last executing test programs: 2.542437387s ago: executing program 1 (id=1069): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000002280)={0x3, &(0x7f0000000180)=[{0x20, 0x2, 0x81, 0xfffff034}, {0x20, 0x0, 0x8, 0xfffff010}, {0x6, 0xba, 0x2, 0xffff}]}, 0x10) syz_emit_ethernet(0x4a, &(0x7f0000000bc0)={@local, @local, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "00f300", 0x14, 0x2c, 0x0, @remote, @local, {[], {{0x600, 0x3, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0xc2}}}}}}}, 0x0) 2.522030787s ago: executing program 2 (id=1072): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x103) write(r0, &(0x7f0000000180)='9', 0x1) openat$binder_debug(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) 2.465308329s ago: executing program 1 (id=1075): mkdir(&(0x7f0000000080)='./mytrace\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./mytrace\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./mytrace/events/xhci-hcd/xhci_address_ctrl_ctx/inject\x00', 0x2, 0x0) write(r0, &(0x7f0000000200)='drop=1', 0x6) 2.258118993s ago: executing program 1 (id=1083): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) write(0xffffffffffffffff, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000005000/0x18000)=nil, &(0x7f00000002c0)=[@text32={0x20, &(0x7f0000000340)="b8050000000f01c10f46a78900000066ba2100b067ee66ba2000b000ee6d6c2f800000c00f3266bac0000f3066b808008ed0660f38806f008ee0", 0x3a}], 0x1, 0x8, 0x0, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000003c0)={[0x23, 0x790, 0x80000000002, 0x17d, 0x2000000400000004, 0xffffffffffffffff, 0xf1, 0x3, 0xfffffffffffffd7e, 0x45, 0x0, 0x3b9, 0xfffffffffffffffe, 0x5, 0x0, 0x8], 0x8000000, 0x385310}) ioctl$KVM_RUN(r2, 0xae80, 0x0) openat$random(0xffffff9c, 0x0, 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) 2.257362773s ago: executing program 2 (id=1087): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/serio/devices/serio1/protocol\x00', 0x1, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000003c0)=@gettaction={0x28, 0x32, 0x2, 0x70bd2a, 0x25dfdbfe, {}, [@action_dump_flags=@TCA_ROOT_FLAGS={0xc, 0x2, {0x1}}, @action_dump_flags=@TCA_ROOT_TIME_DELTA={0x8, 0x4, 0x9}]}, 0x28}, 0x1, 0x0, 0x0, 0x24040025}, 0x20000040) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff) r1 = openat$random(0xffffffffffffff9c, &(0x7f0000000880), 0x40800, 0x0) ioctl$RNDADDENTROPY(r1, 0x40085203, &(0x7f0000001c40)=ANY=[@ANYRESHEX, @ANYRESDEC=r0, @ANYRESDEC=0x0]) mount(0x0, 0x0, &(0x7f0000000180)='devtmpfs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./dev/mapper/control\x00', 0x2, 0x0) ioctl(r2, 0xc138fd09, &(0x7f0000000300)="0400000000000000000000009001000038010000010000000000000000000000000000000000000000000000000000006d706174683000"/94) write(r0, &(0x7f0000000140)='auto', 0x4) ioctl$BLKZEROOUT(0xffffffffffffffff, 0x127f, &(0x7f0000001b80)={0xa0a00, 0xa0000}) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000800)={'macvlan0\x00', 0x400}) ioctl$TUNGETSNDBUF(0xffffffffffffffff, 0x400454dc, &(0x7f0000000840)) mkdir(&(0x7f00000004c0)='./cgroup/../file0\x00', 0x155) rmdir(&(0x7f0000000500)='./cgroup/../file0\x00') close(r0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/serio/devices/serio1/drvctl\x00', 0x1, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f00000002c0), r0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r2, 0x89f1, &(0x7f0000000480)={'ip6_vti0\x00', &(0x7f0000000400)={'ip6gre0\x00', 0x0, 0x29, 0x8, 0x1, 0x2, 0x1, @private1={0xfc, 0x1, '\x00', 0x1}, @private2, 0x80, 0x7, 0x0, 0x7fffffff}}) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r2, &(0x7f0000001c00)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000540)={&(0x7f0000001d00)=ANY=[], 0x50}}, 0x8050) recvmmsg(r0, &(0x7f0000001c80)=[{{&(0x7f0000000200)=@caif=@dgm, 0x80, &(0x7f0000000700)=[{&(0x7f00000005c0)=""/231, 0xe7}], 0x1}, 0x4}, {{0x0, 0x0, &(0x7f0000000900)=[{&(0x7f0000000780)=""/106, 0x6a}], 0x1, &(0x7f0000000940)=""/66, 0x42}, 0x1ff}, {{&(0x7f00000009c0)=@rc={0x1f, @none}, 0x80, &(0x7f00000006c0)=[{&(0x7f0000000ac0)=""/4096, 0x1000}, {&(0x7f0000001ac0)=""/103, 0x67}], 0x2}, 0x3}], 0x3, 0x40002100, 0x0) write(r3, &(0x7f00000001c0)='reconne', 0x7) stat(&(0x7f0000000a40)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) 1.715438204s ago: executing program 1 (id=1077): timer_create(0x0, &(0x7f0000000080)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x77359400}}, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) open_tree(0xffffffffffffff9c, &(0x7f00000000c0)='\x00', 0x89901) write$UHID_INPUT2(r0, 0x0, 0xd) read(r0, &(0x7f0000000900), 0x1000) 1.715359344s ago: executing program 2 (id=1078): r0 = openat$dm_control(0xffffffffffffff9c, &(0x7f0000000440), 0x40102, 0x0) ioctl$DM_DEV_CREATE(r0, 0xc138fd03, &(0x7f0000000540)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x800, 0x0, 0x0, {0x0, {'syz', 0x0, '0\x00'}, @uuid={'LVM-syz', 0x0, '2\x00'}}}) ioctl$DM_DEV_SET_GEOMETRY(r0, 0xc138fd0f, &(0x7f0000000680)={0x4, 0x0, 0x0, 0x190, 0x138, 0x0, 0x0, 0x8000, 0x0, 0x0, @by_dev={r1}, {0x3d, 0x20, 0x8000000000084, 0x20, 0x5, 0x20, 0x400000000e48}}) 1.675980895s ago: executing program 3 (id=1081): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f00000025c0)={0x2, 0x4e20, @multicast2}, 0x10) connect$inet(r0, &(0x7f0000002740)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000002780)=0x4, 0x4) sendmsg$inet(r0, &(0x7f00000028c0)={0x0, 0x14, &(0x7f0000002900)=[{&(0x7f0000002940)=' ', 0x100120}], 0x1}, 0x0) recvmsg(r0, &(0x7f0000002980)={0x0, 0x2, &(0x7f00000029c0)=[{&(0x7f0000002a00)=""/4096, 0xa15b0}], 0x1, 0x0, 0x2000000000000}, 0x700) 1.637370356s ago: executing program 2 (id=1097): sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x1) r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x0, 0x4, @loopback={0xfec0ffff00000000}}, 0x1c) 1.637211826s ago: executing program 4 (id=1086): mkdir(&(0x7f0000000080)='./mytrace\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./mytrace\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./mytrace/events/xhci-hcd/xhci_address_ctrl_ctx/inject\x00', 0x2, 0x0) write(r0, &(0x7f0000000200)='drop=1', 0x6) 1.636969626s ago: executing program 4 (id=1088): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000000700)=0x1, 0x4) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000740)=0x1f6, 0x4) sendmmsg$inet(r0, &(0x7f0000000780)=[{{&(0x7f00000007c0)={0x2, 0x4e24, @empty}, 0x10, &(0x7f0000000800)=[{&(0x7f0000000840)="97", 0xfdef}], 0x1}}], 0x1, 0x4000800) 1.609953097s ago: executing program 2 (id=1091): timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000140)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10000, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x3000002, 0x204031, 0xffffffffffffffff, 0xe60d3000) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./dev\x00', 0x17a) mount(0x0, &(0x7f0000000240)='./dev\x00', &(0x7f0000000280)='devtmpfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./dev/kmsg\x00', 0x60000, 0x0) lseek(r1, 0x0, 0x2) read(r1, &(0x7f0000000300)=""/174, 0xae) 1.609837897s ago: executing program 4 (id=1092): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000100)={0x2, 0x4e21, @broadcast}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) sendto$inet(r0, &(0x7f00000002c0)="a7", 0x1, 0x8295, 0x0, 0x0) shutdown(r0, 0x1) recvmmsg(r0, &(0x7f0000001700)=[{{0x0, 0x0, &(0x7f00000015c0)=[{&(0x7f0000000300)=""/132, 0x84}], 0x1}, 0x2000000}], 0x1, 0x10022, 0x0) 1.363379362s ago: executing program 0 (id=1116): syz_emit_ethernet(0x4a, &(0x7f0000000240)=ANY=[@ANYBLOB="aaaa"], 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000980)={0x8, 0xf, &(0x7f0000000200)=ANY=[@ANYBLOB="1800008080b63428e900"/20, @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b7020000000000008500000051000000bf0900000000000055"], 0x0, 0x47, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5}, 0x94) r0 = syz_open_dev$loop(&(0x7f0000000100), 0x2, 0x2001) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.io_service_bytes_recursive\x00', 0x275a, 0x0) sendmsg$IPCTNL_MSG_CT_GET(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000280)=ANY=[], 0x60}, 0x1, 0x0, 0x0, 0x14}, 0x10) write$binfmt_misc(r1, &(0x7f0000000040), 0xe09) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000002c0)={r1, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x0, 0x0, 0x0, 0x14, 0x1c, "fee8a2ab78fc979fd1e00d96b75d34091ea89de2b7fb0000e60080b8785d9600010000000000000600000000000000004000", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c527d3d458dd4992861ac00", "f4bd000000801900", [0x8, 0xffffffff9673e35d]}}) 864.843222ms ago: executing program 1 (id=1106): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./trace\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./trace\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./trace/trace\x00', 0x80000, 0x11e) lseek(r0, 0xffff, 0x0) 864.360372ms ago: executing program 0 (id=1107): socket$nl_generic(0x11, 0x3, 0x10) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ptype\x00') preadv(r0, &(0x7f0000000580)=[{&(0x7f0000000540)=""/29, 0x1d}], 0x1, 0x1a, 0x0) 833.594322ms ago: executing program 3 (id=1108): prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mountinfo\x00') r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f00000001c0)={0x0, 0x0, 0x0, &(0x7f0000000380)=""/70, 0x0, 0x4}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, 0x0, &(0x7f00000000c0)=""/87, 0x0, 0x100000}) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000140)) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000000)=0x1) ioctl$BTRFS_IOC_SUBVOL_GETFLAGS(r0, 0x4008af04, &(0x7f0000000040)) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000004100)={0x0, 0x1, 0x0, 0x0, 0x0, 0x25000}) 833.473062ms ago: executing program 0 (id=1109): r0 = socket$inet(0x2, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000000)={'macvtap0\x00', &(0x7f0000000080)=@ethtool_link_settings={0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, [0x3, 0x1, 0x0, 0x6, 0x2000, 0x0, 0xad]}}) 819.173333ms ago: executing program 1 (id=1120): sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./dev_mnt\x00', 0x1ff) mount(0x0, &(0x7f0000000340)='./dev_mnt\x00', &(0x7f0000000380)='devtmpfs\x00', 0x0, 0x0) r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000003c0)=ANY=[@ANYBLOB="12010000000000407d1e5a2d00000000000109022400010000000009040000010301020009210000000122220009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000400)={0x24, 0x0, 0x0, &(0x7f0000000440)={0x0, 0x22, 0x22, {[@global=@item_012={0x2, 0x1, 0x9, "2313"}, @global=@item_012={0x2, 0x1, 0x0, "e53f"}, @global=@item_4={0x3, 0x1, 0x0, '\f\x00'}, @local=@item_012={0x2, 0x2, 0x2, "9000"}, @global=@item_4={0x3, 0x1, 0x0, "0900be00"}, @main=@item_4={0x3, 0x0, 0x8}, @local=@item_4={0x3, 0x2, 0x0, "09007a15"}, @local=@item_4={0x3, 0x2, 0x0, "5d8c3dda"}]}}, 0x0}, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000480)='./dev_mnt/roccatsavu0\x00', 0x2, 0x0) mmap$IORING_OFF_SQES(0x0, 0x1000, 0x2, 0x109031, 0xffffffffffffffff, 0x10000000) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000500)={0x1, &(0x7f0000000540)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) close_range(r1, 0xffffffffffffffff, 0x0) 804.306633ms ago: executing program 3 (id=1122): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./trace\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./trace\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./trace/trace\x00', 0x80000, 0x11e) lseek(r0, 0xffff, 0x0) 763.574884ms ago: executing program 4 (id=1110): r0 = openat$dm_control(0xffffffffffffff9c, &(0x7f0000000440), 0x40102, 0x0) ioctl$DM_DEV_CREATE(r0, 0xc138fd03, &(0x7f0000000540)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x800, 0x0, 0x0, {0x0, {'syz', 0x0, '0\x00'}, @uuid={'LVM-syz', 0x0, '2\x00'}}}) ioctl$DM_DEV_SET_GEOMETRY(r0, 0xc138fd0f, &(0x7f0000000680)={0x4, 0x0, 0x0, 0x190, 0x138, 0x0, 0x0, 0x8000, 0x0, 0x0, @by_dev={r1}, {0x3d, 0x20, 0x8000000000084, 0x20, 0x5, 0x20, 0x400000000e48}}) 763.168644ms ago: executing program 0 (id=1111): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) close_range(r0, 0xffffffffffffffff, 0x2) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x80b42, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) 762.808214ms ago: executing program 3 (id=1112): r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0x0, 0x822b01) r1 = syz_open_procfs(0x0, &(0x7f0000000280)='fd/3\x00') r2 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000240)={0x80000011}) sendmsg$ETHTOOL_MSG_DEBUG_SET(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000940)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16, @ANYBLOB="00040000000000000000080000000800028000000100000002800000020023020000000002"], 0x34}, 0x1, 0x0, 0x0, 0x24044815}, 0x4884) write$char_usb(r0, &(0x7f0000000040)="e2", 0x2778) 737.049575ms ago: executing program 3 (id=1113): r0 = socket(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e22, 0x13, @local, 0x2}, 0x1c) listen(r0, 0x7f) syz_emit_ethernet(0x4a, &(0x7f00000002c0)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x3c}, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00', 0x14, 0x6, 0x0, @remote, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x2, 0x0, 0x0, 0xff6f}}}}}}}, 0x0) syz_emit_ethernet(0x4e, &(0x7f0000000340)={@local, @remote, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "005480", 0x18, 0x6, 0x0, @remote, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x6, 0xc0, 0x0, 0x0, 0x0, {[@generic={0x22, 0x2}, @sack_perm={0x4, 0x2}]}}}}}}}}, 0x0) 736.874805ms ago: executing program 0 (id=1114): r0 = socket$inet_icmp(0x2, 0x2, 0x1) bind$inet(r0, &(0x7f0000000200)={0x2, 0x0, @loopback}, 0x10) 736.592135ms ago: executing program 2 (id=1117): mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000080)='./file0/../file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) mount$bind(0x0, &(0x7f0000000240)='./file0/file0\x00', 0x0, 0x80000, 0x0) mount$bind(&(0x7f0000000300)='.\x00', &(0x7f00000002c0)='./file0\x00', 0x0, 0x185093, 0x0) mount$tmpfs(0x0, &(0x7f00000001c0)='./file0\x00', 0x0, 0x20000, 0x0) mount$bind(&(0x7f0000000240)='.\x00', &(0x7f0000000280)='./file0/file0\x00', 0x0, 0x11050ca, 0x0) 731.626124ms ago: executing program 4 (id=1118): r0 = io_uring_setup(0x2a8d, &(0x7f0000000240)={0x0, 0x14da, 0x2, 0x3, 0x1fb}) r1 = syz_usb_connect(0x0, 0x3f, &(0x7f00000001c0)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0) syz_usb_control_io$printer(r1, 0x0, &(0x7f0000000200)={0x1c, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_disconnect(r1) close_range(r0, 0xffffffffffffffff, 0x0) 668.28µs ago: executing program 4 (id=1119): timer_create(0x0, &(0x7f0000000080)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x77359400}}, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) open_tree(0xffffffffffffff9c, &(0x7f00000000c0)='\x00', 0x89901) write$UHID_INPUT2(r0, 0x0, 0xd) read(r0, &(0x7f0000000900), 0x1000) 221.4µs ago: executing program 0 (id=1131): mknodat$loop(0xffffffffffffff9c, 0x0, 0x6004, 0x1) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000006840)='./file0\x00', 0x1d4) ioctl$BLKPG(r0, 0x1269, &(0x7f0000006880)={0x1, 0x0, 0x0, 0x0}) 0s ago: executing program 3 (id=1123): r0 = socket$inet(0x2, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000000)={'macvtap0\x00', &(0x7f0000000080)=@ethtool_link_settings={0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, [0x3, 0x1, 0x0, 0x6, 0x2000, 0x0, 0xad]}}) kernel console output (not intermixed with test programs): syzkaller syzkaller login: [ 14.787374][ T28] kauditd_printk_skb: 31 callbacks suppressed [ 14.787388][ T28] audit: type=1400 audit(1792727940.267:59): avc: denied { transition } for pid=224 comm="sshd-session" path="/bin/sh" dev="sda1" ino=90 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 14.792556][ T28] audit: type=1400 audit(1792727940.267:60): avc: denied { noatsecure } for pid=224 comm="sshd-session" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 14.796130][ T28] audit: type=1400 audit(1792727940.277:61): avc: denied { write } for pid=224 comm="sh" path="pipe:[14544]" dev="pipefs" ino=14544 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 14.799625][ T28] audit: type=1400 audit(1792727940.277:62): avc: denied { rlimitinh } for pid=224 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 14.802996][ T28] audit: type=1400 audit(1792727940.277:63): avc: denied { siginh } for pid=224 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 Warning: Permanently added '10.128.0.162' (ED25519) to the list of known hosts. [ 22.554039][ T28] audit: type=1400 audit(1792727948.037:64): avc: denied { mounton } for pid=278 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 22.557526][ T278] cgroup: Unknown subsys name 'net' [ 22.576740][ T28] audit: type=1400 audit(1792727948.037:65): avc: denied { mount } for pid=278 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.604052][ T28] audit: type=1400 audit(1792727948.067:66): avc: denied { unmount } for pid=278 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.604550][ T278] cgroup: Unknown subsys name 'devices' [ 22.744862][ T278] cgroup: Unknown subsys name 'hugetlb' [ 22.750505][ T278] cgroup: Unknown subsys name 'rlimit' [ 22.855702][ T28] audit: type=1400 audit(1792727948.337:67): avc: denied { setattr } for pid=278 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=258 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 22.878939][ T28] audit: type=1400 audit(1792727948.337:68): avc: denied { mounton } for pid=278 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 22.903868][ T28] audit: type=1400 audit(1792727948.337:69): avc: denied { mount } for pid=278 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 22.927956][ T280] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 22.937207][ T28] audit: type=1400 audit(1792727948.417:70): avc: denied { relabelto } for pid=280 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.962777][ T28] audit: type=1400 audit(1792727948.417:71): avc: denied { write } for pid=280 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.001149][ T28] audit: type=1400 audit(1792727948.477:72): avc: denied { read } for pid=278 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.026744][ T28] audit: type=1400 audit(1792727948.477:73): avc: denied { open } for pid=278 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.026785][ T278] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 23.871294][ T286] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.878463][ T286] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.886088][ T286] device bridge_slave_0 entered promiscuous mode [ 23.895051][ T286] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.902104][ T286] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.909585][ T286] device bridge_slave_1 entered promiscuous mode [ 23.999242][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.006437][ T287] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.013961][ T287] device bridge_slave_0 entered promiscuous mode [ 24.023284][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.030344][ T287] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.037873][ T287] device bridge_slave_1 entered promiscuous mode [ 24.057124][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.064245][ T289] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.071718][ T289] device bridge_slave_0 entered promiscuous mode [ 24.102323][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.109523][ T289] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.117100][ T289] device bridge_slave_1 entered promiscuous mode [ 24.133002][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.140089][ T288] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.147626][ T288] device bridge_slave_0 entered promiscuous mode [ 24.168149][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.175294][ T288] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.182815][ T288] device bridge_slave_1 entered promiscuous mode [ 24.223714][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.230796][ T290] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.238334][ T290] device bridge_slave_0 entered promiscuous mode [ 24.248290][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.255608][ T290] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.263117][ T290] device bridge_slave_1 entered promiscuous mode [ 24.298641][ T286] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.305723][ T286] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.313037][ T286] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.320094][ T286] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.438224][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.445300][ T287] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.452606][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.459655][ T287] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.475653][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.482787][ T288] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.490082][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.497155][ T288] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.505619][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.513234][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.520927][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.528375][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.535952][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.543528][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.551376][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 24.558971][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.585387][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.593636][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.600665][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.608168][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.616694][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.623797][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.657199][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.664967][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.678635][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.715411][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.724221][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.732220][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.740559][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.747608][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.756614][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.764875][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.771904][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.779389][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.787717][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.794799][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.802404][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.810593][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.817666][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.825096][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.833402][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.840452][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.847906][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.855902][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.864535][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 24.872601][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 24.909526][ T287] device veth0_vlan entered promiscuous mode [ 24.918014][ T286] device veth0_vlan entered promiscuous mode [ 24.925030][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 24.935182][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.943277][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 24.951344][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.959514][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.968018][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.976401][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.985026][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.993539][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 25.001823][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.010454][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 25.018463][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.026536][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 25.035047][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 25.043467][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.050498][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.057925][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 25.065997][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.074264][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.081768][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.089475][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.097139][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.105576][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 25.113181][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 25.125754][ T289] device veth0_vlan entered promiscuous mode [ 25.136325][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.144689][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 25.153272][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 25.161594][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 25.170458][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 25.178598][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.186153][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.199847][ T287] device veth1_macvtap entered promiscuous mode [ 25.212747][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.221190][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.229415][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 25.237136][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 25.245648][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 25.254103][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.261149][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.268605][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 25.277094][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 25.285438][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.292508][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.300874][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.312088][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.320385][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.341391][ T289] device veth1_macvtap entered promiscuous mode [ 25.349992][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.358634][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.367444][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.375797][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.384277][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 25.392904][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.401222][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 25.409617][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 25.418146][ T286] device veth1_macvtap entered promiscuous mode [ 25.428971][ T290] device veth0_vlan entered promiscuous mode [ 25.436650][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 25.444678][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 25.452966][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.461115][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.468725][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.497930][ T290] device veth1_macvtap entered promiscuous mode [ 25.504906][ T286] request_module fs-gadgetfs succeeded, but still no fs? [ 25.506098][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 25.521696][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 25.530014][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.538376][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.546953][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.555376][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.563760][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.571969][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.581051][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.589282][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.597544][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 25.625721][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.634455][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.643513][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.651891][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.677195][ T288] device veth0_vlan entered promiscuous mode [ 25.688466][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 25.698461][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.707595][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.718710][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.727240][ T318] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 25.729213][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 25.754214][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.762956][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.770548][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.796995][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.810361][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.837075][ T288] device veth1_macvtap entered promiscuous mode [ 25.851617][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.860288][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.876690][ T327] netlink: 48 bytes leftover after parsing attributes in process `syz.3.4'. [ 25.899443][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.916848][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.958513][ T328] device syzkaller0 entered promiscuous mode [ 26.462898][ T6] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 27.272337][ C1] sched: RT throttling activated [ 27.373576][ T6] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 27.403430][ T6] usb 2-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 4 [ 27.459916][ T6] usb 2-1: New USB device found, idVendor=0552, idProduct=5510, bcdDevice= 0.00 [ 27.477820][ T6] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 27.656766][ T6] usb 2-1: Product: syz [ 27.661045][ T6] usb 2-1: Manufacturer: syz [ 27.680440][ T28] kauditd_printk_skb: 70 callbacks suppressed [ 27.680456][ T28] audit: type=1400 audit(1792727953.157:144): avc: denied { read write } for pid=381 comm="syz.2.31" name="uhid" dev="devtmpfs" ino=267 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:uhid_device_t tclass=chr_file permissive=1 [ 27.709777][ T28] audit: type=1400 audit(1792727953.157:145): avc: denied { open } for pid=381 comm="syz.2.31" path="/dev/uhid" dev="devtmpfs" ino=267 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:uhid_device_t tclass=chr_file permissive=1 [ 27.806209][ T28] audit: type=1400 audit(1792727953.287:146): avc: denied { read } for pid=373 comm="syz.4.28" name="msr" dev="devtmpfs" ino=86 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 27.836681][ T28] audit: type=1400 audit(1792727953.287:147): avc: denied { open } for pid=373 comm="syz.4.28" path="/dev/cpu/0/msr" dev="devtmpfs" ino=86 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 27.860679][ T28] audit: type=1400 audit(1792727953.287:148): avc: denied { mount } for pid=373 comm="syz.4.28" name="/" dev="configfs" ino=13925 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=filesystem permissive=1 [ 27.883907][ T28] audit: type=1400 audit(1792727953.287:149): avc: denied { search } for pid=373 comm="syz.4.28" name="/" dev="configfs" ino=13925 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 27.932415][ T28] audit: type=1400 audit(1792727953.397:150): avc: denied { unmount } for pid=287 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=filesystem permissive=1 [ 27.976259][ T28] audit: type=1400 audit(1792727953.457:151): avc: denied { mmap_zero } for pid=383 comm="syz.3.32" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=memprotect permissive=1 [ 28.001274][ T28] audit: type=1400 audit(1792727953.487:152): avc: denied { unmount } for pid=287 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 28.087659][ T28] audit: type=1400 audit(1792727953.567:153): avc: denied { create } for pid=397 comm="syz.4.37" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 28.297561][ T405] FAULT_INJECTION: forcing a failure. [ 28.297561][ T405] name failslab, interval 1, probability 0, space 0, times 1 [ 28.310427][ T405] CPU: 1 PID: 405 Comm: syz.0.40 Not tainted syzkaller #0 [ 28.317581][ T405] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 28.327690][ T405] Call Trace: [ 28.331016][ T405] [ 28.333973][ T405] __dump_stack+0x21/0x24 [ 28.338345][ T405] dump_stack_lvl+0x110/0x170 [ 28.343046][ T405] ? __cfi_dump_stack_lvl+0x8/0x8 [ 28.348185][ T405] dump_stack+0x15/0x24 [ 28.352401][ T405] should_fail_ex+0x3bf/0x510 [ 28.357110][ T405] ? single_open+0x147/0x280 [ 28.361744][ T405] __should_failslab+0xac/0xf0 [ 28.366562][ T405] should_failslab+0x9/0x20 [ 28.371124][ T405] kmem_cache_alloc+0x3b/0x320 [ 28.372492][ T6] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 28.375920][ T405] ? single_open+0x5a/0x280 [ 28.387913][ T405] single_open+0x147/0x280 [ 28.392398][ T405] state_open+0x4a/0x50 [ 28.396589][ T405] full_proxy_open+0x527/0x820 [ 28.401382][ T405] do_dentry_open+0x885/0x11f0 [ 28.406184][ T405] ? __cfi_full_proxy_open+0x10/0x10 [ 28.411512][ T405] vfs_open+0x73/0x80 [ 28.415532][ T405] path_openat+0x2699/0x2f30 [ 28.420158][ T405] ? slab_post_alloc_hook+0x4f/0x2d0 [ 28.425499][ T405] ? kmem_cache_alloc+0x166/0x320 [ 28.430554][ T405] ? getname_flags+0xba/0x510 [ 28.435258][ T405] ? do_sys_openat2+0xeb/0x820 [ 28.440065][ T405] ? do_filp_open+0x420/0x420 [ 28.444775][ T405] do_filp_open+0x1ee/0x420 [ 28.449324][ T405] ? __cfi_do_filp_open+0x10/0x10 [ 28.454394][ T405] ? alloc_fd+0x4c1/0x570 [ 28.458757][ T405] do_sys_openat2+0x15e/0x820 [ 28.463442][ T405] ? __se_sys_futex+0x136/0x310 [ 28.468290][ T405] ? do_sys_open+0xe0/0xe0 [ 28.472728][ T405] ? __this_cpu_preempt_check+0x13/0x20 [ 28.478279][ T405] ? xfd_validate_state+0x70/0x150 [ 28.483401][ T405] __x64_sys_openat+0x136/0x160 [ 28.488280][ T405] x64_sys_call+0x783/0x9a0 [ 28.492786][ T405] do_syscall_64+0x4c/0xa0 [ 28.497198][ T405] ? clear_bhb_loop+0x30/0x80 [ 28.501887][ T405] ? clear_bhb_loop+0x30/0x80 [ 28.506584][ T405] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 28.512481][ T405] RIP: 0033:0x7f38dab9f559 [ 28.516909][ T405] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 28.536514][ T405] RSP: 002b:00007f38dba30028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 28.544924][ T405] RAX: ffffffffffffffda RBX: 00007f38dae25fa0 RCX: 00007f38dab9f559 [ 28.552893][ T405] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: ffffffffffffff9c [ 28.560868][ T405] RBP: 00007f38dac36b20 R08: 0000000000000000 R09: 0000000000000000 [ 28.562855][ T6] usb 5-1: Using ep0 maxpacket: 8 [ 28.568877][ T405] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 28.568893][ T405] R13: 00007f38dae26038 R14: 00007f38dae25fa0 R15: 00007fff0ce081c8 [ 28.568915][ T405] [ 28.575779][ T6] usb 5-1: config 168 has an invalid descriptor of length 255, skipping remainder of the config [ 28.604720][ T6] usb 5-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 28.616227][ T6] usb 5-1: config 168 interface 0 altsetting 188 has 0 endpoint descriptors, different from the interface descriptor's value: 100 [ 28.629958][ T6] usb 5-1: config 168 interface 0 has no altsetting 0 [ 28.642658][ T6] usb 5-1: config 168 has an invalid descriptor of length 255, skipping remainder of the config [ 28.662402][ T6] usb 5-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 28.675513][ T6] usb 5-1: config 168 interface 0 altsetting 188 has 0 endpoint descriptors, different from the interface descriptor's value: 100 [ 28.696818][ T6] usb 5-1: config 168 interface 0 has no altsetting 0 [ 28.717047][ T6] usb 5-1: config 168 has an invalid descriptor of length 255, skipping remainder of the config [ 28.728706][ T6] usb 5-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 28.761175][ T6] usb 5-1: config 168 interface 0 altsetting 188 has 0 endpoint descriptors, different from the interface descriptor's value: 100 [ 28.778177][ T6] usb 5-1: config 168 interface 0 has no altsetting 0 [ 28.809443][ T6] usb 5-1: string descriptor 0 read error: -22 [ 28.816940][ T6] usb 5-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 28.826561][ T6] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 29.046629][ T310] usb 5-1: USB disconnect, device number 2 [ 29.263246][ T454] device-mapper: ioctl: Geometry exceeds range limits. [ 29.271143][ T291] usb 2-1: USB disconnect, device number 2 [ 29.382460][ T298] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 29.540673][ T460] netlink: 'syz.1.61': attribute type 1 has an invalid length. [ 29.562421][ T298] usb 1-1: Using ep0 maxpacket: 8 [ 29.568768][ T298] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 29.580719][ T298] usb 1-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 29.590406][ T298] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 29.599138][ T298] usb 1-1: config 0 descriptor?? [ 29.847447][ T504] FAULT_INJECTION: forcing a failure. [ 29.847447][ T504] name failslab, interval 1, probability 0, space 0, times 0 [ 29.861477][ T504] CPU: 0 PID: 504 Comm: syz.4.83 Not tainted syzkaller #0 [ 29.868647][ T504] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 29.878736][ T504] Call Trace: [ 29.882046][ T504] [ 29.885012][ T504] __dump_stack+0x21/0x24 [ 29.889375][ T504] dump_stack_lvl+0x110/0x170 [ 29.893640][ T509] tipc: Started in network mode [ 29.894086][ T504] ? __cfi_dump_stack_lvl+0x8/0x8 [ 29.899249][ T509] tipc: Node identity fe9ac6399ba, cluster identity 4711 [ 29.904040][ T504] dump_stack+0x15/0x24 [ 29.904062][ T504] should_fail_ex+0x3bf/0x510 [ 29.911671][ T509] tipc: Enabled bearer , priority 0 [ 29.915269][ T504] __should_failslab+0xac/0xf0 [ 29.915303][ T504] should_failslab+0x9/0x20 [ 29.915325][ T504] __kmem_cache_alloc_node+0x3d/0x2d0 [ 29.924260][ T509] device syzkaller0 entered promiscuous mode [ 29.926696][ T504] ? kobject_uevent_env+0x286/0x720 [ 29.939694][ T509] tipc: Resetting bearer [ 29.941500][ T504] ? __cfi_dev_uevent_name+0x10/0x10 [ 29.963779][ T504] ? kobject_uevent_env+0x286/0x720 [ 29.969019][ T504] kmalloc_trace+0x29/0xb0 [ 29.973476][ T504] ? __cfi_dev_uevent_name+0x10/0x10 [ 29.978788][ T504] kobject_uevent_env+0x286/0x720 [ 29.983882][ T504] kobject_uevent+0x1d/0x30 [ 29.988420][ T504] driver_bound+0x4b4/0x500 [ 29.993086][ T504] really_probe+0x84a/0x9a0 [ 29.997628][ T504] ? __kasan_check_write+0x14/0x20 [ 30.002786][ T504] __driver_probe_device+0x193/0x270 [ 30.008109][ T504] driver_probe_device+0x54/0x3e0 [ 30.013172][ T504] __driver_attach+0x41a/0x5d0 [ 30.018003][ T504] bus_for_each_dev+0x18c/0x200 [ 30.022889][ T504] ? __cfi___driver_attach+0x10/0x10 [ 30.028209][ T504] ? __cfi_bus_for_each_dev+0x10/0x10 [ 30.033704][ T504] ? _raw_spin_unlock+0x4c/0x70 [ 30.038610][ T504] ? klist_add_tail+0x1e5/0x220 [ 30.043461][ T504] driver_attach+0x42/0x50 [ 30.047898][ T504] bus_add_driver+0x322/0x560 [ 30.052577][ T504] driver_register+0x335/0x440 [ 30.057351][ T504] usb_gadget_register_driver_owner+0xf8/0x270 [ 30.063504][ T504] raw_ioctl+0x112c/0x3180 [ 30.067942][ T504] ? ioctl_has_perm+0x3a6/0x4f0 [ 30.072795][ T504] ? __cfi_raw_ioctl+0x10/0x10 [ 30.077561][ T504] ? has_cap_mac_admin+0x370/0x370 [ 30.082679][ T504] ? handle_mm_fault+0x18d8/0x26b0 [ 30.087792][ T504] ? selinux_file_ioctl+0x3ad/0x4c0 [ 30.092997][ T504] ? __cfi_selinux_file_ioctl+0x10/0x10 [ 30.098600][ T504] ? __fget_files+0x2d1/0x330 [ 30.103283][ T504] ? security_file_ioctl+0x95/0xc0 [ 30.108403][ T504] ? __cfi_raw_ioctl+0x10/0x10 [ 30.113213][ T504] __se_sys_ioctl+0x12f/0x1b0 [ 30.117927][ T504] __x64_sys_ioctl+0x7b/0x90 [ 30.122548][ T504] x64_sys_call+0x58b/0x9a0 [ 30.127086][ T504] do_syscall_64+0x4c/0xa0 [ 30.131513][ T504] ? clear_bhb_loop+0x30/0x80 [ 30.136254][ T504] ? clear_bhb_loop+0x30/0x80 [ 30.140954][ T504] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 30.146846][ T504] RIP: 0033:0x7f0d1159f1eb [ 30.151260][ T504] Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00 [ 30.162926][ T298] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 30.170876][ T504] RSP: 002b:00007f0d123aef00 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 30.170902][ T504] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00007f0d1159f1eb [ 30.170916][ T504] RDX: 0000000000000000 RSI: 0000000000005501 RDI: 0000000000000005 [ 30.170928][ T504] RBP: 00007f0d123affd0 R08: 0000000000000001 R09: 00000000ffffffff [ 30.170940][ T504] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 30.170951][ T504] R13: 0000200000000280 R14: 0000000000000005 R15: 0000000000000868 [ 30.170969][ T504] [ 30.231090][ T508] tipc: Resetting bearer [ 30.238426][ T508] tipc: Disabling bearer [ 30.252129][ T520] binder_alloc: 519: pid 519 spamming oneway? 1 buffers allocated for a total size of 4096 [ 30.262770][ T520] binder_alloc: 519: pid 519 spamming oneway? 2 buffers allocated for a total size of 5120 [ 30.310903][ T531] netlink: 8 bytes leftover after parsing attributes in process `syz.2.95'. [ 30.321031][ T531] netlink: 'syz.2.95': attribute type 2 has an invalid length. [ 30.374646][ T539] netlink: 8 bytes leftover after parsing attributes in process `syz.2.95'. [ 30.384221][ T539] netlink: 'syz.2.95': attribute type 2 has an invalid length. [ 30.398843][ T541] netlink: 216 bytes leftover after parsing attributes in process `syz.1.99'. [ 30.412489][ T298] usb 5-1: device descriptor read/64, error -71 [ 30.472748][ T539] Zero length message leads to an empty skb [ 30.506565][ T558] usb usb7: usbfs: process 558 (syz.2.107) did not claim interface 0 before use [ 30.553241][ T568] pci 0000:00:00.0: [8086:1237] type 00 class 0x060000 [ 30.573123][ T570] tmpfs: Unknown parameter 'usrquota' [ 30.682454][ T298] usb 5-1: device descriptor read/64, error -71 [ 30.792426][ T6] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 30.882416][ T40] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 30.952429][ T298] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 30.972398][ T6] usb 4-1: Using ep0 maxpacket: 8 [ 30.978602][ T6] usb 4-1: config index 0 descriptor too short (expected 74, got 45) [ 30.986826][ T6] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 1536, setting to 1024 [ 30.997953][ T6] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 31.008033][ T6] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x8B has invalid maxpacket 30768, setting to 1024 [ 31.019285][ T6] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 1024 [ 31.029511][ T6] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 31.042779][ T6] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 31.051839][ T6] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 31.073630][ T40] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 31.083434][ T40] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 31.094696][ T40] usb 3-1: New USB device found, idVendor=0711, idProduct=0900, bcdDevice= 1.00 [ 31.104020][ T40] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 31.112033][ T40] usb 3-1: Product: syz [ 31.116259][ T298] usb 5-1: device descriptor read/64, error -71 [ 31.123074][ T40] usb 3-1: Manufacturer: syz [ 31.127708][ T40] usb 3-1: SerialNumber: syz [ 31.335426][ T40] usblp 3-1:1.0: usblp0: USB Bidirectional printer dev 2 if 0 alt 0 proto 2 vid 0x0711 pid 0x0900 [ 31.402429][ T298] usb 5-1: device descriptor read/64, error -71 [ 31.409992][ T581] FAULT_INJECTION: forcing a failure. [ 31.409992][ T581] name failslab, interval 1, probability 0, space 0, times 0 [ 31.422728][ T581] CPU: 0 PID: 581 Comm: syz.1.118 Not tainted syzkaller #0 [ 31.429944][ T581] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 31.440000][ T581] Call Trace: [ 31.443290][ T581] [ 31.446244][ T581] __dump_stack+0x21/0x24 [ 31.450596][ T581] dump_stack_lvl+0x110/0x170 [ 31.455287][ T581] ? __cfi_dump_stack_lvl+0x8/0x8 [ 31.460311][ T581] ? __kmem_cache_free+0xb7/0x1b0 [ 31.465356][ T581] ? slab_free_freelist_hook+0xc2/0x190 [ 31.470933][ T581] dump_stack+0x15/0x24 [ 31.475097][ T581] should_fail_ex+0x3bf/0x510 [ 31.479801][ T581] __should_failslab+0xac/0xf0 [ 31.484581][ T581] should_failslab+0x9/0x20 [ 31.489102][ T581] __kmem_cache_alloc_node+0x3d/0x2d0 [ 31.494491][ T581] ? kvm_ioapic_init+0x58/0xec0 [ 31.499353][ T581] ? __cfi_mutex_unlock+0x10/0x10 [ 31.504386][ T581] ? kvm_ioapic_init+0x58/0xec0 [ 31.509246][ T581] kmalloc_trace+0x29/0xb0 [ 31.513672][ T581] kvm_ioapic_init+0x58/0xec0 [ 31.518378][ T581] ? kvm_pic_init+0x210/0x2f0 [ 31.523073][ T581] kvm_arch_vm_ioctl+0x11bc/0x1510 [ 31.523964][ T298] usb usb5-port1: attempt power cycle [ 31.528221][ T581] ? __cfi_kvm_arch_vm_ioctl+0x10/0x10 [ 31.528257][ T581] ? reweight_entity+0x73/0x5c0 [ 31.543948][ T581] ? kvm_sched_clock_read+0x18/0x40 [ 31.549257][ T581] ? save_fpregs_to_fpstate+0x199/0x220 [ 31.554822][ T581] ? __kasan_check_write+0x14/0x20 [ 31.559943][ T581] ? __switch_to+0x56f/0x1070 [ 31.564636][ T581] ? __cfi___switch_to+0x10/0x10 [ 31.569605][ T581] ? _raw_spin_unlock+0x4c/0x70 [ 31.574477][ T581] ? finish_task_switch+0x16b/0x7c0 [ 31.579687][ T581] ? switch_mm_irqs_off+0x2fb/0x960 [ 31.584895][ T581] ? __schedule+0xcbb/0x1700 [ 31.589530][ T581] ? release_firmware_map_entry+0x190/0x190 [ 31.595446][ T581] ? __futex_queue+0x175/0x300 [ 31.600215][ T581] ? __asan_set_shadow_00+0xe/0x10 [ 31.605342][ T581] ? do_vfs_ioctl+0x1b68/0x1cd0 [ 31.610255][ T581] ? __ia32_compat_sys_ioctl+0x860/0x860 [ 31.615909][ T581] ? __kasan_check_read+0x11/0x20 [ 31.620951][ T581] ? schedule+0xd4/0x170 [ 31.625208][ T581] ? futex_unqueue+0x132/0x160 [ 31.629997][ T581] kvm_vm_ioctl+0x78a/0xb00 [ 31.634511][ T581] ? __cfi_kvm_vm_ioctl+0x10/0x10 [ 31.639545][ T581] ? __cfi_futex_wait+0x10/0x10 [ 31.644414][ T581] ? ioctl_has_perm+0x1b8/0x4f0 [ 31.649281][ T581] ? memcpy+0x56/0x70 [ 31.653267][ T581] ? ioctl_has_perm+0x40f/0x4f0 [ 31.658123][ T581] ? has_cap_mac_admin+0x370/0x370 [ 31.663246][ T581] ? vfs_write+0xa51/0xd00 [ 31.667660][ T581] ? do_futex+0x2e2/0x430 [ 31.672024][ T581] ? selinux_file_ioctl+0x3ad/0x4c0 [ 31.677233][ T581] ? __cfi_do_futex+0x10/0x10 [ 31.681906][ T581] ? __cfi_selinux_file_ioctl+0x10/0x10 [ 31.687463][ T581] ? mutex_unlock+0x8f/0x230 [ 31.692113][ T581] ? __fget_files+0x2d1/0x330 [ 31.696818][ T581] ? security_file_ioctl+0x95/0xc0 [ 31.701932][ T581] ? __cfi_kvm_vm_ioctl+0x10/0x10 [ 31.706965][ T581] __se_sys_ioctl+0x12f/0x1b0 [ 31.711655][ T581] __x64_sys_ioctl+0x7b/0x90 [ 31.716256][ T581] x64_sys_call+0x58b/0x9a0 [ 31.720766][ T581] do_syscall_64+0x4c/0xa0 [ 31.725181][ T581] ? clear_bhb_loop+0x30/0x80 [ 31.729876][ T581] ? clear_bhb_loop+0x30/0x80 [ 31.734560][ T581] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 31.740457][ T581] RIP: 0033:0x7fcd3ef9f559 [ 31.744886][ T581] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 31.764495][ T581] RSP: 002b:00007fcd3fe61028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 31.772918][ T581] RAX: ffffffffffffffda RBX: 00007fcd3f225fa0 RCX: 00007fcd3ef9f559 [ 31.780900][ T581] RDX: 0000000000000000 RSI: 000000000000ae60 RDI: 0000000000000004 [ 31.788870][ T581] RBP: 00007fcd3f036b20 R08: 0000000000000000 R09: 0000000000000000 [ 31.796841][ T581] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 31.804817][ T581] R13: 00007fcd3f226038 R14: 00007fcd3f225fa0 R15: 00007fff0effc8d8 [ 31.812800][ T581] [ 31.895256][ T40] usb 3-1: USB disconnect, device number 2 [ 31.913961][ T40] usblp0: removed [ 31.942442][ T298] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 31.973458][ T298] usb 5-1: device descriptor read/8, error -71 [ 32.119337][ T309] usb 1-1: USB disconnect, device number 2 [ 32.143403][ T298] usb 5-1: device descriptor read/8, error -71 [ 32.179519][ T596] FAULT_INJECTION: forcing a failure. [ 32.179519][ T596] name failslab, interval 1, probability 0, space 0, times 0 [ 32.179551][ T596] CPU: 0 PID: 596 Comm: syz.0.123 Not tainted syzkaller #0 [ 32.179573][ T596] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 32.179586][ T596] Call Trace: [ 32.179592][ T596] [ 32.179599][ T596] __dump_stack+0x21/0x24 [ 32.179624][ T596] dump_stack_lvl+0x110/0x170 [ 32.179643][ T596] ? __cfi_dump_stack_lvl+0x8/0x8 [ 32.179664][ T596] ? security_file_alloc+0x33/0x130 [ 32.179686][ T596] dump_stack+0x15/0x24 [ 32.179703][ T596] should_fail_ex+0x3bf/0x510 [ 32.179727][ T596] ? __alloc_file+0x28/0x2a0 [ 32.179753][ T596] __should_failslab+0xac/0xf0 [ 32.179781][ T596] should_failslab+0x9/0x20 [ 32.179802][ T596] kmem_cache_alloc+0x3b/0x320 [ 32.179831][ T596] __alloc_file+0x28/0x2a0 [ 32.179857][ T596] alloc_empty_file+0x97/0x180 [ 32.179882][ T596] alloc_file+0x59/0x600 [ 32.179909][ T596] alloc_file_clone+0x28/0xb0 [ 32.179943][ T596] create_pipe_files+0x3e7/0x6c0 [ 32.179976][ T596] __do_pipe_flags+0x4f/0x200 [ 32.179996][ T596] do_pipe2+0xa7/0x190 [ 32.180014][ T596] ? __this_cpu_preempt_check+0x13/0x20 [ 32.180044][ T596] ? pipe_fcntl+0x510/0x510 [ 32.180065][ T596] ? fpregs_restore_userregs+0x128/0x260 [ 32.309950][ T596] __x64_sys_pipe2+0x5a/0x70 [ 32.314576][ T596] x64_sys_call+0x258/0x9a0 [ 32.314624][ T596] do_syscall_64+0x4c/0xa0 [ 32.314644][ T596] ? clear_bhb_loop+0x30/0x80 [ 32.314671][ T596] ? clear_bhb_loop+0x30/0x80 [ 32.314697][ T596] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 32.314722][ T596] RIP: 0033:0x7f38dab9f559 [ 32.314740][ T596] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 32.314758][ T596] RSP: 002b:00007f38dba30028 EFLAGS: 00000246 ORIG_RAX: 0000000000000125 [ 32.314782][ T596] RAX: ffffffffffffffda RBX: 00007f38dae25fa0 RCX: 00007f38dab9f559 [ 32.314797][ T596] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 32.314809][ T596] RBP: 00007f38dac36b20 R08: 0000000000000000 R09: 0000000000000000 [ 32.314822][ T596] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 32.314834][ T596] R13: 00007f38dae26038 R14: 00007f38dae25fa0 R15: 00007fff0ce081c8 [ 32.314853][ T596] [ 32.386471][ T598] 9pnet_virtio: no channels available for device syz [ 32.442460][ T298] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 32.464145][ T605] FAULT_INJECTION: forcing a failure. [ 32.464145][ T605] name failslab, interval 1, probability 0, space 0, times 0 [ 32.477175][ T605] CPU: 1 PID: 605 Comm: syz.0.127 Not tainted syzkaller #0 [ 32.477206][ T605] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 32.477219][ T605] Call Trace: [ 32.477225][ T605] [ 32.477233][ T605] __dump_stack+0x21/0x24 [ 32.477264][ T605] dump_stack_lvl+0x110/0x170 [ 32.477283][ T605] ? __cfi_dump_stack_lvl+0x8/0x8 [ 32.477305][ T605] dump_stack+0x15/0x24 [ 32.477322][ T605] should_fail_ex+0x3bf/0x510 [ 32.477346][ T605] __should_failslab+0xac/0xf0 [ 32.477374][ T605] should_failslab+0x9/0x20 [ 32.477395][ T605] __kmem_cache_alloc_node+0x3d/0x2d0 [ 32.538416][ T605] ? __request_module+0x2c3/0x910 [ 32.538448][ T605] ? __request_module+0x2c3/0x910 [ 32.538468][ T605] __kmalloc_node_track_caller+0xa1/0x1e0 [ 32.538490][ T605] ? __kasan_kmalloc+0x95/0xb0 [ 32.538517][ T605] kstrdup+0x3b/0x80 [ 32.538533][ T605] __request_module+0x2c3/0x910 [ 32.538552][ T605] ? __cfi___request_module+0x10/0x10 [ 32.538578][ T605] get_fs_type+0x181/0x4e0 [ 32.538601][ T605] __se_sys_fsopen+0x89/0x2f0 [ 32.538620][ T605] __x64_sys_fsopen+0x5b/0x70 [ 32.538636][ T605] x64_sys_call+0x537/0x9a0 [ 32.538658][ T605] do_syscall_64+0x4c/0xa0 [ 32.538675][ T605] ? clear_bhb_loop+0x30/0x80 [ 32.538699][ T605] ? clear_bhb_loop+0x30/0x80 [ 32.538721][ T605] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 32.538744][ T605] RIP: 0033:0x7f38dab9f559 [ 32.538759][ T605] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 32.538775][ T605] RSP: 002b:00007f38dba30028 EFLAGS: 00000246 ORIG_RAX: 00000000000001ae [ 32.538796][ T605] RAX: ffffffffffffffda RBX: 00007f38dae25fa0 RCX: 00007f38dab9f559 [ 32.538810][ T605] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000200000000200 [ 32.538823][ T605] RBP: 00007f38dac36b20 R08: 0000000000000000 R09: 0000000000000000 [ 32.538834][ T605] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 32.538845][ T605] R13: 00007f38dae26038 R14: 00007f38dae25fa0 R15: 00007fff0ce081c8 [ 32.538862][ T605] [ 32.544093][ T298] usb 5-1: device descriptor read/8, error -71 [ 32.703848][ T298] usb 5-1: device descriptor read/8, error -71 [ 32.763187][ T28] kauditd_printk_skb: 66 callbacks suppressed [ 32.763221][ T28] audit: type=1400 audit(1792727958.237:220): avc: denied { connect } for pid=612 comm="syz.1.130" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 32.792228][ T615] mmap: syz.0.131 (615) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 32.807511][ T28] audit: type=1400 audit(1792727958.297:221): avc: denied { create } for pid=616 comm="syz.1.132" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 32.855744][ T28] audit: type=1400 audit(1792727958.337:222): avc: denied { write } for pid=620 comm="syz.1.134" path="socket:[17757]" dev="sockfs" ino=17757 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 32.879922][ T298] usb usb5-port1: unable to enumerate USB device [ 32.963435][ T28] audit: type=1400 audit(1792727958.447:223): avc: denied { create } for pid=628 comm="syz.1.138" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 32.985058][ T627] binder: 626:627 ioctl c0306201 200000000340 returned -14 [ 33.072467][ T28] audit: type=1400 audit(1792727958.527:224): avc: denied { ioctl } for pid=624 comm="syz.0.136" path="socket:[16971]" dev="sockfs" ino=16971 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 33.144422][ T639] 9pnet_virtio: no channels available for device syz [ 33.224400][ T640] ======================================================= [ 33.224400][ T640] WARNING: The mand mount option has been deprecated and [ 33.224400][ T640] and is ignored by this kernel. Remove the mand [ 33.224400][ T640] option from the mount to silence this warning. [ 33.224400][ T640] ======================================================= [ 33.284497][ T642] FAULT_INJECTION: forcing a failure. [ 33.284497][ T642] name failslab, interval 1, probability 0, space 0, times 0 [ 33.297636][ T642] CPU: 1 PID: 642 Comm: syz.0.142 Not tainted syzkaller #0 [ 33.304868][ T642] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 33.314945][ T642] Call Trace: [ 33.318249][ T642] [ 33.321196][ T642] __dump_stack+0x21/0x24 [ 33.325556][ T642] dump_stack_lvl+0x110/0x170 [ 33.330258][ T642] ? __cfi_dump_stack_lvl+0x8/0x8 [ 33.335299][ T642] ? __cfi___switch_to+0x10/0x10 [ 33.340255][ T642] dump_stack+0x15/0x24 [ 33.344432][ T642] should_fail_ex+0x3bf/0x510 [ 33.349152][ T642] __should_failslab+0xac/0xf0 [ 33.353945][ T642] should_failslab+0x9/0x20 [ 33.358487][ T642] slab_pre_alloc_hook+0x30/0x1d0 [ 33.363538][ T642] kmem_cache_alloc_lru+0x49/0x280 [ 33.368694][ T642] ? __d_alloc+0x34/0x6d0 [ 33.373057][ T642] __d_alloc+0x34/0x6d0 [ 33.377248][ T642] d_alloc_parallel+0xe2/0x1280 [ 33.382123][ T642] ? __cfi_d_alloc_parallel+0x10/0x10 [ 33.387514][ T642] ? __kasan_check_read+0x11/0x20 [ 33.392568][ T642] ? preempt_schedule_common+0xbe/0xf0 [ 33.398067][ T642] ? preempt_schedule+0xbc/0xd0 [ 33.402966][ T642] ? __cfi_preempt_schedule+0x10/0x10 [ 33.408376][ T642] ? rwsem_read_trylock+0x2af/0x640 [ 33.413606][ T642] __lookup_slow+0x14f/0x410 [ 33.418226][ T642] ? lookup_one_len+0x2e0/0x2e0 [ 33.423101][ T642] ? down_read+0xe9/0xf0 [ 33.427376][ T642] ? __cfi_down_read+0x10/0x10 [ 33.432348][ T642] lookup_slow+0x57/0x70 [ 33.436629][ T642] link_path_walk+0x984/0xeb0 [ 33.441326][ T642] ? handle_lookup_down+0x130/0x130 [ 33.446553][ T642] path_openat+0x27f/0x2f30 [ 33.451085][ T642] ? release_firmware_map_entry+0x190/0x190 [ 33.457022][ T642] ? do_sys_openat2+0xeb/0x820 [ 33.461816][ T642] ? entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 33.467911][ T642] ? do_filp_open+0x420/0x420 [ 33.472620][ T642] do_filp_open+0x1ee/0x420 [ 33.477162][ T642] ? __cfi_do_filp_open+0x10/0x10 [ 33.482211][ T642] ? __cfi_kfree_link+0x10/0x10 [ 33.487083][ T642] ? alloc_fd+0x4c1/0x570 [ 33.491439][ T642] do_sys_openat2+0x15e/0x820 [ 33.496151][ T642] ? do_sys_open+0xe0/0xe0 [ 33.500597][ T642] ? __this_cpu_preempt_check+0x13/0x20 [ 33.506163][ T642] ? xfd_validate_state+0x70/0x150 [ 33.511292][ T642] __x64_sys_openat+0x136/0x160 [ 33.516173][ T642] x64_sys_call+0x783/0x9a0 [ 33.520687][ T642] do_syscall_64+0x4c/0xa0 [ 33.525117][ T642] ? clear_bhb_loop+0x30/0x80 [ 33.529814][ T642] ? clear_bhb_loop+0x30/0x80 [ 33.534519][ T642] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 33.540446][ T642] RIP: 0033:0x7f38dab5fd8e [ 33.544901][ T642] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 33.564528][ T642] RSP: 002b:00007f38dba2fec8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 33.572974][ T642] RAX: ffffffffffffffda RBX: 00007f38dba306c0 RCX: 00007f38dab5fd8e [ 33.580960][ T642] RDX: 0000000000000002 RSI: 00007f38dba2ff90 RDI: ffffffffffffff9c [ 33.588944][ T642] RBP: 00007f38dac36b20 R08: 0000000000000000 R09: 0000000000000000 [ 33.596924][ T642] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 33.604905][ T642] R13: 00007f38dae26038 R14: 00007f38dae25fa0 R15: 00007fff0ce081c8 [ 33.612900][ T642] [ 33.638185][ T632] syz.1.139 (632) used greatest stack depth: 21352 bytes left [ 33.653860][ T298] usb 4-1: USB disconnect, device number 2 [ 33.671347][ T28] audit: type=1400 audit(1792727959.147:225): avc: denied { write } for pid=645 comm="syz.1.143" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=key permissive=1 [ 33.717610][ T28] audit: type=1400 audit(1792727959.187:226): avc: denied { read } for pid=651 comm="syz.0.147" name="rtc0" dev="devtmpfs" ino=263 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 33.741880][ T28] audit: type=1400 audit(1792727959.187:227): avc: denied { open } for pid=651 comm="syz.0.147" path="/dev/rtc0" dev="devtmpfs" ino=263 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 33.766265][ T28] audit: type=1400 audit(1792727959.187:228): avc: denied { ioctl } for pid=651 comm="syz.0.147" path="/dev/rtc0" dev="devtmpfs" ino=263 ioctlcmd=0x7003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 33.766418][ T655] netlink: 16 bytes leftover after parsing attributes in process `syz.2.148'. [ 33.806044][ T28] audit: type=1400 audit(1792727959.287:229): avc: denied { connect } for pid=656 comm="syz.3.149" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 33.826779][ T662] tmpfs: Unknown parameter 'usrquota' [ 34.053261][ T696] FAULT_INJECTION: forcing a failure. [ 34.053261][ T696] name failslab, interval 1, probability 0, space 0, times 0 [ 34.071740][ T696] CPU: 0 PID: 696 Comm: syz.2.163 Not tainted syzkaller #0 [ 34.078995][ T696] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 34.089093][ T696] Call Trace: [ 34.092401][ T696] [ 34.095350][ T696] __dump_stack+0x21/0x24 [ 34.099721][ T696] dump_stack_lvl+0x110/0x170 [ 34.104437][ T696] ? __cfi_dump_stack_lvl+0x8/0x8 [ 34.109491][ T696] dump_stack+0x15/0x24 [ 34.113683][ T696] should_fail_ex+0x3bf/0x510 [ 34.118407][ T696] __should_failslab+0xac/0xf0 [ 34.123208][ T696] should_failslab+0x9/0x20 [ 34.127742][ T696] __kmem_cache_alloc_node+0x3d/0x2d0 [ 34.133158][ T696] ? fib_default_rule_add+0x55/0x3d0 [ 34.138483][ T696] ? kasan_save_alloc_info+0x1f/0x30 [ 34.143797][ T696] ? fib_default_rule_add+0x55/0x3d0 [ 34.149117][ T696] __kmalloc+0xa4/0x1e0 [ 34.153313][ T696] fib_default_rule_add+0x55/0x3d0 [ 34.158493][ T696] fib4_rules_init+0x9b/0x170 [ 34.163224][ T696] fib_net_init+0x123/0x2e0 [ 34.167777][ T696] ? __cfi_fib_net_init+0x10/0x10 [ 34.172871][ T696] ? register_net_sysctl+0x23f/0x250 [ 34.178200][ T696] ? memcpy+0x56/0x70 [ 34.182220][ T696] ? devinet_init_net+0x377/0x5b0 [ 34.187304][ T696] ops_init+0x2ce/0x470 [ 34.191499][ T696] setup_net+0x4b4/0xcd0 [ 34.193475][ T702] device-mapper: table: 252:1: multipath: unknown target type [ 34.195787][ T696] ? copy_net_ns+0x5c0/0x5c0 [ 34.195811][ T696] ? __kasan_kmalloc+0x95/0xb0 [ 34.212630][ T696] ? copy_net_ns+0x185/0x5c0 [ 34.214151][ T702] device-mapper: ioctl: error adding target to table [ 34.217267][ T696] copy_net_ns+0x355/0x5c0 [ 34.228436][ T696] create_new_namespaces+0x3a8/0x660 [ 34.233773][ T696] unshare_nsproxy_namespaces+0x120/0x170 [ 34.239538][ T696] ksys_unshare+0x4d5/0x850 [ 34.244085][ T696] ? __cfi_ksys_unshare+0x10/0x10 [ 34.249190][ T696] ? fpregs_restore_userregs+0x128/0x260 [ 34.254864][ T696] __x64_sys_unshare+0x38/0x40 [ 34.259676][ T696] x64_sys_call+0x767/0x9a0 [ 34.264248][ T696] do_syscall_64+0x4c/0xa0 [ 34.268719][ T696] ? clear_bhb_loop+0x30/0x80 [ 34.272490][ T298] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 34.273427][ T696] ? clear_bhb_loop+0x30/0x80 [ 34.285591][ T696] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 34.291519][ T696] RIP: 0033:0x7faf57b9f559 [ 34.295962][ T696] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 34.315602][ T696] RSP: 002b:00007faf589c2028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 34.324067][ T696] RAX: ffffffffffffffda RBX: 00007faf57e25fa0 RCX: 00007faf57b9f559 [ 34.332163][ T696] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000040000000 [ 34.340158][ T696] RBP: 00007faf57c36b20 R08: 0000000000000000 R09: 0000000000000000 [ 34.348156][ T696] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 34.356155][ T696] R13: 00007faf57e26038 R14: 00007faf57e25fa0 R15: 00007ffe2c2bd038 [ 34.364164][ T696] [ 34.470641][ T720] netlink: 4 bytes leftover after parsing attributes in process `syz.4.175'. [ 34.483473][ T298] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 34.499941][ T298] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 34.514687][ T298] usb 4-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 34.527490][ T298] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 34.539946][ T298] usb 4-1: config 0 descriptor?? [ 34.749695][ T298] usbhid 4-1:0.0: can't add hid device: -71 [ 34.757155][ T298] usbhid: probe of 4-1:0.0 failed with error -71 [ 34.771333][ T298] usb 4-1: USB disconnect, device number 3 [ 35.122394][ T310] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 35.222413][ T298] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 35.302414][ T310] usb 1-1: Using ep0 maxpacket: 8 [ 35.318552][ T310] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 35.331396][ T310] usb 1-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 35.340840][ T310] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 35.353311][ T310] usb 1-1: config 0 descriptor?? [ 35.353329][ T802] netlink: 28 bytes leftover after parsing attributes in process `syz.4.212'. [ 35.422974][ T810] device-mapper: table: 252:2: integrity: unknown target type [ 35.432825][ T810] device-mapper: ioctl: error adding target to table [ 35.440132][ T298] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 35.451442][ T813] fscrypt (sda1, inode 1262): Can't use IV_INO_LBLK_64 policy with contents mode other than AES-256-XTS [ 35.479321][ T298] usb 2-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 35.503512][ T298] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 35.529836][ T298] usb 2-1: config 0 descriptor?? [ 35.604984][ T830] loop0: detected capacity change from 0 to 1 [ 35.653033][ T830] loop0: [ 35.661071][ T102] loop0: [ 35.749136][ T298] usbhid 2-1:0.0: can't add hid device: -71 [ 35.755309][ T298] usbhid: probe of 2-1:0.0 failed with error -71 [ 35.766973][ T298] usb 2-1: USB disconnect, device number 3 [ 35.776298][ T843] tipc: Started in network mode [ 35.781307][ T843] tipc: Node identity 7f000001, cluster identity 4711 [ 35.788585][ T843] tipc: Enabled bearer , priority 10 [ 35.796919][ T843] netlink: 104 bytes leftover after parsing attributes in process `syz.4.231'. [ 35.807949][ T843] tipc: Enabling of bearer rejected, failed to enable media [ 35.817363][ T846] device-mapper: table: 252:3: cache: unknown target type [ 35.824610][ T846] device-mapper: ioctl: error adding target to table [ 36.126784][ T877] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 36.342442][ T298] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 36.412393][ T588] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 36.532392][ T298] usb 2-1: Using ep0 maxpacket: 32 [ 36.538833][ T298] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 36.549786][ T298] usb 2-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice= 0.40 [ 36.558882][ T298] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 36.568335][ T298] usb 2-1: config 0 descriptor?? [ 36.602419][ T588] usb 5-1: Using ep0 maxpacket: 8 [ 36.608704][ T588] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 36.619678][ T588] usb 5-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 36.628777][ T588] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 36.638065][ T588] usb 5-1: config 0 descriptor?? [ 36.782411][ T588] tipc: Node number set to 2130706433 [ 37.152420][ T6] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 37.333628][ T6] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 0, changing to 7 [ 37.344563][ T6] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 37.354871][ T6] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8A has an invalid bInterval 0, changing to 7 [ 37.366019][ T6] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8A has invalid wMaxPacketSize 0 [ 37.379217][ T6] usb 3-1: New USB device found, idVendor=0a07, idProduct=00d0, bcdDevice=10.13 [ 37.388591][ T6] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 37.396675][ T6] usb 3-1: Product: syz [ 37.400932][ T6] usb 3-1: Manufacturer: syz [ 37.405607][ T6] usb 3-1: SerialNumber: syz [ 37.411268][ T6] usb 3-1: config 0 descriptor?? [ 37.870418][ T6] usb 1-1: USB disconnect, device number 3 [ 38.061022][ T28] kauditd_printk_skb: 32 callbacks suppressed [ 38.061036][ T28] audit: type=1400 audit(1792727963.537:262): avc: denied { write } for pid=931 comm="syz.0.267" name="ptp0" dev="devtmpfs" ino=264 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 38.098729][ T934] device bridge1 entered promiscuous mode [ 38.117796][ T936] device-mapper: table: 252:4: integrity: unknown target type [ 38.125383][ T936] device-mapper: ioctl: error adding target to table                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              [ 39.359244][ T28] audit: type=1400 audit(1792727964.817:267): avc: denied { read write } for pid=997 comm="getty" name="utmp" dev="tmpfs" ino=2 scontext=system_u:system_r:getty_t tcontext=system_u:object_r:init_tmpfs_t tclass=file permissive=1 [ 39.390057][ T28] audit: type=1400 audit(1792727964.817:268): avc: denied { open } for pid=997 comm="getty" path="/run/utmp" dev="tmpfs" ino=2 scontext=system_u:system_r:getty_t tcontext=system_u:object_r:init_tmpfs_t tclass=file permissive=1 [ 39.414852][ T28] audit: type=1400 audit(1792727964.817:269): avc: denied { lock } for pid=997 comm="getty" path="/run/utmp" dev="tmpfs" ino=2 scontext=system_u:system_r:getty_t tcontext=system_u:object_r:init_tmpfs_t tclass=file permissive=1 [ 39.437903][ T28] audit: type=1400 audit(1792727964.867:270): avc: denied { append } for pid=1001 comm="syz.4.297" name="kvm" dev="devtmpfs" ino=83 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 syzkaller syzk[ 39.463370][ T28] audit: type=1400 audit(1792727964.947:271): avc: denied { name_bind } for pid=1000 comm="syz.3.298" src=20000 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=udp_socket permissive=1 aller login: [ 39.851785][ T1037] device veth0 entered promiscuous mode [ 39.857730][ T1036] device veth0 left promiscuous mode [ 39.900528][ T291] usb 3-1: USB disconnect, device number 3 [ 39.910445][ T1047] FAULT_INJECTION: forcing a failure. [ 39.910445][ T1047] name failslab, interval 1, probability 0, space 0, times 0 [ 39.940302][ T1047] CPU: 0 PID: 1047 Comm: syz.1.317 Not tainted syzkaller #0 [ 39.947665][ T1047] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 39.957762][ T1047] Call Trace: [ 39.961077][ T1047] [ 39.964076][ T1047] __dump_stack+0x21/0x24 [ 39.968447][ T1047] dump_stack_lvl+0x110/0x170 [ 39.973163][ T1047] ? __cfi_dump_stack_lvl+0x8/0x8 [ 39.978232][ T1047] dump_stack+0x15/0x24 [ 39.982444][ T1047] should_fail_ex+0x3bf/0x510 [ 39.987162][ T1047] __should_failslab+0xac/0xf0 [ 39.991984][ T1047] should_failslab+0x9/0x20 [ 39.996549][ T1047] __kmem_cache_alloc_node+0x3d/0x2d0 [ 40.001970][ T1047] ? create_filter_start+0xc5/0x2d0 [ 40.007232][ T1047] ? create_filter_start+0xc5/0x2d0 [ 40.012484][ T1047] kmalloc_trace+0x29/0xb0 [ 40.016936][ T1047] create_filter_start+0xc5/0x2d0 [ 40.022012][ T1047] ? apply_event_filter+0x8c/0x5c0 [ 40.027182][ T1047] apply_event_filter+0x168/0x5c0 [ 40.032286][ T1047] ? __kasan_check_write+0x14/0x20 [ 40.037444][ T1047] event_filter_write+0xda/0x150 [ 40.042425][ T1047] ? __cfi_event_filter_write+0x10/0x10 [ 40.046149][ T1054] netlink: 32 bytes leftover after parsing attributes in process `syz.0.321'. [ 40.048022][ T1047] vfs_write+0x3fb/0xd00 [ 40.057252][ T1054] netlink: 16 bytes leftover after parsing attributes in process `syz.0.321'. [ 40.061155][ T1047] ? __cfi_vfs_write+0x10/0x10 [ 40.070368][ T1054] netlink: 16 bytes leftover after parsing attributes in process `syz.0.321'. [ 40.074790][ T1047] ? __kasan_check_write+0x14/0x20 [ 40.074817][ T1047] ? mutex_lock+0x93/0x1b0 [ 40.093314][ T1047] ? __cfi_mutex_lock+0x10/0x10 [ 40.098219][ T1047] ? __fdget_pos+0x2cd/0x380 [ 40.102848][ T1047] ? ksys_write+0x70/0x260 [ 40.107297][ T1047] ksys_write+0x14a/0x260 [ 40.111663][ T1047] ? __cfi_ksys_write+0x10/0x10 [ 40.116549][ T1047] ? fpregs_restore_userregs+0x128/0x260 [ 40.122234][ T1047] __x64_sys_write+0x7b/0x90 [ 40.122263][ T1047] x64_sys_call+0x27b/0x9a0 [ 40.122289][ T1047] do_syscall_64+0x4c/0xa0 [ 40.122310][ T1047] ? clear_bhb_loop+0x30/0x80 [ 40.122335][ T1047] ? clear_bhb_loop+0x30/0x80 [ 40.122361][ T1047] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 40.122384][ T1047] RIP: 0033:0x7fcd3ef9f559 [ 40.122402][ T1047] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 40.122420][ T1047] RSP: 002b:00007fcd3fe61028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 40.122443][ T1047] RAX: ffffffffffffffda RBX: 00007fcd3f225fa0 RCX: 00007fcd3ef9f559 [ 40.122458][ T1047] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 [ 40.122470][ T1047] RBP: 00007fcd3f036b20 R08: 0000000000000000 R09: 0000000000000000 [ 40.122483][ T1047] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 40.122496][ T1047] R13: 00007fcd3f226038 R14: 00007fcd3f225fa0 R15: 00007fff0effc8d8 [ 40.122516][ T1047] [ 40.266037][ T1063] FAULT_INJECTION: forcing a failure. [ 40.266037][ T1063] name failslab, interval 1, probability 0, space 0, times 0 [ 40.280640][ T1063] CPU: 1 PID: 1063 Comm: syz.2.324 Not tainted syzkaller #0 [ 40.283754][ T310] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 40.288022][ T1063] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 40.305588][ T1063] Call Trace: [ 40.308947][ T1063] [ 40.311922][ T1063] __dump_stack+0x21/0x24 [ 40.316301][ T1063] dump_stack_lvl+0x110/0x170 [ 40.321011][ T1063] ? __cfi_dump_stack_lvl+0x8/0x8 [ 40.326039][ T1063] ? __kmem_cache_free+0xb7/0x1b0 [ 40.331130][ T1063] ? slab_free_freelist_hook+0xc2/0x190 [ 40.336680][ T1063] dump_stack+0x15/0x24 [ 40.340860][ T1063] should_fail_ex+0x3bf/0x510 [ 40.345577][ T1063] __should_failslab+0xac/0xf0 [ 40.350370][ T1063] should_failslab+0x9/0x20 [ 40.354894][ T1063] __kmem_cache_alloc_node+0x3d/0x2d0 [ 40.360295][ T1063] ? kvm_ioapic_init+0x58/0xec0 [ 40.365197][ T1063] ? __cfi_mutex_unlock+0x10/0x10 [ 40.370255][ T1063] ? kvm_ioapic_init+0x58/0xec0 [ 40.375126][ T1063] kmalloc_trace+0x29/0xb0 [ 40.379560][ T1063] kvm_ioapic_init+0x58/0xec0 [ 40.384262][ T1063] ? kvm_pic_init+0x210/0x2f0 [ 40.389051][ T1063] kvm_arch_vm_ioctl+0x11bc/0x1510 [ 40.394192][ T1063] ? xfd_validate_state+0x70/0x150 [ 40.399346][ T1063] ? __cfi_kvm_arch_vm_ioctl+0x10/0x10 [ 40.404827][ T1063] ? save_fpregs_to_fpstate+0x199/0x220 [ 40.410399][ T1063] ? __kasan_check_write+0x14/0x20 [ 40.415532][ T1063] ? __switch_to+0x56f/0x1070 [ 40.420241][ T1063] ? _raw_spin_unlock+0x4c/0x70 [ 40.425145][ T1063] ? finish_task_switch+0x16b/0x7c0 [ 40.430368][ T1063] ? switch_mm_irqs_off+0x2fb/0x960 [ 40.435672][ T1063] ? __schedule+0xcbb/0x1700 [ 40.440291][ T1063] ? release_firmware_map_entry+0x190/0x190 [ 40.446199][ T1063] ? check_preempt_wakeup+0x619/0xbe0 [ 40.451584][ T1063] ? __kasan_check_read+0x11/0x20 [ 40.456629][ T1063] ? preempt_schedule_common+0xbe/0xf0 [ 40.462107][ T1063] ? preempt_schedule+0xbc/0xd0 [ 40.466970][ T1063] ? __cfi_preempt_schedule+0x10/0x10 [ 40.472363][ T1063] ? ttwu_do_wakeup+0x468/0x490 [ 40.477238][ T1063] ? __asan_set_shadow_00+0xe/0x10 [ 40.482376][ T1063] ? do_vfs_ioctl+0x1b68/0x1cd0 [ 40.487252][ T1063] ? __ia32_compat_sys_ioctl+0x860/0x860 [ 40.492904][ T1063] ? try_to_wake_up+0x6c6/0x1250 [ 40.497868][ T1063] kvm_vm_ioctl+0x78a/0xb00 [ 40.502398][ T1063] ? __cfi_kvm_vm_ioctl+0x10/0x10 [ 40.507541][ T1063] ? futex_wake+0x5fa/0x8e0 [ 40.512068][ T1063] ? ioctl_has_perm+0x1b8/0x4f0 [ 40.516950][ T1063] ? memcpy+0x56/0x70 [ 40.520967][ T1063] ? ioctl_has_perm+0x40f/0x4f0 [ 40.525853][ T1063] ? has_cap_mac_admin+0x370/0x370 [ 40.530989][ T1063] ? vfs_write+0xa51/0xd00 [ 40.535427][ T1063] ? do_futex+0x2bf/0x430 [ 40.539804][ T1063] ? selinux_file_ioctl+0x3ad/0x4c0 [ 40.545028][ T1063] ? __cfi_do_futex+0x10/0x10 [ 40.549724][ T1063] ? __cfi_selinux_file_ioctl+0x10/0x10 [ 40.555299][ T1063] ? mutex_unlock+0x8f/0x230 [ 40.559913][ T1063] ? __fget_files+0x2d1/0x330 [ 40.564607][ T1063] ? security_file_ioctl+0x95/0xc0 [ 40.569737][ T1063] ? __cfi_kvm_vm_ioctl+0x10/0x10 [ 40.574787][ T1063] __se_sys_ioctl+0x12f/0x1b0 [ 40.579485][ T1063] __x64_sys_ioctl+0x7b/0x90 [ 40.584096][ T1063] x64_sys_call+0x58b/0x9a0 [ 40.588623][ T1063] do_syscall_64+0x4c/0xa0 [ 40.593088][ T1063] ? clear_bhb_loop+0x30/0x80 [ 40.597785][ T1063] ? clear_bhb_loop+0x30/0x80 [ 40.602489][ T1063] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 40.608400][ T1063] RIP: 0033:0x7faf57b9f559 [ 40.612829][ T1063] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 40.632574][ T1063] RSP: 002b:00007faf589c2028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 40.641046][ T1063] RAX: ffffffffffffffda RBX: 00007faf57e25fa0 RCX: 00007faf57b9f559 [ 40.649138][ T1063] RDX: 0000000000000000 RSI: 000000000000ae60 RDI: 0000000000000004 [ 40.657154][ T1063] RBP: 00007faf57c36b20 R08: 0000000000000000 R09: 0000000000000000 [ 40.665155][ T1063] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 40.673156][ T1063] R13: 00007faf57e26038 R14: 00007faf57e25fa0 R15: 00007ffe2c2bd038 [ 40.681160][ T1063] [ 40.783525][ T310] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 40.797349][ T310] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 40.807677][ T310] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 40.825445][ T310] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 40.836771][ T310] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 40.848187][ T310] usb 5-1: config 0 descriptor?? [ 40.909416][ T24] input: syz0 as /devices/virtual/misc/uhid/0003:1B1C:0C10.0001/input/input5 [ 40.920327][ T24] hid-generic 0003:1B1C:0C10.0001: input,hidraw0: USB HID v0.00 Device [syz0] on syz0 [ 40.991953][ T1098] fido_id[1098]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 41.033720][ T1118] netlink: 24 bytes leftover after parsing attributes in process `syz.0.347'. [ 41.044648][ T1115] device-mapper: table: 252:1: crypt: Error decoding and setting key (-EINVAL) [ 41.053805][ T1115] device-mapper: ioctl: error adding target to table [ 41.134988][ T1136] device bridge2 entered promiscuous mode [ 41.259015][ T310] plantronics 0003:047F:FFFF.0002: No inputs registered, leaving [ 41.274122][ T310] plantronics 0003:047F:FFFF.0002: hiddev96,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.4-1/input0 [ 41.359470][ T1157] capability: warning: `syz.0.364' uses deprecated v2 capabilities in a way that may be insecure [ 41.372825][ T1157] Need at least one configuration in g1. [ 41.378546][ T1157] udc dummy_udc.0: failed to start g1: -22 [ 41.384799][ T1157] configfs-gadget.g1: probe of gadget.0 failed with error -22 [ 41.393476][ T1157] UDC core: g1: couldn't find an available UDC or it's busy [ 41.440626][ T1171] netlink: 4 bytes leftover after parsing attributes in process `syz.3.370'. [ 41.498561][ T1186] loop2: detected capacity change from 0 to 128 [ 41.510964][ T1186] FAT-fs (loop2): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 41.514505][ T1185] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=1185 comm=syz.3.376 [ 41.537213][ T310] usb 5-1: USB disconnect, device number 8 [ 41.543512][ T1186] FAT-fs (loop2): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1) [ 41.579633][ T308] FAT-fs (loop2): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1) [ 41.581116][ T1193] loop0: detected capacity change from 0 to 256 [ 41.638275][ T1193] FAT-fs (loop0): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 41.695656][ T1211] loop4: detected capacity change from 0 to 7 [ 41.703253][ C0] I/O error, dev loop4, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 41.712533][ C0] Buffer I/O error on dev loop4, logical block 0, async page read [ 41.721473][ C1] I/O error, dev loop4, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 41.730684][ C1] Buffer I/O error on dev loop4, logical block 0, async page read [ 41.738592][ T452] loop4: unable to read partition table [ 41.746173][ T1215] Invalid ELF header len 1 [ 41.792690][ C0] I/O error, dev loop4, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 41.801899][ C0] Buffer I/O error on dev loop4, logical block 0, async page read [ 41.810118][ C0] I/O error, dev loop4, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 41.819304][ C0] Buffer I/O error on dev loop4, logical block 0, async page read [ 41.827400][ T1211] loop4: unable to read partition table [ 41.834998][ C0] I/O error, dev loop4, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 41.844279][ C0] Buffer I/O error on dev loop4, logical block 0, async page read [ 41.853187][ T1211] loop_reread_partitions: partition scan of loop4 (Cj̖P=ý?}X %֐ȵ4FLQk݊5) failed (rc=-5) [ 41.865663][ C0] I/O error, dev loop4, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 41.865700][ C0] Buffer I/O error on dev loop4, logical block 0, async page read [ 41.883151][ C0] I/O error, dev loop4, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 41.892311][ C0] Buffer I/O error on dev loop4, logical block 0, async page read [ 41.900581][ C0] I/O error, dev loop4, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 41.909774][ C0] Buffer I/O error on dev loop4, logical block 0, async page read [ 41.922357][ C0] I/O error, dev loop4, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 41.931551][ C0] Buffer I/O error on dev loop4, logical block 0, async page read [ 41.953637][ T1237] 9p: Unknown Cache mode read)ahead [ 41.959114][ T1237] 9p: Unknown Cache mode [ 42.101278][ T1265] loop4: detected capacity change from 0 to 256 [ 42.193176][ T1282] overlayfs: The uuid=off requires a single fs for lower and upper, falling back to uuid=on. [ 42.240682][ T1287] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 42.265290][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): bond_slave_0: link becomes ready [ 42.278137][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 42.300790][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): bond_slave_1: link becomes ready [ 42.312473][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 42.324544][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 42.336621][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 42.349355][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 42.360810][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 42.436542][ T1302] device gretap1 entered promiscuous mode [ 42.869059][ T1384] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=1384 comm=syz.4.467 [ 43.178003][ T1419] fuse: Bad value for 'fd' [ 43.186319][ T1419] process 'syz.3.486' launched './file0' with NULL argv: empty string added [ 43.196149][ T28] kauditd_printk_skb: 48 callbacks suppressed [ 43.196164][ T28] audit: type=1400 audit(1792727968.677:320): avc: denied { execute } for pid=1418 comm="syz.3.486" name="file0" dev="tmpfs" ino=592 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 43.440878][ T1448] A link change request failed with some changes committed already. Interface gre1 may have been left with an inconsistent configuration, please check. [ 43.557764][ T1465] overlayfs: failed to clone upperpath [ 43.633814][ T1470] fuse: Bad value for 'fd' [ 43.807093][ T28] audit: type=1400 audit(1792727969.287:321): avc: denied { mounton } for pid=1485 comm="syz.0.516" path="/116/file0" dev="tmpfs" ino=631 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=fifo_file permissive=1 [ 43.809243][ T1488] fuse: Bad value for 'fd' [ 43.851029][ T1488] 9pnet_fd: Insufficient options for proto=fd [ 43.980668][ T1510] overlayfs: failed to clone upperpath [ 43.986983][ T1510] overlayfs: failed to clone upperpath [ 43.993057][ T28] audit: type=1400 audit(1792727969.477:322): avc: denied { remount } for pid=1509 comm="syz.0.528" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 44.194901][ T28] audit: type=1400 audit(1792727969.677:323): avc: denied { mount } for pid=1522 comm="syz.3.535" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 44.481710][ T28] audit: type=1400 audit(1792727969.957:324): avc: denied { ioctl } for pid=1551 comm="syz.1.548" path="/dev/input/event0" dev="devtmpfs" ino=260 ioctlcmd=0x4593 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 44.554011][ T1557] netlink: 12 bytes leftover after parsing attributes in process `syz.1.550'. [ 44.580115][ T1559] overlayfs: failed to clone upperpath [ 44.586723][ T1557] netlink: 8 bytes leftover after parsing attributes in process `syz.1.550'. [ 44.642851][ T28] audit: type=1400 audit(1792727970.127:325): avc: denied { name_bind } for pid=1562 comm="syz.1.553" src=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:reserved_port_t tclass=tcp_socket permissive=1 [ 44.743932][ T1567] loop1: detected capacity change from 0 to 8192 [ 44.931035][ T1594] loop2: detected capacity change from 0 to 512 [ 44.965371][ T1594] FAT-fs (loop2): Invalid FSINFO signature: 0x41615252, 0x61000000 (sector = 1) [ 45.084260][ T1608] overlayfs: failed to clone upperpath [ 45.230773][ T1621] loop2: detected capacity change from 0 to 8192 [ 45.289082][ T28] audit: type=1400 audit(1792727970.767:326): avc: denied { bind } for pid=1637 comm="syz.1.587" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 45.337339][ T28] audit: type=1400 audit(1792727970.787:327): avc: denied { name_bind } for pid=1637 comm="syz.1.587" src=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=icmp_socket permissive=1 [ 45.423983][ T28] audit: type=1400 audit(1792727970.787:328): avc: denied { node_bind } for pid=1637 comm="syz.1.587" src=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=icmp_socket permissive=1 [ 45.581747][ T1666] loop1: detected capacity change from 0 to 16 [ 45.610728][ T28] audit: type=1400 audit(1792727971.087:329): avc: denied { write } for pid=1667 comm="syz.2.601" name="icmp6" dev="proc" ino=4026532609 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_net_t tclass=file permissive=1 [ 45.646096][ T1666] erofs: (device loop1): erofs_init_device: empty device tag @ pos 0 [ 45.682539][ T1674] loop2: detected capacity change from 0 to 256 [ 45.723830][ T1676] overlayfs: The uuid=off requires a single fs for lower and upper, falling back to uuid=on. [ 45.735934][ T1674] FAT-fs (loop2): Directory bread(block 64) failed [ 45.760098][ T1674] FAT-fs (loop2): Directory bread(block 65) failed [ 45.772410][ T1674] FAT-fs (loop2): Directory bread(block 66) failed [ 45.792654][ T1674] FAT-fs (loop2): Directory bread(block 67) failed [ 45.805413][ T1674] FAT-fs (loop2): Directory bread(block 68) failed [ 45.814195][ T1686] netlink: 8 bytes leftover after parsing attributes in process `syz.4.611'. [ 45.823259][ T1674] FAT-fs (loop2): Directory bread(block 69) failed [ 45.829841][ T1674] FAT-fs (loop2): Directory bread(block 70) failed [ 45.846493][ T1674] FAT-fs (loop2): Directory bread(block 71) failed [ 45.879265][ T1674] FAT-fs (loop2): Directory bread(block 72) failed [ 45.885976][ T1674] FAT-fs (loop2): Directory bread(block 73) failed [ 45.906898][ T1696] ip_tables: iptables: counters copy to user failed while replacing table [ 45.956383][ T1699] loop2: detected capacity change from 0 to 16 [ 46.007513][ T1699] erofs: (device loop2): mounted with root inode @ nid 36. [ 46.027416][ T1699] erofs: (device loop2): z_erofs_readahead: readahead error at page 2 @ nid 89 [ 46.041519][ T1699] syz.2.616: attempt to access beyond end of device [ 46.041519][ T1699] loop2: rw=524288, sector=524296, nr_sectors = 8 limit=16 [ 46.067470][ T1699] syz.2.616: attempt to access beyond end of device [ 46.067470][ T1699] loop2: rw=0, sector=524296, nr_sectors = 8 limit=16 [ 46.081416][ T1699] syz.2.616: attempt to access beyond end of device [ 46.081416][ T1699] loop2: rw=0, sector=524296, nr_sectors = 8 limit=16 [ 46.111158][ T1710] FAT-fs (loop1): Unrecognized mount option "tz=UTC>shortname=win95" or missing value [ 46.141459][ T1699] erofs: (device loop2): z_erofs_lz4_decompress_mem: failed to decompress -5 in[4096, 0] out[4100] [ 46.155235][ T1699] syz.2.616: attempt to access beyond end of device [ 46.155235][ T1699] loop2: rw=0, sector=524296, nr_sectors = 8 limit=16 [ 46.170775][ T1699] erofs: (device loop2): z_erofs_lz4_decompress_mem: failed to decompress -5 in[4096, 0] out[4100] [ 46.183063][ T1699] syz.2.616: attempt to access beyond end of device [ 46.183063][ T1699] loop2: rw=0, sector=524296, nr_sectors = 8 limit=16 [ 46.197233][ T1699] erofs: (device loop2): z_erofs_lz4_decompress_mem: failed to decompress -5 in[4096, 0] out[4100] [ 46.561763][ T1744] device erspan1 entered promiscuous mode [ 46.592748][ T1746] netlink: 4 bytes leftover after parsing attributes in process `syz.2.635'. [ 46.739072][ T1753] set_capacity_and_notify: 1 callbacks suppressed [ 46.739091][ T1753] loop1: detected capacity change from 0 to 512 [ 46.840504][ T1757] netlink: 'syz.4.640': attribute type 4 has an invalid length. [ 46.865976][ T1759] loop1: detected capacity change from 0 to 16 [ 46.867066][ T1757] netlink: 96 bytes leftover after parsing attributes in process `syz.4.640'. [ 46.901943][ T1759] erofs: (device loop1): mounted with root inode @ nid 36. [ 47.167858][ T1782] fuse: Bad value for 'fd' [ 47.687152][ T1815] bridge0: port 2(bridge_slave_1) entered disabled state [ 47.702905][ T1815] syz.0.666 (1815) used greatest stack depth: 21120 bytes left [ 47.797874][ T1824] netlink: 40 bytes leftover after parsing attributes in process `syz.0.670'. [ 47.806954][ T1824] netlink: 40 bytes leftover after parsing attributes in process `syz.0.670'. [ 47.816146][ T1823] netlink: 40 bytes leftover after parsing attributes in process `syz.0.670'. [ 47.825304][ T1823] netlink: 40 bytes leftover after parsing attributes in process `syz.0.670'. [ 47.834469][ T1823] netlink: 40 bytes leftover after parsing attributes in process `syz.0.670'. [ 47.843524][ T1823] netlink: 40 bytes leftover after parsing attributes in process `syz.0.670'. [ 47.852550][ T1823] netlink: 40 bytes leftover after parsing attributes in process `syz.0.670'. [ 48.067263][ T1830] loop1: detected capacity change from 0 to 128 [ 48.074056][ T1830] FAT-fs (loop1): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 48.096393][ T1830] FAT-fs (loop1): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1) [ 48.116558][ T43] FAT-fs (loop1): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1) [ 48.353165][ T1847] overlayfs: option "index=on" is useless in a non-upper mount, ignore [ 48.361539][ T1847] overlayfs: conflicting options: userxattr,redirect_dir=on [ 48.529022][ T28] kauditd_printk_skb: 4 callbacks suppressed [ 48.529039][ T28] audit: type=1400 audit(1792727974.007:334): avc: denied { bind } for pid=1873 comm="syz.2.692" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 48.556246][ T28] audit: type=1400 audit(1792727974.007:335): avc: denied { setopt } for pid=1873 comm="syz.2.692" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 48.652825][ T28] audit: type=1400 audit(1792727974.137:336): avc: denied { name_bind } for pid=1887 comm="syz.1.699" src=128 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:reserved_port_t tclass=udp_socket permissive=1 [ 48.714578][ T1894] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 48.748330][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth2: link becomes ready [ 48.762770][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): bond_slave_0: link becomes ready [ 48.778717][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 48.796274][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): bond_slave_1: link becomes ready [ 48.813597][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 48.831206][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 48.849724][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 48.863811][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 48.872147][ T308] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 48.913417][ T1901] fuse: Bad value for 'fd' [ 49.000567][ T1909] loop2: detected capacity change from 0 to 512 [ 50.291527][ T28] audit: type=1400 audit(1792727975.767:337): avc: denied { execute } for pid=1916 comm="syz.3.713" path="/file1" dev="ramfs" ino=22527 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:ramfs_t tclass=file permissive=1 [ 51.370025][ T1928] fuse: Bad value for 'fd' [ 51.463799][ T1944] __nla_validate_parse: 26 callbacks suppressed [ 51.463820][ T1944] netlink: 60 bytes leftover after parsing attributes in process `syz.1.723'. [ 51.529862][ T1952] fuse: Bad value for 'fd' [ 51.649397][ T1989] netlink: 'syz.1.746': attribute type 4 has an invalid length. [ 51.660703][ T1989] netlink: 'syz.1.746': attribute type 4 has an invalid length. [ 51.683162][ T1989] syz.1.746 (1989) used greatest stack depth: 21056 bytes left [ 52.161737][ T28] audit: type=1400 audit(1792727977.637:338): avc: denied { read } for pid=2045 comm="syz.1.771" lport=2 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 52.251934][ T2059] loop2: detected capacity change from 0 to 128 [ 52.289819][ T28] audit: type=1400 audit(1792727977.767:339): avc: denied { execute_no_trans } for pid=2061 comm="syz.2.778" path="/162/file1" dev="tmpfs" ino=874 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 52.427102][ T2072] netlink: 32 bytes leftover after parsing attributes in process `syz.0.782'. [ 52.479136][ T28] audit: type=1400 audit(1792727977.957:340): avc: denied { write } for pid=2079 comm="syz.0.786" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 52.518995][ T28] audit: type=1400 audit(1792727977.997:341): avc: denied { watch watch_reads } for pid=2083 comm="syz.2.788" path="/165" dev="tmpfs" ino=886 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 52.567156][ T28] audit: type=1400 audit(1792727978.047:342): avc: denied { mount } for pid=2087 comm="syz.0.790" name="/" dev="bpf" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bpf_t tclass=filesystem permissive=1 [ 52.671186][ T2113] loop2: detected capacity change from 0 to 512 [ 52.678670][ T28] audit: type=1400 audit(1792727978.157:343): avc: denied { mounton } for pid=2109 comm="syz.0.800" path="/165/file0" dev="tmpfs" ino=893 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 52.713557][ T2115] device veth1_to_bond entered promiscuous mode [ 52.720323][ T2115] netlink: 4 bytes leftover after parsing attributes in process `syz.3.803'. [ 52.733895][ T2115] device veth1_to_bond left promiscuous mode [ 52.762671][ T2121] netlink: 12 bytes leftover after parsing attributes in process `syz.2.805'. [ 52.837396][ T2138] netlink: 6 bytes leftover after parsing attributes in process `syz.2.815'. [ 52.876440][ T2143] bridge0: port 3(ip6gretap0) entered blocking state [ 52.883299][ T2143] bridge0: port 3(ip6gretap0) entered disabled state [ 52.891113][ T2143] device ip6gretap0 entered promiscuous mode [ 52.897580][ T2143] bridge0: port 3(ip6gretap0) entered blocking state [ 52.904425][ T2143] bridge0: port 3(ip6gretap0) entered forwarding state [ 53.063571][ T2150] fuse: Bad value for 'fd' [ 53.484901][ T2195] bridge0: port 2(bridge_slave_1) entered disabled state [ 53.611752][ T28] kauditd_printk_skb: 6 callbacks suppressed [ 53.611768][ T28] audit: type=1400 audit(1792727979.087:350): avc: denied { remount } for pid=2213 comm="syz.1.849" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 53.668850][ T2222] netlink: 588 bytes leftover after parsing attributes in process `syz.1.853'. [ 53.678551][ T2222] A link change request failed with some changes committed already. Interface bridge_slave_1 may have been left with an inconsistent configuration, please check. [ 53.938440][ T2231] FAULT_INJECTION: forcing a failure. [ 53.938440][ T2231] name failslab, interval 1, probability 0, space 0, times 0 [ 53.954056][ T2231] CPU: 1 PID: 2231 Comm: syz.1.857 Not tainted syzkaller #0 [ 53.961401][ T2231] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 53.971489][ T2231] Call Trace: [ 53.974798][ T2231] [ 53.977759][ T2231] __dump_stack+0x21/0x24 [ 53.982175][ T2231] dump_stack_lvl+0x110/0x170 [ 53.986886][ T2231] ? __cfi_dump_stack_lvl+0x8/0x8 [ 53.991969][ T2231] ? kasan_save_alloc_info+0x1f/0x30 [ 53.997282][ T2231] ? kmalloc_trace+0x40/0xb0 [ 54.001906][ T2231] ? pty_unix98_install+0xd9/0x540 [ 54.007061][ T2231] ? tty_init_dev+0xde/0x4e0 [ 54.011697][ T2231] ? chrdev_open+0x593/0x600 [ 54.016326][ T2231] ? do_dentry_open+0x885/0x11f0 [ 54.021305][ T2231] ? vfs_open+0x73/0x80 [ 54.025509][ T2231] ? path_openat+0x2699/0x2f30 [ 54.030324][ T2231] dump_stack+0x15/0x24 [ 54.034508][ T2231] should_fail_ex+0x3bf/0x510 [ 54.039218][ T2231] __should_failslab+0xac/0xf0 [ 54.044024][ T2231] should_failslab+0x9/0x20 [ 54.048558][ T2231] __kmem_cache_alloc_node+0x3d/0x2d0 [ 54.054011][ T2231] ? alloc_tty_struct+0xa3/0x760 [ 54.058992][ T2231] ? alloc_tty_struct+0xa3/0x760 [ 54.059493][ T2271] fuse: Bad value for 'fd' [ 54.063965][ T2231] kmalloc_trace+0x29/0xb0 [ 54.063997][ T2231] alloc_tty_struct+0xa3/0x760 [ 54.064030][ T2231] ? __cfi_alloc_tty_struct+0x10/0x10 [ 54.064062][ T2231] ? kasan_save_alloc_info+0x1f/0x30 [ 54.068703][ T28] audit: type=1400 audit(1792727979.497:351): avc: denied { setopt } for pid=2268 comm="syz.4.874" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 54.072939][ T2231] ? __kasan_kmalloc+0x95/0xb0 [ 54.072973][ T2231] ? pty_unix98_install+0xd9/0x540 [ 54.117612][ T2231] ? kmalloc_trace+0x40/0xb0 [ 54.122233][ T2231] pty_unix98_install+0x178/0x540 [ 54.127310][ T2231] tty_init_dev+0xde/0x4e0 [ 54.131783][ T2231] ptmx_open+0xdd/0x2f0 [ 54.135984][ T2231] chrdev_open+0x593/0x600 [ 54.140442][ T2231] ? __cfi_chrdev_open+0x10/0x10 [ 54.145415][ T2231] ? fsnotify_perm+0x3e9/0x5b0 [ 54.150250][ T2231] do_dentry_open+0x885/0x11f0 [ 54.155065][ T2231] ? __cfi_chrdev_open+0x10/0x10 [ 54.160042][ T2231] vfs_open+0x73/0x80 [ 54.164072][ T2231] path_openat+0x2699/0x2f30 [ 54.168723][ T2231] ? slab_post_alloc_hook+0x4f/0x2d0 [ 54.174121][ T2231] ? kmem_cache_alloc+0x166/0x320 [ 54.179202][ T2231] ? getname_flags+0xba/0x510 [ 54.183914][ T2231] ? do_sys_openat2+0xeb/0x820 [ 54.188723][ T2231] ? do_filp_open+0x420/0x420 [ 54.193442][ T2231] do_filp_open+0x1ee/0x420 [ 54.197982][ T2231] ? __cfi_do_filp_open+0x10/0x10 [ 54.203049][ T2231] ? alloc_fd+0x4c1/0x570 [ 54.207419][ T2231] do_sys_openat2+0x15e/0x820 [ 54.212146][ T2231] ? __se_sys_futex+0x136/0x310 [ 54.217038][ T2231] ? do_sys_open+0xe0/0xe0 [ 54.221487][ T2231] ? __x64_sys_futex+0x100/0x100 [ 54.226465][ T2231] __x64_sys_openat+0x136/0x160 [ 54.231371][ T2231] x64_sys_call+0x783/0x9a0 [ 54.235920][ T2231] do_syscall_64+0x4c/0xa0 [ 54.240456][ T2231] ? clear_bhb_loop+0x30/0x80 [ 54.245171][ T2231] ? clear_bhb_loop+0x30/0x80 [ 54.249891][ T2231] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 54.255877][ T2231] RIP: 0033:0x7fcd3ef9f559 [ 54.260328][ T2231] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 54.279981][ T2231] RSP: 002b:00007fcd3fe61028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 54.288433][ T2231] RAX: ffffffffffffffda RBX: 00007fcd3f225fa0 RCX: 00007fcd3ef9f559 [ 54.296439][ T2231] RDX: 0000000000121301 RSI: 000020000001d9c0 RDI: ffffffffffffff9c [ 54.304463][ T2231] RBP: 00007fcd3f036b20 R08: 0000000000000000 R09: 0000000000000000 [ 54.312485][ T2231] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 54.320484][ T2231] R13: 00007fcd3f226038 R14: 00007fcd3f225fa0 R15: 00007fff0effc8d8 [ 54.328601][ T2231] [ 54.581240][ T2298] loop2: detected capacity change from 0 to 7 [ 54.618182][ T28] audit: type=1326 audit(1792727980.097:352): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2302 comm="syz.0.889" exe="/root/ci2-android-6-1/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f38dab9f559 code=0x0 [ 54.713691][ T2324] netlink: 'syz.4.901': attribute type 12 has an invalid length. [ 54.758364][ T2330] fuse: Bad value for 'fd' [ 54.803899][ T28] audit: type=1400 audit(1792727980.287:353): avc: denied { execute } for pid=2335 comm="syz.1.906" dev="tmpfs" ino=1063 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 54.839045][ T28] audit: type=1400 audit(1792727980.317:354): avc: denied { execute_no_trans } for pid=2335 comm="syz.1.906" path=2F6D656D66643A5B0BDB58A65B35A990FF631F1AA9FDFAADD16D64E7E27F9BD55210F3B6FF54BFD1C8854858A9250C1A65E0202864656C6574656429 dev="tmpfs" ino=1063 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 55.077391][ T2349] loop5: detected capacity change from 0 to 1 [ 55.225640][ T43] loop: Write error at byte offset 4, length 512. [ 55.232130][ C0] I/O error, dev loop5, sector 0 op 0x1:(WRITE) flags 0x800 phys_seg 1 prio class 2 [ 55.241562][ C0] Buffer I/O error on dev loop5, logical block 0, lost async page write [ 55.273457][ T2356] device gretap0 entered promiscuous mode [ 55.279371][ T2356] device vlan2 entered promiscuous mode [ 55.499513][ T2398] loop1: detected capacity change from 0 to 16 [ 55.517557][ T2398] erofs: (device loop1): mounted with root inode @ nid 36. [ 55.692459][ T28] audit: type=1400 audit(1792727981.177:355): avc: denied { read write } for pid=2411 comm="syz.2.939" name="file0" dev="fuse" ino=16390 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=blk_file permissive=1 [ 55.715950][ T28] audit: type=1400 audit(1792727981.177:356): avc: denied { open } for pid=2411 comm="syz.2.939" path="/183/file0/file0" dev="fuse" ino=16390 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=blk_file permissive=1 [ 55.748943][ T2429] device vlan0 entered promiscuous mode [ 55.795141][ T2434] loop2: detected capacity change from 0 to 256 [ 55.816492][ T2436] overlayfs: empty lowerdir [ 55.831547][ T2434] FAT-fs (loop2): Directory bread(block 64) failed [ 55.839820][ T2434] FAT-fs (loop2): Directory bread(block 65) failed [ 55.846875][ T2434] FAT-fs (loop2): Directory bread(block 66) failed [ 55.853883][ T2434] FAT-fs (loop2): Directory bread(block 67) failed [ 55.860692][ T2434] FAT-fs (loop2): Directory bread(block 68) failed [ 55.867336][ T2434] FAT-fs (loop2): Directory bread(block 69) failed [ 55.874344][ T2434] FAT-fs (loop2): Directory bread(block 70) failed [ 55.880931][ T2434] FAT-fs (loop2): Directory bread(block 71) failed [ 55.887678][ T2434] FAT-fs (loop2): Directory bread(block 72) failed [ 55.894284][ T2434] FAT-fs (loop2): Directory bread(block 73) failed [ 55.914635][ T28] audit: type=1400 audit(1792727981.397:357): avc: denied { mounton } for pid=2441 comm="syz.4.953" path="/199/file0" dev="tmpfs" ino=1069 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 55.964699][ T2448] A link change request failed with some changes committed already. Interface gre2 may have been left with an inconsistent configuration, please check. [ 55.981382][ T2450] capability: warning: `syz.2.955' uses 32-bit capabilities (legacy support in use) [ 55.994691][ T2450] overlayfs: failed to set xattr on upper [ 56.022585][ T28] audit: type=1326 audit(1792727981.497:358): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2454 comm="syz.2.959" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faf57b9f559 code=0x7ffc0000 [ 56.051623][ T28] audit: type=1326 audit(1792727981.497:359): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2454 comm="syz.2.959" exe="/root/ci2-android-6-1/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faf57b9f559 code=0x7ffc0000 [ 56.115691][ T2466] tmpfs: Bad value for 'gid' [ 56.221818][ T2476] overlayfs: failed to clone upperpath [ 56.391144][ T2505] netlink: 48 bytes leftover after parsing attributes in process `syz.3.983'. [ 56.461954][ T2517] netlink: 28 bytes leftover after parsing attributes in process `syz.4.989'. [ 56.610035][ T2540] netlink: 68 bytes leftover after parsing attributes in process `syz.0.999'. [ 57.388422][ T2574] netlink: 68 bytes leftover after parsing attributes in process `syz.4.1012'. [ 57.416625][ T2576] FAULT_INJECTION: forcing a failure. [ 57.416625][ T2576] name failslab, interval 1, probability 0, space 0, times 0 [ 57.431760][ T2576] CPU: 0 PID: 2576 Comm: syz.2.1014 Not tainted syzkaller #0 [ 57.439180][ T2576] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 57.449303][ T2576] Call Trace: [ 57.452608][ T2576] [ 57.455563][ T2576] __dump_stack+0x21/0x24 [ 57.459925][ T2576] dump_stack_lvl+0x110/0x170 [ 57.464630][ T2576] ? __cfi_dump_stack_lvl+0x8/0x8 [ 57.469683][ T2576] dump_stack+0x15/0x24 [ 57.473866][ T2576] should_fail_ex+0x3bf/0x510 [ 57.478569][ T2576] ? __kernfs_new_node+0xe1/0x670 [ 57.483615][ T2576] __should_failslab+0xac/0xf0 [ 57.488411][ T2576] should_failslab+0x9/0x20 [ 57.492945][ T2576] kmem_cache_alloc+0x3b/0x320 [ 57.497783][ T2576] __kernfs_new_node+0xe1/0x670 [ 57.502659][ T2576] ? kernfs_new_node+0x260/0x260 [ 57.507626][ T2576] ? ktime_get_real_ts64+0x253/0x2e0 [ 57.512938][ T2576] ? kasan_save_alloc_info+0x1f/0x30 [ 57.518266][ T2576] ? __kasan_check_write+0x14/0x20 [ 57.523419][ T2576] ? mutex_unlock+0x8f/0x230 [ 57.528047][ T2576] ? __cfi_mutex_unlock+0x10/0x10 [ 57.533104][ T2576] kernfs_new_node+0x150/0x260 [ 57.537904][ T2576] __kernfs_create_file+0x4e/0x270 [ 57.543078][ T2576] cgroup_addrm_files+0x701/0xbb0 [ 57.548156][ T2576] ? trace_raw_output_cgroup_event+0x1e0/0x1e0 [ 57.554376][ T2576] ? kasan_save_alloc_info+0x1f/0x30 [ 57.559702][ T2576] ? __kernfs_iattrs+0x97/0x2f0 [ 57.564578][ T2576] ? __kernfs_iattrs+0x13c/0x2f0 [ 57.569571][ T2576] css_populate_dir+0x1b4/0x370 [ 57.574449][ T2576] cgroup_mkdir+0x12d8/0x1550 [ 57.579166][ T2576] ? __cfi_cgroup_mkdir+0x10/0x10 [ 57.584222][ T2576] ? up_read+0x56/0x1d0 [ 57.588417][ T2576] ? __cfi_cgroup_mkdir+0x10/0x10 [ 57.593470][ T2576] kernfs_iop_mkdir+0x1b1/0x2b0 [ 57.598347][ T2576] vfs_mkdir+0x39c/0x580 [ 57.602622][ T2576] do_mkdirat+0x174/0x4d0 [ 57.606987][ T2576] __x64_sys_mkdirat+0x89/0xa0 [ 57.611793][ T2576] x64_sys_call+0x73d/0x9a0 [ 57.616336][ T2576] do_syscall_64+0x4c/0xa0 [ 57.620782][ T2576] ? clear_bhb_loop+0x30/0x80 [ 57.625492][ T2576] ? clear_bhb_loop+0x30/0x80 [ 57.630218][ T2576] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 57.636176][ T2576] RIP: 0033:0x7faf57b9f559 [ 57.640703][ T2576] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 57.660359][ T2576] RSP: 002b:00007faf589c2028 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 [ 57.668811][ T2576] RAX: ffffffffffffffda RBX: 00007faf57e25fa0 RCX: 00007faf57b9f559 [ 57.676825][ T2576] RDX: 00000000000001ff RSI: 0000200000000000 RDI: ffffffffffffff9c [ 57.684832][ T2576] RBP: 00007faf57c36b20 R08: 0000000000000000 R09: 0000000000000000 [ 57.692833][ T2576] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 57.700832][ T2576] R13: 00007faf57e26038 R14: 00007faf57e25fa0 R15: 00007ffe2c2bd038 [ 57.708844][ T2576] [ 57.716474][ T2576] cgroup: cgroup_addrm_files: failed to add notify_on_release, err=-12 [ 60.260399][ T2603] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=16 sclass=netlink_audit_socket pid=2603 comm=syz.3.1025 [ 60.275995][ T28] kauditd_printk_skb: 19 callbacks suppressed [ 60.276011][ T28] audit: type=1400 audit(1792727985.757:379): avc: denied { nlmsg_write } for pid=2602 comm="syz.3.1025" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_audit_socket permissive=1 [ 61.302633][ T28] audit: type=1400 audit(1792727986.777:380): avc: denied { execmem } for pid=2608 comm="syz.2.1028" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 61.410283][ T2609] fuse: Bad value for 'fd' [ 61.755462][ T28] audit: type=1400 audit(1792727987.237:381): avc: denied { bind } for pid=2638 comm="syz.0.1049" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 61.777280][ T28] audit: type=1400 audit(1792727987.257:382): avc: denied { setopt } for pid=2638 comm="syz.0.1049" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 63.392161][ T28] audit: type=1400 audit(1792727988.867:383): avc: denied { mounton } for pid=2656 comm="syz.2.1043" path="/201/proc/443/task/444/fail-nth" dev="proc" ino=24744 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=file permissive=1 [ 63.416834][ T2661] FAULT_INJECTION: forcing a failure. [ 63.416834][ T2661] name failslab, interval 1, probability 0, space 0, times 0 [ 63.433807][ T2661] CPU: 0 PID: 2661 Comm: syz.2.1043 Not tainted syzkaller #0 [ 63.441267][ T2661] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 63.451363][ T2661] Call Trace: [ 63.454669][ T2661] [ 63.457622][ T2661] __dump_stack+0x21/0x24 [ 63.462033][ T2661] dump_stack_lvl+0x110/0x170 [ 63.466734][ T2661] ? __cfi_dump_stack_lvl+0x8/0x8 [ 63.471852][ T2661] dump_stack+0x15/0x24 [ 63.476065][ T2661] should_fail_ex+0x3bf/0x510 [ 63.480776][ T2661] __should_failslab+0xac/0xf0 [ 63.485589][ T2661] should_failslab+0x9/0x20 [ 63.490157][ T2661] __kmem_cache_alloc_node+0x3d/0x2d0 [ 63.495591][ T2661] ? get_mountpoint+0x20b/0x440 [ 63.500482][ T2661] ? get_mountpoint+0x20b/0x440 [ 63.505373][ T2661] kmalloc_trace+0x29/0xb0 [ 63.509818][ T2661] get_mountpoint+0x20b/0x440 [ 63.514560][ T2661] lock_mount+0xbc/0x2b0 [ 63.518838][ T2661] do_new_mount+0x37d/0xb40 [ 63.523360][ T2661] ? security_capable+0x99/0xc0 [ 63.528244][ T2661] path_mount+0x640/0xfd0 [ 63.532624][ T2661] __se_sys_mount+0x320/0x390 [ 63.537339][ T2661] ? __this_cpu_preempt_check+0x13/0x20 [ 63.542925][ T2661] ? __x64_sys_mount+0xd0/0xd0 [ 63.547752][ T2661] ? __kasan_check_write+0x14/0x20 [ 63.552893][ T2661] ? fpregs_restore_userregs+0x128/0x260 [ 63.558558][ T2661] __x64_sys_mount+0xbf/0xd0 [ 63.563175][ T2661] x64_sys_call+0x65d/0x9a0 [ 63.567709][ T2661] do_syscall_64+0x4c/0xa0 [ 63.572146][ T2661] ? clear_bhb_loop+0x30/0x80 [ 63.576858][ T2661] ? clear_bhb_loop+0x30/0x80 [ 63.581569][ T2661] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 63.587510][ T2661] RIP: 0033:0x7faf57b9f559 [ 63.591958][ T2661] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 63.611618][ T2661] RSP: 002b:00007faf589c2028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 63.620080][ T2661] RAX: ffffffffffffffda RBX: 00007faf57e25fa0 RCX: 00007faf57b9f559 [ 63.628092][ T2661] RDX: 00002000000003c0 RSI: 0000200000000380 RDI: 0000000000000000 [ 63.636098][ T2661] RBP: 00007faf57c36b20 R08: 0000000000000000 R09: 0000000000000000 [ 63.644094][ T2661] R10: 0000000002000000 R11: 0000000000000246 R12: 0000000000000000 [ 63.649837][ T2673] xt_hashlimit: overflow, try lower: 0/0 [ 63.652085][ T2661] R13: 00007faf57e26038 R14: 00007faf57e25fa0 R15: 00007ffe2c2bd038 [ 63.652109][ T2661] [ 64.054477][ T2696] overlayfs: failed to clone upperpath [ 66.364835][ T2717] FAULT_INJECTION: forcing a failure. [ 66.364835][ T2717] name fail_futex, interval 1, probability 0, space 0, times 0 [ 66.377868][ T2717] CPU: 1 PID: 2717 Comm: syz.2.1072 Not tainted syzkaller #0 [ 66.385291][ T2717] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 66.395400][ T2717] Call Trace: [ 66.398731][ T2717] [ 66.401685][ T2717] __dump_stack+0x21/0x24 [ 66.406134][ T2717] dump_stack_lvl+0x110/0x170 [ 66.410851][ T2717] ? __cfi_dump_stack_lvl+0x8/0x8 [ 66.415909][ T2717] ? __stack_depot_save+0x36/0x490 [ 66.421061][ T2717] dump_stack+0x15/0x24 [ 66.425245][ T2717] should_fail_ex+0x3bf/0x510 [ 66.429998][ T2717] should_fail+0xb/0x10 [ 66.434185][ T2717] get_futex_key+0x143/0xb10 [ 66.438824][ T2717] ? __cfi_get_futex_key+0x10/0x10 [ 66.443979][ T2717] futex_wake+0x150/0x8e0 [ 66.448345][ T2717] ? __cfi_futex_wake+0x10/0x10 [ 66.453238][ T2717] ? kasan_quarantine_put+0x34/0x190 [ 66.458567][ T2717] ? kmem_cache_free+0x12d/0x300 [ 66.463539][ T2717] ? __kasan_slab_free+0x11/0x20 [ 66.468521][ T2717] do_futex+0x2bf/0x430 [ 66.472722][ T2717] ? __cfi_do_futex+0x10/0x10 [ 66.477414][ T2717] __se_sys_futex+0x136/0x310 [ 66.482090][ T2717] ? __x64_sys_futex+0x100/0x100 [ 66.487037][ T2717] ? xfd_validate_state+0x70/0x150 [ 66.492182][ T2717] __x64_sys_futex+0xe5/0x100 [ 66.496863][ T2717] x64_sys_call+0x7ec/0x9a0 [ 66.501407][ T2717] do_syscall_64+0x4c/0xa0 [ 66.505833][ T2717] ? clear_bhb_loop+0x30/0x80 [ 66.510531][ T2717] ? clear_bhb_loop+0x30/0x80 [ 66.515229][ T2717] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 66.521130][ T2717] RIP: 0033:0x7faf57b9f559 [ 66.525546][ T2717] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 66.545155][ T2717] RSP: 002b:00007faf589c20e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 66.553581][ T2717] RAX: ffffffffffffffda RBX: 00007faf57e25fa8 RCX: 00007faf57b9f559 [ 66.561566][ T2717] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007faf57e25fac [ 66.569547][ T2717] RBP: 00007faf57e25fa0 R08: 00128b3a392fb090 R09: 0000000000000000 [ 66.577518][ T2717] R10: 0000000000000004 R11: 0000000000000246 R12: 0000000000000000 [ 66.585493][ T2717] R13: 00007faf57e26038 R14: 00007ffe2c2bcf50 R15: 00007ffe2c2bd038 [ 66.593486][ T2717] [ 67.182962][ T2741] device-mapper: ioctl: Geometry exceeds range limits. [ 67.191927][ T2748] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1082'. [ 68.322929][ T19] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 68.364757][ T362] bridge0: port 3(ip6gretap0) entered disabled state [ 68.386032][ T362] device ip6gretap0 left promiscuous mode [ 68.391808][ T362] bridge0: port 3(ip6gretap0) entered disabled state [ 68.503577][ T19] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 68.514518][ T19] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 68.524522][ T19] usb 2-1: New USB device found, idVendor=1e7d, idProduct=2d5a, bcdDevice= 0.00 [ 68.533656][ T19] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 68.543098][ T19] usb 2-1: config 0 descriptor?? [ 68.843143][ T362] device bridge_slave_1 left promiscuous mode [ 68.849435][ T362] bridge0: port 2(bridge_slave_1) entered disabled state [ 68.857265][ T362] device bridge_slave_0 left promiscuous mode [ 68.863535][ T362] bridge0: port 1(bridge_slave_0) entered disabled state [ 68.892762][ T362] device veth1_macvtap left promiscuous mode [ 68.898968][ T362] device veth0_vlan left promiscuous mode [ 68.952193][ T19] savu 0003:1E7D:2D5A.0003: hidraw0: USB HID v0.00 Device [HID 1e7d:2d5a] on usb-dummy_hcd.1-1/input0 [ 68.981802][ T28] audit: type=1400 audit(1792727994.457:384): avc: denied { mounton } for pid=2828 comm="syz-executor" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 69.079364][ T2828] bridge0: port 1(bridge_slave_0) entered blocking state [ 69.086443][ T2828] bridge0: port 1(bridge_slave_0) entered disabled state [ 69.093919][ T2828] device bridge_slave_0 entered promiscuous mode [ 69.100865][ T2828] bridge0: port 2(bridge_slave_1) entered blocking state [ 69.107946][ T2828] bridge0: port 2(bridge_slave_1) entered disabled state [ 69.115752][ T2828] device bridge_slave_1 entered promiscuous mode [ 69.163606][ T2828] bridge0: port 2(bridge_slave_1) entered blocking state [ 69.170661][ T2828] bridge0: port 2(bridge_slave_1) entered forwarding state [ 69.177974][ T2828] bridge0: port 1(bridge_slave_0) entered blocking state [ 69.185050][ T2828] bridge0: port 1(bridge_slave_0) entered forwarding state [ 69.205892][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 69.211074][ T588] usb 2-1: USB disconnect, device number 5 [ 69.220398][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 69.228769][ T588] ================================================================== [ 69.236869][ T588] BUG: KASAN: use-after-free in roccat_disconnect+0x22d/0x240 [ 69.244340][ T588] Read of size 4 at addr ffff88810f7e8c08 by task kworker/1:4/588 [ 69.252166][ T588] [ 69.254484][ T588] CPU: 1 PID: 588 Comm: kworker/1:4 Not tainted syzkaller #0 [ 69.261890][ T588] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 69.271945][ T588] Workqueue: usb_hub_wq hub_event [ 69.276978][ T588] Call Trace: [ 69.280256][ T588] [ 69.283194][ T588] __dump_stack+0x21/0x24 [ 69.287549][ T588] dump_stack_lvl+0x110/0x170 [ 69.292241][ T588] ? __cfi_dump_stack_lvl+0x8/0x8 [ 69.297260][ T588] ? __cfi__printk+0x8/0x8 [ 69.301673][ T588] ? kfree_const+0x39/0x40 [ 69.306092][ T588] ? roccat_disconnect+0x22d/0x240 [ 69.311208][ T588] print_address_description+0x71/0x200 [ 69.316761][ T588] print_report+0x4a/0x60 [ 69.321096][ T588] kasan_report+0x122/0x150 [ 69.325627][ T588] ? roccat_disconnect+0x22d/0x240 [ 69.330755][ T588] __asan_report_load4_noabort+0x14/0x20 [ 69.336412][ T588] roccat_disconnect+0x22d/0x240 [ 69.341384][ T588] savu_remove+0xec/0x170 [ 69.345722][ T588] ? __cfi_savu_remove+0x10/0x10 [ 69.350676][ T588] hid_device_remove+0x292/0x3c0 [ 69.355619][ T588] ? __cfi_hid_device_remove+0x10/0x10 [ 69.361075][ T588] device_release_driver_internal+0x486/0x7e0 [ 69.367148][ T588] device_release_driver+0x19/0x20 [ 69.372263][ T588] bus_remove_device+0x2f0/0x350 [ 69.377198][ T588] device_del+0x63c/0xe50 [ 69.381533][ T588] ? __cfi_device_del+0x10/0x10 [ 69.386394][ T588] ? __kasan_check_write+0x14/0x20 [ 69.391504][ T588] ? _raw_spin_lock_irq+0x95/0xf0 [ 69.396527][ T588] ? __cfi__raw_spin_lock_irq+0x10/0x10 [ 69.402095][ T588] hid_destroy_device+0x6a/0x110 [ 69.407029][ T588] usbhid_disconnect+0x9f/0xc0 [ 69.411799][ T588] usb_unbind_interface+0x223/0x8b0 [ 69.416998][ T588] ? kernfs_remove_by_name_ns+0x120/0x160 [ 69.422727][ T588] ? __cfi_usb_unbind_interface+0x10/0x10 [ 69.428484][ T588] device_release_driver_internal+0x4e4/0x7e0 [ 69.434573][ T588] device_release_driver+0x19/0x20 [ 69.439714][ T588] bus_remove_device+0x2f0/0x350 [ 69.444666][ T588] device_del+0x63c/0xe50 [ 69.448997][ T588] ? __cfi_device_del+0x10/0x10 [ 69.453871][ T588] ? device_unregister+0x27/0x40 [ 69.458826][ T588] usb_disable_device+0x3a8/0x750 [ 69.463858][ T588] usb_disconnect+0x32d/0x880 [ 69.468540][ T588] hub_event+0x1a66/0x4310 [ 69.472970][ T588] ? kthread_data+0x50/0xc0 [ 69.477471][ T588] ? __cfi_hub_event+0x10/0x10 [ 69.482237][ T588] ? __schedule+0xcbb/0x1700 [ 69.486828][ T588] process_one_work+0x717/0xc30 [ 69.491687][ T588] worker_thread+0xa4d/0x11d0 [ 69.496374][ T588] kthread+0x281/0x320 [ 69.500458][ T588] ? __cfi_worker_thread+0x10/0x10 [ 69.505577][ T588] ? __cfi_kthread+0x10/0x10 [ 69.510182][ T588] ret_from_fork+0x1f/0x30 [ 69.514607][ T588] [ 69.517620][ T588] [ 69.519941][ T588] Allocated by task 19: [ 69.524095][ T588] kasan_set_track+0x4b/0x70 [ 69.528684][ T588] kasan_save_alloc_info+0x1f/0x30 [ 69.533790][ T588] __kasan_kmalloc+0x95/0xb0 [ 69.538407][ T588] kmalloc_trace+0x40/0xb0 [ 69.542857][ T588] roccat_connect+0x5c/0x4b0 [ 69.547458][ T588] savu_probe+0x1ba/0x360 [ 69.551782][ T588] hid_device_probe+0x267/0x3a0 [ 69.556627][ T588] really_probe+0x2d7/0x9a0 [ 69.561131][ T588] __driver_probe_device+0x193/0x270 [ 69.566416][ T588] driver_probe_device+0x54/0x3e0 [ 69.571440][ T588] __device_attach_driver+0x2e9/0x4a0 [ 69.576813][ T588] bus_for_each_drv+0x192/0x220 [ 69.581667][ T588] __device_attach+0x2b0/0x420 [ 69.586425][ T588] device_initial_probe+0x1a/0x20 [ 69.591450][ T588] bus_probe_device+0xc0/0x1f0 [ 69.596206][ T588] device_add+0xb0b/0xec0 [ 69.600547][ T588] hid_add_device+0x3b8/0x580 [ 69.605242][ T588] usbhid_probe+0xc12/0xff0 [ 69.609766][ T588] usb_probe_interface+0x621/0xb30 [ 69.614884][ T588] really_probe+0x2d7/0x9a0 [ 69.619404][ T588] __driver_probe_device+0x193/0x270 [ 69.624710][ T588] driver_probe_device+0x54/0x3e0 [ 69.629765][ T588] __device_attach_driver+0x2e9/0x4a0 [ 69.635182][ T588] bus_for_each_drv+0x192/0x220 [ 69.640064][ T588] __device_attach+0x2b0/0x420 [ 69.644860][ T588] device_initial_probe+0x1a/0x20 [ 69.649891][ T588] bus_probe_device+0xc0/0x1f0 [ 69.654655][ T588] device_add+0xb0b/0xec0 [ 69.659003][ T588] usb_set_configuration+0x1a01/0x1f70 [ 69.664487][ T588] usb_generic_driver_probe+0x91/0x150 [ 69.669958][ T588] usb_probe_device+0x154/0x260 [ 69.674813][ T588] really_probe+0x2d7/0x9a0 [ 69.679373][ T588] __driver_probe_device+0x193/0x270 [ 69.684669][ T588] driver_probe_device+0x54/0x3e0 [ 69.689708][ T588] __device_attach_driver+0x2e9/0x4a0 [ 69.695174][ T588] bus_for_each_drv+0x192/0x220 [ 69.700026][ T588] __device_attach+0x2b0/0x420 [ 69.704791][ T588] device_initial_probe+0x1a/0x20 [ 69.709842][ T588] bus_probe_device+0xc0/0x1f0 [ 69.714601][ T588] device_add+0xb0b/0xec0 [ 69.718929][ T588] usb_new_device+0x9f4/0x1500 [ 69.723697][ T588] hub_event+0x27fb/0x4310 [ 69.728119][ T588] process_one_work+0x717/0xc30 [ 69.732967][ T588] worker_thread+0xa4d/0x11d0 [ 69.737677][ T588] kthread+0x281/0x320 [ 69.741771][ T588] ret_from_fork+0x1f/0x30 [ 69.746219][ T588] [ 69.748570][ T588] Freed by task 2802: [ 69.752583][ T588] kasan_set_track+0x4b/0x70 [ 69.757215][ T588] kasan_save_free_info+0x2b/0x40 [ 69.762254][ T588] ____kasan_slab_free+0x132/0x180 [ 69.767385][ T588] __kasan_slab_free+0x11/0x20 [ 69.772161][ T588] slab_free_freelist_hook+0xc2/0x190 [ 69.777568][ T588] __kmem_cache_free+0xb7/0x1b0 [ 69.782454][ T588] kfree+0x6f/0xf0 [ 69.786190][ T588] roccat_release+0x2bc/0x380 [ 69.790898][ T588] __fput+0x1fd/0x8f0 [ 69.794888][ T588] ____fput+0x15/0x20 [ 69.798896][ T588] task_work_run+0x1e1/0x250 [ 69.803507][ T588] exit_to_user_mode_loop+0x9b/0xb0 [ 69.808721][ T588] exit_to_user_mode_prepare+0x87/0xd0 [ 69.814199][ T588] syscall_exit_to_user_mode+0x1a/0x30 [ 69.819679][ T588] do_syscall_64+0x58/0xa0 [ 69.824101][ T588] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 69.830145][ T588] [ 69.832494][ T588] The buggy address belongs to the object at ffff88810f7e8c00 [ 69.832494][ T588] which belongs to the cache kmalloc-512 of size 512 [ 69.846561][ T588] The buggy address is located 8 bytes inside of [ 69.846561][ T588] 512-byte region [ffff88810f7e8c00, ffff88810f7e8e00) [ 69.859668][ T588] [ 69.862004][ T588] The buggy address belongs to the physical page: [ 69.868420][ T588] page:ffffea00043dfa00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10f7e8 [ 69.878687][ T588] head:ffffea00043dfa00 order:2 compound_mapcount:0 compound_pincount:0 [ 69.887016][ T588] flags: 0x4000000000010200(slab|head|zone=1) [ 69.893117][ T588] raw: 4000000000010200 0000000000000000 dead000000000001 ffff888100042f00 [ 69.901712][ T588] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 69.910309][ T588] page dumped because: kasan: bad access detected [ 69.916740][ T588] page_owner tracks the page as allocated [ 69.922482][ T588] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 452, tgid 452 (udevd), ts 38437873566, free_ts 24088799964 [ 69.944464][ T588] post_alloc_hook+0x1f5/0x210 [ 69.949263][ T588] prep_new_page+0x1c/0x110 [ 69.953781][ T588] get_page_from_freelist+0x2ca9/0x2d20 [ 69.959354][ T588] __alloc_pages+0x1fa/0x610 [ 69.963967][ T588] alloc_slab_page+0x6e/0xf0 [ 69.968568][ T588] new_slab+0x98/0x3e0 [ 69.972663][ T588] ___slab_alloc+0x70f/0xb70 [ 69.977270][ T588] __slab_alloc+0x5e/0xa0 [ 69.981629][ T588] __kmem_cache_alloc_node+0x204/0x2d0 [ 69.987106][ T588] __kmalloc_node_track_caller+0xa1/0x1e0 [ 69.992842][ T588] __alloc_skb+0x226/0x4a0 [ 69.997271][ T588] alloc_skb_with_frags+0xa8/0x620 [ 70.002393][ T588] sock_alloc_send_pskb+0x87f/0x9a0 [ 70.007598][ T588] unix_dgram_sendmsg+0x5c1/0x1710 [ 70.012732][ T588] sock_write_iter+0x2ea/0x3f0 [ 70.017508][ T588] vfs_write+0x5ef/0xd00 [ 70.021760][ T588] page last free stack trace: [ 70.026434][ T588] free_unref_page_prepare+0x81b/0x820 [ 70.031906][ T588] free_unref_page+0x93/0x530 [ 70.036600][ T588] __free_pages+0x67/0x100 [ 70.041029][ T588] __free_slab+0xc7/0x1a0 [ 70.045365][ T588] discard_slab+0x29/0x40 [ 70.049702][ T588] __slab_free+0x201/0x280 [ 70.054123][ T588] ___cache_free+0xbf/0xd0 [ 70.058551][ T588] qlist_free_all+0xc6/0x140 [ 70.063173][ T588] kasan_quarantine_reduce+0x14a/0x170 [ 70.068643][ T588] __kasan_slab_alloc+0x24/0x80 [ 70.073507][ T588] slab_post_alloc_hook+0x4f/0x2d0 [ 70.078630][ T588] __kmem_cache_alloc_node+0x194/0x2d0 [ 70.084125][ T588] kmalloc_trace+0x29/0xb0 [ 70.088556][ T588] ipv6_add_dev+0xfb/0x1130 [ 70.093074][ T588] addrconf_notify+0x6d0/0xe30 [ 70.097850][ T588] raw_notifier_call_chain+0xa1/0x110 [ 70.103233][ T588] [ 70.105565][ T588] Memory state around the buggy address: [ 70.111202][ T588] ffff88810f7e8b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 70.119287][ T588] ffff88810f7e8b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 70.127362][ T588] >ffff88810f7e8c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 70.135427][ T588] ^ [ 70.139756][ T588] ffff88810f7e8c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 70.147840][ T588] ffff88810f7e8d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 70.155918][ T588] ================================================================== SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 70.165110][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 70.172780][ T28] audit: type=1400 audit(1792727995.657:385): avc: denied { write } for pid=278 comm="syz-executor" path="pipe:[14596]" dev="pipefs" ino=14596 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 70.203014][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 70.245377][ T588] Disabling lock debugging due to kernel taint [ 70.277675][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 70.292416][ T28] audit: type=1400 audit(1792727995.687:386): avc: denied { read } for pid=84 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 70.322794][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 70.329868][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 70.351248][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 70.359424][ T28] audit: type=1400 audit(1792727995.687:387): avc: denied { search } for pid=84 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 70.381389][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 70.389956][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 70.397046][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 70.404605][ T28] audit: type=1400 audit(1792727995.687:388): avc: denied { write } for pid=84 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 70.440937][ T28] audit: type=1400 audit(1792727995.687:389): avc: denied { add_name } for pid=84 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 70.490290][ T28] audit: type=1400 audit(1792727995.687:390): avc: denied { create } for pid=84 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 70.527196][ T28] audit: type=1400 audit(1792727995.687:391): avc: denied { append open } for pid=84 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 70.552985][ T28] audit: type=1400 audit(1792727995.697:392): avc: denied { getattr } for pid=84 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 71.155030][ T362] device bridge_slave_1 left promiscuous mode [ 71.161211][ T362] bridge0: port 2(bridge_slave_1) entered disabled state [ 71.168881][ T362] device bridge_slave_0 left promiscuous mode [ 71.175120][ T362] bridge0: port 1(bridge_slave_0) entered disabled state [ 71.183214][ T362] device veth1_macvtap left promiscuous mode [ 71.189260][ T362] device veth0_vlan left promiscuous mode [ 71.982958][ T362] device bridge_slave_1 left promiscuous mode [ 71.989137][ T362] bridge0: port 2(bridge_slave_1) entered disabled state [ 71.996731][ T362] device bridge_slave_0 left promiscuous mode [ 72.003066][ T362] bridge0: port 1(bridge_slave_0) entered disabled state