: 0000:ffffc9000db1f980 EFLAGS: 00010206 [ 42.759206][ T895] RAX: 000000007fffffff RBX: ffff8881f609d840 RCX: 0000000000e9d840 [ 42.767227][ T895] RDX: ffff8881f609d840 RSI: 0000000000000001 RDI: 000000009e25b93d [ 42.775273][ T895] RBP: ffffc9000db1f9e0 R08: 000000004ba51b70 R09: 000000002966dff3 [ 42.783301][ T895] R10: 000000000000000d R11: ffffffff8175a740 R12: 00000000b1be9d84 [ 42.791354][ T895] R13: 0000000000000000 R14: ffffc9000db1f9f0 R15: 000000000000000d [ 42.799375][ T895] FS: 00007fc91a6996c0(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 42.808519][ T895] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 42.815159][ T895] CR2: 000000110c355ec6 CR3: 000000010527a000 CR4: 00000000003526b0 [ 42.823222][ T895] DR0: 0000000000000000 DR1: 000000001c7800b2 DR2: 0000000000000000 [ 42.831255][ T895] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 42.839393][ T895] Call Trace: [ 42.842716][ T895] [ 42.845703][ T895] ? do_syscall_64+0x57/0xf0 [ 42.850382][ T895] ? entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 42.856513][ T895] kasan_save_track+0x4f/0x80 [ 42.861268][ T895] ? kasan_save_track+0x3e/0x80 [ 42.866165][ T895] ? kasan_save_free_info+0x44/0x50 [ 42.871436][ T895] ? __kasan_slab_free+0x5f/0x80 [ 42.876524][ T895] ? kfree+0x158/0x440 [ 42.880672][ T895] ? gadget_info_attr_release+0xcb/0x130 [ 42.886350][ T895] ? config_item_put+0x178/0x240 [ 42.891358][ T895] ? configfs_rmdir+0x8e8/0x9b0 [ 42.896261][ T895] ? vfs_rmdir+0x3de/0x560 [ 42.900841][ T895] ? do_rmdir+0x29a/0x590 [ 42.905308][ T895] ? __x64_sys_rmdir+0x4b/0x60 [ 42.910170][ T895] ? x64_sys_call+0xaf7/0x2ee0 [ 42.914987][ T895] ? do_syscall_64+0x57/0xf0 [ 42.919652][ T895] ? entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 42.925770][ T895] kasan_save_free_info+0x44/0x50 [ 42.930868][ T895] __kasan_slab_free+0x5f/0x80 [ 42.936040][ T895] kfree+0x158/0x440 [ 42.940007][ T895] ? gadget_info_attr_release+0xcb/0x130 [ 42.945703][ T895] ? __cfi_gadget_info_attr_release+0x10/0x10 [ 42.951847][ T895] gadget_info_attr_release+0xcb/0x130 [ 42.957362][ T895] config_item_put+0x178/0x240 [ 42.962224][ T895] ? __cfi_gadgets_drop+0x10/0x10 [ 42.967342][ T895] configfs_rmdir+0x8e8/0x9b0 [ 42.972126][ T895] vfs_rmdir+0x3de/0x560 [ 42.976426][ T895] do_rmdir+0x29a/0x590 [ 42.980673][ T895] ? __cfi_do_rmdir+0x10/0x10 [ 42.985415][ T895] ? __kasan_check_write+0x18/0x20 [ 42.990713][ T895] __x64_sys_rmdir+0x4b/0x60 [ 42.995371][ T895] x64_sys_call+0xaf7/0x2ee0 [ 43.000061][ T895] do_syscall_64+0x57/0xf0 [ 43.004828][ T895] ? clear_bhb_loop+0x50/0xa0 [ 43.009590][ T895] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 43.015542][ T895] RIP: 0033:0x7fc91979e159 [ 43.020038][ T895] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 43.039721][ T895] RSP: 002b:00007fc91a699028 EFLAGS: 00000246 ORIG_RAX: 0000000000000054 [ 43.048211][ T895] RAX: ffffffffffffffda RBX: 00007fc919a25fa0 RCX: 00007fc91979e159 [ 43.056227][ T895] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00002000000002c0 [ 43.064274][ T895] RBP: 00007fc91983503b R08: 0000000000000000 R09: 0000000000000000 [ 43.072303][ T895] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 43.080343][ T895] R13: 00007fc919a26038 R14: 00007fc919a25fa0 R15: 00007ffca47ee798 [ 43.088377][ T895] [ 43.091526][ T895] ---[ end trace 0000000000000000 ]--- [ 43.099657][ T895] BUG: scheduling while atomic: syz.4.237/895/0x00000000 [ 43.108320][ T399] usb 2-1: USB disconnect, device number 7 [ 43.114756][ T401] usb 3-1: USB disconnect, device number 7 [ 43.132242][ T895] Modules linked in: [ 43.136234][ T895] CPU: 1 UID: 0 PID: 895 Comm: syz.4.237 Tainted: G W syzkaller #0 238002c42480d657f84ffff3a67e0b81dcf43858 [ 43.136271][ T895] Tainted: [W]=WARN [ 43.136279][ T895] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 43.136290][ T895] Call Trace: [ 43.136297][ T895] [ 43.136305][ T895] __dump_stack+0x21/0x30 [ 43.136339][ T895] dump_stack_lvl+0x140/0x1c0 [ 43.136367][ T895] ? __cfi_dump_stack_lvl+0x10/0x10 [ 43.136395][ T895] dump_stack+0x19/0x20 [ 43.136420][ T895] __schedule_bug+0x12b/0x200 [ 43.136443][ T895] ? find_proxy_task+0x2460/0x2460 [ 43.136465][ T895] ? update_load_avg+0x4f3/0x1980 [ 43.136491][ T895] __schedule+0xb85/0x20b0 [ 43.136537][ T895] ? __kasan_check_read+0x15/0x20 [ 43.136560][ T895] ? plist_check_list+0x2a1/0x2c0 [ 43.136581][ T895] ? __sched_text_start+0x10/0x10 [ 43.136602][ T895] ? plist_add+0x4d4/0x570 [ 43.136622][ T895] ? __futex_queue+0x19f/0x350 [ 43.136650][ T895] ? __cfi___futex_queue+0x10/0x10 [ 43.136676][ T895] schedule+0xc5/0x240 [ 43.136696][ T895] futex_wait_queue+0xfc/0x240 [ 43.136716][ T895] __futex_wait+0x15b/0x3d0 [ 43.136736][ T895] ? __cfi___futex_wait+0x10/0x10 [ 43.136754][ T895] ? __cfi_futex_wake_mark+0x10/0x10 [ 43.136774][ T895] ? __kasan_check_read+0x15/0x20 [ 43.136794][ T895] ? futex_wake+0x627/0x950 [ 43.136814][ T895] futex_wait+0x128/0x7c0 [ 43.136832][ T895] ? __cfi_futex_wait+0x10/0x10 [ 43.136853][ T895] do_futex+0x32a/0x510 [ 43.136878][ T895] ? __cfi_do_futex+0x10/0x10 [ 43.136902][ T895] ? __kasan_slab_free+0x6a/0x80 [ 43.136928][ T895] ? kmem_cache_free+0x1bd/0x4f0 [ 43.136958][ T895] __se_sys_futex+0x13c/0x320 [ 43.136985][ T895] ? putname+0x113/0x150 [ 43.137007][ T895] ? __x64_sys_futex+0x110/0x110 [ 43.137034][ T895] __x64_sys_futex+0xe9/0x110 [ 43.137060][ T895] x64_sys_call+0x227f/0x2ee0 [ 43.137079][ T895] do_syscall_64+0x57/0xf0 [ 43.137097][ T895] ? clear_bhb_loop+0x50/0xa0 [ 43.137121][ T895] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 43.137145][ T895] RIP: 0033:0x7fc91979e159 [ 43.137163][ T895] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 43.137180][ T895] RSP: 002b:00007fc91a6990e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 43.137204][ T895] RAX: ffffffffffffffda RBX: 00007fc919a25fa8 RCX: 00007fc91979e159 [ 43.137220][ T895] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fc919a25fa8 [ 43.137235][ T895] RBP: 00007fc919a25fa0 R08: 0000000000000000 R09: 0000000000000000 [ 43.137248][ T895] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 43.137261][ T895] R13: 00007fc919a26038 R14: 00007ffca47ee6b0 R15: 00007ffca47ee798 [ 43.137279][ T895] [ 43.137297][ T401] ------------[ cut here ]------------ [ 43.417440][ T401] pvqspinlock: lock 0xffff8881f6f4fa40 has corrupted value 0x0! [ 43.425092][ T401] WARNING: CPU: 1 PID: 401 at kernel/locking/qspinlock_paravirt.h:506 __pv_queued_spin_unlock_slowpath+0x241/0x300 [ 43.437155][ T401] Modules linked in: [ 43.441042][ T401] CPU: 1 UID: 0 PID: 401 Comm: kworker/0:5 Tainted: G W syzkaller #0 238002c42480d657f84ffff3a67e0b81dcf43858 [ 43.454057][ T401] Tainted: [W]=WARN [ 43.457872][ T401] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 43.467945][ T401] Workqueue: usb_hub_wq hub_event [ 43.472980][ T401] RIP: 0010:__pv_queued_spin_unlock_slowpath+0x241/0x300 [ 43.480033][ T401] Code: e8 64 09 39 fc 48 89 d8 48 c1 e8 03 42 0f b6 04 30 84 c0 0f 85 b2 00 00 00 8b 13 48 c7 c7 c0 d4 e8 85 48 89 de e8 df fb 5c fb <0f> 0b eb 96 48 c7 c7 40 6a 52 87 4c 89 e6 48 89 ca 49 89 ce e8 e6 [ 43.499768][ T401] RSP: 0018:ffffc9000cabeab0 EFLAGS: 00010046 [ 43.505836][ T401] RAX: 50501afb506bba00 RBX: ffff8881f6f4fa40 RCX: ffff888132304c00 [ 43.513800][ T401] RDX: 0000000040000002 RSI: 0000000000000000 RDI: 0000000000000002 [ 43.521861][ T401] RBP: ffffc9000cabead8 R08: ffff8881f6f294d3 R09: 1ffff1103ede529a [ 43.529826][ T401] R10: dffffc0000000000 R11: ffffed103ede529b R12: ffff8881f6f4fa40 [ 43.538136][ T401] R13: 0000000000000000 R14: dffffc0000000000 R15: ffff888132304c00 [ 43.546102][ T401] FS: 0000000000000000(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 43.555027][ T401] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 43.561604][ T401] CR2: 000000110c355ec6 CR3: 000000010527a000 CR4: 00000000003526b0 [ 43.569568][ T401] DR0: 0000000000000000 DR1: 000000001c7800b2 DR2: 0000000000000000 [ 43.577534][ T401] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 43.585516][ T401] Call Trace: [ 43.588798][ T401] [ 43.591741][ T401] __raw_callee_save___pv_queued_spin_unlock_slowpath+0x19/0x40 [ 43.599368][ T401] .slowpath+0x9/0x13 [ 43.603339][ T401] _raw_spin_unlock+0x45/0x60 [ 43.608012][ T401] finish_task_switch+0x139/0x770 [ 43.613041][ T401] __schedule+0x149e/0x20b0 [ 43.617541][ T401] ? update_curr+0xf1/0x9c0 [ 43.622041][ T401] ? __sched_text_start+0x10/0x10 [ 43.627057][ T401] ? _raw_spin_lock_irq+0x93/0x120 [ 43.632154][ T401] ? __cfi__raw_spin_lock_irq+0x10/0x10 [ 43.637708][ T401] ? rwsem_spin_on_owner+0xa4/0x3b0 [ 43.642900][ T401] ? kick_pool+0xb9/0x540 [ 43.647305][ T401] ? _raw_spin_unlock_irq+0x45/0x70 [ 43.652523][ T401] ? wq_worker_sleeping+0x197/0x260 [ 43.657743][ T401] schedule+0xc5/0x240 [ 43.661823][ T401] schedule_preempt_disabled+0x14/0x30 [ 43.667290][ T401] rwsem_down_write_slowpath+0x5c9/0x1b60 [ 43.673074][ T401] ? activate_task+0x43b/0x480 [ 43.677857][ T401] ? rwsem_down_read_slowpath+0x14c0/0x14c0 [ 43.683750][ T401] ? try_to_wake_up+0x111a/0x1fd0 [ 43.688872][ T401] ? __kasan_check_write+0x18/0x20 [ 43.694014][ T401] ? wake_q_add_safe+0x29/0x100 [ 43.698869][ T401] ? __cfi_try_to_wake_up+0x10/0x10 [ 43.704064][ T401] ? rwsem_mark_wake+0x507/0x770 [ 43.708996][ T401] ? __kasan_check_write+0x18/0x20 [ 43.714096][ T401] ? rwsem_read_trylock+0x275/0x5a0 [ 43.719320][ T401] ? downgrade_write+0x470/0x470 [ 43.724251][ T401] down_write+0x163/0x2b0 [ 43.728581][ T401] ? __cfi_down_write+0x10/0x10 [ 43.733508][ T401] ? __kasan_check_write+0x18/0x20 [ 43.738624][ T401] kernfs_remove_by_name_ns+0x8c/0x180 [ 43.744074][ T401] sysfs_remove_group+0x108/0x250 [ 43.749094][ T401] dpm_sysfs_remove+0x99/0xd0 [ 43.753863][ T401] device_del+0x241/0xcf0 [ 43.758182][ T401] ? __cfi_device_del+0x10/0x10 [ 43.763019][ T401] ? __kasan_check_write+0x18/0x20 [ 43.768128][ T401] ? mutex_lock+0x97/0x1d0 [ 43.772536][ T401] cdev_device_del+0x2a/0x110 [ 43.777205][ T401] evdev_disconnect+0x50/0xd0 [ 43.781883][ T401] __input_unregister_device+0x3c3/0x620 [ 43.787534][ T401] ? hidinput_disconnect+0x279/0x2f0 [ 43.792822][ T401] input_unregister_device+0x9f/0x100 [ 43.798184][ T401] hidinput_disconnect+0x22d/0x2f0 [ 43.803296][ T401] hid_device_remove+0x13e/0x400 [ 43.808223][ T401] ? __cfi_hid_device_remove+0x10/0x10 [ 43.813795][ T401] device_release_driver_internal+0x4ad/0x830 [ 43.819874][ T401] device_release_driver+0x1d/0x30 [ 43.824982][ T401] bus_remove_device+0x34f/0x370 [ 43.829937][ T401] device_del+0x583/0xcf0 [ 43.834264][ T401] ? __cfi__raw_spin_lock_irq+0x10/0x10 [ 43.839824][ T401] ? __pm_runtime_resume+0xa0/0xa0 [ 43.845143][ T401] ? __cfi_device_del+0x10/0x10 [ 43.849999][ T401] ? __kasan_check_write+0x18/0x20 [ 43.855109][ T401] ? _raw_spin_lock_irq+0x93/0x120 [ 43.860217][ T401] ? __cfi__raw_spin_lock_irq+0x10/0x10 [ 43.865754][ T401] hid_destroy_device+0x6e/0x110 [ 43.870688][ T401] usbhid_disconnect+0xa3/0xc0 [ 43.875461][ T401] usb_unbind_interface+0x2b0/0xa40 [ 43.880656][ T401] ? __cfi_usb_unbind_interface+0x10/0x10 [ 43.886369][ T401] device_release_driver_internal+0x525/0x830 [ 43.892427][ T401] device_release_driver+0x1d/0x30 [ 43.897879][ T401] bus_remove_device+0x34f/0x370 [ 43.902829][ T401] device_del+0x583/0xcf0 [ 43.907167][ T401] ? kfree_const+0x3d/0x50 [ 43.911670][ T401] ? __cfi_device_release+0x10/0x10 [ 43.916948][ T401] ? __cfi_device_del+0x10/0x10 [ 43.921803][ T401] ? kobject_put+0x238/0x2a0 [ 43.926397][ T401] ? device_unregister+0x2b/0x40 [ 43.931431][ T401] usb_disable_device+0x3af/0x770 [ 43.936480][ T401] usb_disconnect+0x331/0x950 [ 43.941178][ T401] hub_event+0x1ad5/0x4360 [ 43.945609][ T401] ? __cfi_hub_event+0x10/0x10 [ 43.950385][ T401] ? kick_pool+0xad/0x540 [ 43.954708][ T401] process_scheduled_works+0x7f4/0x1060 [ 43.960255][ T401] worker_thread+0xc99/0x13f0 [ 43.964930][ T401] ? __cfi_set_cpus_allowed_ptr+0x10/0x10 [ 43.970640][ T401] ? __kasan_check_read+0x15/0x20 [ 43.975673][ T401] kthread+0x2c4/0x360 [ 43.979907][ T401] ? __cfi_worker_thread+0x10/0x10 [ 43.985008][ T401] ? __cfi_kthread+0x10/0x10 [ 43.989641][ T401] ret_from_fork+0x64/0xa0 [ 43.994070][ T401] ? __cfi_kthread+0x10/0x10 [ 43.998662][ T401] ret_from_fork_asm+0x1a/0x30 [ 44.003520][ T401] [ 44.006530][ T401] ---[ end trace 0000000000000000 ]---