last executing test programs: 12.575144992s ago: executing program 0 (id=1): r0 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r0, 0x0, 0x23, &(0x7f0000000740)={@multicast2, @loopback}, 0xc) setsockopt$inet_mreqsrc(r0, 0x0, 0x24, &(0x7f0000000440)={@empty, @loopback, @dev={0xac, 0x14, 0x14, 0x2c}}, 0xc) 11.932263561s ago: executing program 0 (id=5): listen(0xffffffffffffffff, 0x0) r0 = socket(0x28, 0x5, 0x0) connect$vsock_stream(r0, &(0x7f0000000080), 0x10) sendmmsg(r0, &(0x7f0000000100)=[{{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000000)="1b", 0x38a9b}], 0x1}}], 0x1, 0x24008094) 11.802292745s ago: executing program 0 (id=6): r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) r1 = dup2(r0, r0) ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000000)=0x6) 11.66276317s ago: executing program 0 (id=7): r0 = openat$audio(0xffffffffffffff9c, &(0x7f00000001c0), 0x22281, 0x0) ioctl$SNDCTL_DSP_GETOSPACE(r0, 0x8010500c, &(0x7f0000000200)) 11.541447193s ago: executing program 0 (id=8): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_GET_ADDR(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000140)=ANY=[@ANYBLOB="1c010000", @ANYRES16=r1, @ANYBLOB="01002bbd7000fddbdf250300000014000180080006"], 0x11c}, 0x1, 0x0, 0x0, 0x20000000}, 0x40040) 11.378615811s ago: executing program 0 (id=9): r0 = syz_usb_connect(0x0, 0x3f, &(0x7f00000000c0)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0) syz_usb_control_io$uac1(r0, 0x0, &(0x7f00000009c0)={0x24, &(0x7f0000000700)=ANY=[@ANYBLOB="40000f000000012721dcfe14c639a500ba17162716"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000001180)={0x2c, &(0x7f0000000f00)={0x20, 0x13, 0x1, "9f"}, 0x0, 0x0, 0x0, 0x0}) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$EVIOCGMASK(r1, 0x5b14, 0x0) 2.560635383s ago: executing program 1 (id=31): r0 = socket$inet6(0xa, 0x3, 0x8000000003c) connect$inet6(r0, &(0x7f0000000180)={0xa, 0x3, 0xc, @dev={0xfe, 0x80, '\x00', 0xd}, 0x9}, 0x1c) sendmsg(r0, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2c}, 0x44004) 2.420939848s ago: executing program 1 (id=32): r0 = add_key$fscrypt_v1(&(0x7f0000000440), &(0x7f0000000480)={'fscrypt:', @auto=[0x0, 0x0, 0x0, 0x34]}, &(0x7f00000000c0)={0x0, "3e82554dc8ccfbc2e85ec82d4ee9df60f6ae16b1a5f2c848722ba3b132e4fde178c945bd950b0477e801fc8a1be9b4ebbe9c2289a6b0aa00"}, 0x48, 0xfffffffffffffffe) pipe2$watch_queue(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) keyctl$KEYCTL_WATCH_KEY(0x20, r0, r1, 0x0) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000340)={0x1, &(0x7f0000000000)=[{0x6, 0xf, 0x0, 0x7fff8000}]}) close_range(r2, 0xffffffffffffffff, 0x0) 2.255773546s ago: executing program 1 (id=33): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0) setxattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='Vr'], 0x0, 0x0, 0x0) 1.48118074s ago: executing program 1 (id=34): capset(0x0, &(0x7f00000000c0)={0x200000, 0x200000, 0x7}) r0 = socket(0x2, 0x2, 0x1) ioctl$sock_SIOCSIFVLAN_DEL_VLAN_CMD(r0, 0x8983, &(0x7f0000000040)={0x1, 'vlan1\x00', {}, 0xffff}) 357.907301ms ago: executing program 1 (id=35): socket$xdp(0x2c, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000000)={'syz_tun\x00', &(0x7f0000000380)=@ethtool_link_settings={0x4c, 0x0, 0xf7, 0x3, 0xc0, 0x7, 0xc2, 0x4, 0x66, 0x4, [0x20044, 0x81, 0x10, 0x40, 0x6, 0x8, 0x2001, 0x2174]}}) 0s ago: executing program 1 (id=36): r0 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x0, 0x0) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, &(0x7f00000000c0)={'8255\x00', [0x100, 0x10000, 0x4, 0xc, 0xe, 0x7, 0x75, 0x3, 0x80008, 0x0, 0x2, 0x1, 0x7, 0x1, 0x1, 0xfd, 0xfffffffb, 0x9, 0x3, 0x7fffffff, 0x4089, 0xca9f, 0xffff, 0x20001e58, 0x8, 0xf39e, 0x9, 0x8, 0x10a6b4, 0x0, 0xfffffff8]}) kernel console output (not intermixed with test programs): [ 44.965919][ T28] audit: type=1400 audit(44.890:91): avc: denied { read write } for pid=3096 comm="scp" name="null" dev="devtmpfs" ino=4 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 44.968095][ T28] audit: type=1400 audit(44.890:92): avc: denied { open } for pid=3096 comm="scp" path="/dev/null" dev="devtmpfs" ino=4 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 Warning: Permanently added '[localhost]:12890' (ED25519) to the list of known hosts. [ 62.467610][ T28] audit: type=1400 audit(62.390:93): avc: denied { name_bind } for pid=3099 comm="sshd-session" src=30000 scontext=system_u:system_r:sshd_t tcontext=system_u:object_r:unreserved_port_t tclass=tcp_socket permissive=1 [ 63.841336][ T28] audit: type=1400 audit(63.760:94): avc: denied { execute } for pid=3100 comm="sh" name="syz-executor" dev="vda" ino=805 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:etc_runtime_t tclass=file permissive=1 [ 63.848054][ T28] audit: type=1400 audit(63.770:95): avc: denied { execute_no_trans } for pid=3100 comm="sh" path="/syz-executor" dev="vda" ino=805 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:etc_runtime_t tclass=file permissive=1 [ 66.340120][ T28] audit: type=1400 audit(66.260:96): avc: denied { mounton } for pid=3100 comm="syz-executor" path="/syzcgroup/unified" dev="vda" ino=806 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 66.346417][ T28] audit: type=1400 audit(66.270:97): avc: denied { mount } for pid=3100 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 66.357096][ T3100] cgroup: Unknown subsys name 'net' [ 66.363029][ T28] audit: type=1400 audit(66.280:98): avc: denied { unmount } for pid=3100 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 66.513049][ T3100] cgroup: Unknown subsys name 'cpuset' [ 66.520630][ T3100] cgroup: Unknown subsys name 'hugetlb' [ 66.523706][ T3100] cgroup: Unknown subsys name 'rlimit' [ 66.751659][ T28] audit: type=1400 audit(66.670:99): avc: denied { setattr } for pid=3100 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=693 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 66.756795][ T28] audit: type=1400 audit(66.680:100): avc: denied { mounton } for pid=3100 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 66.757390][ T28] audit: type=1400 audit(66.680:101): avc: denied { mount } for pid=3100 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 66.970064][ T3102] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 66.973100][ T28] audit: type=1400 audit(66.890:102): avc: denied { relabelto } for pid=3102 comm="mkswap" name="swap-file" dev="vda" ino=809 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" Setting up swapspace version 1, size = 127995904 bytes [ 74.192894][ T3100] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 76.358053][ T28] kauditd_printk_skb: 3 callbacks suppressed [ 76.360837][ T28] audit: type=1400 audit(76.280:106): avc: denied { execmem } for pid=3103 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 76.423449][ T28] audit: type=1400 audit(76.340:107): avc: denied { read } for pid=3105 comm="syz-executor" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 76.430702][ T28] audit: type=1400 audit(76.350:108): avc: denied { open } for pid=3105 comm="syz-executor" path="net:[4026531833]" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 76.431182][ T28] audit: type=1400 audit(76.350:109): avc: denied { mounton } for pid=3105 comm="syz-executor" path="/" dev="vda" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 76.459746][ T28] audit: type=1400 audit(76.380:110): avc: denied { module_request } for pid=3105 comm="syz-executor" kmod="netdev-nr0" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 76.460147][ T28] audit: type=1400 audit(76.380:111): avc: denied { module_request } for pid=3106 comm="syz-executor" kmod="netdev-nr1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 76.523026][ T28] audit: type=1400 audit(76.440:112): avc: denied { sys_module } for pid=3106 comm="syz-executor" capability=16 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 77.161615][ T28] audit: type=1400 audit(77.080:113): avc: denied { ioctl } for pid=3106 comm="syz-executor" path="/dev/net/tun" dev="devtmpfs" ino=677 ioctlcmd=0x54ca scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 78.196929][ T3105] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 78.209601][ T3105] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 78.335792][ T3106] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 78.347109][ T3106] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 79.140887][ T3105] hsr_slave_0: entered promiscuous mode [ 79.148049][ T3105] hsr_slave_1: entered promiscuous mode [ 79.271250][ T3106] hsr_slave_0: entered promiscuous mode [ 79.277186][ T3106] hsr_slave_1: entered promiscuous mode [ 79.280983][ T3106] debugfs: 'hsr0' already exists in 'hsr' [ 79.281737][ T3106] Cannot create hsr debugfs directory [ 79.691000][ T28] audit: type=1400 audit(79.610:114): avc: denied { create } for pid=3105 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 79.695200][ T28] audit: type=1400 audit(79.620:115): avc: denied { write } for pid=3105 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 79.727952][ T3105] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 79.738189][ T3105] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 79.752289][ T3105] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 79.760555][ T3105] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 79.775700][ T3105] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 79.781117][ T3105] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 79.787086][ T3105] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 79.795709][ T3105] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 79.797223][ T3106] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 79.803445][ T3106] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 79.851029][ T3106] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 79.861927][ T3106] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 79.874619][ T3106] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 79.880730][ T3106] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 79.888826][ T3106] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 79.898957][ T3106] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 80.638146][ T3105] 8021q: adding VLAN 0 to HW filter on device bond0 [ 80.669488][ T3106] 8021q: adding VLAN 0 to HW filter on device bond0 [ 83.300502][ T3106] veth0_vlan: entered promiscuous mode [ 83.331786][ T3106] veth1_vlan: entered promiscuous mode [ 83.373222][ T3105] veth0_vlan: entered promiscuous mode [ 83.420859][ T3105] veth1_vlan: entered promiscuous mode [ 83.426128][ T3106] veth0_macvtap: entered promiscuous mode [ 83.439588][ T3106] veth1_macvtap: entered promiscuous mode [ 83.537444][ T50] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.538193][ T50] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.550727][ T50] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.551103][ T50] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.590459][ T3105] veth0_macvtap: entered promiscuous mode [ 83.625426][ T3105] veth1_macvtap: entered promiscuous mode [ 83.729023][ T1053] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.729581][ T1053] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.729687][ T1053] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.729773][ T1053] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.775199][ T28] kauditd_printk_skb: 1 callbacks suppressed [ 83.775585][ T28] audit: type=1400 audit(83.690:117): avc: denied { mount } for pid=3106 comm="syz-executor" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 83.783394][ T28] audit: type=1400 audit(83.700:118): avc: denied { mounton } for pid=3106 comm="syz-executor" path="/syzkaller.gEJyTz/syz-tmp/newroot/dev" dev="tmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 83.816840][ T28] audit: type=1400 audit(83.740:119): avc: denied { mount } for pid=3106 comm="syz-executor" name="/" dev="proc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 83.835034][ T28] audit: type=1400 audit(83.750:120): avc: denied { mounton } for pid=3106 comm="syz-executor" path="/syzkaller.gEJyTz/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 83.838000][ T28] audit: type=1400 audit(83.760:121): avc: denied { mounton } for pid=3106 comm="syz-executor" path="/syzkaller.gEJyTz/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=3133 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1 [ 83.850072][ T28] audit: type=1400 audit(83.770:122): avc: denied { unmount } for pid=3106 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 83.858378][ T28] audit: type=1400 audit(83.780:123): avc: denied { mounton } for pid=3106 comm="syz-executor" path="/dev/gadgetfs" dev="devtmpfs" ino=772 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=dir permissive=1 [ 83.861071][ T28] audit: type=1400 audit(83.780:124): avc: denied { mount } for pid=3106 comm="syz-executor" name="/" dev="gadgetfs" ino=2314 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=filesystem permissive=1 [ 83.870552][ T28] audit: type=1400 audit(83.790:125): avc: denied { mount } for pid=3106 comm="syz-executor" name="/" dev="binder" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 83.872689][ T28] audit: type=1400 audit(83.790:126): avc: denied { mounton } for pid=3106 comm="syz-executor" path="/sys/fs/fuse/connections" dev="fusectl" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=dir permissive=1 [ 83.953084][ T3106] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 83.953096][ T3105] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 85.353277][ T3727] netlink: 8 bytes leftover after parsing attributes in process `syz.0.8'. [ 85.358857][ T3727] netlink: 244 bytes leftover after parsing attributes in process `syz.0.8'. [ 85.365277][ T3727] netlink: 8 bytes leftover after parsing attributes in process `syz.0.8'. [ 85.695359][ T11] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 85.844350][ T11] usb 1-1: Using ep0 maxpacket: 8 [ 85.853481][ T11] usb 1-1: config index 0 descriptor too short (expected 301, got 45) [ 85.855379][ T11] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 85.855689][ T11] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 85.855964][ T11] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 85.856055][ T11] usb 1-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 85.856342][ T11] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 85.856388][ T11] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 88.164526][ T2890] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 88.323130][ T2890] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 88.323497][ T2890] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 88.341971][ T2890] usb 2-1: New USB device found, idVendor=041e, idProduct=3048, bcdDevice= 0.40 [ 88.342315][ T2890] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 88.342620][ T2890] usb 2-1: Product: syz [ 88.342682][ T2890] usb 2-1: Manufacturer: syz [ 88.342711][ T2890] usb 2-1: SerialNumber: syz [ 88.592469][ T2890] usb 2-1: USB disconnect, device number 2 [ 89.094855][ T2890] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 89.244854][ T2890] usb 2-1: Using ep0 maxpacket: 32 [ 89.251680][ T2890] usb 2-1: config 0 has an invalid interface number: 2 but max is 0 [ 89.252021][ T2890] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 89.256033][ T2890] usb 2-1: config 0 has no interface number 0 [ 89.257216][ T2890] usb 2-1: config 0 interface 2 altsetting 2 endpoint 0x82 has invalid wMaxPacketSize 0 [ 89.260522][ T2890] usb 2-1: config 0 interface 2 altsetting 2 has 1 endpoint descriptor, different from the interface descriptor's value: 16 [ 89.262424][ T2890] usb 2-1: config 0 interface 2 has no altsetting 0 [ 89.279345][ T2890] usb 2-1: New USB device found, idVendor=05ac, idProduct=7778, bcdDevice=eb.3a [ 89.279651][ T2890] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 89.279984][ T2890] usb 2-1: Product: syz [ 89.280039][ T2890] usb 2-1: Manufacturer: syz [ 89.280063][ T2890] usb 2-1: SerialNumber: syz [ 89.284956][ T2890] usb 2-1: config 0 descriptor?? [ 89.295232][ T2890] cdc_acm 2-1:0.2: Zero length descriptor references [ 89.295756][ T2890] cdc_acm 2-1:0.2: probe with driver cdc_acm failed with error -22 [ 89.498438][ T43] usb 2-1: USB disconnect, device number 3 [ 89.666841][ T28] kauditd_printk_skb: 21 callbacks suppressed [ 89.671400][ T28] audit: type=1400 audit(89.590:148): avc: denied { remount } for pid=3789 comm="syz.1.18" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 89.890315][ T28] audit: type=1400 audit(89.810:149): avc: denied { ioctl } for pid=3794 comm="syz.1.20" path="socket:[2371]" dev="sockfs" ino=2371 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 89.896844][ T28] audit: type=1400 audit(89.820:150): avc: denied { bind } for pid=3794 comm="syz.1.20" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 89.903283][ T28] audit: type=1400 audit(89.820:151): avc: denied { setopt } for pid=3794 comm="syz.1.20" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 89.910340][ T28] audit: type=1400 audit(89.830:152): avc: denied { write } for pid=3794 comm="syz.1.20" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 90.244602][ T1809] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 90.404595][ T1809] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 252, changing to 11 [ 90.404925][ T1809] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 90.405334][ T1809] usb 2-1: New USB device found, idVendor=04d9, idProduct=a04a, bcdDevice= 0.00 [ 90.405406][ T1809] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 90.412515][ T1809] usb 2-1: config 0 descriptor?? [ 90.865800][ T1809] holtek_mouse 0003:04D9:A04A.0001: unknown main item tag 0x0 [ 90.866356][ T1809] holtek_mouse 0003:04D9:A04A.0001: unknown main item tag 0x0 [ 90.866497][ T1809] holtek_mouse 0003:04D9:A04A.0001: unknown main item tag 0x0 [ 90.866624][ T1809] holtek_mouse 0003:04D9:A04A.0001: unknown main item tag 0x0 [ 90.866731][ T1809] holtek_mouse 0003:04D9:A04A.0001: unknown main item tag 0x0 [ 90.866880][ T1809] holtek_mouse 0003:04D9:A04A.0001: unknown main item tag 0x0 [ 90.866988][ T1809] holtek_mouse 0003:04D9:A04A.0001: unknown main item tag 0x0 [ 90.867090][ T1809] holtek_mouse 0003:04D9:A04A.0001: unknown main item tag 0x0 [ 90.867195][ T1809] holtek_mouse 0003:04D9:A04A.0001: unknown main item tag 0x0 [ 90.867297][ T1809] holtek_mouse 0003:04D9:A04A.0001: unknown main item tag 0x0 [ 90.878411][ T1809] holtek_mouse 0003:04D9:A04A.0001: item fetching failed at offset 186/235 [ 90.879469][ T1809] holtek_mouse 0003:04D9:A04A.0001: hid parse failed: -22 [ 90.879653][ T1809] holtek_mouse 0003:04D9:A04A.0001: probe with driver holtek_mouse failed with error -22 [ 91.070618][ T23] usb 2-1: USB disconnect, device number 4 [ 91.869867][ T28] audit: type=1400 audit(91.790:153): avc: denied { create } for pid=3827 comm="syz.1.27" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 91.881247][ T28] audit: type=1400 audit(91.790:154): avc: denied { write } for pid=3827 comm="syz.1.27" lport=132 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 94.312173][ T28] audit: type=1400 audit(94.230:155): avc: denied { connect } for pid=3835 comm="syz.1.31" lport=60 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 96.061267][ T28] audit: type=1400 audit(95.980:156): avc: denied { create } for pid=3841 comm="syz.1.34" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 96.066367][ T28] audit: type=1400 audit(95.990:157): avc: denied { ioctl } for pid=3841 comm="syz.1.34" path="socket:[2430]" dev="sockfs" ino=2430 ioctlcmd=0x8983 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 97.438588][ T3850] 8<--- cut here --- [ 97.444080][ T3850] Unable to handle kernel paging request at virtual address fee00103 when write [ 97.447708][ T3850] [fee00103] *pgd=80000080007003 [ 97.453360][ T28] audit: type=1400 audit(97.370:158): avc: denied { read } for pid=2913 comm="syslogd" name="log" dev="vda" ino=795 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 97.463381][ T3850] , *pmd=00000000 [ 97.464988][ T28] audit: type=1400 audit(97.380:159): avc: denied { search } for pid=2913 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 97.465444][ T3850] Internal error: Oops: a06 [#1] SMP ARM [ 97.467858][ T3850] Modules linked in: [ 97.468722][ T3850] CPU: 0 UID: 0 PID: 3850 Comm: syz.1.36 Not tainted syzkaller #0 PREEMPT [ 97.469222][ T3850] Hardware name: ARM-Versatile Express [ 97.469682][ T3850] PC is at subdev_8255_io+0x60/0x6c [ 97.470569][ T3850] LR is at subdev_8255_io+0x4c/0x6c [ 97.470808][ T3850] pc : [<814654f8>] lr : [<814654e4>] psr: 60000013 [ 97.471079][ T3850] sp : ea649cb8 ip : ea649cb8 fp : ea649cd4 [ 97.471384][ T3850] r10: 00000100 r9 : 00000004 r8 : ea649da4 [ 97.471638][ T3850] r7 : 00000000 r6 : 0000009b r5 : 8334bd80 r4 : 00000103 [ 97.471921][ T3850] r3 : 0000009b r2 : fee00103 r1 : 00000001 r0 : 8334bd80 [ 97.472043][ T28] audit: type=1400 audit(97.380:160): avc: denied { write search } for pid=2913 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 97.472459][ T28] audit: type=1400 audit(97.390:161): avc: denied { add_name } for pid=2913 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 97.472854][ T28] audit: type=1400 audit(97.390:162): avc: denied { create } for pid=2913 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 97.473153][ T28] audit: type=1400 audit(97.390:163): avc: denied { append open } for pid=2913 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 97.473536][ T28] audit: type=1400 audit(97.390:164): avc: denied { getattr } for pid=2913 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 97.476512][ T3850] Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user [ 97.476850][ T3850] Control: 30c5387d Table: 85ce8f00 DAC: fffffffd [ 97.477172][ T3850] Register r0 information: slab kmalloc-192 start 8334bd80 pointer offset 0 size 192 [ 97.478398][ T3850] Register r1 information: non-paged memory [ 97.478918][ T3850] Register r2 information: 0-page vmalloc region starting at 0xfee00000 allocated at pci_reserve_io+0x0/0x38 [ 97.479549][ T3850] Register r3 information: non-paged memory [ 97.479806][ T3850] Register r4 information: non-paged memory [ 97.480098][ T3850] Register r5 information: slab kmalloc-192 start 8334bd80 pointer offset 0 size 192 [ 97.480567][ T3850] Register r6 information: non-paged memory [ 97.480825][ T3850] Register r7 information: NULL pointer [ 97.481077][ T3850] Register r8 information: 2-page vmalloc region starting at 0xea648000 allocated at kernel_clone+0xbc/0x43c [ 97.481652][ T3850] Register r9 information: non-paged memory [ 97.481900][ T3850] Register r10 information: non-paged memory [ 97.482181][ T3850] Register r11 information: 2-page vmalloc region starting at 0xea648000 allocated at kernel_clone+0xbc/0x43c [ 97.484213][ T3850] Register r12 information: 2-page vmalloc region starting at 0xea648000 allocated at kernel_clone+0xbc/0x43c [ 97.484920][ T3850] Process syz.1.36 (pid: 3850, stack limit = 0xea648000) [ 97.485359][ T3850] Stack: (0xea649cb8 to 0xea64a000) [ 97.485721][ T3850] 9ca0: 81465498 00000100 [ 97.486099][ T3850] 9cc0: 8334bd80 00000000 ea649cf4 ea649cd8 814651d4 814654a4 00000100 80532248 [ 97.486481][ T3850] 9ce0: 85bc9000 85bc9000 ea649d14 ea649cf8 8146558c 81465188 8334bd80 00000000 [ 97.486837][ T3850] 9d00: 85bc9000 00000000 ea649d54 ea649d18 8146573c 81465510 ffffffff 00000004 [ 97.487196][ T3850] 9d20: 82a20900 00000000 00000000 82bd325c 8334bd80 00000000 ea649d90 8334bd80 [ 97.487661][ T3850] 9d40: 00000000 82d2cdc4 ea649d8c ea649d58 814540c4 814656d4 40946400 00000000 [ 97.487994][ T3850] 9d60: ea649d7c 200000c0 8334bd80 b5403587 40946400 00000003 00000003 83fbf080 [ 97.488383][ T3850] 9d80: ea649e4c ea649d90 8144f8d0 81453fc8 35353238 00000000 00000000 00000000 [ 97.488735][ T3850] 9da0: 00000000 00000100 00010000 00000004 0000000c 0000000e 00000007 00000075 [ 97.489128][ T3850] 9dc0: 00000003 00080008 00000000 00000002 00000001 00000007 00000001 00000001 [ 97.489518][ T3850] 9de0: 000000fd fffffffb 00000009 00000003 7fffffff 00004089 0000ca9f 0000ffff [ 97.489895][ T3850] 9e00: 20001e58 00000008 0000f39e 00000009 00000008 0010a6b4 00000000 fffffff8 [ 97.490242][ T3850] 9e20: 00000000 d6259212 00000000 8600a800 8334bd80 200000c0 40946400 00000003 [ 97.490718][ T3850] 9e40: ea649f14 ea649e50 81450bf4 8144f808 00000000 d6259212 00000000 00000000 [ 97.491301][ T3850] 9e60: 82530804 ea649ea4 0000005f 84667dd8 00000064 8334bdb0 ea649ee4 ea649e88 [ 97.491707][ T3850] 9e80: 807e94e8 807df7fc 00000064 00000001 00000000 ea649ea4 830ea250 8341d770 [ 97.492163][ T3850] 9ea0: 00006400 0000000b ea649e98 00000000 00000000 d6259212 00000000 8600a800 [ 97.492716][ T3850] 9ec0: 40946400 200000c0 200000c0 8600a800 00000003 83fbf080 ea649ef4 ea649ee8 [ 97.493060][ T3850] 9ee0: 807e961c d6259212 ea649f14 00000000 8600a801 40946400 200000c0 8600a800 [ 97.493523][ T3850] 9f00: 00000003 83fbf080 ea649fa4 ea649f18 805a1864 814508ac ecac8b10 83fbf080 [ 97.494006][ T3850] 9f20: ea649f3c ea649f30 81b15f14 81b15de0 ea649f54 ea649f40 8025a69c 8028e1bc [ 97.494479][ T3850] 9f40: ea649fb0 40000000 ea649f84 ea649f58 80220be0 8025a658 00000000 82a1c63c [ 97.497760][ T3850] 9f60: ea649fb0 0013e9b0 ecac8b10 80220b34 00000000 d6259212 ea649fac 00000000 [ 97.503519][ T3850] 9f80: 00000000 00346310 00000036 8020029c 83fbf080 00000036 00000000 ea649fa8 [ 97.503982][ T3850] 9fa0: 80200060 805a162c 00000000 00000000 00000003 40946400 200000c0 00000000 [ 97.504373][ T3850] 9fc0: 00000000 00000000 00346310 00000036 003462d8 00000000 00000001 76fa70dc [ 97.504661][ T3850] 9fe0: 76fa6e88 76fa6e78 00018ebc 00130810 60000010 00000003 00000000 00000000 [ 97.505301][ T3850] Call trace: [ 97.505864][ T3850] [<81465498>] (subdev_8255_io) from [<814651d4>] (subdev_8255_do_config+0x58/0x60) [ 97.506563][ T3850] r7:00000000 r6:8334bd80 r5:00000100 r4:81465498 [ 97.506981][ T3850] [<8146517c>] (subdev_8255_do_config) from [<8146558c>] (subdev_8255_io_init+0x88/0x98) [ 97.507441][ T3850] r4:85bc9000 [ 97.507672][ T3850] [<81465504>] (subdev_8255_io_init) from [<8146573c>] (dev_8255_attach+0x74/0x138) [ 97.508174][ T3850] r7:00000000 r6:85bc9000 r5:00000000 r4:8334bd80 [ 97.508397][ T3850] [<814656c8>] (dev_8255_attach) from [<814540c4>] (comedi_device_attach+0x108/0x244) [ 97.508788][ T3850] r10:82d2cdc4 r9:00000000 r8:8334bd80 r7:ea649d90 r6:00000000 r5:8334bd80 [ 97.509133][ T3850] r4:82bd325c [ 97.509351][ T3850] [<81453fbc>] (comedi_device_attach) from [<8144f8d0>] (do_devconfig_ioctl+0xd4/0x21c) [ 97.509748][ T3850] r10:83fbf080 r9:00000003 r8:00000003 r7:40946400 r6:b5403587 r5:8334bd80 [ 97.510075][ T3850] r4:200000c0 [ 97.510215][ T3850] [<8144f7fc>] (do_devconfig_ioctl) from [<81450bf4>] (comedi_unlocked_ioctl+0x354/0x1db8) [ 97.510600][ T3850] r8:00000003 r7:40946400 r6:200000c0 r5:8334bd80 r4:8600a800 [ 97.510900][ T3850] [<814508a0>] (comedi_unlocked_ioctl) from [<805a1864>] (sys_ioctl+0x244/0xb5c) [ 97.511314][ T3850] r10:83fbf080 r9:00000003 r8:8600a800 r7:200000c0 r6:40946400 r5:8600a801 [ 97.511606][ T3850] r4:00000000 [ 97.511746][ T3850] [<805a1620>] (sys_ioctl) from [<80200060>] (ret_fast_syscall+0x0/0x1c) [ 97.512159][ T3850] Exception stack(0xea649fa8 to 0xea649ff0) [ 97.512437][ T3850] 9fa0: 00000000 00000000 00000003 40946400 200000c0 00000000 [ 97.512736][ T3850] 9fc0: 00000000 00000000 00346310 00000036 003462d8 00000000 00000001 76fa70dc [ 97.513071][ T3850] 9fe0: 76fa6e88 76fa6e78 00018ebc 00130810 [ 97.513315][ T3850] r10:00000036 r9:83fbf080 r8:8020029c r7:00000036 r6:00346310 r5:00000000 [ 97.513741][ T3850] r4:00000000 [ 97.514219][ T3850] Code: e6ef3076 e0842002 e7f32052 e2422612 (e5c23000) [ 97.516092][ T3850] ---[ end trace 0000000000000000 ]--- SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 97.576087][ T3850] Kernel panic - not syncing: Fatal exception [ 97.578749][ T3850] Rebooting in 86400 seconds.. VM DIAGNOSIS: 16:03:16 Registers: info registers vcpu 0 CPU#0 R00=85ac2404 R01=00000023 R02=00000000 R03=00000000 R04=85ac2400 R05=00000000 R06=850b1900 R07=003462e4 R08=b5003500 R09=00000000 R10=00000002 R11=e0435d94 R12=e0435d98 R13=e0435d70 R14=8028f8ac R15=802d1ed8 PSR=80000013 N--- A S svc32 s00=00000000 s01=00000000 d00=0000000000000000 s02=00000000 s03=00000000 d01=0000000000000000 s04=00000000 s05=00000000 d02=0000000000000000 s06=00000000 s07=00000000 d03=0000000000000000 s08=00000000 s09=00000000 d04=0000000000000000 s10=00000000 s11=00000000 d05=0000000000000000 s12=00000000 s13=00000000 d06=0000000000000000 s14=00000000 s15=00000000 d07=0000000000000000 s16=00000000 s17=00000000 d08=0000000000000000 s18=00000000 s19=00000000 d09=0000000000000000 s20=00000000 s21=00000000 d10=0000000000000000 s22=00000000 s23=00000000 d11=0000000000000000 s24=00000000 s25=00000000 d12=0000000000000000 s26=00000000 s27=00000000 d13=0000000000000000 s28=00000000 s29=00000000 d14=0000000000000000 s30=00000000 s31=00000000 d15=0000000000000000 s32=00000000 s33=00000000 d16=0000000000000000 s34=00000000 s35=00000000 d17=0000000000000000 s36=00000000 s37=00000000 d18=0000000000000000 s38=00000000 s39=00000000 d19=0000000000000000 s40=00000000 s41=00000000 d20=0000000000000000 s42=00000000 s43=00000000 d21=0000000000000000 s44=00000000 s45=00000000 d22=0000000000000000 s46=00000000 s47=00000000 d23=0000000000000000 s48=00000000 s49=00000000 d24=0000000000000000 s50=00000000 s51=00000000 d25=0000000000000000 s52=00000000 s53=00000000 d26=0000000000000000 s54=00000000 s55=00000000 d27=0000000000000000 s56=00000000 s57=00000000 d28=0000000000000000 s58=00000000 s59=00000000 d29=0000000000000000 s60=00000000 s61=00000000 d30=0000000000000000 s62=00000000 s63=00000000 d31=0000000000000000 FPSCR: 00000000 info registers vcpu 1 CPU#1 R00=00000000 R01=00000000 R02=7e8837d0 R03=7e8837dc R04=00000000 R05=00000000 R06=00000000 R07=00000109 R08=0001d3b1 R09=00000000 R10=00000000 R11=00346384 R12=7e883798 R13=7e883784 R14=0010ba34 R15=00112618 PSR=60000010 -ZC- A S usr32 s00=72656820 s01=2d2d2065 d00=2d2d206572656820 s02=00000000 s03=00000000 d01=0000000000000000 s04=ef0cee00 s05=ef0cee00 d02=ef0cee00ef0cee00 s06=08040200 s07=80402000 d03=8040200008040200 s08=00000c00 s09=c0200c03 d04=c0200c0300000c00 s10=08040201 s11=80402000 d05=8040200008040201 s12=08040201 s13=80402010 d06=8040201008040201 s14=08040201 s15=80402010 d07=8040201008040201 s16=00000000 s17=00000000 d08=0000000000000000 s18=00000000 s19=00000000 d09=0000000000000000 s20=00000000 s21=00000000 d10=0000000000000000 s22=00000000 s23=00000000 d11=0000000000000000 s24=00000000 s25=00000000 d12=0000000000000000 s26=00000000 s27=00000000 d13=0000000000000000 s28=00000000 s29=00000000 d14=0000000000000000 s30=00000000 s31=00000000 d15=0000000000000000 s32=00000000 s33=00000000 d16=0000000000000000 s34=00000000 s35=00000000 d17=0000000000000000 s36=00000000 s37=00000000 d18=0000000000000000 s38=00000000 s39=00000000 d19=0000000000000000 s40=00000000 s41=00000000 d20=0000000000000000 s42=00000000 s43=00000000 d21=0000000000000000 s44=00000000 s45=00000000 d22=0000000000000000 s46=00000000 s47=00000000 d23=0000000000000000 s48=00000000 s49=00000000 d24=0000000000000000 s50=00000000 s51=00000000 d25=0000000000000000 s52=00000000 s53=00000000 d26=0000000000000000 s54=00000000 s55=00000000 d27=0000000000000000 s56=00000000 s57=00000000 d28=0000000000000000 s58=00000000 s59=00000000 d29=0000000000000000 s60=00000000 s61=00000000 d30=0000000000000000 s62=00000000 s63=00000000 d31=0000000000000000 FPSCR: 00000000