last executing test programs: 987.278545ms ago: executing program 0 (id=1): syz_open_dev$usbmon(&(0x7f0000000280), 0x0, 0x0) r0 = syz_usb_connect(0x3, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000014da2108ab12a390eb1e000000010902240001b30000040904410017ff5d810009050f1f01040000000905830300b3"], 0x0) syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x8, &(0x7f0000000200)=ANY=[]) syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x101301) 661.769304ms ago: executing program 2 (id=21): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f00000000c0)={0x1, 0x0, [{0x4000009a}]}) 498.431528ms ago: executing program 2 (id=25): mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x0, 0x0}}, &(0x7f0000000480)) r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000200), 0x800, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, 0x0) 483.711328ms ago: executing program 2 (id=26): mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./proc\x00', 0x1ff) mount(0x0, &(0x7f00000002c0)='./proc\x00', &(0x7f0000000300)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./proc/sys/kernel/printk_devkmsg\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)='of', 0x2) 429.809359ms ago: executing program 2 (id=27): unshare(0x2040400) listxattr(0x0, 0x0, 0x0) r0 = socket(0x28, 0x801, 0x0) shutdown(r0, 0x3) 366.283131ms ago: executing program 2 (id=31): madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) pipe2(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) vmsplice(r0, &(0x7f0000e79000)=[{&(0x7f00003fb000)="f7", 0x7ffff000}], 0x1, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x15) 255.764933ms ago: executing program 1 (id=33): r0 = socket$inet6(0xa, 0x80002, 0x0) r1 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000000)={'vcan0\x00', 0x0}) ioctl$sock_inet6_SIOCDIFADDR(r0, 0x8936, &(0x7f0000000040)={@ipv4={'\x00', '\xff\xff', @multicast2}, 0x14, r2}) 222.938394ms ago: executing program 2 (id=34): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$IPCTNL_MSG_EXP_GET(0xffffffffffffffff, &(0x7f0000000f00)={0x0, 0x0, &(0x7f0000000ec0)={&(0x7f0000000c80)=ANY=[@ANYBLOB="1c0000000102050000000000000000000200000806000750000100"], 0x1c}, 0x1, 0x0, 0x0, 0x24080040}, 0x0) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) 209.158115ms ago: executing program 3 (id=35): r0 = socket(0x80000000000000a, 0x1, 0x0) r1 = landlock_create_ruleset(&(0x7f0000000140)={0x0, 0x3, 0x3}, 0x18, 0x0) landlock_restrict_self(r1, 0x0) bind$inet(r0, &(0x7f0000000200)={0x2, 0x4e23, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10) 192.744135ms ago: executing program 1 (id=36): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1a7) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/mtrr\x00', 0x2, 0x0) ioctl(r0, 0x40104d05, &(0x7f0000000900)="00000d0000000000000001") 191.403305ms ago: executing program 3 (id=37): mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) r0 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) r1 = dup(r0) connect$inet(r1, &(0x7f0000000180)={0x2, 0x4e24, @rand_addr=0x640100fd}, 0x10) 166.327786ms ago: executing program 3 (id=38): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/devices/system/memory/memory0/state\x00', 0x1, 0x0) write$FUSE_INIT(r0, &(0x7f0000000340)={0xfffffee7, 0x0, 0x0, {0x7, 0x1f, 0x0, 0x3f559460, 0x4, 0x9, 0x800003, 0x0, 0x0, 0x0, 0x0, 0xa4001f7e}}, 0x50) 159.718965ms ago: executing program 1 (id=39): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./proc_dir\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./proc_dir\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc_dir/acpi/wakeup\x00', 0x2, 0x0) write(r0, 0x0, 0xc) 134.190076ms ago: executing program 3 (id=40): write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000540)={'syz0\x00', {0xd25e, 0x9, 0x3, 0x453e}, 0x2a, [0x9, 0xf8, 0xc, 0x181fe10b, 0x5, 0x40, 0x249, 0x7, 0x5, 0x7, 0x4, 0x81, 0xd, 0x5, 0x396, 0x5, 0x1, 0x2, 0x0, 0x1, 0x3, 0x40, 0x800, 0x9, 0x6, 0x1, 0xc00, 0x8, 0x7, 0xa, 0x9, 0x2, 0x10, 0xfffffffc, 0x3, 0x2, 0x800, 0x0, 0x80000000, 0x1, 0x2, 0x6, 0xfff, 0x5, 0x1, 0x4, 0xffffffff, 0xfffffff9, 0x9, 0x3, 0x6, 0x10001, 0xaa0, 0x80000001, 0x7, 0x820, 0x1, 0x3ff, 0x6, 0x8, 0x1, 0x3, 0x8000, 0x97], [0x9, 0x28c2, 0x6e, 0x1000, 0xd, 0x7, 0xe775, 0x2, 0x1, 0x1b, 0x3, 0xffffffc0, 0x8, 0x0, 0x4, 0xffffffca, 0x7fffffff, 0x8, 0x7ff, 0x8, 0x5, 0xfffffffb, 0x101, 0x2, 0x6, 0x8, 0x3, 0x9, 0x1000, 0x9f0, 0x81d, 0x60, 0x4, 0x1000, 0x3, 0xfff, 0x3, 0x3, 0x2, 0x1000, 0xcf5b, 0x2, 0xd, 0x3, 0x0, 0x0, 0x5, 0x8, 0x0, 0x1a47, 0x4, 0x8, 0x4, 0x1751, 0x5, 0x7b, 0x9, 0x3, 0x8, 0x4, 0x6, 0xffffffff, 0x200, 0x7], [0x8, 0x6, 0x1, 0x2, 0x9, 0xc, 0x5, 0x6, 0xfff, 0x3, 0x8, 0x1000, 0x3, 0x9, 0x4, 0x1000, 0xfffffffb, 0x54379595, 0x9, 0xb, 0x7ec, 0x0, 0xb3, 0x4, 0x6, 0x3, 0x6, 0x4, 0x800, 0x7, 0x800000, 0x6, 0x2, 0x9, 0x2, 0x4, 0x2, 0xffff, 0x6, 0x8, 0x3, 0xc65, 0xaa, 0x3, 0x6, 0x2, 0x8001, 0x2, 0xd, 0x1, 0x4, 0x0, 0x75a, 0x5, 0x4, 0x7, 0x6, 0x4, 0x4, 0x8, 0x2, 0xa3a7, 0x4], [0x1000, 0xfffffff8, 0xfffffff9, 0x4, 0x80, 0xfffffffc, 0x2, 0x0, 0x4, 0x3, 0x4, 0x10000, 0x2, 0x81, 0x1, 0x4, 0x793, 0x7fff, 0x2, 0x9, 0x163, 0x0, 0x8, 0x3, 0x7, 0x3, 0x8, 0x0, 0x7, 0x4, 0x10, 0xe8, 0x183, 0x0, 0x4, 0x2, 0x6, 0x48c9, 0x80000000, 0x4, 0x8, 0x2, 0x2, 0x3, 0x2, 0x0, 0x0, 0xf, 0x0, 0x3, 0x800, 0x3ff, 0x7fffffff, 0x9e0, 0xffffffff, 0x6, 0x0, 0x10000, 0x8, 0x5, 0x3, 0x9, 0x2, 0x9]}, 0x45c) r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000040)={0x802}, 0x10) sendmsg$nl_generic(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=ANY=[@ANYBLOB="1c0000004a00010200000000000000000a"], 0x164}}, 0x0) 121.427186ms ago: executing program 1 (id=41): pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r0, &(0x7f00000000c0)=[{&(0x7f0000000180)="77690addcfbe1fbb66ec", 0xff3b}], 0x1, 0x1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000a00)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r0, 0x0, 0x8, 0x2) 92.434537ms ago: executing program 3 (id=42): r0 = socket$inet6(0xa, 0x3, 0x8000000003c) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000000140)={'syztnl0\x00', &(0x7f0000000040)={'ip6_vti0\x00', 0x0, 0xcbd4734c110a32c4, 0xa, 0x76, 0xffff8000, 0x19, @local, @loopback, 0x20, 0x10, 0x3c7, 0x4}}) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x4ea4, 0x0, @local, 0x9}, 0x1c) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x953a, &(0x7f0000000100)=[{&(0x7f0000000000)="2c10", 0xffd0}], 0x1, 0x0, 0x0, 0x2c}, 0x44004) 74.092678ms ago: executing program 1 (id=43): mkdir(&(0x7f0000000400)='./my_sys\x00', 0x1ff) mount(&(0x7f0000000500)=@filename='none\x00', &(0x7f0000000600)='./my_sys\x00', &(0x7f0000000700)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000001100)='./my_sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000001200)='dummy_udc.0', 0xb) 16.664509ms ago: executing program 1 (id=44): memfd_create(&(0x7f0000000000)='\x103q}2\x9a\xce\xaf\x03\xdfy[\xd9\xffR8\xf4\x1c\bi\xe4^\xd5\xfd\xa9\r\xac7A\x94\xa0\x00\x00\x00\x90+\xd6\x05\r\x84\x87\x1c\b\xdb\xe2\x00\x00A\x90m\xb6&\xd0\x9d\x00\x00\xc5\xb8,\f\xd4s\xb2\x99/\xc0\x9a\xf2O\xdb\x00\x00\x00\x00\x00\x00\r\x1b\xd3\xff<\x83z\x80\x8fQ|\xf5d\x10\x10\xd7\x01M\x7fML\x18\'\x1a<\xfee7{l\x16}\xa0I\x7f\xb5)l\xbb\x02\xfa\xb7\xb6\xa0]\xda8\xe0~\x1c \x91\t\x8b\xbd\x1f\xb3834d1i\x9b\x94\xa6\\\x0e\xe2\xfa\xe5!\xd3\xcf\xfc\xce\xba\xe2\x9f\x05xgL5\x14Y+\xb3\x1axi)<\xf7\x98\xc1\xba\xf4|\xe7|\xc4\xd7\x03\x00\x00\x00\x04D\x15E^7%8\x94y\x98\xf0l\xa0\'Q%\xd4\xda\xee\x81}\xcc\xfd\xa2\xe3M~x\x96\xe3]\xd70\xa2\x17\xca\xde\x1b\xaa\xe0l\xfc\x85\x8fc\x1c{|e\x8bs\xb0\x85E\xce;p)\xf8\xa6\xaa&QC4V\x81\x04\xcf\xd2\x81\xdc\xdf\xd7<\x9f\x93\x8bX\xd4\xea\xb2\xff\b\x92\xc7\x00\xef\xff\x00\x93\x1f\x92\xa7dcY\x9c\x9e9O-\xfcF\xbb\xbd{:IR\xea\xd8$\xe2\xa0\xc2\x8b\x1a\xead\xb8\xe1:6\x15M\x1d\xdak\x8c\x909\xd8\xb3\x02\xe0\x04\x9c\xc2\x06|\xf0\x0f\xa6Y&r\x9b\xc7\x1d\xe7jDf\x87@\x8fg\x15RJwe\xe2\xdcunu\xff`\xa40\xce\xffB%\xe4k\xff\x8d\x06\x0e\x89\xd9DC\x9fF\x9c[M=\xe0^\xa8\xed)\xe8Z\xe8\x99&\x87\x04\xa4\t\xaa\xd8\xd6\xd5pG\xcb\xc4\x8b\xf7\xb8#\xcb\xd8|\xa5\xa6S\x8b\x8cv\xb7)\x02k\xf3L\x03\xbb\xfa\xe1\\\xf1\x8cUj\xd5\xa5\x88GL\xe7_\xfd\x17C=G\x0f\xe9u\x1d\xfeg\xfex\xcd\xaa\xad\x906\xd0sy\xc6T\x93\xae\xd5r\xc8G\xc5\xfdS\xff\x04:`\x1e\xe3;l\xcd&\xd4\xf4\x8eum\x04\x00~\xfa\x05\xd7\xe7X\xc7/\xae5\x93wwT\x13\xbd,\xd6\x16\x84\xcd\xd1\xd8\xe1P_\xbf0\xd8\x8d%Yh\xb5\xb4\"\xf5\x93\xdeh\xce\xa5\xe8\xc8\xec\x88\x89\xf07{\x95\xc9\xd0\xee\xe1\x1d\x80\xcc]-\xc2\xa1\x02ELhI\xd9\xf5\xcfk\x8a&i\xc1\xff9T\x8e\xe2rY\xa3\xd2H9\xfe\x0e\x1e\xac\x0f\xc3\xbd{\xd9\xcc\xbe\xa9\x93\xe0\xa4W\x1cn>\xc1\xf1\x9e\"\x93\x19\x19\x1a\xcc\x7fy\xd2~\x05\x99\xe6\x00o\xca\xe0\xc6\xd4\xf5\xa0\xc8P\xd6;\xf3\xc6~E\xacI\xd4\xe9\xa1|>\x91.K\x81\xa9+\xcf\xff\xcb\xfa\x0f\xe7n\x83H\x12\xac\x80\x16\xf8\x87Q\x97Az\n`\xb6\xe13A\xec\x8d(\\D\xec\xa6\t1\xa0h\xfc\x1f\xdd1@-4\xb4:\xf8\xd5wP \x84m\xe2\xd9\xfcb\xa0\xc3\xc9\xe7W\x86\xd7$\xa4ml\xee\x97[\xb7\xfa', 0x2) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$IEEE802154_ASSOCIATE_REQ(0xffffffffffffffff, &(0x7f0000000a40)={0x0, 0x0, &(0x7f0000000a00)={&(0x7f0000000000)={0x14, 0x0, 0x1, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x800}, 0x40050) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x2500, &(0x7f0000000440)={&(0x7f0000000000)=ANY=[@ANYBLOB="650100001b"], 0x188}, 0x1, 0x300}, 0x0) 0s ago: executing program 3 (id=45): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000280)=0x1, 0x4) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f0000000100)=0x5, 0x4) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.17' (ED25519) to the list of known hosts. [ 30.905728][ T288] cgroup: Unknown subsys name 'net' [ 30.912017][ T36] audit: type=1400 audit(1787354869.990:64): avc: denied { mounton } for pid=288 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 30.936649][ T36] audit: type=1400 audit(1787354869.990:65): avc: denied { mount } for pid=288 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 30.937354][ T288] cgroup: Unknown subsys name 'devices' [ 30.966000][ T36] audit: type=1400 audit(1787354870.000:66): avc: denied { unmount } for pid=288 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 31.075173][ T288] cgroup: Unknown subsys name 'hugetlb' [ 31.081811][ T288] cgroup: Unknown subsys name 'rlimit' [ 31.177412][ T36] audit: type=1400 audit(1787354870.260:67): avc: denied { setattr } for pid=288 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 31.203070][ T36] audit: type=1400 audit(1787354870.260:68): avc: denied { mounton } for pid=288 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 31.233410][ T36] audit: type=1400 audit(1787354870.260:69): avc: denied { mount } for pid=288 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 31.263745][ T290] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 31.278102][ T36] audit: type=1400 audit(1787354870.360:70): avc: denied { relabelto } for pid=290 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" Setting up swapspace version 1, size = 127995904 bytes [ 31.314943][ T36] audit: type=1400 audit(1787354870.360:71): avc: denied { write } for pid=290 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 31.365411][ T36] audit: type=1400 audit(1787354870.450:72): avc: denied { read } for pid=288 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 31.394116][ T36] audit: type=1400 audit(1787354870.450:73): avc: denied { open } for pid=288 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 31.396760][ T288] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 32.896472][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.905068][ T295] bridge0: port 1(bridge_slave_0) entered disabled state [ 32.913544][ T295] bridge_slave_0: entered allmulticast mode [ 32.921671][ T295] bridge_slave_0: entered promiscuous mode [ 32.930112][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.937694][ T295] bridge0: port 2(bridge_slave_1) entered disabled state [ 32.945681][ T295] bridge_slave_1: entered allmulticast mode [ 32.952724][ T295] bridge_slave_1: entered promiscuous mode [ 33.096763][ T300] bridge0: port 1(bridge_slave_0) entered blocking state [ 33.104797][ T300] bridge0: port 1(bridge_slave_0) entered disabled state [ 33.113418][ T300] bridge_slave_0: entered allmulticast mode [ 33.121484][ T300] bridge_slave_0: entered promiscuous mode [ 33.131832][ T300] bridge0: port 2(bridge_slave_1) entered blocking state [ 33.140275][ T300] bridge0: port 2(bridge_slave_1) entered disabled state [ 33.148209][ T300] bridge_slave_1: entered allmulticast mode [ 33.155813][ T300] bridge_slave_1: entered promiscuous mode [ 33.219336][ T299] bridge0: port 1(bridge_slave_0) entered blocking state [ 33.227707][ T299] bridge0: port 1(bridge_slave_0) entered disabled state [ 33.235085][ T299] bridge_slave_0: entered allmulticast mode [ 33.242784][ T299] bridge_slave_0: entered promiscuous mode [ 33.251236][ T299] bridge0: port 2(bridge_slave_1) entered blocking state [ 33.259409][ T299] bridge0: port 2(bridge_slave_1) entered disabled state [ 33.271361][ T299] bridge_slave_1: entered allmulticast mode [ 33.278975][ T299] bridge_slave_1: entered promiscuous mode [ 33.308249][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 33.317059][ T295] bridge0: port 2(bridge_slave_1) entered forwarding state [ 33.326123][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 33.335570][ T295] bridge0: port 1(bridge_slave_0) entered forwarding state [ 33.362891][ T301] bridge0: port 1(bridge_slave_0) entered blocking state [ 33.370294][ T301] bridge0: port 1(bridge_slave_0) entered disabled state [ 33.378211][ T301] bridge_slave_0: entered allmulticast mode [ 33.385466][ T301] bridge_slave_0: entered promiscuous mode [ 33.394347][ T301] bridge0: port 2(bridge_slave_1) entered blocking state [ 33.401448][ T301] bridge0: port 2(bridge_slave_1) entered disabled state [ 33.409723][ T301] bridge_slave_1: entered allmulticast mode [ 33.416903][ T301] bridge_slave_1: entered promiscuous mode [ 33.536166][ T299] bridge0: port 2(bridge_slave_1) entered blocking state [ 33.546013][ T299] bridge0: port 2(bridge_slave_1) entered forwarding state [ 33.555829][ T299] bridge0: port 1(bridge_slave_0) entered blocking state [ 33.566144][ T299] bridge0: port 1(bridge_slave_0) entered forwarding state [ 33.579463][ T300] bridge0: port 2(bridge_slave_1) entered blocking state [ 33.588982][ T300] bridge0: port 2(bridge_slave_1) entered forwarding state [ 33.598303][ T300] bridge0: port 1(bridge_slave_0) entered blocking state [ 33.606057][ T300] bridge0: port 1(bridge_slave_0) entered forwarding state [ 33.619771][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 33.628434][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 33.636578][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 33.645023][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 33.653290][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 33.664284][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 33.696465][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 33.704019][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 33.713756][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 33.722577][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 33.769595][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 33.779811][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 33.792614][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 33.800497][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 33.836835][ T295] veth0_vlan: entered promiscuous mode [ 33.845680][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 33.853389][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 33.870330][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 33.878135][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 33.888421][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 33.896416][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 33.910072][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 33.917657][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 33.939035][ T295] veth1_macvtap: entered promiscuous mode [ 33.984293][ T300] veth0_vlan: entered promiscuous mode [ 34.012190][ T299] veth0_vlan: entered promiscuous mode [ 34.024037][ T295] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 34.048591][ T301] veth0_vlan: entered promiscuous mode [ 34.060933][ T300] veth1_macvtap: entered promiscuous mode [ 34.098202][ T299] veth1_macvtap: entered promiscuous mode [ 34.111505][ T301] veth1_macvtap: entered promiscuous mode [ 34.285978][ T330] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 34.511965][ T45] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 34.534356][ T352] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 34.691946][ T45] usb 1-1: Using ep0 maxpacket: 8 [ 34.700994][ T45] usb 1-1: config 179 has an invalid interface number: 65 but max is 0 [ 34.717343][ T45] usb 1-1: config 179 has no interface number 0 [ 34.727630][ T45] usb 1-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 34.749032][ T45] usb 1-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 34.791902][ T45] usb 1-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 34.807229][ T45] usb 1-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 34.836295][ T45] usb 1-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 34.880927][ T45] usb 1-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 34.902090][ T45] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 34.922154][ T319] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 35.114673][ T66] usb 1-1: USB disconnect, device number 2 [ 35.114701][ C1] xpad 1-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 35.130604][ C1] dummy_hcd dummy_hcd.0: timer fired with no URBs pending? [ 35.168702][ T319] ================================================================== [ 35.179142][ T319] BUG: KASAN: slab-use-after-free in string+0x20f/0x2b0 [ 35.186717][ T319] Read of size 1 at addr ffff888106707ce0 by task syz.0.1/319 [ 35.194997][ T319] [ 35.197486][ T319] CPU: 1 UID: 0 PID: 319 Comm: syz.0.1 Not tainted syzkaller #0 9a2c17613351c9eac8e18d74829f474689ac6bc1 [ 35.197525][ T319] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 35.197553][ T319] Call Trace: [ 35.197563][ T319] [ 35.197573][ T319] __dump_stack+0x21/0x30 [ 35.197619][ T319] dump_stack_lvl+0x140/0x1c0 [ 35.197658][ T319] ? __cfi_dump_stack_lvl+0x10/0x10 [ 35.197699][ T319] print_address_description+0x71/0x210 [ 35.197740][ T319] print_report+0x4a/0x70 [ 35.197777][ T319] kasan_report+0x162/0x1a0 [ 35.197814][ T319] ? string+0x20f/0x2b0 [ 35.197849][ T319] ? string+0x20f/0x2b0 [ 35.197883][ T319] __asan_report_load1_noabort+0x18/0x20 [ 35.197910][ T319] string+0x20f/0x2b0 [ 35.197945][ T319] vsnprintf+0xe65/0x1ad0 [ 35.197982][ T319] snprintf+0xe9/0x140 [ 35.198018][ T319] ? __cfi_snprintf+0x10/0x10 [ 35.198062][ T319] ? is_bpf_text_address+0x17b/0x1a0 [ 35.198106][ T319] ? dev_vprintk_emit+0x179/0x400 [ 35.198139][ T319] dev_vprintk_emit+0x313/0x400 [ 35.198172][ T319] ? __cfi_dev_vprintk_emit+0x10/0x10 [ 35.198205][ T319] ? _raw_spin_lock_irqsave+0xc1/0x160 [ 35.198247][ T319] dev_printk_emit+0xef/0x150 [ 35.198281][ T319] ? __cfi_dev_printk_emit+0x10/0x10 [ 35.198312][ T319] ? kasan_save_alloc_info+0x3a/0x50 [ 35.198338][ T319] ? raw_ioctl+0x1ed2/0x37a0 [ 35.198378][ T319] ? __se_sys_ioctl+0x135/0x1b0 [ 35.198411][ T319] ? __x64_sys_ioctl+0x7f/0xa0 [ 35.198444][ T319] ? x64_sys_call+0x1878/0x2ee0 [ 35.198470][ T319] ? do_syscall_64+0x57/0xf0 [ 35.198510][ T319] __dev_printk+0x17f/0x1b0 [ 35.198536][ T319] _dev_err+0x11f/0x180 [ 35.198569][ T319] ? __cfi__dev_err+0x10/0x10 [ 35.198600][ T319] ? dummy_queue+0x246/0x8e0 [ 35.198626][ T319] ? __cfi__raw_spin_lock_irqsave+0x10/0x10 [ 35.198667][ T319] ? usb_ep_queue+0xf0/0x230 [ 35.198708][ T319] raw_process_ep_io+0x720/0x920 [ 35.198732][ T319] ? __virt_addr_valid+0x2a1/0x370 [ 35.198784][ T319] ? raw_process_ep0_io+0x7a0/0x7a0 [ 35.198826][ T319] ? __kasan_check_write+0x18/0x20 [ 35.198854][ T319] ? _copy_from_user+0x87/0xa0 [ 35.198894][ T319] ? memdup_user+0xb1/0x170 [ 35.198918][ T319] ? raw_ioctl+0x17d6/0x37a0 [ 35.198958][ T319] raw_ioctl+0x223d/0x37a0 [ 35.198998][ T319] ? futex_wait+0x2b8/0x7c0 [ 35.199024][ T319] ? __cfi_futex_wait+0x10/0x10 [ 35.199057][ T319] ? __cfi_raw_ioctl+0x10/0x10 [ 35.199097][ T319] ? selinux_file_ioctl+0x732/0x1480 [ 35.199126][ T319] ? __cfi_selinux_file_ioctl+0x10/0x10 [ 35.199153][ T319] ? hrtimer_nanosleep+0x265/0x340 [ 35.199196][ T319] ? do_futex+0x32a/0x510 [ 35.199234][ T319] ? __cfi_hrtimer_wakeup+0x10/0x10 [ 35.199260][ T319] ? __cfi_do_futex+0x10/0x10 [ 35.199296][ T319] ? get_timespec64+0x11a/0x1b0 [ 35.199338][ T319] ? bpf_lsm_file_ioctl+0xd/0x20 [ 35.199373][ T319] ? security_file_ioctl+0x3e/0x110 [ 35.199398][ T319] ? __cfi_raw_ioctl+0x10/0x10 [ 35.199437][ T319] __se_sys_ioctl+0x135/0x1b0 [ 35.199472][ T319] __x64_sys_ioctl+0x7f/0xa0 [ 35.199505][ T319] x64_sys_call+0x1878/0x2ee0 [ 35.199543][ T319] do_syscall_64+0x57/0xf0 [ 35.199613][ T319] ? clear_bhb_loop+0x50/0xa0 [ 35.199642][ T319] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 35.199687][ T319] RIP: 0033:0x7f78ef39dd6b [ 35.199711][ T319] Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00 [ 35.199735][ T319] RSP: 002b:00007f78f02aef60 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 35.199774][ T319] RAX: ffffffffffffffda RBX: 0000000000000008 RCX: 00007f78ef39dd6b [ 35.199794][ T319] RDX: 00007f78f02aefe0 RSI: 0000000040085507 RDI: 0000000000000004 [ 35.199813][ T319] RBP: 0000000000000004 R08: 00007f78ef750320 R09: 0000000000000000 [ 35.199832][ T319] R10: 0000000000000004 R11: 0000000000000246 R12: 0000200000000200 [ 35.199850][ T319] R13: 000000000000000c R14: 00007f78ef625fa0 R15: 00007ffc87172768 [ 35.199872][ T319] [ 35.199884][ T319] [ 35.219044][ T409] netlink: 165 bytes leftover after parsing attributes in process `syz.1.44'. [ 35.222638][ T319] Allocated by task 1: [ 35.222654][ T319] kasan_save_track+0x3e/0x80 [ 35.222687][ T319] kasan_save_alloc_info+0x3a/0x50 [ 35.222707][ T319] __kasan_kmalloc+0x96/0xb0 [ 35.222732][ T319] __kmalloc_node_track_caller_noprof+0x24e/0x4f0 [ 35.222759][ T319] kvasprintf+0xf1/0x260 [ 35.222778][ T319] kvasprintf_const+0xf6/0x250 [ 35.222797][ T319] kobject_set_name_vargs+0x65/0x120 [ 35.222828][ T319] dev_set_name+0xe3/0x140 [ 35.740505][ T319] usb_add_gadget+0x436/0x780 [ 35.747298][ T319] usb_add_gadget_udc+0x11e/0x160 [ 35.753626][ T319] dummy_udc_probe+0x6ea/0x7f0 [ 35.759158][ T319] platform_probe+0x17a/0x200 [ 35.765036][ T319] really_probe+0x2e1/0x8b0 [ 35.770717][ T319] __driver_probe_device+0x193/0x280 [ 35.777081][ T319] driver_probe_device+0x54/0x3f0 [ 35.785619][ T319] __device_attach_driver+0x2f1/0x4b0 [ 35.792000][ T319] bus_for_each_drv+0x264/0x300 [ 35.797809][ T319] __device_attach+0x2c4/0x3c0 [ 35.803456][ T319] device_initial_probe+0x1e/0x30 [ 35.813878][ T319] bus_probe_device+0x18b/0x270 [ 35.822220][ T319] device_add+0x7fd/0xbf0 [ 35.828713][ T319] platform_device_add+0x464/0x6c0 [ 35.836211][ T319] dummy_hcd_init+0xce2/0x1230 [ 35.844470][ T319] do_one_initcall+0x1e8/0x6a0 [ 35.853255][ T319] do_initcall_level+0x174/0x2e5 [ 35.861586][ T319] do_initcalls+0x7e/0x160 [ 35.869943][ T319] do_basic_setup+0x95/0xb0 [ 35.876515][ T319] kernel_init_freeable+0x2b1/0x400 [ 35.882725][ T319] kernel_init+0x21/0x1e0 [ 35.888043][ T319] ret_from_fork+0x67/0xa0 [ 35.893723][ T319] ret_from_fork_asm+0x1a/0x30 [ 35.901942][ T319] [ 35.905179][ T319] Freed by task 405: [ 35.910296][ T319] kasan_save_track+0x3e/0x80 [ 35.915799][ T319] kasan_save_free_info+0x44/0x50 [ 35.922002][ T319] __kasan_slab_free+0x5f/0x80 [ 35.927143][ T319] kfree+0x158/0x440 [ 35.931412][ T319] kfree_const+0x3d/0x50 [ 35.935788][ T319] kobject_put+0x21f/0x2a0 [ 35.940961][ T319] put_device+0x23/0x40 [ 35.945343][ T319] usb_del_gadget_udc+0x25/0x30 [ 35.951191][ T319] dummy_udc_remove+0x5c/0x70 [ 35.957020][ T319] platform_remove+0x7e/0xb0 [ 35.962426][ T319] device_release_driver_internal+0x4ad/0x830 [ 35.970595][ T319] device_driver_detach+0x3f/0x50 [ 35.977718][ T319] unbind_store+0x1ab/0x1f0 [ 35.985318][ T319] drv_attr_store+0x91/0xb0 [ 35.991361][ T319] sysfs_kf_write+0x141/0x160 [ 35.997098][ T319] kernfs_fop_write_iter+0x316/0x510 [ 36.003162][ T319] vfs_write+0x75f/0xfd0 [ 36.009813][ T319] ksys_write+0x145/0x260 [ 36.016276][ T319] __x64_sys_write+0x7f/0x90 [ 36.023391][ T319] x64_sys_call+0x271c/0x2ee0 [ 36.030063][ T319] do_syscall_64+0x57/0xf0 [ 36.034990][ T319] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 36.042089][ T319] [ 36.044908][ T319] The buggy address belongs to the object at ffff888106707ce0 [ 36.044908][ T319] which belongs to the cache kmalloc-16 of size 16 [ 36.066668][ T319] The buggy address is located 0 bytes inside of [ 36.066668][ T319] freed 16-byte region [ffff888106707ce0, ffff888106707cf0) [ 36.087559][ T319] [ 36.090740][ T319] The buggy address belongs to the physical page: [ 36.098758][ T319] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x106707 [ 36.110431][ T319] anon flags: 0x4000000000000000(zone=1) [ 36.118712][ T319] page_type: f5(slab) [ 36.123496][ T319] raw: 4000000000000000 ffff888100041640 0000000000000000 0000000000000001 [ 36.134840][ T319] raw: 0000000000000000 0000000000800080 00000001f5000000 0000000000000000 [ 36.144110][ T319] page dumped because: kasan: bad access detected [ 36.151173][ T319] page_owner tracks the page as allocated [ 36.157323][ T319] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 1, tgid 1 (swapper/0), ts 5336403098, free_ts 0 [ 36.177361][ T319] post_alloc_hook+0x37d/0x3b0 [ 36.182244][ T319] prep_new_page+0x2d/0x180 [ 36.187653][ T319] get_page_from_freelist+0x4aea/0x4ba0 [ 36.193779][ T319] __alloc_pages_noprof+0x35a/0x7e0 [ 36.199353][ T319] alloc_slab_page+0x6b/0x1e0 [ 36.204322][ T319] allocate_slab+0x69/0x430 [ 36.210005][ T319] ___slab_alloc+0x591/0x8c0 [ 36.214809][ T319] __kmalloc_node_track_caller_noprof+0x2e3/0x4f0 [ 36.222903][ T319] kstrdup+0x4d/0x130 [ 36.227698][ T319] kstrdup_const+0x45/0x60 [ 36.232563][ T319] __kernfs_new_node+0xaa/0x740 [ 36.238119][ T319] kernfs_new_node+0x154/0x280 [ 36.243386][ T319] kernfs_create_link+0xa8/0x200 [ 36.249042][ T319] sysfs_do_create_link_sd+0x8a/0x120 [ 36.254841][ T319] sysfs_create_link+0x6c/0x90 [ 36.260051][ T319] bus_add_device+0x2a0/0x430 [ 36.265924][ T319] page_owner free stack trace missing [ 36.271453][ T319] [ 36.274051][ T319] Memory state around the buggy address: [ 36.280826][ T319] ffff888106707b80: 00 01 fc fc 00 04 fc fc 00 00 fc fc 00 00 fc fc [ 36.289630][ T319] ffff888106707c00: 00 04 fc fc 00 04 fc fc 00 04 fc fc 00 04 fc fc [ 36.298182][ T319] >ffff888106707c80: 00 01 fc fc 00 04 fc fc 00 04 fc fc fa fb fc fc [ 36.307899][ T319] ^ [ 36.316595][ T319] ffff888106707d00: 00 00 fc fc 00 00 fc fc 00 05 fc fc 00 00 fc fc [ 36.325389][ T319] ffff888106707d80: 00 04 fc fc 00 01 fc fc 00 04 fc fc 00 04 fc fc [ 36.335413][ T319] ================================================================== [ 36.347306][ T319] Disabling lock debugging due to kernel taint [ 36.354624][ T319] gadget : fail, usb_ep_queue returned -108 [ 36.387687][ T36] kauditd_printk_skb: 87 callbacks suppressed [ 36.387706][ T36] audit: type=1400 audit(1787354875.470:161): avc: denied { read } for pid=94 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 36.431974][ T36] audit: type=1400 audit(1787354875.470:162): avc: denied { search } for pid=94 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 36.457586][ T36] audit: type=1400 audit(1787354875.470:163): avc: denied { write } for pid=94 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 36.483731][ T36] audit: type=1400 audit(1787354875.470:164): avc: denied { add_name } for pid=94 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 36.510431][ T36] audit: type=1400 audit(1787354875.470:165): avc: denied { create } for pid=94 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 36.534861][ T36] audit: type=1400 audit(1787354875.470:166): avc: denied { append open } for pid=94 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 36.561601][ T36] audit: type=1400 audit(1787354875.470:167): avc: denied { getattr } for pid=94 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1