last executing test programs: 980.915676ms ago: executing program 0 (id=1): r0 = accept4$bt_l2cap(0xffffffffffffffff, &(0x7f0000000000)={0x1f, 0x0, @fixed}, &(0x7f0000000040)=0xe, 0x0) setsockopt$bt_BT_SECURITY(r0, 0x112, 0x4, &(0x7f0000000080)={0x2, 0x9}, 0x2) ioctl$sock_SIOCOUTQNSD(r0, 0x894b, &(0x7f00000002c0)) syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000840)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="1201000000000040ac054382408b0b00000109022400010000002009040000fd0301000009210000000122010009058103"], 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) r2 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000380), 0x48f82, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x7, 0x12, r2, 0xe851000) madvise(&(0x7f00000b3000/0x2000)=nil, 0x2000, 0xe) ioctl$BLKFLSBUF(r2, 0x1261, &(0x7f0000000000)=0x1aff) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) syz_usb_control_io$hid(r1, &(0x7f00000003c0)={0x24, 0x0, 0x0, &(0x7f0000000a80)=ANY=[@ANYBLOB="002281"], 0x0}, 0x0) ioctl$FS_IOC_SETFSLABEL(r0, 0x41009432, &(0x7f00000001c0)="68baa35272dd43c9940983349af8cc099f897dbbba8cf4153b54a040d40f0163d0a88044c6c794b49350e7f0a893c2d48657a4f33ff005e8613d55f6a523a65f6ff4c312a1bf7c6dfa97122443fa7e6b5e2353176fb0545390dbaf4a7b07f6c92ba40d4ff490d61a59902f58128adbe3962768dc749fa5d9dd6afe23fee519feda7d4c188dd0d093bb41100890f39f1b3ac79b294ba3d6c6a0fe6d70330d42b391b28add090c1300987d426eebe93c0d00ed585957e7be67df4638a5dbd0a37273f7d2db61de002b676fabebb616591618b59163f04627a24e45f10cae42fc771971e21cbc89c9195c91798cd28e9e0f5f1b2b8741e3afe9d82a41ef396d6a18") r3 = syz_open_dev$hiddev(&(0x7f00000000c0), 0x0, 0x0) ioctl$int_in(r3, 0x5452, &(0x7f0000000440)=0x1ff) nanosleep(&(0x7f0000000300)={0x1}, 0x0) 933.071787ms ago: executing program 1 (id=2): r0 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000380)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x8, 0x5ac, 0x25b, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x90, 0x9, "", [{{0x9, 0x4, 0x0, 0xfe, 0x1, 0x3, 0x0, 0x1, 0x0, {0x9, 0x21, 0xc1, 0x5, 0x1, {0x22, 0x28}}, {{{0x9, 0x5, 0x81, 0x3, 0x20, 0x0, 0xc8, 0x4}}}}}]}}]}}, 0x0) syz_usb_connect$uac2(0x0, 0xe4, &(0x7f0000000100)={{0x12, 0x1, 0x310, 0x0, 0x0, 0x0, 0x40, 0x1235, 0x8213, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xd2, 0x3, 0x1, 0x2, 0x0, 0x6, {0x8, 0xb, 0x2, 0x0, 0x1, 0xc, 0x20, 0xf}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0xa, 0x6, 0x41, 0x9}, [@processing_unit={0x11, 0x24, 0x8, 0x1, 0x6, [0x0, 0x2, 0x3, 0x3, 0x2, 0x58be2c443deb3566]}, @effect_unit={0xf, 0x24, 0x7, 0x5, 0x4, 0x4, [0x2, 0x0, 0x2, 0x1]}, @multiply_unit={0x7, 0x24, 0xc, 0x2, 0xf2, 0xc4, 0x4}, @effect_unit={0x11, 0x24, 0x7, 0x5, 0x4, 0x1, [0x0, 0x2, 0x1, 0x2, 0x0]}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {[@format_type_i_discrete={0xb, 0x24, 0x2, 0x1, 0xf8, 0x4, 0x6, 0x0, "3f671a"}, @as_header={0x10, 0x24, 0x1, 0x4, 0x4, 0x2, 0x3, 0x0, 0xfffffffe, 0x2}, @format_type_i_discrete={0xd, 0x24, 0x2, 0x1, 0x6, 0x3, 0x40, 0x5, "0259056e93"}, @format_type_ii_discrete={0x9, 0x24, 0x2, 0x2, 0x418, 0x7e3, 0x1}]}, {{0x9, 0x5, 0x1, 0x9, 0x200, 0x6, 0x8, 0x8, {0x8, 0x25, 0x1, 0x82, 0x3, 0x6, 0x8}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x200, 0xd, 0x8, 0x6, {0x8, 0x25, 0x1, 0x1, 0x3f, 0xb, 0xf}}}}}}}}]}}, &(0x7f00000002c0)={0xa, &(0x7f0000000200)={0xa, 0x6, 0x250, 0x4, 0x2, 0x8, 0x8, 0x7}, 0xe, &(0x7f0000000240)={0x5, 0xf, 0xe, 0x3, [@ptm_cap={0x3}, @ptm_cap={0x3}, @ptm_cap={0x3}]}, 0x1, [{0x4, &(0x7f0000000280)=@lang_id={0x4, 0x3, 0x458}}]}) mkdir(&(0x7f00000002c0)='./sys\x00', 0x20) mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0) write(r1, &(0x7f0000000400)='dummy_udc.0', 0xb) sendmmsg$inet(0xffffffffffffffff, &(0x7f00000000c0)=[{{&(0x7f0000000080)={0x2, 0x4e23, @remote}, 0x10, 0x0}}, {{&(0x7f0000000300)={0x2, 0x4e23, @remote}, 0x10, 0x0, 0x0, &(0x7f0000000040)=[@ip_retopts={{0x14, 0x0, 0x7, {[@generic={0x7, 0x2}]}}}], 0x18}}], 0x2, 0x0) r2 = socket(0x5, 0x5, 0x6) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000140)=0x10) setsockopt$inet6_group_source_req(r2, 0x29, 0x2e, &(0x7f0000000000)={0x3, {{0xa, 0xfffb, 0x0, @empty, 0x101}}, {{0xa, 0x4e24, 0x0, @remote}}}, 0x108) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/kernel/mm/lru_gen/enabled\x00', 0x1, 0x0) write$FUSE_BMAP(r3, &(0x7f0000000240)={0x79, 0x0, 0x0, {0x4}}, 0x18) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./tracing\x00', &(0x7f0000000080)='tracefs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./tracing/dynamic_events\x00', 0x1, 0x0) write(r4, &(0x7f0000000100)='-:m', 0x3) setsockopt$inet6_group_source_req(r2, 0x29, 0x2f, &(0x7f0000000580)={0x5, {{0xa, 0x4e24, 0x0, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x19}}, 0x7fffffff}}, {{0xa, 0x0, 0x0, @dev={0xfe, 0x80, '\x00', 0x1d}, 0x5}}}, 0x108) socket$inet6_udp(0xa, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./debug/lru_gen\x00', 0x2, 0x0) write(r5, &(0x7f0000000800)='+ 1 0 0', 0x7) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f00000000c0)={0x2c, &(0x7f0000000080)={0x20, 0x22, 0x28, {0x28, 0xa, "c2631385269c2c3cbdeacc918d0fb74237cc6e442a52973661d6090055443800000000000000"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) 902.465268ms ago: executing program 3 (id=4): landlock_create_ruleset(&(0x7f0000000040)={0x0, 0x3}, 0x10, 0x0) (async) r0 = landlock_create_ruleset(&(0x7f0000000040)={0x0, 0x3}, 0x10, 0x0) landlock_restrict_self(r0, 0x0) (async) landlock_restrict_self(r0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = landlock_create_ruleset(&(0x7f0000000000)={0x4000, 0x3, 0x0, 0x0, 0x2}, 0x30, 0x0) landlock_restrict_self(r2, 0x0) landlock_create_ruleset(&(0x7f0000000040)={0x0, 0x3}, 0x10, 0x0) (async) r3 = landlock_create_ruleset(&(0x7f0000000040)={0x0, 0x3}, 0x10, 0x0) landlock_restrict_self(r3, 0x0) landlock_restrict_self(r3, 0x0) landlock_restrict_self(r3, 0x0) landlock_restrict_self(r3, 0x0) landlock_restrict_self(r0, 0x0) sendmmsg$unix(r1, &(0x7f00000bd000), 0x100, 0x0) (async) sendmmsg$unix(r1, &(0x7f00000bd000), 0x100, 0x0) 794.975031ms ago: executing program 2 (id=5): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x181) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x141) sendto$inet6(0xffffffffffffffff, &(0x7f0000000040), 0x0, 0x810, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000100)='./bus\x00', &(0x7f0000000440), 0x200489, &(0x7f0000000140)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './cgroup'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) chdir(&(0x7f00000000c0)='./bus\x00') r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x200002, 0x0) openat$cgroup_ro(r0, &(0x7f0000000100)='cgroup.kill\x00', 0x275a, 0x0) 794.693721ms ago: executing program 2 (id=6): r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000000c0), 0x701e41, 0x0) (async, rerun: 64) syz_usb_connect$uac2(0x3, 0x87, &(0x7f0000000300)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x40, 0x499, 0x104e, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x75, 0x3, 0x1, 0x80, 0xa0, 0xe, {0x8, 0xb, 0x1, 0x1, 0x1, 0xa, 0x20, 0x76}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0x0, 0x3, 0x15, 0xde}, [@output_terminal={0xc, 0x24, 0x3, 0xfd, 0x504, 0xa8, 0x4, 0x6, 0x6, 0x22}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x40, 0x5, 0x4, 0x0, {0x8, 0x25, 0x1, 0x1, 0x9, 0x9, 0x2}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x3ff, 0x9, 0x4, 0x2, {0x8, 0x25, 0x1, 0x3, 0x3c, 0xa, 0x2}}}}}}}}]}}, 0x0) (async, rerun: 64) setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000000)={{{@in=@initdev={0xac, 0x1e, 0x0, 0x0}, @in6=@remote, 0x4e23, 0x6, 0x4e22, 0x0, 0x2, 0x20, 0x20, 0x1d}, {0x7, 0x7, 0x5, 0x95d, 0xfffffffffffffffb, 0x2, 0x0, 0x5c2}, {0xe, 0x5, 0xb1b}, 0x401, 0x0, 0x2, 0x1, 0x0, 0x2}, {{@in6=@empty, 0x4d4, 0x2a}, 0x39573c4e467c4e, @in=@multicast1, 0x3502, 0x4, 0x0, 0x40, 0x9, 0x30, 0x7}}, 0xe8) (async) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$netlink(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)=ANY=[@ANYBLOB="280000002100010002000000000000000a00000000000001016200000c0018"], 0x28}], 0x1, 0x0, 0x0, 0x8000}, 0x0) preadv(r0, &(0x7f0000001300)=[{&(0x7f0000000100)=""/207, 0xcf}, {&(0x7f0000000200)=""/229, 0xe5}, {&(0x7f0000001340)=""/4098, 0x1002}], 0x3, 0x3871, 0x8) 794.520731ms ago: executing program 2 (id=7): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000002280)={0x3, &(0x7f0000000180)=[{0x20, 0x2, 0x81, 0xfffff034}, {0x20, 0x0, 0x8, 0xfffff010}, {0x6, 0xba, 0x2, 0xffff}]}, 0x10) r1 = socket$inet(0x2, 0x2, 0x1) setsockopt$sock_int(r1, 0x1, 0x6, &(0x7f0000001200)=0xe095, 0x4) sendmsg$inet(r1, &(0x7f0000000640)={&(0x7f00000005c0)={0x2, 0x0, @broadcast}, 0x10, &(0x7f00000000c0)=[{&(0x7f0000000080)='\b\x00', 0x2}, {&(0x7f0000000180)="96bc1480bb35", 0x6}], 0x2, &(0x7f0000000240)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @local, @empty}}}], 0x20}, 0x24048804) r2 = accept$packet(r0, 0x0, &(0x7f0000000040)) r3 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, 0x0, 0x0) ioctl$sock_SIOCBRDELBR(r2, 0x89a1, &(0x7f0000000100)='vxcan1\x00') 791.617231ms ago: executing program 2 (id=8): r0 = socket$netlink(0x10, 0x3, 0x0) ioctl$FS_IOC_GETVERSION(r0, 0x80087601, &(0x7f0000000180)) ioctl$KVM_CAP_SPLIT_IRQCHIP(0xffffffffffffffff, 0x4068aea3, &(0x7f0000000040)={0x79, 0x0, 0xcfe}) r1 = openat$selinux_create(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) pwrite64(r1, &(0x7f00000000c0)="19fc9368c82137d53ab5e217922201dc16d719f8dfb3eac2c0e1dd56d05b9f59737bc5d93c3fe76c1c4f4836c40eec5738391cfc4871822526ae902c9dc4bceb79342ec52b4b25585b8f5bbf7b4b5f7f4b3edbf877a15ce80cc8b5237388e8be9c012374ea1b4c820a37164d3f744fcb8115b0a65a725ce06e24ed6916b55d222538bf", 0x83, 0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000001c0)='io\x00') read$FUSE(r2, &(0x7f0000000980)={0x2020}, 0x160e) sendmsg$nl_generic(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000900)={0x24, 0x1e, 0x21, 0x0, 0x0, {0xa}, [@typed={0x5, 0x0, 0x0, 0x0, @str='\x00'}, @nested={0x8, 0x7, 0x0, 0x1, [@nested={0x4, 0x3f}]}]}, 0x24}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000680)=ANY=[@ANYBLOB="300000001c0021002dbd70000000000007000000050000000000000014000200"], 0x30}, 0x1, 0x0, 0x0, 0x4014}, 0x0) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), r0) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000002c0)={'wlan0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan1\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000340)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_MESH_CONFIG(r3, &(0x7f0000000440)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000400)={&(0x7f0000000380)={0x58, r4, 0x400, 0x70bd29, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_MESH_CONFIG={0x2c, 0x23, 0x0, 0x1, [@NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME={0x6}, @NL80211_MESHCONF_RSSI_THRESHOLD={0x8, 0x14, 0xffffffffffffffe7}, @NL80211_MESHCONF_GATE_ANNOUNCEMENTS={0x5}, @NL80211_MESHCONF_CONNECTED_TO_GATE={0x5}, @NL80211_MESHCONF_HWMP_RANN_INTERVAL={0x6, 0x10, 0x100}]}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r6}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r7}]}, 0x58}, 0x1, 0x0, 0x0, 0x10004081}, 0x200400c0) 764.815422ms ago: executing program 2 (id=9): madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) (async) openat$fuse(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) (async) r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000200), 0x42082) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000000040)={{0x1}}) (async) r1 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x4) ioctl$KVM_INTERRUPT(r1, 0x4004ae86, 0x0) (async) recvmsg(0xffffffffffffffff, 0x0, 0x0) (async) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0xb, 0x31, 0xffffffffffffffff, 0x41e04000) (async) personality(0x5400004) (async) remap_file_pages(&(0x7f00006ca000/0x4000)=nil, 0x4000, 0x0, 0x0, 0x4000000) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) signalfd(0xffffffffffffffff, &(0x7f0000003840)={[0x100]}, 0x8) ioctl$SNDRV_TIMER_IOCTL_STOP(r0, 0x54a1) (async) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x8) 741.932962ms ago: executing program 2 (id=10): syz_usb_connect$uac2(0x3, 0xa8, &(0x7f0000000280)=ANY=[@ANYBLOB="120110030000004082054c00400001020301090296000301053009080b00010107208c0904000000010120000924010040041d000708240b0001ff23000c240302070300040007008109040100000102f700090401010101022000090501090002030b04082501000040040009040200000102200009040201010102200009240201000f0e07011024010201000400000008b8000000030905820908"], &(0x7f0000000880)={0x0, 0x0, 0x0, 0x0}) syz_create_resource$binfmt(&(0x7f0000000000)='./bus\x00') syz_open_procfs(0x0, &(0x7f00000000c0)='task\x00') chdir(&(0x7f0000000540)='./cgroup\x00') ioctl$FS_IOC_ENABLE_VERITY(0xffffffffffffffff, 0x40806685, 0x0) fchmodat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0xfffffffb) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x14e174135c0b87af) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x158) mount$overlay(0x0, &(0x7f0000000000)='./file1\x00', &(0x7f0000000b80), 0x0, &(0x7f0000000240)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) syz_usb_connect$cdc_ncm(0x4, 0x93, &(0x7f0000000000)={{0x12, 0x1, 0x250, 0x2, 0x0, 0x0, 0x8, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x81, 0x2, 0x1, 0x8, 0x80, 0x5, "", {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x6, 0x24, 0x6, 0x0, 0x1, "af"}, {0x5, 0x24, 0x0, 0x8}, {0xd, 0x24, 0xf, 0x1, 0x6, 0x7, 0xb15, 0x4}, {0x6, 0x24, 0x1a, 0x1, 0x10}, [@call_mgmt={0x5, 0x24, 0x1, 0x1, 0xfa}, @mdlm={0x15, 0x24, 0x12, 0xfff9}, @call_mgmt={0x5, 0x24, 0x1, 0x1, 0xfe}, @call_mgmt={0x5, 0x24, 0x1, 0x6, 0x40}]}, {{0x9, 0x5, 0x81, 0x3, 0x20, 0x1, 0x6, 0xf}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x0, 0x8c, 0x43, 0x76}}, {{0x9, 0x5, 0x3, 0x2, 0x20, 0x6, 0xa, 0x2}}}}}}}]}}, &(0x7f0000000380)={0xa, &(0x7f00000000c0)={0xa, 0x6, 0x310, 0x1, 0x67, 0x5, 0x8, 0x1}, 0xba, &(0x7f00000003c0)={0x5, 0xf, 0xba, 0x5, [@ss_cap={0xa, 0x10, 0x3, 0x0, 0x4, 0x7f, 0x48, 0x225}, @generic={0x38, 0x10, 0x3, "31e4d240818db9ba1485c3e3743d7854798ec3ea5b4a6213f32908ffce2b148015a1208920ec40f53fcd200188a454ce205d6a8a16"}, @ext_cap={0x7, 0x10, 0x2, 0x8, 0x9, 0x5, 0x7ff}, @generic={0x62, 0x10, 0x4, "023d74693841bdb6c69b57b10d2868ce57bda42d8b88ace6a099ca46df3cb538096e9225dc6fe566546a52194220dfd1f5e2c7f65e702fd0327bf7e8c668936db7da250f1c7239795ca1b25f13da6f27891e845390e3572314a5d37f729f95"}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0x1, 0x9, 0xe, 0x7f92}]}, 0x3, [{0x4, &(0x7f0000000140)=@lang_id={0x4, 0x3, 0x81a}}, {0xcb, &(0x7f0000000180)=@string={0xcb, 0x3, "502fb7d80f39cbf7e170e36c83ea021c8211e18c68772133181a54fb3b92dccbffaf473353216e22839f25883b70e0d475bb00e9eba9c4d64a1ad50982c4654ab5b0ecbe50e727bf7fd2f92409c44ccb154997ecd7ab5744c77d2493130cb8f458fe6414d9cb5eedf89857699a8ee1caed6b40a6feab49abed0d09ddd496c1b6fe9c1dde58be036f151af0212f1373feac855bf0d776b669ac74363852dc3baaf19b112046bee31c578eeb41d47b85b24474b46cf517e1b4a88f28810f83b2778bdb0a9a7aadd5dc6e"}}, {0x4, &(0x7f0000000340)=@lang_id={0x4, 0x3, 0x40a}}]}) syz_usb_connect$cdc_ecm(0x0, 0x12a, &(0x7f0000000580)={{0x12, 0x1, 0x300, 0x2, 0x0, 0x0, 0xff, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x118, 0x1, 0x1, 0x1, 0x70, 0x6, "", [{{0x9, 0x4, 0x0, 0xa, 0x2, 0x2, 0x6, 0x0, 0x3, {{0x5}, {0x5, 0x24, 0x0, 0x4ed2}, {0xd, 0x24, 0xf, 0x1, 0x1000, 0x101, 0x5, 0x1}, [@network_terminal={0x7, 0x24, 0xa, 0x4, 0x7f, 0x42, 0x6}, @ncm={0x6, 0x24, 0x1a, 0xdaf, 0x13}, @mdlm_detail={0xbb, 0x24, 0x13, 0x5, "2aaca557854f56f5a0b8dfeadfb6acac49ba449a576deb60dfa91a082338f0cf1aad950d7f29930ec718a93c9f842823c5e5451baa93b4b4af585790b14ef00ccf2ddf38cd23bcfbf31e90be241ed7f326e6271ce21de9686aafb6110c3d2be80c2d76c7380174984f81a5eea8176d21ae2b19cb186a8256bd5ac51cd6413d371bc1fc0db14d6b40e50ffcd9db496df706d655a09f3c7f2b3886ff23d46f954a49c437ef12eef28b76db011649539f9cc03d927c3795fb"}, @mdlm={0x15, 0x24, 0x12, 0xc589}]}, {[], {{0x9, 0x5, 0x82, 0x2, 0x20, 0xe, 0x1, 0x7}}, {{0x9, 0x5, 0x3, 0x2, 0x8, 0x4, 0x2, 0xfe}}}}}]}}]}}, &(0x7f0000000900)={0xa, &(0x7f00000006c0)={0xa, 0x6, 0x200, 0x7f, 0x77, 0x0, 0x8, 0x48}, 0x5, &(0x7f0000000700)={0x5, 0xf, 0x5}, 0x6, [{0x4, &(0x7f0000000740)=@lang_id={0x4, 0x3, 0xc04}}, {0x4, &(0x7f0000000780)=@lang_id={0x4, 0x3, 0xc01}}, {0x4, &(0x7f00000007c0)=@lang_id={0x4, 0x3, 0x861}}, {0x4, &(0x7f0000000800)=@lang_id={0x4, 0x3, 0x449}}, {0x4, &(0x7f0000000840)=@lang_id={0x4, 0x3, 0x443}}, {0x4, &(0x7f00000008c0)=@lang_id={0x4, 0x3, 0x280a}}]}) 6.19474ms ago: executing program 3 (id=11): r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = syz_init_net_socket$nfc_raw(0x27, 0x5, 0x0) socket$packet(0x11, 0x2, 0x300) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040), 0x2) r3 = memfd_create(&(0x7f0000000140)='y\x105\xfb\xf7u\x83%:r\xc2\xb9x\xa4q\xc1\xea_\x8cZ7\xcda\x9b\x11X\x0e\xa1\xcf\x1a\x98S7\xc9\x00'/47, 0x2) ftruncate(r3, 0xffff) fcntl$addseals(r3, 0x409, 0x7) ioctl$UDMABUF_CREATE(r2, 0x40187542, &(0x7f0000000000)={r3, 0x0, 0x0, 0x8000}) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz1\x00', {0x9, 0x4, 0x6, 0xfffa}, 0x1d, [0x1, 0xc95a, 0xfffffff3, 0x9, 0x80, 0x2, 0x3, 0x7f, 0x6, 0x4d, 0x39cc191a, 0x2, 0x9, 0x5, 0x2, 0x0, 0x6, 0x3, 0x0, 0x2ab, 0x4, 0x7, 0x4, 0x3c5b, 0x4, 0xb, 0x9, 0x1, 0x1f461e2c, 0x7, 0xe661, 0x7fff, 0xb, 0x3, 0x7fff, 0x4c74, 0x80000000, 0x800242, 0xffffffff, 0xe, 0x0, 0x71, 0x2, 0x6, 0x3, 0x50, 0x5, 0x3e, 0x8f, 0x6, 0x6, 0x3, 0x80092a3, 0x800, 0x1, 0x20000000, 0x82, 0x0, 0x7, 0x6, 0x4, 0x4, 0x1, 0x40], [0x10000007, 0x401, 0x12f, 0x6, 0x10, 0xfffffff3, 0x129432e6, 0xcb, 0xf9, 0xd, 0x2bf, 0x2, 0xffe, 0xfffffffc, 0x334000, 0x0, 0x7, 0x5, 0x2f, 0x4, 0x312, 0x1, 0x0, 0xfffffffe, 0x8, 0x4, 0x8000, 0x9, 0x3fe, 0x401, 0x6, 0x4, 0xfb, 0x5, 0x8000, 0x5f31, 0xbcf5, 0x3, 0x2, 0x2, 0x9, 0x3000000, 0x9, 0x8, 0x9, 0x6, 0xb, 0xa, 0x1, 0x9, 0x9, 0x2, 0x7f, 0x9, 0x1, 0x3, 0x9, 0xffffffff, 0x7, 0x3, 0x9, 0x48c93690, 0x42, 0x400004], [0x6, 0x6, 0x80000001, 0x2, 0xff, 0x100, 0x2c, 0x9, 0x5, 0x7fff, 0x0, 0x1, 0xb, 0x4, 0x5, 0x1005, 0x0, 0x1f0, 0xfffffffd, 0x2, 0x86, 0x1, 0x9, 0x3e7, 0x9, 0x5, 0x2, 0x2, 0x800, 0x8, 0x5, 0x8001, 0x7, 0x38, 0x800003, 0x200, 0x80, 0x2, 0xcc52, 0x950bfaf, 0x1000, 0xfffffff6, 0x7, 0x7, 0xfffffff9, 0x6, 0x8000b8d, 0xbf, 0x10002, 0x403, 0x7ff, 0x3, 0x0, 0x1, 0xffff, 0x5, 0x6, 0x1c, 0x120000, 0x3, 0x6, 0xaaed, 0x4, 0xff], [0x9, 0xbb31, 0x3, 0xb, 0x5, 0x1, 0x6, 0x1, 0x0, 0x3, 0x80ce7, 0x1ff, 0x3, 0x7, 0x3112, 0x1003, 0x101, 0x10000, 0x6, 0x7fff, 0xffff, 0xe620, 0x2, 0x2, 0x1, 0x2, 0x14c, 0x60a7, 0x6, 0x4, 0xffffffff, 0x80000000, 0x7, 0x8, 0xc8, 0xee1, 0x0, 0xffff, 0x3, 0x7f, 0x100, 0x9602, 0x5, 0x2, 0xffff, 0x6, 0x1, 0x10080, 0x6, 0x8, 0x30b1d693, 0x5a2b, 0xc, 0x7, 0x1, 0x6c1b, 0x0, 0x4, 0x5, 0xb1c, 0x1, 0x200, 0xffff3440, 0xfff]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) r4 = dup2(r1, r0) connect$bt_rfcomm(r4, &(0x7f0000000580)={0x1f, @any, 0x6}, 0xa) socket$inet_tcp(0x2, 0x1, 0x0) (async) syz_init_net_socket$nfc_raw(0x27, 0x5, 0x0) (async) socket$packet(0x11, 0x2, 0x300) (async) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) (async) openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040), 0x2) (async) memfd_create(&(0x7f0000000140)='y\x105\xfb\xf7u\x83%:r\xc2\xb9x\xa4q\xc1\xea_\x8cZ7\xcda\x9b\x11X\x0e\xa1\xcf\x1a\x98S7\xc9\x00'/47, 0x2) (async) ftruncate(r3, 0xffff) (async) fcntl$addseals(r3, 0x409, 0x7) (async) ioctl$UDMABUF_CREATE(r2, 0x40187542, &(0x7f0000000000)={r3, 0x0, 0x0, 0x8000}) (async) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz1\x00', {0x9, 0x4, 0x6, 0xfffa}, 0x1d, [0x1, 0xc95a, 0xfffffff3, 0x9, 0x80, 0x2, 0x3, 0x7f, 0x6, 0x4d, 0x39cc191a, 0x2, 0x9, 0x5, 0x2, 0x0, 0x6, 0x3, 0x0, 0x2ab, 0x4, 0x7, 0x4, 0x3c5b, 0x4, 0xb, 0x9, 0x1, 0x1f461e2c, 0x7, 0xe661, 0x7fff, 0xb, 0x3, 0x7fff, 0x4c74, 0x80000000, 0x800242, 0xffffffff, 0xe, 0x0, 0x71, 0x2, 0x6, 0x3, 0x50, 0x5, 0x3e, 0x8f, 0x6, 0x6, 0x3, 0x80092a3, 0x800, 0x1, 0x20000000, 0x82, 0x0, 0x7, 0x6, 0x4, 0x4, 0x1, 0x40], [0x10000007, 0x401, 0x12f, 0x6, 0x10, 0xfffffff3, 0x129432e6, 0xcb, 0xf9, 0xd, 0x2bf, 0x2, 0xffe, 0xfffffffc, 0x334000, 0x0, 0x7, 0x5, 0x2f, 0x4, 0x312, 0x1, 0x0, 0xfffffffe, 0x8, 0x4, 0x8000, 0x9, 0x3fe, 0x401, 0x6, 0x4, 0xfb, 0x5, 0x8000, 0x5f31, 0xbcf5, 0x3, 0x2, 0x2, 0x9, 0x3000000, 0x9, 0x8, 0x9, 0x6, 0xb, 0xa, 0x1, 0x9, 0x9, 0x2, 0x7f, 0x9, 0x1, 0x3, 0x9, 0xffffffff, 0x7, 0x3, 0x9, 0x48c93690, 0x42, 0x400004], [0x6, 0x6, 0x80000001, 0x2, 0xff, 0x100, 0x2c, 0x9, 0x5, 0x7fff, 0x0, 0x1, 0xb, 0x4, 0x5, 0x1005, 0x0, 0x1f0, 0xfffffffd, 0x2, 0x86, 0x1, 0x9, 0x3e7, 0x9, 0x5, 0x2, 0x2, 0x800, 0x8, 0x5, 0x8001, 0x7, 0x38, 0x800003, 0x200, 0x80, 0x2, 0xcc52, 0x950bfaf, 0x1000, 0xfffffff6, 0x7, 0x7, 0xfffffff9, 0x6, 0x8000b8d, 0xbf, 0x10002, 0x403, 0x7ff, 0x3, 0x0, 0x1, 0xffff, 0x5, 0x6, 0x1c, 0x120000, 0x3, 0x6, 0xaaed, 0x4, 0xff], [0x9, 0xbb31, 0x3, 0xb, 0x5, 0x1, 0x6, 0x1, 0x0, 0x3, 0x80ce7, 0x1ff, 0x3, 0x7, 0x3112, 0x1003, 0x101, 0x10000, 0x6, 0x7fff, 0xffff, 0xe620, 0x2, 0x2, 0x1, 0x2, 0x14c, 0x60a7, 0x6, 0x4, 0xffffffff, 0x80000000, 0x7, 0x8, 0xc8, 0xee1, 0x0, 0xffff, 0x3, 0x7f, 0x100, 0x9602, 0x5, 0x2, 0xffff, 0x6, 0x1, 0x10080, 0x6, 0x8, 0x30b1d693, 0x5a2b, 0xc, 0x7, 0x1, 0x6c1b, 0x0, 0x4, 0x5, 0xb1c, 0x1, 0x200, 0xffff3440, 0xfff]}, 0x45c) (async) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) (async) dup2(r1, r0) (async) connect$bt_rfcomm(r4, &(0x7f0000000580)={0x1f, @any, 0x6}, 0xa) (async) 4.22834ms ago: executing program 3 (id=12): capset(&(0x7f0000000040)={0x20080522}, &(0x7f0000000080)) r0 = open$dir(&(0x7f0000000000)='./file7\x00', 0x8000, 0x95949da15545b60) mknodat(r0, &(0x7f0000000400)='./file7\x00', 0x40, 0x2) r1 = socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$inet6(r1, &(0x7f0000001740)={&(0x7f00000000c0)={0xa, 0x4e23, 0x1, @loopback, 0x1}, 0x1c, 0x0, 0x0, &(0x7f0000001780)=[@flowinfo={{0x14, 0x29, 0xb, 0x53}}, @flowinfo={{0x14, 0x29, 0xb, 0x4}}], 0x30}, 0x4004) r2 = socket$key(0xf, 0x3, 0x2) memfd_secret(0x80000) getsockopt$sock_buf(r2, 0x1, 0x1c, 0x0, &(0x7f0000001ec0)) 0s ago: executing program 3 (id=13): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000200)=0x474c, 0x4) (async) bind$inet(r0, &(0x7f0000000240)={0x2, 0x0, @local}, 0x6f) (async) connect$inet(r0, &(0x7f0000000480)={0x2, 0x4e23, @multicast1}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x800001d, 0x300) (async) setsockopt$inet_int(r0, 0x0, 0x19, &(0x7f0000000180)=0x1f5, 0x4) setsockopt$inet_int(r0, 0x0, 0x14, &(0x7f0000000440)=0x135, 0x4) (async) recvmmsg(r0, &(0x7f0000000100)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)=""/25, 0x19}, 0x8000}], 0x1, 0x45833af92e4a39df, 0x0) (async) r1 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(r1, 0x11b, 0x6, &(0x7f0000000000)=0x200010, 0x4) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.224' (ED25519) to the list of known hosts. [ 21.703889][ T36] audit: type=1400 audit(1786270777.349:64): avc: denied { mounton } for pid=286 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 21.705018][ T286] cgroup: Unknown subsys name 'net' [ 21.726509][ T36] audit: type=1400 audit(1786270777.349:65): avc: denied { mount } for pid=286 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 21.753765][ T36] audit: type=1400 audit(1786270777.389:66): avc: denied { unmount } for pid=286 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 21.753899][ T286] cgroup: Unknown subsys name 'devices' [ 21.879574][ T286] cgroup: Unknown subsys name 'hugetlb' [ 21.885176][ T286] cgroup: Unknown subsys name 'rlimit' [ 21.997200][ T36] audit: type=1400 audit(1786270777.639:67): avc: denied { setattr } for pid=286 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 22.020345][ T36] audit: type=1400 audit(1786270777.639:68): avc: denied { mounton } for pid=286 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 22.045073][ T36] audit: type=1400 audit(1786270777.639:69): avc: denied { mount } for pid=286 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 22.053168][ T288] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 22.076983][ T36] audit: type=1400 audit(1786270777.719:70): avc: denied { relabelto } for pid=288 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.102413][ T36] audit: type=1400 audit(1786270777.719:71): avc: denied { write } for pid=288 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.113087][ T286] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 22.127973][ T36] audit: type=1400 audit(1786270777.759:72): avc: denied { read } for pid=286 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.162064][ T36] audit: type=1400 audit(1786270777.759:73): avc: denied { open } for pid=286 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.989978][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.997011][ T293] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.004432][ T293] bridge_slave_0: entered allmulticast mode [ 23.010768][ T293] bridge_slave_0: entered promiscuous mode [ 23.020356][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.027379][ T293] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.034426][ T293] bridge_slave_1: entered allmulticast mode [ 23.040737][ T293] bridge_slave_1: entered promiscuous mode [ 23.064838][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.071925][ T294] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.079006][ T294] bridge_slave_0: entered allmulticast mode [ 23.085096][ T294] bridge_slave_0: entered promiscuous mode [ 23.092190][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.099289][ T294] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.106324][ T294] bridge_slave_1: entered allmulticast mode [ 23.112652][ T294] bridge_slave_1: entered promiscuous mode [ 23.154711][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.161828][ T295] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.168907][ T295] bridge_slave_0: entered allmulticast mode [ 23.175002][ T295] bridge_slave_0: entered promiscuous mode [ 23.183854][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.190899][ T295] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.197975][ T295] bridge_slave_1: entered allmulticast mode [ 23.204217][ T295] bridge_slave_1: entered promiscuous mode [ 23.234674][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.241738][ T296] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.248809][ T296] bridge_slave_0: entered allmulticast mode [ 23.254917][ T296] bridge_slave_0: entered promiscuous mode [ 23.261663][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.268697][ T296] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.275727][ T296] bridge_slave_1: entered allmulticast mode [ 23.281995][ T296] bridge_slave_1: entered promiscuous mode [ 23.399534][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.406579][ T294] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.413861][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.420884][ T294] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.429607][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.436641][ T293] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.443937][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.450967][ T293] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.474608][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.481652][ T295] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.488913][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.495921][ T295] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.530838][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.538103][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.545298][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.552954][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.560506][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.567596][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.581324][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.588363][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.602614][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.609656][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.632344][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.639386][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.671458][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.678507][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.685878][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.692893][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.700452][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.707457][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.731043][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.738084][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.745686][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.752708][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.768748][ T293] veth0_vlan: entered promiscuous mode [ 23.774743][ T294] veth0_vlan: entered promiscuous mode [ 23.793194][ T293] veth1_macvtap: entered promiscuous mode [ 23.803018][ T294] veth1_macvtap: entered promiscuous mode [ 23.828761][ T295] veth0_vlan: entered promiscuous mode [ 23.855017][ T295] veth1_macvtap: entered promiscuous mode [ 23.865135][ T293] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 23.884012][ T296] veth0_vlan: entered promiscuous mode [ 23.905552][ T314] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 23.926407][ T296] veth1_macvtap: entered promiscuous mode [ 24.095407][ T334] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=334 comm=syz.2.8 [ 24.120857][ T337] mmap: syz.2.9 (337) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 24.188006][ T31] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 24.208005][ T311] usb 2-1: new full-speed USB device number 2 using dummy_hcd [ 24.339003][ T31] usb 1-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 24.349900][ T31] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 24.360850][ T31] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 24.371036][ T31] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 24.384057][ T45] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 24.391978][ T311] usb 2-1: config 0 interface 0 altsetting 254 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 24.403289][ T311] usb 2-1: config 0 interface 0 has no altsetting 0 [ 24.409929][ T311] usb 2-1: New USB device found, idVendor=05ac, idProduct=025b, bcdDevice= 0.00 [ 24.419049][ T31] usb 1-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice=8b.40 [ 24.428145][ T311] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 24.436335][ T31] usb 1-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 24.444645][ T311] usb 2-1: config 0 descriptor?? [ 24.450118][ T31] usb 1-1: Manufacturer: syz [ 24.455233][ T31] usb 1-1: config 0 descriptor?? [ 24.549274][ T45] usb 3-1: unable to get BOS descriptor or descriptor too short [ 24.557596][ T45] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 24.567789][ T45] usb 3-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 24.580128][ T45] usb 3-1: New USB device found, idVendor=0582, idProduct=004c, bcdDevice= 0.40 [ 24.589378][ T45] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 24.597352][ T45] usb 3-1: Product: syz [ 24.601540][ T45] usb 3-1: Manufacturer: syz [ 24.606150][ T45] usb 3-1: SerialNumber: syz [ 24.662733][ T320] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 24.671308][ T320] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 24.683705][ T31] usbhid 1-1:0.0: can't add hid device: -71 [ 24.692200][ T31] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 24.701181][ T31] usb 1-1: USB disconnect, device number 2 [ 24.816340][ T339] overlayfs: failed to resolve './file0': -2 [ 24.827170][ T339] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 24.835935][ T339] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 24.846080][ T45] usb 3-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 24.854113][ T45] usb 3-1: 2:1 : no or invalid class specific endpoint descriptor [ 24.862364][ T45] usb 3-1: parse_audio_format_rates_v2v3(): unable to find clock source (clock -22) [ 24.882529][ T45] usb 3-1: USB disconnect, device number 2 [ 24.909117][ T342] udevd[342]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 24.943117][ T311] apple 0003:05AC:025B.0001: unknown main item tag 0x1 [ 24.952538][ T354] ================================================================== [ 24.960618][ T354] BUG: KASAN: slab-use-after-free in string+0x20f/0x2b0 [ 24.961057][ T311] apple 0003:05AC:025B.0001: unknown main item tag 0x5 [ 24.967575][ T354] Read of size 1 at addr ffff888105f53aa0 by task syz.0.1/354 [ 24.967596][ T354] [ 24.967610][ T354] CPU: 0 UID: 0 PID: 354 Comm: syz.0.1 Not tainted syzkaller #0 c4896d72d1fb51cdc6291d08376a37fd8080d7bb [ 24.967635][ T354] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 24.967655][ T354] Call Trace: [ 24.967663][ T354] [ 24.967671][ T354] __dump_stack+0x21/0x30 [ 24.967708][ T354] dump_stack_lvl+0x140/0x1c0 [ 24.967732][ T354] ? __cfi_dump_stack_lvl+0x10/0x10 [ 24.967757][ T354] ? post_alloc_hook+0x37d/0x3b0 [ 24.967782][ T354] print_address_description+0x71/0x210 [ 24.967805][ T354] print_report+0x4a/0x70 [ 24.967828][ T354] kasan_report+0x162/0x1a0 [ 24.967850][ T354] ? string+0x20f/0x2b0 [ 24.967875][ T354] ? string+0x20f/0x2b0 [ 24.967893][ T354] __asan_report_load1_noabort+0x18/0x20 [ 24.967911][ T354] string+0x20f/0x2b0 [ 24.967930][ T354] vsnprintf+0xe65/0x1ad0 [ 24.967951][ T354] snprintf+0xe9/0x140 [ 24.967969][ T354] ? __kernel_text_address+0x11/0x40 [ 24.967992][ T354] ? unwind_get_return_address+0x51/0x90 [ 24.968016][ T354] ? __cfi_snprintf+0x10/0x10 [ 24.968035][ T354] ? dev_vprintk_emit+0x179/0x400 [ 24.968056][ T354] dev_vprintk_emit+0x313/0x400 [ 24.968077][ T354] ? __cfi_dev_vprintk_emit+0x10/0x10 [ 24.968098][ T354] ? kasan_save_track+0x4f/0x80 [ 24.968117][ T354] ? kasan_save_track+0x3e/0x80 [ 24.968136][ T354] ? kasan_save_alloc_info+0x3a/0x50 [ 24.968162][ T354] dev_printk_emit+0xef/0x150 [ 24.968182][ T354] ? __cfi_dev_printk_emit+0x10/0x10 [ 24.968204][ T354] __dev_printk+0x17f/0x1b0 [ 24.968221][ T354] _dev_err+0x11f/0x180 [ 24.968241][ T354] ? __cfi__dev_err+0x10/0x10 [ 24.968260][ T354] ? _raw_spin_lock_irqsave+0xc1/0x160 [ 24.968282][ T354] ? __cfi__raw_spin_lock_irqsave+0x10/0x10 [ 24.968301][ T354] ? __check_object_size+0x54c/0x870 [ 24.968321][ T354] ? usb_ep_queue+0xf0/0x230 [ 24.968346][ T354] raw_process_ep0_io+0x54b/0x7a0 [ 24.968373][ T354] raw_ioctl+0x226c/0x37a0 [ 24.968398][ T354] ? __cfi_raw_ioctl+0x10/0x10 [ 24.968421][ T354] ? selinux_file_ioctl+0x732/0x1480 [ 24.968440][ T354] ? __cfi_selinux_file_ioctl+0x10/0x10 [ 24.968457][ T354] ? __cfi_handle_mm_fault+0x10/0x10 [ 24.968478][ T354] ? lock_vma_under_rcu+0x4cf/0x590 [ 24.968503][ T354] ? bpf_lsm_file_ioctl+0xd/0x20 [ 24.968525][ T354] ? security_file_ioctl+0x3e/0x110 [ 24.968551][ T354] ? __cfi_raw_ioctl+0x10/0x10 [ 24.968574][ T354] __se_sys_ioctl+0x135/0x1b0 [ 24.968595][ T354] __x64_sys_ioctl+0x7f/0xa0 [ 24.968615][ T354] x64_sys_call+0x1878/0x2ee0 [ 24.968632][ T354] do_syscall_64+0x57/0xf0 [ 24.968652][ T354] ? clear_bhb_loop+0x50/0xa0 [ 24.968682][ T354] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 24.968705][ T354] RIP: 0033:0x7fc1f3f9dd6b [ 24.968721][ T354] Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00 [ 24.968737][ T354] RSP: 002b:00007fc1f4e45f50 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 24.968763][ T354] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fc1f3f9dd6b [ 24.968778][ T354] RDX: 00007fc1f4e45fd0 RSI: 0000000040085503 RDI: 0000000000000003 [ 24.968791][ T354] RBP: 00007fc1f4e45fd0 R08: 0000000000000001 R09: 0000000000000000 [ 24.968804][ T354] R10: 0000000000000003 R11: 0000000000000246 R12: 00007fc1f4e45fd8 [ 24.968816][ T354] R13: 00002000000003c0 R14: 00007fc1f4226090 R15: 00007fff9f185c38 [ 24.968833][ T354] [ 24.968839][ T354] [ 24.989951][ T311] apple 0003:05AC:025B.0001: unknown main item tag 0x6 [ 24.995331][ T354] Allocated by task 1: [ 25.025135][ T311] apple 0003:05AC:025B.0001: unknown main item tag 0x0 [ 25.025693][ T354] kasan_save_track+0x3e/0x80 [ 25.033976][ T311] apple 0003:05AC:025B.0001: unknown main item tag 0x0 [ 25.036122][ T354] kasan_save_alloc_info+0x3a/0x50 [ 25.045459][ T311] apple 0003:05AC:025B.0001: unknown main item tag 0x0 [ 25.049057][ T354] __kasan_kmalloc+0x96/0xb0 [ 25.049082][ T354] __kmalloc_node_track_caller_noprof+0x24e/0x4f0 [ 25.049102][ T354] kvasprintf+0xf1/0x260 [ 25.049118][ T354] kvasprintf_const+0xf6/0x250 [ 25.058594][ T311] apple 0003:05AC:025B.0001: unknown main item tag 0x0 [ 25.058850][ T354] kobject_set_name_vargs+0x65/0x120 [ 25.062866][ T311] apple 0003:05AC:025B.0001: unknown main item tag 0x0 [ 25.067111][ T354] dev_set_name+0xe3/0x140 [ 25.067136][ T354] usb_add_gadget+0x436/0x780 [ 25.071519][ T311] apple 0003:05AC:025B.0001: unknown main item tag 0x0 [ 25.076443][ T354] usb_add_gadget_udc+0x11e/0x160 [ 25.082413][ T311] apple 0003:05AC:025B.0001: unknown main item tag 0x0 [ 25.086710][ T354] dummy_udc_probe+0x6ea/0x7f0 [ 25.148209][ T311] apple 0003:05AC:025B.0001: hidraw0: USB HID v0.c1 Device [HID 05ac:025b] on usb-dummy_hcd.1-1/input0 [ 25.151233][ T354] platform_probe+0x17a/0x200 [ 25.172477][ T311] usb 2-1: USB disconnect, device number 2 [ 25.175201][ T354] really_probe+0x2e1/0x8b0 [ 25.237449][ T355] fido_id[355]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.1/usb2/report_descriptor': No such file or directory [ 25.239966][ T354] __driver_probe_device+0x193/0x280 [ 25.239996][ T354] driver_probe_device+0x54/0x3f0 [ 25.479713][ T354] __device_attach_driver+0x2f1/0x4b0 [ 25.485076][ T354] bus_for_each_drv+0x264/0x300 [ 25.489910][ T354] __device_attach+0x2c4/0x3c0 [ 25.494658][ T354] device_initial_probe+0x1e/0x30 [ 25.499670][ T354] bus_probe_device+0x18b/0x270 [ 25.504499][ T354] device_add+0x7fd/0xbf0 [ 25.508807][ T354] platform_device_add+0x464/0x6c0 [ 25.513896][ T354] dummy_hcd_init+0xce2/0x1230 [ 25.518642][ T354] do_one_initcall+0x1e8/0x6a0 [ 25.523391][ T354] do_initcall_level+0x174/0x2e5 [ 25.528305][ T354] do_initcalls+0x7e/0x160 [ 25.532702][ T354] do_basic_setup+0x95/0xb0 [ 25.537187][ T354] kernel_init_freeable+0x2b1/0x400 [ 25.542363][ T354] kernel_init+0x21/0x1e0 [ 25.546671][ T354] ret_from_fork+0x67/0xa0 [ 25.551067][ T354] ret_from_fork_asm+0x1a/0x30 [ 25.555807][ T354] [ 25.558109][ T354] Freed by task 320: [ 25.561975][ T354] kasan_save_track+0x3e/0x80 [ 25.566632][ T354] kasan_save_free_info+0x44/0x50 [ 25.571639][ T354] __kasan_slab_free+0x5f/0x80 [ 25.576389][ T354] kfree+0x158/0x440 [ 25.580260][ T354] kfree_const+0x3d/0x50 [ 25.584482][ T354] kobject_put+0x21f/0x2a0 [ 25.588875][ T354] put_device+0x23/0x40 [ 25.593010][ T354] usb_del_gadget_udc+0x25/0x30 [ 25.597837][ T354] dummy_udc_remove+0x5c/0x70 [ 25.602510][ T354] platform_remove+0x7e/0xb0 [ 25.607078][ T354] device_release_driver_internal+0x4ad/0x830 [ 25.613124][ T354] device_driver_detach+0x3f/0x50 [ 25.618132][ T354] unbind_store+0x1ab/0x1f0 [ 25.622617][ T354] drv_attr_store+0x91/0xb0 [ 25.627101][ T354] sysfs_kf_write+0x13e/0x160 [ 25.631755][ T354] kernfs_fop_write_iter+0x319/0x510 [ 25.637019][ T354] vfs_write+0x75f/0xfd0 [ 25.641235][ T354] ksys_write+0x145/0x260 [ 25.645538][ T354] __x64_sys_write+0x7f/0x90 [ 25.650105][ T354] x64_sys_call+0x271c/0x2ee0 [ 25.654761][ T354] do_syscall_64+0x57/0xf0 [ 25.659157][ T354] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 25.665031][ T354] [ 25.667329][ T354] The buggy address belongs to the object at ffff888105f53aa0 [ 25.667329][ T354] which belongs to the cache kmalloc-16 of size 16 [ 25.681183][ T354] The buggy address is located 0 bytes inside of [ 25.681183][ T354] freed 16-byte region [ffff888105f53aa0, ffff888105f53ab0) [ 25.694712][ T354] [ 25.697013][ T354] The buggy address belongs to the physical page: [ 25.703404][ T354] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x105f53 [ 25.712233][ T354] anon flags: 0x4000000000000000(zone=1) [ 25.717840][ T354] page_type: f5(slab) [ 25.721813][ T354] raw: 4000000000000000 ffff888100041640 0000000000000000 0000000000000001 [ 25.730376][ T354] raw: 0000000000000000 0000000000800080 00000001f5000000 0000000000000000 [ 25.738930][ T354] page dumped because: kasan: bad access detected [ 25.745321][ T354] page_owner tracks the page as allocated [ 25.751019][ T354] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 1, tgid 1 (swapper/0), ts 2773983579, free_ts 0 [ 25.768537][ T354] post_alloc_hook+0x37d/0x3b0 [ 25.773301][ T354] prep_new_page+0x2d/0x180 [ 25.777782][ T354] get_page_from_freelist+0x4aea/0x4ba0 [ 25.783310][ T354] __alloc_pages_noprof+0x35a/0x7e0 [ 25.788490][ T354] alloc_slab_page+0x6b/0x1e0 [ 25.793144][ T354] allocate_slab+0x69/0x430 [ 25.797622][ T354] ___slab_alloc+0x591/0x8c0 [ 25.802196][ T354] __kmalloc_node_track_caller_noprof+0x2e3/0x4f0 [ 25.808588][ T354] kstrdup+0x4d/0x130 [ 25.812563][ T354] kstrdup_const+0x45/0x60 [ 25.816957][ T354] __kernfs_new_node+0xaa/0x740 [ 25.821800][ T354] kernfs_new_node+0x154/0x280 [ 25.826555][ T354] kernfs_create_dir_ns+0x4b/0x130 [ 25.831643][ T354] sysfs_create_dir_ns+0x127/0x210 [ 25.836733][ T354] kobject_add_internal+0x71f/0xc20 [ 25.841912][ T354] kobject_add+0x169/0x240 [ 25.846303][ T354] page_owner free stack trace missing [ 25.851646][ T354] [ 25.853947][ T354] Memory state around the buggy address: [ 25.859553][ T354] ffff888105f53980: 00 04 fc fc 00 01 fc fc 00 04 fc fc 00 05 fc fc [ 25.867586][ T354] ffff888105f53a00: 00 01 fc fc 00 04 fc fc fa fb fc fc 00 01 fc fc [ 25.875628][ T354] >ffff888105f53a80: 00 04 fc fc fa fb fc fc 00 07 fc fc fa fb fc fc [ 25.883661][ T354] ^ [ 25.888750][ T354] ffff888105f53b00: 00 05 fc fc 00 00 fc fc 00 06 fc fc 00 05 fc fc [ 25.896789][ T354] ffff888105f53b80: 00 04 fc fc 00 04 fc fc 00 05 fc fc 00 00 fc fc [ 25.904823][ T354] ================================================================== [ 25.927987][ T354] Disabling lock debugging due to kernel taint [ 25.934193][ T354] gadget @F>@: fail, usb_ep_queue returned -108