Warning: Permanently added '10.128.0.221' (ED25519) to the list of known hosts. 2026/03/26 23:06:53 parsed 1 programs [ 88.186634][ T30] audit: type=1400 audit(1774566413.973:62): avc: denied { node_bind } for pid=5808 comm="syz-execprog" saddr=::1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 90.368885][ T30] audit: type=1400 audit(1774566416.153:63): avc: denied { mounton } for pid=5815 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 90.392432][ T30] audit: type=1400 audit(1774566416.173:64): avc: denied { mount } for pid=5815 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 90.396334][ T5815] cgroup: Unknown subsys name 'net' [ 90.421992][ T30] audit: type=1400 audit(1774566416.203:65): avc: denied { unmount } for pid=5815 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 90.576970][ T5815] cgroup: Unknown subsys name 'cpuset' [ 90.585235][ T5815] cgroup: Unknown subsys name 'rlimit' [ 90.741053][ T30] audit: type=1400 audit(1774566416.523:66): avc: denied { setattr } for pid=5815 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=815 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 90.794057][ T30] audit: type=1400 audit(1774566416.523:67): avc: denied { create } for pid=5815 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 90.815239][ T30] audit: type=1400 audit(1774566416.523:68): avc: denied { write } for pid=5815 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 90.840458][ T30] audit: type=1400 audit(1774566416.523:69): avc: denied { read } for pid=5815 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 90.865870][ T30] audit: type=1400 audit(1774566416.523:70): avc: denied { mounton } for pid=5815 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 90.877556][ T5819] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 90.899437][ T30] audit: type=1400 audit(1774566416.523:71): avc: denied { mount } for pid=5815 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 91.854258][ T5815] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 93.723625][ T30] kauditd_printk_skb: 4 callbacks suppressed [ 93.723642][ T30] audit: type=1400 audit(1774566419.503:76): avc: denied { execmem } for pid=5823 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 93.764170][ T30] audit: type=1400 audit(1774566419.543:77): avc: denied { read } for pid=5824 comm="syz-executor" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 93.788367][ T30] audit: type=1400 audit(1774566419.543:78): avc: denied { open } for pid=5824 comm="syz-executor" path="net:[4026531833]" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 93.812197][ T30] audit: type=1400 audit(1774566419.543:79): avc: denied { mounton } for pid=5824 comm="syz-executor" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 93.857323][ T30] audit: type=1400 audit(1774566419.643:80): avc: denied { mounton } for pid=5824 comm="syz-executor" path="/root/syzkaller.bKCK1l/syz-tmp" dev="sda1" ino=2030 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 93.881576][ T30] audit: type=1400 audit(1774566419.643:81): avc: denied { mount } for pid=5824 comm="syz-executor" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 93.903695][ T30] audit: type=1400 audit(1774566419.643:82): avc: denied { mounton } for pid=5824 comm="syz-executor" path="/root/syzkaller.bKCK1l/syz-tmp/newroot/dev" dev="tmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 93.929146][ T30] audit: type=1400 audit(1774566419.643:83): avc: denied { mount } for pid=5824 comm="syz-executor" name="/" dev="proc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 93.952419][ T30] audit: type=1400 audit(1774566419.643:84): avc: denied { mounton } for pid=5824 comm="syz-executor" path="/root/syzkaller.bKCK1l/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 93.958097][ T5824] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 93.994815][ T30] audit: type=1400 audit(1774566419.653:85): avc: denied { mounton } for pid=5824 comm="syz-executor" path="/root/syzkaller.bKCK1l/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=4082 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1 [ 94.400003][ T51] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 94.409353][ T51] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 94.419410][ T51] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 94.445871][ T51] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 94.454045][ T51] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 94.701005][ T130] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 94.709554][ T130] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 94.736693][ T130] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 94.744658][ T130] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 95.541850][ T5868] chnl_net:caif_netlink_parms(): no params data found [ 95.603169][ T5868] bridge0: port 1(bridge_slave_0) entered blocking state [ 95.610912][ T5868] bridge0: port 1(bridge_slave_0) entered disabled state [ 95.618305][ T5868] bridge_slave_0: entered allmulticast mode [ 95.625543][ T5868] bridge_slave_0: entered promiscuous mode [ 95.633868][ T5868] bridge0: port 2(bridge_slave_1) entered blocking state [ 95.641093][ T5868] bridge0: port 2(bridge_slave_1) entered disabled state [ 95.649512][ T5868] bridge_slave_1: entered allmulticast mode [ 95.656592][ T5868] bridge_slave_1: entered promiscuous mode [ 95.683890][ T5868] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 95.697013][ T5868] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 95.728232][ T5868] team0: Port device team_slave_0 added [ 95.735809][ T5868] team0: Port device team_slave_1 added [ 95.789338][ T5868] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 95.796517][ T5868] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 95.822522][ T5868] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 95.845290][ T5868] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 95.852481][ T5868] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 95.878498][ T5868] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 95.927551][ T5868] hsr_slave_0: entered promiscuous mode [ 95.933693][ T5868] hsr_slave_1: entered promiscuous mode [ 96.053447][ T5868] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 96.065334][ T5868] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 96.075225][ T5868] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 96.086016][ T5868] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 96.150422][ T5868] 8021q: adding VLAN 0 to HW filter on device bond0 [ 96.170737][ T5868] 8021q: adding VLAN 0 to HW filter on device team0 [ 96.183631][ T2980] bridge0: port 1(bridge_slave_0) entered blocking state [ 96.190991][ T2980] bridge0: port 1(bridge_slave_0) entered forwarding state [ 96.206410][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 96.213492][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 96.344875][ T5868] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 96.380333][ T5868] veth0_vlan: entered promiscuous mode [ 96.390933][ T5868] veth1_vlan: entered promiscuous mode [ 96.415307][ T5868] veth0_macvtap: entered promiscuous mode [ 96.423720][ T5868] veth1_macvtap: entered promiscuous mode [ 96.440861][ T5868] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 96.455890][ T5868] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 96.470040][ T13] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 96.480800][ T13] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 96.490371][ T13] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 96.506527][ T13] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 96.633258][ T36] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 96.721055][ T36] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 96.802171][ T36] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 96.896989][ T36] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 2026/03/26 23:07:03 executed programs: 0 [ 98.228109][ T51] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 98.237795][ T51] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 98.246206][ T51] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 98.254405][ T51] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 98.262022][ T51] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 98.380101][ T5918] chnl_net:caif_netlink_parms(): no params data found [ 98.436548][ T5918] bridge0: port 1(bridge_slave_0) entered blocking state [ 98.444179][ T5918] bridge0: port 1(bridge_slave_0) entered disabled state [ 98.451295][ T5918] bridge_slave_0: entered allmulticast mode [ 98.458993][ T5918] bridge_slave_0: entered promiscuous mode [ 98.466702][ T5918] bridge0: port 2(bridge_slave_1) entered blocking state [ 98.473756][ T5918] bridge0: port 2(bridge_slave_1) entered disabled state [ 98.481255][ T5918] bridge_slave_1: entered allmulticast mode [ 98.488457][ T5918] bridge_slave_1: entered promiscuous mode [ 98.510759][ T5918] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 98.521896][ T5918] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 98.546095][ T5918] team0: Port device team_slave_0 added [ 98.553771][ T5918] team0: Port device team_slave_1 added [ 98.574192][ T5918] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 98.581145][ T5918] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 98.607663][ T5918] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 98.619728][ T5918] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 98.626754][ T5918] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 98.653309][ T5918] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 98.690011][ T5918] hsr_slave_0: entered promiscuous mode [ 98.698387][ T5918] hsr_slave_1: entered promiscuous mode [ 98.704725][ T5918] debugfs: 'hsr0' already exists in 'hsr' [ 98.710561][ T5918] Cannot create hsr debugfs directory [ 100.016575][ T36] bridge_slave_1: left allmulticast mode [ 100.022341][ T36] bridge_slave_1: left promiscuous mode [ 100.029525][ T36] bridge0: port 2(bridge_slave_1) entered disabled state [ 100.041015][ T36] bridge_slave_0: left allmulticast mode [ 100.051269][ T36] bridge_slave_0: left promiscuous mode [ 100.062438][ T36] bridge0: port 1(bridge_slave_0) entered disabled state [ 100.257453][ T36] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 100.268918][ T36] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 100.279616][ T36] bond0 (unregistering): Released all slaves [ 100.296089][ T5128] Bluetooth: hci0: command tx timeout [ 100.384226][ T36] hsr_slave_0: left promiscuous mode [ 100.390192][ T36] hsr_slave_1: left promiscuous mode [ 100.396653][ T36] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 100.406421][ T36] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 100.418601][ T36] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 100.426135][ T36] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 100.440632][ T36] veth1_macvtap: left promiscuous mode [ 100.448266][ T36] veth0_macvtap: left promiscuous mode [ 100.453837][ T36] veth1_vlan: left promiscuous mode [ 100.459382][ T36] veth0_vlan: left promiscuous mode [ 100.710468][ T36] team0 (unregistering): Port device team_slave_1 removed [ 100.727371][ T36] team0 (unregistering): Port device team_slave_0 removed [ 101.138862][ T5918] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 101.153815][ T5918] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 101.169847][ T5918] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 101.182932][ T5918] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 101.297362][ T5918] 8021q: adding VLAN 0 to HW filter on device bond0 [ 101.314352][ T5918] 8021q: adding VLAN 0 to HW filter on device team0 [ 101.327257][ T59] bridge0: port 1(bridge_slave_0) entered blocking state [ 101.334358][ T59] bridge0: port 1(bridge_slave_0) entered forwarding state [ 101.354000][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 101.361199][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 101.918753][ T5918] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 101.952523][ T5918] veth0_vlan: entered promiscuous mode [ 101.962343][ T5918] veth1_vlan: entered promiscuous mode [ 101.988733][ T5918] veth0_macvtap: entered promiscuous mode [ 101.997307][ T5918] veth1_macvtap: entered promiscuous mode [ 102.011208][ T5918] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 102.023712][ T5918] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 102.040023][ T59] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 102.049883][ T59] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 102.060587][ T59] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 102.070685][ T59] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 102.119394][ T59] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 102.127710][ T59] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 102.153357][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 102.161421][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 102.209786][ T30] kauditd_printk_skb: 19 callbacks suppressed [ 102.209802][ T30] audit: type=1400 audit(1774566427.993:105): avc: denied { read write } for pid=5991 comm="syz.0.17" name="raw-gadget" dev="devtmpfs" ino=815 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 102.243654][ T30] audit: type=1400 audit(1774566427.993:106): avc: denied { open } for pid=5991 comm="syz.0.17" path="/dev/raw-gadget" dev="devtmpfs" ino=815 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 102.268381][ T30] audit: type=1400 audit(1774566427.993:107): avc: denied { ioctl } for pid=5991 comm="syz.0.17" path="/dev/raw-gadget" dev="devtmpfs" ino=815 ioctlcmd=0x5500 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 102.374184][ T5128] Bluetooth: hci0: command tx timeout [ 102.464488][ T29] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 102.644093][ T29] usb 1-1: Using ep0 maxpacket: 16 [ 102.651940][ T29] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 102.663555][ T29] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 56, changing to 7 [ 102.674517][ T29] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x83 has invalid maxpacket 57832, setting to 1024 [ 102.689449][ T29] usb 1-1: New USB device found, idVendor=2040, idProduct=0265, bcdDevice=4e.d1 [ 102.698734][ T29] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 102.706771][ T29] usb 1-1: Product: syz [ 102.710924][ T29] usb 1-1: Manufacturer: syz [ 102.715569][ T29] usb 1-1: SerialNumber: syz [ 102.723092][ T29] usb 1-1: config 0 descriptor?? [ 102.732583][ T29] em28xx 1-1:0.0: New device syz syz @ 480 Mbps (2040:0265, interface 0, class 0) [ 102.741987][ T29] em28xx 1-1:0.0: Audio interface 0 found (Vendor Class) [ 102.994462][ T29] em28xx 1-1:0.0: unknown em28xx chip ID (0) [ 103.001210][ T29] em28xx 1-1:0.0: Config register raw data: 0xfffffffb [ 103.008436][ T29] em28xx 1-1:0.0: AC97 chip type couldn't be determined [ 103.015710][ T29] em28xx 1-1:0.0: No AC97 audio processor [ 103.021477][ T29] em28xx 1-1:0.0: We currently don't support analog TV or stream capture on dual tuners. [ 103.094465][ T29] em28xx 1-1:0.0: unknown em28xx chip ID (0) [ 103.100835][ T29] em28xx 1-1:0.0: Config register raw data: 0xfffffffb [ 103.108722][ T29] em28xx 1-1:0.0: AC97 chip type couldn't be determined [ 103.115704][ T29] em28xx 1-1:0.0: No AC97 audio processor [ 103.335720][ T29] usb 1-1: USB disconnect, device number 2 [ 103.342722][ T29] em28xx 1-1:0.0: Disconnecting em28xx #1 [ 103.354717][ T29] em28xx 1-1:0.0: Disconnecting em28xx [ 103.365830][ T29] em28xx 1-1:0.0: Freeing device [ 103.370815][ T29] em28xx 1-1:0.0: Freeing device 2026/03/26 23:07:09 executed programs: 3 [ 103.784721][ T29] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 103.944061][ T29] usb 1-1: Using ep0 maxpacket: 16 [ 103.950634][ T29] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 103.962221][ T29] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 56, changing to 7 [ 103.973310][ T29] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x83 has invalid maxpacket 57832, setting to 1024 [ 103.986820][ T29] usb 1-1: New USB device found, idVendor=2040, idProduct=0265, bcdDevice=4e.d1 [ 103.996598][ T29] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 104.004627][ T29] usb 1-1: Product: syz [ 104.008775][ T29] usb 1-1: Manufacturer: syz [ 104.013347][ T29] usb 1-1: SerialNumber: syz [ 104.020257][ T29] usb 1-1: config 0 descriptor?? [ 104.027680][ T29] em28xx 1-1:0.0: New device syz syz @ 480 Mbps (2040:0265, interface 0, class 0) [ 104.036933][ T29] em28xx 1-1:0.0: Audio interface 0 found (Vendor Class) [ 104.284878][ T29] em28xx 1-1:0.0: unknown em28xx chip ID (0) [ 104.291285][ T29] em28xx 1-1:0.0: Config register raw data: 0xfffffffb [ 104.298587][ T29] em28xx 1-1:0.0: AC97 chip type couldn't be determined [ 104.305569][ T29] em28xx 1-1:0.0: No AC97 audio processor [ 104.311301][ T29] non-slab/vmalloc memory [ 104.315991][ T29] list_add corruption. prev->next should be next (ffffffff90064f00), but was ffffffff81cf7da6. (prev=ffff88802ad60250). [ 104.329459][ T29] ------------[ cut here ]------------ [ 104.335169][ T29] kernel BUG at lib/list_debug.c:32! [ 104.340750][ T29] Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI [ 104.347158][ T29] CPU: 1 UID: 0 PID: 29 Comm: kworker/1:1 Not tainted syzkaller #0 PREEMPT(full) [ 104.356332][ T29] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 104.366412][ T29] Workqueue: usb_hub_wq hub_event [ 104.371426][ T29] RIP: 0010:__list_add_valid_or_report+0xfb/0x130 [ 104.377824][ T29] Code: b8 00 00 00 00 00 fc ff df 48 c1 ea 03 80 3c 02 00 75 3d 49 8b 55 00 4c 89 e9 48 89 de 48 c7 c7 e0 14 1b 8c e8 56 5b 23 fc 90 <0f> 0b 4c 89 e7 e8 3b 94 76 fd e9 3a ff ff ff 4c 89 ef e8 2e 94 76 [ 104.397426][ T29] RSP: 0018:ffffc90000a56e20 EFLAGS: 00010282 [ 104.403477][ T29] RAX: 0000000000000075 RBX: ffffffff90064f00 RCX: 0000000000000000 [ 104.411431][ T29] RDX: 0000000000000075 RSI: ffffffff81e7cae9 RDI: fffff5200014adb5 [ 104.419486][ T29] RBP: ffff888039be0250 R08: 0000000000000005 R09: 0000000000000000 [ 104.427450][ T29] R10: 0000000080000000 R11: 0000000000000001 R12: ffffffff90064f08 [ 104.435399][ T29] R13: ffff88802ad60250 R14: ffff888048d6d800 R15: ffff8880297d39c0 [ 104.443345][ T29] FS: 0000000000000000(0000) GS:ffff88812443f000(0000) knlGS:0000000000000000 [ 104.452273][ T29] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 104.458842][ T29] CR2: 0000001b2e963fff CR3: 00000000330c4000 CR4: 00000000003526f0 [ 104.466798][ T29] Call Trace: [ 104.470070][ T29] [ 104.472982][ T29] em28xx_init_extension+0x48/0x200 [ 104.478174][ T29] ? em28xx_audio_setup+0x2e2/0x360 [ 104.483366][ T29] em28xx_init_dev.isra.0+0xac3/0x17c4 [ 104.488815][ T29] ? _dev_info+0xef/0x127 [ 104.493129][ T29] ? __pfx_em28xx_init_dev.isra.0+0x10/0x10 [ 104.499015][ T29] ? trace_kmalloc+0x101/0x130 [ 104.503761][ T29] ? __kasan_kmalloc+0xaa/0xb0 [ 104.508517][ T29] ? lockdep_init_map_type+0x5c/0x250 [ 104.513876][ T29] ? lockdep_init_map_type+0x5c/0x250 [ 104.519238][ T29] em28xx_usb_probe.cold+0xc3b/0x24ab [ 104.524612][ T29] usb_probe_interface+0x303/0x8f0 [ 104.529718][ T29] ? __pfx_usb_probe_interface+0x10/0x10 [ 104.535340][ T29] really_probe+0x241/0xa60 [ 104.539836][ T29] __driver_probe_device+0x1de/0x400 [ 104.545111][ T29] driver_probe_device+0x4c/0x1b0 [ 104.550128][ T29] __device_attach_driver+0x1df/0x340 [ 104.555496][ T29] ? __pfx___device_attach_driver+0x10/0x10 [ 104.561377][ T29] bus_for_each_drv+0x159/0x1e0 [ 104.566218][ T29] ? __pfx_bus_for_each_drv+0x10/0x10 [ 104.571576][ T29] ? lockdep_hardirqs_on+0x78/0x100 [ 104.577032][ T29] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 104.582842][ T29] __device_attach+0x1e4/0x4d0 [ 104.587619][ T29] ? __pfx___device_attach+0x10/0x10 [ 104.592898][ T29] ? do_raw_spin_unlock+0x145/0x1e0 [ 104.598090][ T29] device_initial_probe+0xaf/0xd0 [ 104.603112][ T29] bus_probe_device+0x64/0x160 [ 104.607886][ T29] device_add+0x11d9/0x1950 [ 104.612373][ T29] ? __pfx_device_add+0x10/0x10 [ 104.617212][ T29] usb_set_configuration+0xd97/0x1c60 [ 104.622578][ T29] ? __pfx_usb_generic_driver_probe+0x10/0x10 [ 104.628630][ T29] usb_generic_driver_probe+0xa1/0xe0 [ 104.633992][ T29] usb_probe_device+0xef/0x400 [ 104.638747][ T29] ? __pfx_usb_probe_device+0x10/0x10 [ 104.644105][ T29] really_probe+0x241/0xa60 [ 104.648610][ T29] __driver_probe_device+0x1de/0x400 [ 104.653885][ T29] ? usb_driver_applicable+0x1c7/0x220 [ 104.659338][ T29] driver_probe_device+0x4c/0x1b0 [ 104.664352][ T29] __device_attach_driver+0x1df/0x340 [ 104.669715][ T29] ? __pfx___device_attach_driver+0x10/0x10 [ 104.675598][ T29] bus_for_each_drv+0x159/0x1e0 [ 104.680434][ T29] ? __pfx_bus_for_each_drv+0x10/0x10 [ 104.685790][ T29] ? lockdep_hardirqs_on+0x78/0x100 [ 104.690975][ T29] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 104.696769][ T29] __device_attach+0x1e4/0x4d0 [ 104.701524][ T29] ? __pfx___device_attach+0x10/0x10 [ 104.706798][ T29] ? do_raw_spin_unlock+0x145/0x1e0 [ 104.711983][ T29] device_initial_probe+0xaf/0xd0 [ 104.716998][ T29] bus_probe_device+0x64/0x160 [ 104.721749][ T29] device_add+0x11d9/0x1950 [ 104.726236][ T29] ? __pfx_device_add+0x10/0x10 [ 104.731068][ T29] ? add_device_randomness+0xb7/0xf0 [ 104.736349][ T29] usb_new_device.cold+0x685/0x115c [ 104.741566][ T29] ? do_raw_spin_lock+0x128/0x260 [ 104.746574][ T29] ? __pfx_usb_new_device+0x10/0x10 [ 104.751760][ T29] ? mark_held_locks+0x40/0x70 [ 104.756504][ T29] hub_event+0x314d/0x4af0 [ 104.760916][ T29] ? __pfx_hub_event+0x10/0x10 [ 104.765673][ T29] ? debug_object_deactivate+0x2e4/0x3b0 [ 104.771298][ T29] ? rcu_is_watching+0x12/0xc0 [ 104.776048][ T29] process_one_work+0xa23/0x19a0 [ 104.780972][ T29] ? __pfx_process_one_work+0x10/0x10 [ 104.786328][ T29] ? __pfx_hub_event+0x10/0x10 [ 104.791111][ T29] worker_thread+0x5ef/0xe50 [ 104.795701][ T29] ? kthread+0x13a/0x450 [ 104.799923][ T29] ? __pfx_worker_thread+0x10/0x10 [ 104.805016][ T29] kthread+0x370/0x450 [ 104.809068][ T29] ? __pfx_kthread+0x10/0x10 [ 104.813644][ T29] ret_from_fork+0x754/0xd80 [ 104.818218][ T29] ? __pfx_ret_from_fork+0x10/0x10 [ 104.823314][ T29] ? __switch_to+0x7b4/0x1120 [ 104.827989][ T29] ? __pfx_kthread+0x10/0x10 [ 104.832572][ T29] ret_from_fork_asm+0x1a/0x30 [ 104.837329][ T29] [ 104.840335][ T29] Modules linked in: [ 104.844281][ T5128] Bluetooth: hci0: command tx timeout [ 104.844510][ T29] ---[ end trace 0000000000000000 ]--- [ 104.864882][ T29] RIP: 0010:__list_add_valid_or_report+0xfb/0x130 [ 104.871437][ T29] Code: b8 00 00 00 00 00 fc ff df 48 c1 ea 03 80 3c 02 00 75 3d 49 8b 55 00 4c 89 e9 48 89 de 48 c7 c7 e0 14 1b 8c e8 56 5b 23 fc 90 <0f> 0b 4c 89 e7 e8 3b 94 76 fd e9 3a ff ff ff 4c 89 ef e8 2e 94 76 [ 104.893321][ T29] RSP: 0018:ffffc90000a56e20 EFLAGS: 00010282 [ 104.899895][ T29] RAX: 0000000000000075 RBX: ffffffff90064f00 RCX: 0000000000000000 [ 104.908692][ T29] RDX: 0000000000000075 RSI: ffffffff81e7cae9 RDI: fffff5200014adb5 [ 104.916706][ T29] RBP: ffff888039be0250 R08: 0000000000000005 R09: 0000000000000000 [ 104.924730][ T29] R10: 0000000080000000 R11: 0000000000000001 R12: ffffffff90064f08 [ 104.933149][ T29] R13: ffff88802ad60250 R14: ffff888048d6d800 R15: ffff8880297d39c0 [ 104.942276][ T29] FS: 0000000000000000(0000) GS:ffff88812443f000(0000) knlGS:0000000000000000 [ 104.951253][ T29] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 104.959107][ T29] CR2: 000055a90ce0b660 CR3: 000000000e598000 CR4: 00000000003526f0 [ 104.967315][ T29] Kernel panic - not syncing: Fatal exception [ 104.973608][ T29] Kernel Offset: disabled [ 104.978081][ T29] Rebooting in 86400 seconds..