last executing test programs: 1m1.507654385s ago: executing program 0 (id=1): r0 = syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x20, 0x3f0, 0x6c17, 0x40, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x12, 0x7, 0x1, 0x3, 0x0, "", {{}, [{}]}}}]}}]}}, 0x0) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000000200)={0x34, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000000400)={0x34, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)={0x20, 0x0, 0x1}}) nanosleep(&(0x7f00000001c0)={0x1}, 0x0) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) write$char_usb(r1, &(0x7f0000000300)="0123456789abcdef", 0x10) read$char_usb(r1, &(0x7f0000000400), 0x10) syz_usb_disconnect(r0) 1m1.2788445s ago: executing program 1 (id=2): r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) write$UHID_CREATE2(r0, &(0x7f0000000180)={0xb, {'syz1\x00', 'syz1\x00', 'syz1\x00', 0x7, 0x3, 0x54c, 0x5c4, 0x1, 0x0, "05010905a101c0"}}, 0x11f) read(r0, &(0x7f00000002c0)=""/256, 0x100) write(r0, &(0x7f00000003c0)="0a0000000100000001000000", 0xc) mkdir(&(0x7f0000000400)='sys\x00', 0x1ff) mount(&(0x7f0000000440)=@filename='none\x00', &(0x7f0000000480)='sys\x00', &(0x7f00000004c0)='sysfs\x00', 0x0, &(0x7f0000000500)) r1 = openat(0xffffffffffffff9c, &(0x7f0000000540)='sys/bus/hid/drivers/playstation/bind\x00', 0x1, 0x0) write(r1, &(0x7f0000000580)='0003:054C:05C4.0001\x00', 0x14) write(r1, &(0x7f00000005c0)='0003:054C:05C4.0002\x00', 0x14) write(r1, &(0x7f0000000600)='0003:054C:05C4.0003\x00', 0x14) write(r1, &(0x7f0000000640)='0003:054C:05C4.0004\x00', 0x14) 1m1.266399441s ago: executing program 2 (id=3): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000c00000/0x1000)=nil}) r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f0000000100)={0x0, &(0x7f0000000200)=[@enable_nested={0x12c, 0x18}, @nested_create_vm={0x12d, 0x18}, @nested_load_code={0x12e, 0x23, {0x0, "a100000000a300100000f4"}}, @nested_vmlaunch={0x12f, 0x18}], 0x40}) r4 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r0, 0xae04) mmap$KVM_VCPU(&(0x7f0000009000/0x1000)=nil, r4, 0x3, 0x11, r3, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_CLEAR_DIRTY_LOG(r1, 0x4010ae20, &(0x7f0000000500)={0x0, 0x0, 0x1, &(0x7f0000000600)}) ioctl$KVM_RUN(r3, 0xae80, 0x0) 1m1.200962643s ago: executing program 1 (id=6): r0 = openat$kvm(0x0, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f0000000080)={0x0, &(0x7f0000000540)=[@enable_nested={0x12c, 0x18}, @nested_create_vm={0x12d, 0x18}, @nested_load_code={0x12e, 0x19, {0x0, "f4"}}, @nested_vmlaunch={0x12f, 0x18}], 0x61}) r4 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r0, 0xae05) mmap$KVM_VCPU(&(0x7f0000009000/0x1000)=nil, r4, 0x3, 0x11, r3, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_GET_REGS(r3, 0x8001ae81, &(0x7f0000000100)) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_GET_SREGS(r3, 0x808cae83, &(0x7f0000000200)) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_GET_REGS(r3, 0x8001ae81, &(0x7f0000000300)) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_GET_SREGS(r3, 0x808cae83, &(0x7f0000000400)) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f00000005c0)) 1m1.181942793s ago: executing program 3 (id=7): r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x42, 0x1ff) write(r0, &(0x7f0000000080)='A\x00', 0x2) lseek(r0, 0xffffe, 0x0) write(r0, &(0x7f00000000c0)='B\x00', 0x2) close(r0) mkdir(&(0x7f0000000100)='./config\x00', 0x1ff) mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./config\x00', &(0x7f00000001c0)='configfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000200)='./config/usb_gadget/g1\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x1, 0x0) write(r1, &(0x7f0000000280)='0x1d6b\x00', 0x7) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/idProduct\x00', 0x1, 0x0) write(r2, &(0x7f0000000300)='0x0104\x00', 0x7) close(r2) mkdir(&(0x7f0000000340)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff) r3 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x1, 0x0) write(r3, &(0x7f00000003c0)='1234567890\x00', 0xb) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/strings/0x409/manufacturer\x00', 0x1, 0x0) close(r4) r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/strings/0x409/product\x00', 0x1, 0x0) write(r5, &(0x7f00000004c0)='Product\x00', 0x8) close(r5) mkdir(&(0x7f0000000500)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdir(&(0x7f0000000540)='./config/usb_gadget/g1/configs/c.1/strings/0x409\x00', 0x1ff) r6 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./config/usb_gadget/g1/configs/c.1/strings/0x409/configuration\x00', 0x1, 0x0) write(r6, &(0x7f00000005c0)='Conf 1\x00', 0x7) close(r6) mkdir(&(0x7f0000000600)='./config/usb_gadget/g1/functions/mass_storage.usb0\x00', 0x1ff) write(0xffffffffffffffff, &(0x7f0000000680)='/proc/self/cwd/file0\x00', 0x14) symlink(&(0x7f00000006c0)='./config/usb_gadget/g1/functions/mass_storage.usb0\x00', &(0x7f0000000700)='./config/usb_gadget/g1/configs/c.1/mass_storage.usb0\x00') 1m1.125764355s ago: executing program 3 (id=8): r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x42, 0x1ff) write(r0, &(0x7f0000000080)='A\x00', 0x2) lseek(r0, 0xffffe, 0x0) write(r0, &(0x7f00000000c0)='B\x00', 0x2) close(r0) mkdir(&(0x7f0000000100)='./config\x00', 0x1ff) mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./config\x00', &(0x7f00000001c0)='configfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x1, 0x0) write(r1, &(0x7f0000000280)='0x1d6b\x00', 0x7) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/idProduct\x00', 0x1, 0x0) write(r2, &(0x7f0000000300)='0x0104\x00', 0x7) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x1, 0x0) write(r3, &(0x7f00000003c0)='1234567890\x00', 0xb) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/strings/0x409/manufacturer\x00', 0x1, 0x0) write(r4, &(0x7f0000000440)='Manufacturer\x00', 0xd) close(r4) openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/strings/0x409/product\x00', 0x1, 0x0) mkdir(&(0x7f0000000500)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) write(0xffffffffffffffff, &(0x7f00000005c0)='Conf 1\x00', 0x7) mkdir(&(0x7f0000000600)='./config/usb_gadget/g1/functions/mass_storage.usb0\x00', 0x1ff) r5 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./config/usb_gadget/g1/functions/mass_storage.usb0/lun.0/file\x00', 0x1, 0x0) write(r5, &(0x7f0000000680)='/proc/self/cwd/file0\x00', 0x14) 1m1.095392015s ago: executing program 3 (id=11): r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup/cgroup.subtree_control\x00', 0x2, 0x0) write(r0, &(0x7f0000000080)='+pids\x00', 0x6) close(r0) mkdir(&(0x7f00000000c0)='./cgroup/g1\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup/g1/pids.max\x00', 0x2, 0x0) 1m1.082210396s ago: executing program 3 (id=12): r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x42, 0x1ff) write(r0, &(0x7f0000000100)='hello\n\x00', 0x6) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./file1\x00', 0x42, 0x1ff) write(r1, &(0x7f0000000300)='world\n\x00', 0x6) close(r1) mkdir(&(0x7f0000000400)='./nfsd_mount\x00', 0x1ff) mkdir(&(0x7f0000000500)='./proc_mount\x00', 0x1ff) mount(0x0, &(0x7f0000000600)='./nfsd_mount\x00', &(0x7f0000000700)='nfsd\x00', 0x0, 0x0) mount(0x0, &(0x7f0000000800)='./proc_mount\x00', &(0x7f0000000900)='proc\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./nfsd_mount/versions\x00', 0x2, 0x0) write(r2, &(0x7f0000000b00)='-2 -3 +4.2\n\x00', 0xb) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000c00)='./nfsd_mount/portlist\x00', 0x2, 0x0) write(r3, &(0x7f0000000d00)='tcp 20000\n\x00', 0xa) write(r3, &(0x7f0000000d20)='tcp 20001\n\x00', 0xa) write(r3, &(0x7f0000000d40)='tcp 20002\n\x00', 0xa) write(r3, &(0x7f0000000d60)='tcp 20003\n\x00', 0xa) write(r3, &(0x7f0000000d80)='tcp 20004\n\x00', 0xa) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000e00)='./proc_mount/net/rpc/auth.unix.ip/channel\x00', 0x2, 0x0) write(r4, &(0x7f0000000f00)='nfsd 127.0.0.1 2147483647 localhost\n\x00', 0x24) close(r4) r5 = openat(0xffffffffffffff9c, &(0x7f0000001000)='./proc_mount/net/rpc/nfsd.export/channel\x00', 0x2, 0x0) write(r5, &(0x7f0000001100)='localhost ./file0 2147483647 9216 0 0 1\n\x00', 0x28) write(r5, &(0x7f0000001140)='localhost ./file1 2147483647 9216 0 0 2\n\x00', 0x28) close(r5) r6 = openat(0xffffffffffffff9c, &(0x7f0000001200)='./proc_mount/net/rpc/nfsd.fh/channel\x00', 0x2, 0x0) write(r6, &(0x7f0000001300)='localhost 1 \\x01000000 2147483647 ./file0\n\x00', 0x2b) write(r6, &(0x7f0000001340)='localhost 1 \\x02000000 2147483647 ./file1\n\x00', 0x2b) close(r6) r7 = openat(0xffffffffffffff9c, &(0x7f0000001400)='./nfsd_mount/threads\x00', 0x2, 0x0) write(r7, &(0x7f0000001500)='1\n\x00', 0x2) close(r7) nanosleep(&(0x7f0000001800)={0x2}, 0x0) r8 = socket$inet(0x2, 0x1, 0x6) connect$inet(r8, &(0x7f0000001600)={0x2, 0x4e20, @loopback}, 0x10) write(r8, &(0x7f0000001700)="800000d0123456780000000000000002000186a30000000400000001000000000000000000000000000000000000000000000000000000000000000004746573740000000200000005000000350102030405060708090a0b0c0d0e0f1000000001000000000000000000000001000000160000000c01000100010000000000000000000002000000160000000c0100010002000000000000000000003cffffffffffffffffffffffffffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000004000000000100000000000000", 0xd4) 1m1.081043596s ago: executing program 2 (id=13): syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000400304016000060102030109023200010100a0320904000002ffffff000705810240000007050202400000"], 0x0) nanosleep(&(0x7f0000000300)={0x2}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sys\x00', 0x1ff) mount(&(0x7f0000000140)=@filename='sysfs\x00', &(0x7f0000000180)='./sys\x00', &(0x7f00000001c0)='sysfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/usb-serial/devices/ttyUSB0/latency_timer\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000210)='./sys/bus/usb-serial/devices/ttyUSB0/tty/ttyUSB0/latency_timer\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000220)='./sys/class/tty/ttyUSB0/device/latency_timer\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000230)='./sys/class/tty/ttyUSB0/latency_timer\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/bus/usb-serial/drivers/ftdi_sio/ttyUSB0/latency_timer\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000250)='./sys/bus/usb/devices/1-1/latency_timer\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000260)='./sys/bus/usb/devices/1-1:1.0/latency_timer\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000270)='./sys/bus/usb/devices/1-1:1.0/ttyUSB0/latency_timer\x00', 0x0, 0x0) 1m1.037674177s ago: executing program 1 (id=14): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CAP_PMU_CAPABILITY(r1, 0x4020ae63, &(0x7f0000000100)) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID2(r2, 0x4008ae90, &(0x7f0000000200)={0x3, 0x0, [{0xa, 0x0, 0x0, 0x7300402, 0x0, 0x0, 0x603}, {0x80000022, 0x0, 0x0, 0x0, 0x4}, {0x80000001, 0x0, 0x0, 0x0, 0x0, 0x2}]}) ioctl$KVM_GET_MSRS_cpu(r2, 0xc008ae88, &(0x7f0000000400)={0x5, 0x0, [{0xc1}, {0x4c1}, {0x309}, {0xc0010000}, {0xc0010201}]}) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000500)={0x5, 0x0, [{0xc1, 0x0, 0x100}, {0x4c1, 0x0, 0x100}, {0x309, 0x0, 0x100}, {0xc0010000, 0x0, 0x100}, {0xc0010201, 0x0, 0x100}]}) 1m0.885794661s ago: executing program 1 (id=15): syz_mount_image$ext4(&(0x7f0000000400)='ext4\x00', &(0x7f0000000440)='./file0\x00', 0x0, &(0x7f0000000480), 0x1, 0x3d6, &(0x7f00000004c0)="$eJzs3MtrXFUcB/DvzDRq06mptVqtigXrA8Q0bWnr1p1rCyK4MbTTB522kkRqs1KXWUqhPjaKuBAEi7hx58I/Qij4BwiigojWx8idmTumcSbYZOqg9/OBO3POvXf4nZPwOznnkDsBKmtv8VJLmkmuJZnpVW+8YW/vbeXQ1dPFUUunc+y7Wve+i4euni5vLT+3LclrSe5IUk/SGBJ38dLy2fl2u7XQr+9fOvfy/sVLy0+dOTd/qnWqdf7w3NOHjx45fOTA+Pp6bfrTN75+59nm24+2Pv9y9wdXivY2+9dW92OcaiPO33crgk3Q1kk3gA0pcnNLkqlu/s+k0a0BVdDpdB5e/zLw/1WT5FBR5R/6Yv1bHv/OzKPn22d6C5CL/b2FlUH8Ld29g/TXJtaXwLh9UYw/c8PGv/oNe3TT/X3NZpLtSe7s75XuSHJXkp1J7k6yK8k9NxG/HP9W/jb+1QfjXyPJvZvo467nfvh4ZPzXkz1D49cGO0G1YiGYZPcG439y9LPfRl3rvJ88luHxsyr+6P3h/SfPtFtzvdfhMfZdf+GlUfGL/k+PiF/2v7HJ/dqf3ts78/s68Z94ZPjvf2fKliR/JPklyfUkvyYpfqD3J9mT5IEkD64T//ibH7446loR/8SI/tdXxX9oIx3ve/7yR51NfBwAGLN6d05bq88OyvX67Gxvrrsr0/X2hcWlJ09eeOX8id7cd0em6uVUqzf/naoV9QP9uXBZP7imfqg/T77c2Nqtzx6/0D4x6c5DxW1bk/8/Nnr5D1SEf/mB6pL/UF3yH6pL/kN1yX+oLvkP1SX/obrkP1SX/Ifqkv9QXfIfKqk54vmf7aue3ZnrP+/+VWPq9vJZH+C/r7Uw+CbeNYVJtwy41f5K+km3BAAAAAAYt1G7/+MsTLqPAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAN6f+TS1JcTw+s6+59upttZ8b3fckF989duXV+aWlhQPF+e8H55fe6p8/OIn2A/9UmadlHgPVtXhp+ex8u91aUFBQqFzhzwAAAP//+VV4SQ==") mkdir(&(0x7f00000008c0)='./config\x00', 0x1ff) mount(&(0x7f0000000900)=@filename='none\x00', &(0x7f0000000940)='./config\x00', &(0x7f0000000980)='configfs\x00', 0x0, 0x0) mkdir(&(0x7f00000009c0)='./config/cluster/mycluster\x00', 0x1ff) mkdir(&(0x7f0000000a00)='./config/cluster/mycluster/node/mynode\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000a40)='./config/cluster/mycluster/node/mynode/ipv4_address\x00', 0x1, 0x0) write(r0, &(0x7f0000000a80)='127.0.0.1\x00', 0xa) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000ac0)='./config/cluster/mycluster/node/mynode/ipv4_port\x00', 0x1, 0x0) write(r1, &(0x7f0000000b00)='7777\x00', 0x5) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000b40)='./config/cluster/mycluster/node/mynode/num\x00', 0x1, 0x0) write(r2, &(0x7f0000000b80)='0\x00', 0x2) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000bc0)='./config/cluster/mycluster/node/mynode/local\x00', 0x1, 0x0) write(r3, &(0x7f0000000c00)='1\x00', 0x2) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000c40)='./config/cluster/mycluster/heartbeat/dead_threshold\x00', 0x1, 0x0) write(r4, &(0x7f0000000c80)='3\x00', 0x2) close(r4) mkdir(&(0x7f0000000cc0)='./config/cluster/mycluster/heartbeat/myregion\x00', 0x1ff) r5 = openat(0xffffffffffffff9c, &(0x7f0000000d00)='./config/cluster/mycluster/heartbeat/myregion/block_bytes\x00', 0x1, 0x0) write(r5, &(0x7f0000000d40)='512\x00', 0x4) close(r5) r6 = openat(0xffffffffffffff9c, &(0x7f0000000d80)='./config/cluster/mycluster/heartbeat/myregion/start_block\x00', 0x1, 0x0) write(r6, &(0x7f0000000dc0)='1\x00', 0x2) close(r6) r7 = openat(0xffffffffffffff9c, &(0x7f0000000e00)='./config/cluster/mycluster/heartbeat/myregion/blocks\x00', 0x1, 0x0) write(r7, &(0x7f0000000e40)='64\x00', 0x3) close(r7) r8 = openat(0xffffffffffffff9c, &(0x7f0000000e80)='./config/cluster/mycluster/heartbeat/myregion/dev\x00', 0x1, 0x0) write(r8, &(0x7f0000000ec0)='/dev/loop0\x00', 0xb) close(r8) nanosleep(&(0x7f0000000f00)={0xa}, 0x0) 1m0.240217317s ago: executing program 3 (id=16): r0 = syz_usb_connect(0x0, 0x43, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402505a7a400010102030109024300020100c03209040000010202000005240010010524010001042402020524060001070581030a000a09040100020a0000000705820240000007050302400000"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) close(r1) syz_usb_disconnect(r0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) 1m0.085009391s ago: executing program 1 (id=17): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./sys\x00', 0x1ff) mount(&(0x7f00000000c0)=@filename='none\x00', &(0x7f0000000100)='./sys\x00', &(0x7f0000000140)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/power/pm_test\x00', 0x1, 0x0) write(r1, &(0x7f00000001c0)='core\n', 0x5) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/power/state\x00', 0x1, 0x0) write(r2, &(0x7f0000000240)='mem\n', 0x4) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/power/state\x00', 0x1, 0x0) write(r3, &(0x7f00000002c0)='standby\n', 0x8) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/power/state\x00', 0x1, 0x0) write(r4, &(0x7f0000000340)='disk\n', 0x5) close(r4) 59.861089427s ago: executing program 4 (id=19): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_CAP_HYPERV_SYNIC2(r2, 0x4068aea3, &(0x7f0000000140)) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000200)={0x1, 0x0, [{0x40000090, 0x0, 0x20}]}) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000280)={0x1, 0x0, [{0x40000071, 0x0, 0x40020}]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000300)={0x1, 0x0, [{0x40000070}]}) 59.73435839s ago: executing program 4 (id=20): syz_usb_connect(0x0, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x97, 0xff, 0x82, 0x8, 0x2058, 0x1005, 0xc19b, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x8f, 0x0, 0x0, 0xbf, 0x57, 0x5a}}]}}]}}, 0x0) r0 = syz_usb_connect(0x3, 0x4e, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000401107020900010000000109023c0001010080fa0904000006ff00000007058e0200020007050e02000200070501020002000705030200020007058d0200020007050d02000200"], 0x0) syz_usb_ep_write(r0, 0x8e, 0x20, &(0x7f0000000220)='\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"') 49.324042775s ago: executing program 3 (id=21): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sys\x00', 0x1ff) mount(&(0x7f0000000200)=@filename='sysfs\x00', &(0x7f0000000300)='./sys\x00', &(0x7f0000000400)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/power/pm_test\x00', 0x2, 0x0) write(r1, &(0x7f0000000040)='core\n', 0x5) r2 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/power/state\x00', 0x2, 0x0) write(r2, &(0x7f0000000080)='disk\n', 0x5) 49.320054245s ago: executing program 2 (id=22): r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x42, 0x1ff) write(r0, &(0x7f0000000080)='A\x00', 0x2) lseek(r0, 0xffffe, 0x0) write(r0, &(0x7f00000000c0)='B\x00', 0x2) close(r0) mkdir(&(0x7f0000000100)='./config\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x1, 0x0) write(r1, &(0x7f0000000280)='0x1d6b\x00', 0x7) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/idProduct\x00', 0x1, 0x0) write(r2, &(0x7f0000000300)='0x0104\x00', 0x7) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x1, 0x0) write(r3, &(0x7f00000003c0)='1234567890\x00', 0xb) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/strings/0x409/manufacturer\x00', 0x1, 0x0) write(r4, &(0x7f0000000440)='Manufacturer\x00', 0xd) close(r4) openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/strings/0x409/product\x00', 0x1, 0x0) mkdir(&(0x7f0000000500)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) write(0xffffffffffffffff, &(0x7f00000005c0)='Conf 1\x00', 0x7) mkdir(&(0x7f0000000600)='./config/usb_gadget/g1/functions/mass_storage.usb0\x00', 0x1ff) r5 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./config/usb_gadget/g1/functions/mass_storage.usb0/lun.0/file\x00', 0x1, 0x0) write(r5, &(0x7f0000000680)='/proc/self/cwd/file0\x00', 0x14) 49.318589355s ago: executing program 0 (id=23): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CAP_DIRTY_LOG_RING(r1, 0x4068aea3, &(0x7f0000000040)={0xc0, 0x0, 0x10000}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x0, 0x1, 0x0, 0x10000, 0xfffffffffffffffd}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) mmap(0x0, 0x10000, 0x3, 0x11, r2, 0x40000) r3 = eventfd2(0x2, 0x0) read$eventfd(r3, &(0x7f0000000100), 0x8) ioctl$KVM_RESET_DIRTY_RINGS(r1, 0xaec7) 49.273855036s ago: executing program 4 (id=24): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/module/gspca_m5602/parameters/force_sensor\x00', 0x1, 0x0) write(r0, &(0x7f0000000400)='4', 0x1) close(r0) r1 = syz_usb_connect(0x0, 0x2b, &(0x7f0000000700)=ANY=[@ANYBLOB="1201000200000040020402560001010203010902190001010080320904000001ffffff0007058102000200"], 0x0) syz_usb_control_io(r1, 0x0, &(0x7f0000000140)={0x84, &(0x7f0000000240)={0x40, 0x4, 0x2, "3a14"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r1, 0x0, &(0x7f0000000340)={0x84, &(0x7f0000000440)={0x40, 0x4, 0x2, "3a14"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r1, 0x0, &(0x7f0000000480)={0x84, &(0x7f0000000540)={0x40, 0x4, 0x2, "3a14"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r1, 0x0, &(0x7f0000000580)={0x84, &(0x7f0000000640)={0x40, 0x4, 0x2, "3a14"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r1, 0x0, &(0x7f0000000740)={0x84, &(0x7f0000000800)={0x40, 0x4, 0x2, "3a14"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 49.273619056s ago: executing program 2 (id=25): r0 = syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000408680630b0000000000010902200001010080fa0904000002ffffff000705810200020007050202000200"], 0x0) syz_usb_ep_read(r0, 0x2, 0x40, &(0x7f0000000100)=""/64) (async) syz_usb_ep_read(r0, 0x2, 0x40, &(0x7f0000000200)=""/64) (async) syz_usb_ep_read(r0, 0x2, 0x40, &(0x7f0000000300)=""/64) (async) syz_usb_ep_read(r0, 0x2, 0x40, &(0x7f0000000400)=""/64) (async) syz_usb_ep_write(r0, 0x81, 0x8, &(0x7f0000000500)="0102010400000000") (async) syz_usb_ep_write(r0, 0x81, 0xc, &(0x7f0000000600)="0104020808010008ffffffff") (async) syz_usb_ep_write(r0, 0x81, 0x5, &(0x7f0000000700)="0105030100") (async) syz_usb_ep_write(r0, 0x81, 0x5, &(0x7f0000000800)="0108040100") (async) nanosleep(&(0x7f0000000900)={0x1}, 0x0) 49.248110547s ago: executing program 0 (id=26): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sys\x00', 0x1ff) mount(&(0x7f0000000200)=@filename='sysfs\x00', &(0x7f0000000300)='./sys\x00', &(0x7f0000000400)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/power/pm_test\x00', 0x2, 0x0) write(r1, &(0x7f0000000600)='freezer\n', 0x8) r2 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/power/state\x00', 0x2, 0x0) write(r2, &(0x7f0000000800)='disk\n', 0x5) 36.010986554s ago: executing program 32 (id=17): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./sys\x00', 0x1ff) mount(&(0x7f00000000c0)=@filename='none\x00', &(0x7f0000000100)='./sys\x00', &(0x7f0000000140)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/power/pm_test\x00', 0x1, 0x0) write(r1, &(0x7f00000001c0)='core\n', 0x5) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/power/state\x00', 0x1, 0x0) write(r2, &(0x7f0000000240)='mem\n', 0x4) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/power/state\x00', 0x1, 0x0) write(r3, &(0x7f00000002c0)='standby\n', 0x8) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/power/state\x00', 0x1, 0x0) write(r4, &(0x7f0000000340)='disk\n', 0x5) close(r4) 35.998699304s ago: executing program 4 (id=28): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_NEW_INTERFACE(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000400)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010000000000000000000700000008000100000000000a0004007770616e30000000000800050001000000"], 0x30}}, 0x0) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000100)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_GET_SEC_DEVKEY(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000700)={0x1c, r1, 0x301, 0x0, 0x0, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r2}]}, 0x1c}}, 0x0) 35.998530784s ago: executing program 2 (id=29): syz_usb_connect$midi(0x3, 0x31, &(0x7f0000000740)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x40, 0x2a39, 0x3fd4, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1f, 0x1, 0x1, 0x7, 0x80, 0x1, "", {{{0x9, 0x4, 0x0, 0x0, 0x1, 0x1, 0x3, 0x30, 0xa, [], [{{0x9, 0x5, 0x828f68345dc74cce, 0x8, 0x3e7, 0x3, 0x85, 0x3, {0x4}}}]}}}}}]}}, 0x0) syz_usb_connect(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040990434120001000000010902240001010080320904000001ff0000000b2403010102010102010007050102400000"], 0x0) 35.825804699s ago: executing program 4 (id=30): r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x42, 0x1ff) write(r0, &(0x7f0000000080)='A\x00', 0x2) lseek(r0, 0xffffe, 0x0) write(r0, &(0x7f00000000c0)='B\x00', 0x2) close(r0) mkdir(&(0x7f0000000100)='./config\x00', 0x1ff) mount(&(0x7f0000000140)=@filename='none\x00', &(0x7f0000000180)='./config\x00', &(0x7f00000001c0)='configfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000200)='./config/usb_gadget/g1\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x1, 0x0) write(r1, &(0x7f0000000280)='0x1d6b\x00', 0x7) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/idProduct\x00', 0x1, 0x0) write(r2, &(0x7f0000000300)='0x0104\x00', 0x7) close(r2) mkdir(&(0x7f0000000340)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff) r3 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x1, 0x0) write(r3, &(0x7f00000003c0)='1234567890\x00', 0xb) close(r3) close(0xffffffffffffffff) r4 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/strings/0x409/product\x00', 0x1, 0x0) write(r4, &(0x7f00000004c0)='Product\x00', 0x8) close(r4) mkdir(&(0x7f0000000500)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdir(&(0x7f0000000540)='./config/usb_gadget/g1/configs/c.1/strings/0x409\x00', 0x1ff) r5 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./config/usb_gadget/g1/configs/c.1/strings/0x409/configuration\x00', 0x1, 0x0) write(r5, &(0x7f00000005c0)='Conf 1\x00', 0x7) close(r5) mkdir(&(0x7f0000000600)='./config/usb_gadget/g1/functions/mass_storage.usb0\x00', 0x1ff) write(0xffffffffffffffff, &(0x7f0000000680)='/proc/self/cwd/file0\x00', 0x14) symlink(&(0x7f00000006c0)='./config/usb_gadget/g1/functions/mass_storage.usb0\x00', &(0x7f0000000700)='./config/usb_gadget/g1/configs/c.1/mass_storage.usb0\x00') 25.043634003s ago: executing program 33 (id=26): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sys\x00', 0x1ff) mount(&(0x7f0000000200)=@filename='sysfs\x00', &(0x7f0000000300)='./sys\x00', &(0x7f0000000400)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/power/pm_test\x00', 0x2, 0x0) write(r1, &(0x7f0000000600)='freezer\n', 0x8) r2 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/power/state\x00', 0x2, 0x0) write(r2, &(0x7f0000000800)='disk\n', 0x5) 25.031822214s ago: executing program 34 (id=21): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sys\x00', 0x1ff) mount(&(0x7f0000000200)=@filename='sysfs\x00', &(0x7f0000000300)='./sys\x00', &(0x7f0000000400)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/power/pm_test\x00', 0x2, 0x0) write(r1, &(0x7f0000000040)='core\n', 0x5) r2 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/power/state\x00', 0x2, 0x0) write(r2, &(0x7f0000000080)='disk\n', 0x5) 25.021859314s ago: executing program 2 (id=33): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0) syz_usb_connect(0x3, 0x32, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000200000040c30b01000100000000010902200001010080320904000002ffffff000705810200020007050202000200"], 0x0) nanosleep(&(0x7f0000000140)={0x1}, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000180)='./dev/ttyUSB0\x00', 0x802, 0x0) 25.020975874s ago: executing program 4 (id=34): syz_usb_connect(0x0, 0x55, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002020000402505a7a400010000000109024300020100c032090400000102020000052400100104240202052406000105240100010705810308000a09040100020a0000000705820240000007050302400000"], 0x0) nanosleep(&(0x7f0000000300)={0x1, 0xa}, 0x0) r0 = syz_open_dev$usbfs(&(0x7f0000000100), 0x15, 0x2) ioctl$USBDEVFS_RESET(r0, 0x5514) 4.875710516s ago: executing program 35 (id=33): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0) syz_usb_connect(0x3, 0x32, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000200000040c30b01000100000000010902200001010080320904000002ffffff000705810200020007050202000200"], 0x0) nanosleep(&(0x7f0000000140)={0x1}, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000180)='./dev/ttyUSB0\x00', 0x802, 0x0) 4.797832448s ago: executing program 36 (id=34): syz_usb_connect(0x0, 0x55, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002020000402505a7a400010000000109024300020100c032090400000102020000052400100104240202052406000105240100010705810308000a09040100020a0000000705820240000007050302400000"], 0x0) nanosleep(&(0x7f0000000300)={0x1, 0xa}, 0x0) r0 = syz_open_dev$usbfs(&(0x7f0000000100), 0x15, 0x2) ioctl$USBDEVFS_RESET(r0, 0x5514) 4.004998669s ago: executing program 5 (id=27): r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002e00101408780250001000000000109022700010100c0320904000003e0010100070581034000010705820240000007050202400000"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r1, 0x400448c9, 0x0) syz_usb_ep_write(r0, 0x81, 0x8, &(0x7f0000000100)="ff06878003010100") 2.885516227s ago: executing program 6 (id=31): delete_module(&(0x7f0000000000)='dwc3\x00', 0x0) delete_module(&(0x7f0000000100)='dwc3_pci\x00', 0x0) 2.818108229s ago: executing program 6 (id=37): syz_usb_connect(0x0, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x97, 0xff, 0x82, 0x8, 0x2058, 0x1005, 0xc19b, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x8f, 0x0, 0x0, 0xbf, 0x57, 0x5a}}]}}]}}, 0x0) r0 = openat(0xffffff9c, &(0x7f0000000040)='file0\x00', 0x42, 0x1ff) write(r0, &(0x7f0000000080)='/dev/raw-gadget\x00', 0x10) close(r0) r1 = openat(0xffffff9c, &(0x7f00000000c0)='file0\x00', 0x0, 0x0) read(r1, &(0x7f0000000000)=""/16, 0x10) r2 = syz_open_dev$hidraw(0xfffffffffffffffc, 0x0, 0x2) ioctl(r2, 0x41015500, &(0x7f0000000100)='cdnsp-gadget\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00P') 2.76995125s ago: executing program 8 (id=35): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/drivers/uhci_hcd/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000140)='0000:00:1d.0', 0xc) write(r0, &(0x7f0000000180)='0000:00:1d.1', 0xc) write(r0, &(0x7f00000001c0)='0000:00:1d.2', 0xc) write(r0, &(0x7f0000000200)='0000:00:1a.0', 0xc) write(r0, &(0x7f0000000240)='0000:00:1a.1', 0xc) write(r0, &(0x7f0000000280)='0000:00:1a.2', 0xc) r1 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./sys/bus/pci/drivers/uhci_hcd/bind\x00', 0x1, 0x0) write(r1, &(0x7f0000000300)='0000:00:1d.0', 0xc) write(r1, &(0x7f0000000340)='0000:00:1d.1', 0xc) write(r1, &(0x7f0000000380)='0000:00:1d.2', 0xc) write(r1, &(0x7f00000003c0)='0000:00:1a.0', 0xc) write(r1, &(0x7f0000000400)='0000:00:1a.1', 0xc) write(r1, &(0x7f0000000440)='0000:00:1a.2', 0xc) r2 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./sys/bus/pci/drivers/ehci-pci/unbind\x00', 0x1, 0x0) write(r2, &(0x7f00000004c0)='0000:00:1d.7', 0xc) write(r2, &(0x7f0000000500)='0000:00:1a.7', 0xc) r3 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./sys/bus/pci/drivers/ehci-pci/bind\x00', 0x1, 0x0) write(r3, &(0x7f0000000580)='0000:00:1d.7', 0xc) write(r3, &(0x7f00000005c0)='0000:00:1a.7', 0xc) r4 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/pci/drivers/xhci-hcd/unbind\x00', 0x1, 0x0) write(r4, &(0x7f0000000640)='0000:00:14.0', 0xc) r5 = openat(0xffffffffffffff9c, &(0x7f0000000680)='./sys/bus/pci/drivers/xhci-hcd/bind\x00', 0x1, 0x0) write(r5, &(0x7f00000006c0)='0000:00:14.0', 0xc) 2.736672851s ago: executing program 8 (id=38): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000140)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/ecm.usb0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) symlinkat(&(0x7f0000000240)='./config/usb_gadget/g1/functions/ecm.usb0\x00', 0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/configs/c.1/ecm.usb0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r0, &(0x7f0000000380)='dummy_udc.0\n\x00', 0xc) nanosleep(&(0x7f0000000300)={0x1}, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./sys/bus/usb/devices/5-1/bConfigurationValue\x00', 0x1, 0x0) write(r1, &(0x7f0000000500)='1\n\x00', 0x2) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) write(r1, &(0x7f0000000500)='0\n\x00', 0x2) 2.672772443s ago: executing program 9 (id=36): r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x42, 0x1ff) write(r0, &(0x7f0000000080)='A\x00', 0x2) lseek(r0, 0xffffe, 0x0) write(r0, &(0x7f00000000c0)='B\x00', 0x2) close(r0) mkdir(&(0x7f0000000100)='./config\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x1, 0x0) write(r1, &(0x7f0000000280)='0x1d6b\x00', 0x7) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/idProduct\x00', 0x1, 0x0) write(r2, &(0x7f0000000300)='0x0104\x00', 0x7) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x1, 0x0) write(r3, &(0x7f00000003c0)='1234567890\x00', 0xb) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/strings/0x409/manufacturer\x00', 0x1, 0x0) write(r4, &(0x7f0000000440)='Manufacturer\x00', 0xd) close(r4) openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/strings/0x409/product\x00', 0x1, 0x0) mkdir(&(0x7f0000000500)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) write(0xffffffffffffffff, &(0x7f00000005c0)='Conf 1\x00', 0x7) mkdir(&(0x7f0000000600)='./config/usb_gadget/g1/functions/mass_storage.usb0\x00', 0x1ff) r5 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./config/usb_gadget/g1/functions/mass_storage.usb0/lun.0/file\x00', 0x1, 0x0) write(r5, &(0x7f0000000680)='/proc/self/cwd/file0\x00', 0x14) 2.643303403s ago: executing program 7 (id=32): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x97, 0xff, 0x82, 0x8, 0x1234, 0x5678, 0xc19b, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x8f, 0x0, 0x0, 0xbf, 0x57, 0x5a}}]}}]}}, 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) r1 = syz_open_dev$usbfs(&(0x7f0000000100), 0x19, 0x2) r2 = syz_open_dev$usbfs(&(0x7f0000000200), 0x19, 0x2) ioctl$USBDEVFS_SETCONFIGURATION(r1, 0x80045505, &(0x7f0000000400)=0x1) ioctl$USBDEVFS_SETCONFIGURATION(r2, 0x80045505, &(0x7f0000000400)=0x1) syz_usb_disconnect(r0) 2.561978626s ago: executing program 9 (id=39): syz_usb_connect(0x0, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x97, 0xff, 0x82, 0x8, 0x2058, 0x1005, 0xc19b, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x8f, 0x0, 0x0, 0xbf, 0x57, 0x5a}}]}}]}}, 0x0) syz_usb_connect(0x0, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x40, 0x10c4, 0xea60, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x20, 0x1, 0x1, 0x0, 0x80, 0xfa, "", [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x40}}]}}]}}]}}, 0x0) 1.878473783s ago: executing program 8 (id=40): mkdir(&(0x7f0000000100)='./config_test\x00', 0x1ff) mount(&(0x7f0000000200)=@filename='none\x00', &(0x7f0000000300)='./config_test\x00', &(0x7f0000000400)='configfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000500)='./config_test/usb_gadget/g3\x00', 0x1ff) rmdir(&(0x7f0000000600)='./config_test/usb_gadget/g3\x00') getuid() 1.862939973s ago: executing program 8 (id=41): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000001c0)=[@text32={0x20, &(0x7f0000000480)="f00fb196000001000fc7ad094800000f07b8003000000f23c80f21f835000040000f23f82666d99e00d0ffff8fc860ece7d80f01c3c4c279ad210f0d020f20d835080000000f22d8", 0x48}], 0x1, 0x4, 0x0, 0x0) mmap$KVM_VCPU(&(0x7f0000009000/0x1000)=nil, 0x1000, 0x3, 0x11, r2, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_PRE_FAULT_MEMORY(r2, 0xc040aed5, &(0x7f0000000180)={0x0, 0x2000}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x1, 0x0, 0x0, &(0x7f0000000000/0x1000)=nil}) ioctl$KVM_SET_NR_MMU_PAGES(r1, 0xae44, 0x100) 1.637997759s ago: executing program 8 (id=42): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f0000000100)={0x0, &(0x7f0000000200)=[@wrmsr={0x65, 0x20, {0x830, 0x4020}}, @uexit={0x0, 0x18}], 0x38}) ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f0000000300)={0x2, 0x0, [{0x1b, 0x0, 0xfee00d00}, {0x4b564d04, 0x0, 0xdddd0001}]}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000400)={[], 0x0, 0x202}) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) 1.637815789s ago: executing program 5 (id=43): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x2058, 0x1005, 0xc19b, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x8f}}]}}]}}, 0x0) syz_usb_disconnect(r0) r1 = epoll_create(0x1) epoll_wait(r1, &(0x7f0000000000), 0x1, 0x9c4) 1.5959625s ago: executing program 6 (id=44): r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402505a5a400010102030109022000010100c0000904000002080650000705810200020007050202000200"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) nanosleep(&(0x7f0000000400)={0x3}, 0x0) syz_usb_ep_read(r0, 0x2, 0x20, &(0x7f0000000100)=""/32) syz_usb_ep_write(r0, 0x81, 0x24, &(0x7f0000000200)='6\x00'/36) nanosleep(&(0x7f0000000400)={0x1}, 0x0) 1.537547801s ago: executing program 8 (id=45): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/module/usbcore/parameters/quirks\x00', 0x2, 0x0) write(r0, &(0x7f0000000140)='0fc5:1227:b\n', 0xc) close(r0) syz_usb_connect(0x0, 0x24, &(0x7f0000000200)=ANY=[@ANYBLOB="1201000200000040c50f2712000101020301090212000101008032090400000000000000"], 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x1dcd6500}, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./sys/bus/usb/devices/5-1/power/autosuspend_delay_ms\x00', 0x2, 0x0) write(r1, &(0x7f0000000380)='0\n', 0x2) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./sys/bus/usb/devices/5-1/power/control\x00', 0x2, 0x0) write(r2, &(0x7f0000000400)='auto\n', 0x5) close(r2) nanosleep(&(0x7f0000000300)={0x0, 0x1dcd6500}, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./sys/bus/usb/devices/5-1/power/control\x00', 0x2, 0x0) write(r3, &(0x7f0000000580)='on\n', 0x4) close(r3) nanosleep(&(0x7f0000000600)={0x0, 0x1dcd6500}, 0x0) 1.19799769s ago: executing program 9 (id=46): syz_usb_connect(0x0, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x97, 0xff, 0x82, 0x8, 0x2058, 0x1005, 0xc19b, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x8f, 0x0, 0x0, 0xbf, 0x57, 0x5a}}]}}]}}, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000400)='.\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./my_sysfs\x00', 0x0) mount(0x0, &(0x7f0000000480)='./my_sysfs\x00', &(0x7f00000004c0)='sysfs\x00', 0x0, 0x0) chdir(&(0x7f0000000500)='./my_sysfs\x00') chdir(&(0x7f0000000540)='./module\x00') chdir(&(0x7f0000000580)='./uhci_hcd\x00') chdir(&(0x7f00000005c0)='./parameters\x00') r1 = open(&(0x7f0000000600)='debug\x00', 0x1, 0x0) write(r1, &(0x7f0000000640)='3\x00', 0x2) fchdir(r0) mkdirat(0xffffffffffffff9c, &(0x7f0000000680)='./my_debugfs\x00', 0x0) mount(0x0, &(0x7f00000006c0)='./my_debugfs\x00', &(0x7f0000000700)='debugfs\x00', 0x0, 0x0) chdir(&(0x7f0000000740)='./my_debugfs\x00') chdir(&(0x7f0000000780)='./usb\x00') chdir(&(0x7f00000007c0)='./uhci\x00') r2 = open(&(0x7f0000000800)='0000:00:1d.0\x00', 0x0, 0x0) read(r2, &(0x7f0000000840)=""/1024, 0x400) 360.330601ms ago: executing program 7 (id=47): syz_usb_connect(0x0, 0x27, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000400304016000000102030109022000010100c0000904000002000000000705810240000007050202400000"], 0x0) nanosleep(&(0x7f0000000100)={0x1}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./sys\x00', &(0x7f0000000240)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/usb/devices/2-1/power/control\x00', 0x1, 0x0) write(r0, &(0x7f0000000400)='auto\x00', 0x5) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/usb/devices/2-1/power/autosuspend_delay_ms\x00', 0x1, 0x0) write(r1, &(0x7f0000000400)='0\x00', 0x2) close(r1) nanosleep(&(0x7f0000000100)={0x1}, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/usb/devices/2-1/power/control\x00', 0x1, 0x0) write(r2, &(0x7f0000000400)='on\x00', 0x3) close(r2) 11.98288ms ago: executing program 9 (id=48): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/devices/0000:00:01.0/driver/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000140)='0000:00:01.0\x00', 0xd) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/devices/0000:00:01.0/driver_override\x00', 0x1, 0x0) write(r1, &(0x7f00000001c0)='isp1760\x00', 0x8) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/drivers/isp1760/bind\x00', 0x1, 0x0) write(r2, &(0x7f0000000240)='0000:00:01.0\x00', 0xd) close(r2) 0s ago: executing program 9 (id=49): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0) write(r0, &(0x7f0000000180)='0x1d6b\x00', 0x6) r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0) write(r1, &(0x7f0000000200)='0x0104\x00', 0x6) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0) write(r2, &(0x7f00000002c0)='1234567890\x00', 0xb) r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/strings/0x409/manufacturer\x00', 0x2, 0x0) write(r3, &(0x7f0000000340)='Linux Foundation\x00', 0x11) r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/strings/0x409/product\x00', 0x2, 0x0) write(r4, &(0x7f00000003c0)='Test Gadget\x00', 0xc) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/functions/midi.usb0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/configs/c.1/strings/0x409\x00', 0x1ff) r5 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./config/usb_gadget/g1/configs/c.1/strings/0x409/configuration\x00', 0x2, 0x0) write(r5, &(0x7f0000000500)='Conf 1\x00', 0x7) r6 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/usb_gadget/g1/configs/c.1\x00', 0x0, 0x0) symlinkat(&(0x7f0000000580)='./config/usb_gadget/g1/functions/midi.usb0\x00', r6, &(0x7f00000005c0)='midi.usb0\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g1/configs/c.2\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000640)='./config/usb_gadget/g1/configs/c.2/strings/0x409\x00', 0x1ff) r7 = openat(0xffffffffffffff9c, &(0x7f0000000680)='./config/usb_gadget/g1/configs/c.2/strings/0x409/configuration\x00', 0x2, 0x0) write(r7, &(0x7f00000006c0)='Conf 2\x00', 0x7) r8 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./config/usb_gadget/g1/configs/c.2\x00', 0x0, 0x0) symlinkat(&(0x7f0000000580)='./config/usb_gadget/g1/functions/midi.usb0\x00', r8, &(0x7f0000000740)='midi.usb0\x00') r9 = openat(0xffffffffffffff9c, &(0x7f0000000780)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0) write(r9, &(0x7f00000007c0)='dummy_udc.0\x00', 0xb) nanosleep(&(0x7f0000000800)={0x0, 0x17d78400}, 0x0) r10 = openat(0xffffffffffffff9c, &(0x7f0000000840)='./sys/devices/platform/dummy_hcd.0/usb5/5-1/bConfigurationValue\x00', 0x2, 0x0) write(r10, &(0x7f00000008c0)='2\x00', 0x2) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.152' (ED25519) to the list of known hosts. [ 21.127316][ T28] audit: type=1400 audit(1786952762.044:64): avc: denied { mounton } for pid=279 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 21.128385][ T279] cgroup: Unknown subsys name 'net' [ 21.149988][ T28] audit: type=1400 audit(1786952762.044:65): avc: denied { mount } for pid=279 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 21.177346][ T28] audit: type=1400 audit(1786952762.084:66): avc: denied { unmount } for pid=279 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 21.177512][ T279] cgroup: Unknown subsys name 'devices' [ 21.321893][ T279] cgroup: Unknown subsys name 'hugetlb' [ 21.327678][ T279] cgroup: Unknown subsys name 'rlimit' [ 21.459461][ T28] audit: type=1400 audit(1786952762.384:67): avc: denied { setattr } for pid=279 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=258 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 21.482623][ T28] audit: type=1400 audit(1786952762.384:68): avc: denied { mounton } for pid=279 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 21.507327][ T28] audit: type=1400 audit(1786952762.384:69): avc: denied { mount } for pid=279 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 21.531670][ T281] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 21.540749][ T28] audit: type=1400 audit(1786952762.474:70): avc: denied { relabelto } for pid=281 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.566159][ T28] audit: type=1400 audit(1786952762.474:71): avc: denied { write } for pid=281 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.568070][ T279] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 21.592020][ T28] audit: type=1400 audit(1786952762.484:72): avc: denied { read } for pid=279 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.625896][ T28] audit: type=1400 audit(1786952762.484:73): avc: denied { open } for pid=279 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.010056][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.017163][ T287] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.024696][ T287] device bridge_slave_0 entered promiscuous mode [ 23.031677][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.038699][ T287] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.046157][ T287] device bridge_slave_1 entered promiscuous mode [ 23.065674][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.072723][ T290] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.080070][ T290] device bridge_slave_0 entered promiscuous mode [ 23.088336][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.095405][ T290] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.102758][ T290] device bridge_slave_1 entered promiscuous mode [ 23.136900][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.143953][ T288] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.151376][ T288] device bridge_slave_0 entered promiscuous mode [ 23.158187][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.165391][ T288] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.172755][ T288] device bridge_slave_1 entered promiscuous mode [ 23.220487][ T291] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.227534][ T291] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.235077][ T291] device bridge_slave_0 entered promiscuous mode [ 23.241953][ T291] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.248974][ T291] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.256468][ T291] device bridge_slave_1 entered promiscuous mode [ 23.304257][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.311364][ T289] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.318780][ T289] device bridge_slave_0 entered promiscuous mode [ 23.334904][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.342066][ T289] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.349462][ T289] device bridge_slave_1 entered promiscuous mode [ 23.470798][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.477870][ T288] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.485164][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.492187][ T288] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.512229][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.519269][ T287] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.526542][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.533568][ T287] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.547544][ T291] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.554598][ T291] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.561881][ T291] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.568889][ T291] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.584379][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.591429][ T289] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.598678][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.605712][ T289] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.617894][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.624950][ T290] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.632201][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.639210][ T290] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.684242][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.691512][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.698688][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.706293][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.713445][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.720974][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.728098][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.735375][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.742732][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.749875][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.757209][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.784248][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.791999][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.800078][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.807112][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.814583][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.822994][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.829993][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.837371][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.845515][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.852535][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.859906][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 23.867328][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.874721][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 23.882139][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.889465][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.897676][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.904709][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.912241][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.920401][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.927404][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.934801][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.942915][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.949910][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.957282][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.965422][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.972444][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.980671][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.988837][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.995860][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.022545][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.030775][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.038660][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 24.046954][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.055190][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 24.063444][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.071480][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 24.079418][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.087483][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 24.095639][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.112397][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.120709][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.128946][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.137360][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.145803][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.153853][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.162004][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.169812][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.177905][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.185467][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.192950][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.200446][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.207879][ T290] device veth0_vlan entered promiscuous mode [ 24.220079][ T288] device veth0_vlan entered promiscuous mode [ 24.228906][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 24.237032][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.245162][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 24.253388][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.261521][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.269774][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.282621][ T287] device veth0_vlan entered promiscuous mode [ 24.293655][ T288] device veth1_macvtap entered promiscuous mode [ 24.300387][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.308267][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.316275][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 24.323749][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.331386][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 24.339441][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.347620][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 24.355288][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.362784][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.372520][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 24.380968][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.389103][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.396140][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.409632][ T291] device veth0_vlan entered promiscuous mode [ 24.425874][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.434294][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.443212][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.451857][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.459663][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.467836][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 24.476408][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.484755][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.491805][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.499248][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.506787][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.515096][ T290] device veth1_macvtap entered promiscuous mode [ 24.530048][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.538574][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.547090][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.555483][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.563977][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.572025][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.579873][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 24.588087][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.600735][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.611791][ T291] device veth1_macvtap entered promiscuous mode [ 24.628224][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 24.631339][ T288] request_module fs-gadgetfs succeeded, but still no fs? [ 24.636039][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.651121][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.659464][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.667844][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.676263][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.684520][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.695021][ T287] device veth1_macvtap entered promiscuous mode [ 24.711621][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 24.721370][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.729593][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 24.737855][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.746314][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.755056][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.763314][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.771687][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.779814][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.791472][ T289] device veth0_vlan entered promiscuous mode [ 24.803490][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.811556][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.818904][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.844859][ T289] device veth1_macvtap entered promiscuous mode [ 24.857278][ T315] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.866046][ T315] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.875171][ T315] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.886653][ T318] clocksource: Switched to clocksource kvm-clock [ 24.894117][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.895863][ T318] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 24.903337][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.963270][ T24] sony 0003:054C:05C4.0001: No inputs registered, leaving [ 24.981196][ T24] sony 0003:054C:05C4.0001: hidraw0: USB HID v80.01 Gamepad [syz1] on syz1 [ 24.989812][ T24] sony 0003:054C:05C4.0001: failed to claim input [ 25.004274][ T40] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 25.051299][ T333] Mass Storage Function, version: 2009/09/11 [ 25.066266][ T333] LUN: removable file: (no medium) [ 25.075109][ T328] fido_id[328]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 25.187190][ T347] kvm [346]: vcpu0, guest rIP: 0xfff0 Unhandled WRMSR(0xc1) = 0x100 [ 25.200166][ T40] usb 1-1: Using ep0 maxpacket: 32 [ 25.207315][ T40] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 25.217002][ T40] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 25.226676][ T40] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 25.236547][ T40] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 25.246444][ T40] usb 1-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 25.260439][ T40] usb 1-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 25.269468][ T40] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 25.278731][ T40] usb 1-1: config 0 descriptor?? [ 25.292586][ T351] loop1: detected capacity change from 0 to 512 [ 25.303177][ T351] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 25.311815][ T351] ext4 filesystem being mounted at /3/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 25.390182][ T6] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 25.430202][ T301] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 25.488048][ T40] usblp 1-1:0.0: usblp0: USB Bidirectional printer dev 2 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 25.571803][ T6] usb 5-1: Using ep0 maxpacket: 8 [ 25.577997][ T6] usb 5-1: config 0 has an invalid interface number: 143 but max is 0 [ 25.586444][ T6] usb 5-1: config 0 has no interface number 0 [ 25.592621][ T6] usb 5-1: New USB device found, idVendor=2058, idProduct=1005, bcdDevice=c1.9b [ 25.601682][ T6] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 25.610499][ T6] usb 5-1: config 0 descriptor?? [ 25.621636][ T301] usb 3-1: config index 0 descriptor too short (expected 50, got 32) [ 25.629789][ T301] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 25.639689][ T301] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 25.652262][ T301] usb 3-1: New USB device found, idVendor=0403, idProduct=6001, bcdDevice= 6.00 [ 25.661354][ T301] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 25.669319][ T301] usb 3-1: Product: syz [ 25.673498][ T301] usb 3-1: Manufacturer: syz [ 25.678084][ T301] usb 3-1: SerialNumber: syz [ 25.683589][ T345] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 25.690935][ T345] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 25.698782][ T301] ftdi_sio 3-1:1.0: FTDI USB Serial Device converter detected [ 25.706572][ T301] usb 3-1: Detected FT232R [ 25.818782][ T24] usb 5-1: USB disconnect, device number 2 [ 26.131518][ T28] kauditd_printk_skb: 59 callbacks suppressed [ 26.131531][ T28] audit: type=1400 audit(1786952767.050:133): avc: denied { unlink } for pid=287 comm="syz-executor" name="file0" dev="loop1" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 26.161971][ T28] audit: type=1400 audit(1786952767.060:134): avc: denied { unlink } for pid=287 comm="syz-executor" name="file1" dev="loop1" ino=14 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=lnk_file permissive=1 [ 26.185037][ T28] audit: type=1400 audit(1786952767.090:135): avc: denied { rmdir } for pid=287 comm="syz-executor" name="config" dev="loop1" ino=18 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=dir permissive=1 [ 26.185663][ T287] EXT4-fs (loop1): unmounting filesystem. [ 26.224615][ T360] PM: suspend entry (deep) [ 26.250176][ T40] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 26.330514][ T28] audit: type=1400 audit(1786952767.260:136): avc: denied { write } for pid=363 comm="syz.4.18" name="idVendor" dev="configfs" ino=16261 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=file permissive=1 [ 26.353653][ T28] audit: type=1400 audit(1786952767.260:137): avc: denied { open } for pid=363 comm="syz.4.18" path="/3/config/usb_gadget/g1/idVendor" dev="configfs" ino=16261 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=file permissive=1 [ 26.433428][ T10] Filesystems sync: 0.204 seconds [ 26.452765][ T40] usb 4-1: config index 0 descriptor too short (expected 67, got 49) [ 26.460949][ T40] usb 4-1: config 1 has an invalid descriptor of length 9, skipping remainder of the config [ 26.471106][ T40] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 26.480922][ T360] Freezing user space processes [ 26.482274][ T40] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a7, bcdDevice= 1.00 [ 26.487228][ T6] usb 1-1: USB disconnect, device number 2 [ 26.494874][ T40] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 26.494895][ T40] usb 4-1: Product: syz [ 26.494907][ T40] usb 4-1: Manufacturer: syz [ 26.494919][ T40] usb 4-1: SerialNumber: syz [ 26.502284][ T6] usblp0: removed [ 26.700881][ T19] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 30.770483][ T301] ftdi_sio ttyUSB0: Unable to read latency timer: -110 [ 30.777598][ T301] ftdi_sio ttyUSB0: Unable to write latency timer: -32 [ 30.784725][ T301] ftdi_sio 3-1:1.0: GPIO initialisation failed: -32 [ 30.791839][ T301] usb 3-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 30.804398][ T360] Freezing user space processes completed (elapsed 4.318 seconds) [ 30.812336][ T360] OOM killer disabled. [ 30.816433][ T360] Freezing remaining freezable tasks [ 31.570309][ T40] usb 4-1: can't set config #1, error -110 [ 31.880178][ T19] usb 5-1: device descriptor read/64, error -110 [ 32.150179][ T19] usb 5-1: device descriptor read/64, error -32 [ 32.420734][ T19] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 32.570200][ T19] usb 5-1: device descriptor read/64, error -32 [ 32.840190][ T19] usb 5-1: device descriptor read/64, error -32 [ 32.960381][ T19] usb usb5-port1: attempt power cycle [ 33.370208][ T19] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 33.400810][ T19] usb 5-1: device descriptor read/8, error -32 [ 33.550907][ T19] usb 5-1: device descriptor read/8, error -32 [ 33.820210][ T19] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 33.850757][ T19] usb 5-1: device descriptor read/8, error -32 [ 34.000841][ T19] usb 5-1: device descriptor read/8, error -32 [ 34.120427][ T19] usb usb5-port1: unable to enumerate USB device [ 34.128400][ T360] Freezing remaining freezable tasks completed (elapsed 3.306 seconds) [ 34.136762][ T360] printk: Suspending console(s) (use no_console_suspend to debug) [ 34.190266][ T366] sd 0:0:1:0: [sda] Synchronizing SCSI cache [ 34.284441][ T360] ACPI: PM: Preparing to enter system sleep state S3 [ 34.284580][ T360] ACPI: PM: Saving platform NVS memory [ 34.284663][ T360] Disabling non-boot CPUs ... [ 34.288448][ T360] smpboot: CPU 1 is now offline [ 34.291131][ T360] ACPI: PM: Low-level resume complete [ 34.291173][ T360] ACPI: PM: Restoring platform NVS memory [ 34.301544][ T360] Enabling non-boot CPUs ... [ 34.301694][ T360] x86: Booting SMP configuration: [ 34.301698][ T360] smpboot: Booting Node 0 Processor 1 APIC 0x1 [ 34.303962][ T360] CPU1 is up [ 34.304118][ T360] ACPI: PM: Waking up from system sleep state S3 [ 34.702662][ T374] usb 4-1: reset high-speed USB device number 2 using dummy_hcd [ 34.702720][ T381] usb 3-1: reset high-speed USB device number 2 using dummy_hcd [ 34.852496][ T374] usb 4-1: device descriptor read/64, error -32 [ 34.852496][ T381] usb 3-1: device descriptor read/64, error -32 [ 35.122480][ T381] usb 3-1: device descriptor read/64, error -32 [ 35.122489][ T374] usb 4-1: device descriptor read/64, error -32 [ 35.392496][ T381] usb 3-1: reset high-speed USB device number 2 using dummy_hcd [ 35.392505][ T374] usb 4-1: reset high-speed USB device number 2 using dummy_hcd [ 35.542493][ T381] usb 3-1: device descriptor read/64, error -32 [ 35.542507][ T374] usb 4-1: device descriptor read/64, error -32 [ 35.812486][ T381] usb 3-1: device descriptor read/64, error -32 [ 35.812495][ T374] usb 4-1: device descriptor read/64, error -32 [ 36.082468][ T374] usb 4-1: reset high-speed USB device number 2 using dummy_hcd [ 36.082483][ T381] usb 3-1: reset high-speed USB device number 2 using dummy_hcd [ 36.113020][ T374] usb 4-1: device descriptor read/8, error -32 [ 36.113023][ T381] usb 3-1: device descriptor read/8, error -32 [ 36.263035][ T381] usb 3-1: device descriptor read/8, error -32 [ 36.263035][ T374] usb 4-1: device descriptor read/8, error -32 [ 36.532494][ T381] usb 3-1: reset high-speed USB device number 2 using dummy_hcd [ 36.532502][ T374] usb 4-1: reset high-speed USB device number 2 using dummy_hcd [ 36.563083][ T374] usb 4-1: device descriptor read/8, error -32 [ 36.563126][ T381] usb 3-1: device descriptor read/8, error -32 [ 36.713105][ T374] usb 4-1: device descriptor read/8, error -32 [ 36.713105][ T381] usb 3-1: device descriptor read/8, error -32 [ 36.865310][ T360] OOM killer enabled. [ 36.865898][ T360] Restarting tasks ... [ 36.872978][ T6] usb 3-1: USB disconnect, device number 2 [ 36.875205][ T301] usb 4-1: USB disconnect, device number 2 [ 36.876548][ T6] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 36.878147][ T6] ftdi_sio 3-1:1.0: device disconnected [ 36.886524][ T360] done. [ 36.905479][ T360] random: crng reseeded on system resumption [ 36.906353][ T360] Resume cause unknown [ 36.906978][ T360] PM: suspend exit [ 36.907801][ T362] PM: hibernation: hibernation entry [ 36.945131][ T28] audit: type=1400 audit(1786952777.905:138): avc: denied { mmap_zero } for pid=390 comm="syz.0.23" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=memprotect permissive=1 [ 37.013900][ T381] Filesystems sync: 0.071 seconds [ 37.014953][ T362] Freezing user space processes [ 37.252436][ T6] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 37.253592][ T19] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 42.452437][ T19] usb 5-1: device descriptor read/64, error -110 [ 42.453422][ T6] usb 3-1: device descriptor read/64, error -110 [ 42.722442][ T6] usb 3-1: device descriptor read/64, error -32 [ 42.723379][ T19] usb 5-1: device descriptor read/64, error -32 [ 42.992442][ T6] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 42.993576][ T19] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 43.142443][ T19] usb 5-1: device descriptor read/64, error -32 [ 43.143381][ T6] usb 3-1: device descriptor read/64, error -32 [ 43.412469][ T6] usb 3-1: device descriptor read/64, error -32 [ 43.413458][ T19] usb 5-1: device descriptor read/64, error -32 [ 43.532742][ T19] usb usb5-port1: attempt power cycle [ 43.533627][ T6] usb usb3-port1: attempt power cycle [ 43.942434][ T19] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 43.943615][ T6] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 43.973062][ T19] usb 5-1: device descriptor read/8, error -32 [ 43.974000][ T6] usb 3-1: device descriptor read/8, error -32 [ 44.123001][ T19] usb 5-1: device descriptor read/8, error -32 [ 44.123930][ T6] usb 3-1: device descriptor read/8, error -32 [ 44.392456][ T19] usb 5-1: new high-speed USB device number 10 using dummy_hcd [ 44.393576][ T6] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 44.423069][ T6] usb 3-1: device descriptor read/8, error -32 [ 44.424002][ T19] usb 5-1: device descriptor read/8, error -32 [ 44.573189][ T6] usb 3-1: device descriptor read/8, error -32 [ 44.574096][ T19] usb 5-1: device descriptor read/8, error -32 [ 44.692486][ T6] usb usb3-port1: unable to enumerate USB device [ 44.693491][ T19] usb usb5-port1: unable to enumerate USB device [ 44.696793][ T362] Freezing user space processes completed (elapsed 7.681 seconds) [ 44.697867][ T362] OOM killer disabled. [ 44.703562][ T362] PM: hibernation: Preallocating image memory [ 46.991329][ T362] PM: hibernation: Allocated 560598 pages for snapshot [ 46.992387][ T362] PM: hibernation: Allocated 2242392 kbytes in 2.28 seconds (983.50 MB/s) [ 46.993573][ T362] Freezing remaining freezable tasks [ 46.995618][ T362] Freezing remaining freezable tasks completed (elapsed 0.001 seconds) [ 46.997578][ T362] printk: Suspending console(s) (use no_console_suspend to debug) [ 47.374738][ T362] ACPI: PM: Preparing to enter system sleep state S4 [ 47.374865][ T362] ACPI: PM: Saving platform NVS memory [ 47.374886][ T362] Disabling non-boot CPUs ... [ 47.377380][ T362] smpboot: CPU 1 is now offline [ 47.379769][ T362] PM: hibernation: Creating image: [ 47.849716][ T362] PM: hibernation: Need to copy 553896 pages [ 48.853498][ T362] PM: hibernation: Image created (316668 pages copied, 237228 zero pages) [ 48.853669][ T362] ACPI: PM: Restoring platform NVS memory [ 48.867349][ T362] Enabling non-boot CPUs ... [ 48.867488][ T362] x86: Booting SMP configuration: [ 48.867491][ T362] smpboot: Booting Node 0 Processor 1 APIC 0x1 [ 48.869593][ T362] CPU1 is up [ 48.869751][ T362] ACPI: PM: Waking up from system sleep state S4 [ 49.039736][ T362] PM: Failed to allocate lzo data [ 50.177785][ T362] OOM killer enabled. [ 50.178381][ T362] Restarting tasks ... done. [ 50.187399][ T362] PM: hibernation: hibernation exit [ 50.187433][ T397] PM: hibernation: hibernation entry [ 50.217320][ T28] audit: type=1400 audit(1786952791.172:139): avc: denied { read } for pid=410 comm="syz.4.28" dev="nsfs" ino=4026532569 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 50.239394][ T411] netlink: 8 bytes leftover after parsing attributes in process `syz.4.28'. [ 50.255766][ T28] audit: type=1400 audit(1786952791.172:140): avc: denied { open } for pid=410 comm="syz.4.28" path="net:[4026532569]" dev="nsfs" ino=4026532569 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 50.279856][ T28] audit: type=1400 audit(1786952791.172:141): avc: denied { create } for pid=410 comm="syz.4.28" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 50.301261][ T28] audit: type=1400 audit(1786952791.202:142): avc: denied { write } for pid=410 comm="syz.4.28" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 50.321646][ T28] audit: type=1400 audit(1786952791.202:143): avc: denied { read } for pid=410 comm="syz.4.28" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 50.346882][ T28] audit: type=1400 audit(1786952791.262:144): avc: denied { ioctl } for pid=410 comm="syz.4.28" path="socket:[16652]" dev="sockfs" ino=16652 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 50.374609][ T43] Filesystems sync: 0.125 seconds [ 50.374762][ T287] syz-executor (287) used greatest stack depth: 21664 bytes left [ 50.387542][ T397] Freezing user space processes [ 50.396096][ T397] Freezing user space processes completed (elapsed 0.003 seconds) [ 50.403964][ T397] OOM killer disabled. [ 50.413087][ T397] PM: hibernation: Preallocating image memory [ 50.760778][ T19] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 51.062400][ T10] device bridge_slave_1 left promiscuous mode [ 51.068582][ T10] bridge0: port 2(bridge_slave_1) entered disabled state [ 51.076213][ T10] device bridge_slave_0 left promiscuous mode [ 51.082466][ T10] bridge0: port 1(bridge_slave_0) entered disabled state [ 51.090712][ T10] device veth1_macvtap left promiscuous mode [ 51.096784][ T10] device veth0_vlan left promiscuous mode [ 53.002047][ T397] PM: hibernation: Allocated 560299 pages for snapshot [ 53.008952][ T397] PM: hibernation: Allocated 2241196 kbytes in 2.58 seconds (868.68 MB/s) [ 53.017456][ T397] Freezing remaining freezable tasks [ 55.941669][ T19] usb 3-1: device descriptor read/64, error -110 [ 56.211689][ T19] usb 3-1: device descriptor read/64, error -32 [ 56.481669][ T19] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 56.631670][ T19] usb 3-1: device descriptor read/64, error -32 [ 56.901658][ T19] usb 3-1: device descriptor read/64, error -32 [ 57.021818][ T19] usb usb3-port1: attempt power cycle [ 57.431657][ T19] usb 3-1: new high-speed USB device number 9 using dummy_hcd [ 57.462162][ T19] usb 3-1: device descriptor read/8, error -32 [ 57.612320][ T19] usb 3-1: device descriptor read/8, error -32 [ 57.881675][ T19] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 57.912260][ T19] usb 3-1: device descriptor read/8, error -32 [ 58.062496][ T19] usb 3-1: device descriptor read/8, error -32 [ 58.181726][ T19] usb usb3-port1: unable to enumerate USB device [ 58.189838][ T397] Freezing remaining freezable tasks completed (elapsed 5.167 seconds) [ 58.198823][ T397] printk: Suspending console(s) (use no_console_suspend to debug) [ 58.343063][ T397] ACPI: PM: Preparing to enter system sleep state S4 [ 58.343176][ T397] ACPI: PM: Saving platform NVS memory [ 58.343230][ T397] Disabling non-boot CPUs ... [ 58.345804][ T397] smpboot: CPU 1 is now offline [ 58.351193][ T397] PM: hibernation: Creating image: [ 58.819535][ T397] PM: hibernation: Need to copy 552532 pages [ 59.791448][ T397] PM: hibernation: Image created (314424 pages copied, 238108 zero pages) [ 59.791625][ T397] ACPI: PM: Restoring platform NVS memory [ 59.802951][ T397] Enabling non-boot CPUs ... [ 59.803087][ T397] x86: Booting SMP configuration: [ 59.803091][ T397] smpboot: Booting Node 0 Processor 1 APIC 0x1 [ 59.805197][ T397] CPU1 is up [ 59.805387][ T397] ACPI: PM: Waking up from system sleep state S4 [ 60.006307][ T397] PM: Cannot find swap device, try swapon -a [ 60.007133][ T397] PM: Cannot get swap writer [ 61.145950][ T397] OOM killer enabled. [ 61.146583][ T397] Restarting tasks ... done. [ 61.160383][ T403] PM: hibernation: hibernation entry [ 61.161446][ T397] PM: hibernation: hibernation exit [ 61.200161][ T28] audit: type=1400 audit(1786952802.159:145): avc: denied { mount } for pid=430 comm="syz.2.33" name="/" dev="devtmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 61.222837][ T414] bridge0: port 1(bridge_slave_0) entered blocking state [ 61.223938][ T414] bridge0: port 1(bridge_slave_0) entered disabled state [ 61.229151][ T414] device bridge_slave_0 entered promiscuous mode [ 61.230997][ T414] bridge0: port 2(bridge_slave_1) entered blocking state [ 61.232038][ T414] bridge0: port 2(bridge_slave_1) entered disabled state [ 61.233473][ T414] device bridge_slave_1 entered promiscuous mode [ 61.302860][ T8] Filesystems sync: 0.057 seconds [ 61.303988][ T403] Freezing user space processes [ 61.464884][ T421] usb 5-1: new high-speed USB device number 11 using dummy_hcd [ 61.594760][ T316] usb 3-1: new high-speed USB device number 11 using dummy_hcd [ 61.785183][ T8] device bridge_slave_1 left promiscuous mode [ 61.786178][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 61.787533][ T8] device bridge_slave_0 left promiscuous mode [ 61.788413][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 61.790249][ T8] device veth1_macvtap left promiscuous mode [ 61.791160][ T8] device veth0_vlan left promiscuous mode [ 66.674793][ T421] usb 5-1: device descriptor read/64, error -110 [ 66.754811][ T316] usb 3-1: device descriptor read/64, error -110 [ 66.944783][ T421] usb 5-1: device descriptor read/64, error -32 [ 67.024782][ T316] usb 3-1: device descriptor read/64, error -32 [ 67.214793][ T421] usb 5-1: new high-speed USB device number 12 using dummy_hcd [ 67.294778][ T316] usb 3-1: new high-speed USB device number 12 using dummy_hcd [ 67.364834][ T421] usb 5-1: device descriptor read/64, error -32 [ 67.444778][ T316] usb 3-1: device descriptor read/64, error -32 [ 67.644786][ T421] usb 5-1: device descriptor read/64, error -32 [ 67.714755][ T316] usb 3-1: device descriptor read/64, error -32 [ 67.764823][ T421] usb usb5-port1: attempt power cycle [ 67.834839][ T316] usb usb3-port1: attempt power cycle [ 68.174773][ T421] usb 5-1: new high-speed USB device number 13 using dummy_hcd [ 68.205271][ T421] usb 5-1: device descriptor read/8, error -32 [ 68.244762][ T316] usb 3-1: new high-speed USB device number 13 using dummy_hcd [ 68.275254][ T316] usb 3-1: device descriptor read/8, error -32 [ 68.355286][ T421] usb 5-1: device descriptor read/8, error -32 [ 68.425287][ T316] usb 3-1: device descriptor read/8, error -32 [ 68.624780][ T421] usb 5-1: new high-speed USB device number 14 using dummy_hcd [ 68.655342][ T421] usb 5-1: device descriptor read/8, error -32 [ 68.694799][ T316] usb 3-1: new high-speed USB device number 14 using dummy_hcd [ 68.725263][ T316] usb 3-1: device descriptor read/8, error -32 [ 68.805334][ T421] usb 5-1: device descriptor read/8, error -32 [ 68.875273][ T316] usb 3-1: device descriptor read/8, error -32 [ 68.925057][ T421] usb usb5-port1: unable to enumerate USB device [ 68.994818][ T316] usb usb3-port1: unable to enumerate USB device [ 81.314825][ T403] Freezing of tasks failed after 20.009 seconds (1 tasks refusing to freeze, wq_busy=0): [ 81.316488][ T403] OOM killer enabled. [ 81.317076][ T403] Restarting tasks ... [ 81.337519][ T28] audit: type=1400 audit(1786952822.299:146): avc: denied { sys_module } for pid=432 comm="syz-executor" capability=16 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 81.348492][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 81.370877][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 81.374797][ T403] done. [ 81.391137][ T403] PM: hibernation: hibernation exit [ 81.394510][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 81.431082][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 81.474961][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 81.482011][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 81.515400][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 81.534915][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 81.543864][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 81.550945][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 81.558841][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 81.582138][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 81.590665][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 81.606220][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 81.614307][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 81.679337][ T432] bridge0: port 1(bridge_slave_0) entered blocking state [ 81.686502][ T432] bridge0: port 1(bridge_slave_0) entered disabled state [ 81.693891][ T432] device bridge_slave_0 entered promiscuous mode [ 81.704442][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 81.712894][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 81.746869][ T432] bridge0: port 2(bridge_slave_1) entered blocking state [ 81.753952][ T432] bridge0: port 2(bridge_slave_1) entered disabled state [ 81.761545][ T432] device bridge_slave_1 entered promiscuous mode [ 81.768107][ T414] device veth0_vlan entered promiscuous mode [ 81.776403][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 81.784400][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 81.805480][ T435] bridge0: port 1(bridge_slave_0) entered blocking state [ 81.812518][ T435] bridge0: port 1(bridge_slave_0) entered disabled state [ 81.819956][ T435] device bridge_slave_0 entered promiscuous mode [ 81.844613][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 81.852202][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 81.868283][ T437] bridge0: port 1(bridge_slave_0) entered blocking state [ 81.875373][ T437] bridge0: port 1(bridge_slave_0) entered disabled state [ 81.882661][ T437] device bridge_slave_0 entered promiscuous mode [ 81.889584][ T435] bridge0: port 2(bridge_slave_1) entered blocking state [ 81.896754][ T435] bridge0: port 2(bridge_slave_1) entered disabled state [ 81.904041][ T435] device bridge_slave_1 entered promiscuous mode [ 81.920455][ T437] bridge0: port 2(bridge_slave_1) entered blocking state [ 81.927543][ T437] bridge0: port 2(bridge_slave_1) entered disabled state [ 81.934891][ T437] device bridge_slave_1 entered promiscuous mode [ 81.965249][ T436] bridge0: port 1(bridge_slave_0) entered blocking state [ 81.972433][ T436] bridge0: port 1(bridge_slave_0) entered disabled state [ 81.979882][ T436] device bridge_slave_0 entered promiscuous mode [ 82.000477][ T436] bridge0: port 2(bridge_slave_1) entered blocking state [ 82.007663][ T436] bridge0: port 2(bridge_slave_1) entered disabled state [ 82.015096][ T436] device bridge_slave_1 entered promiscuous mode [ 82.039318][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 82.047507][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 82.087823][ T414] device veth1_macvtap entered promiscuous mode [ 82.126478][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 82.134628][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 82.143092][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 82.167571][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 82.175852][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 82.273275][ T381] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 82.280804][ T381] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 82.294270][ T381] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 82.303054][ T381] bridge0: port 1(bridge_slave_0) entered blocking state [ 82.310103][ T381] bridge0: port 1(bridge_slave_0) entered forwarding state [ 82.318311][ T381] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 82.325974][ T381] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 82.334133][ T381] bridge0: port 1(bridge_slave_0) entered blocking state [ 82.341173][ T381] bridge0: port 1(bridge_slave_0) entered forwarding state [ 82.348746][ T381] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 82.356960][ T381] bridge0: port 1(bridge_slave_0) entered blocking state [ 82.363981][ T381] bridge0: port 1(bridge_slave_0) entered forwarding state [ 82.372080][ T381] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 82.379794][ T381] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 82.387890][ T381] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 82.406678][ T43] device bridge_slave_1 left promiscuous mode [ 82.412808][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 82.420493][ T43] device bridge_slave_0 left promiscuous mode [ 82.426796][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 82.435384][ T43] device veth1_macvtap left promiscuous mode [ 82.441475][ T43] device veth0_vlan left promiscuous mode [ 82.504849][ T422] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 82.526415][ T381] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 82.534926][ T381] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 82.543213][ T381] bridge0: port 2(bridge_slave_1) entered blocking state [ 82.550251][ T381] bridge0: port 2(bridge_slave_1) entered forwarding state [ 82.557642][ T381] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 82.566020][ T381] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 82.574095][ T381] bridge0: port 2(bridge_slave_1) entered blocking state [ 82.581141][ T381] bridge0: port 2(bridge_slave_1) entered forwarding state [ 82.588659][ T381] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 82.596300][ T381] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 82.603727][ T381] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 82.612201][ T381] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 82.620503][ T381] bridge0: port 1(bridge_slave_0) entered blocking state [ 82.627597][ T381] bridge0: port 1(bridge_slave_0) entered forwarding state [ 82.635068][ T381] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 82.643168][ T381] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 82.651180][ T381] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 82.659572][ T381] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 82.667762][ T381] bridge0: port 2(bridge_slave_1) entered blocking state [ 82.674787][ T381] bridge0: port 2(bridge_slave_1) entered forwarding state [ 82.682188][ T381] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 82.690365][ T381] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 82.698318][ T381] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 82.705819][ T422] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 64 [ 82.706712][ T381] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 82.716457][ T422] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 82.724409][ T381] bridge0: port 2(bridge_slave_1) entered blocking state [ 82.734075][ T422] usb 6-1: New USB device found, idVendor=8087, idProduct=0025, bcdDevice= 0.01 [ 82.740908][ T381] bridge0: port 2(bridge_slave_1) entered forwarding state [ 82.741165][ T381] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 82.764762][ T422] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 82.773976][ T451] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 82.795631][ T381] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 82.795722][ T451] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 82.804187][ T381] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 82.820295][ T381] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 82.828735][ T381] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 82.837082][ T381] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 82.846089][ T381] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 82.853994][ T381] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 82.862178][ T381] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 82.870195][ T381] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 82.878283][ T381] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 82.886353][ T381] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 82.894627][ T381] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 82.905070][ T432] device veth0_vlan entered promiscuous mode [ 82.918323][ T435] device veth0_vlan entered promiscuous mode [ 82.925639][ T381] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 82.933537][ T381] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 82.941626][ T381] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 82.950828][ T381] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 82.958881][ T381] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 82.967154][ T381] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 82.975144][ T381] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 82.982978][ T381] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 82.991228][ T381] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 82.998762][ T381] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 83.006438][ T381] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 83.013954][ T381] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 83.031368][ T432] device veth1_macvtap entered promiscuous mode [ 83.040941][ T381] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 83.049145][ T381] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 83.057427][ T381] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 83.072834][ T436] device veth0_vlan entered promiscuous mode [ 83.081911][ T381] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 83.090625][ T381] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 83.091467][ T28] audit: type=1400 audit(1786952824.049:147): avc: denied { create } for pid=450 comm="syz.5.27" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 83.099073][ T381] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 83.119282][ T28] audit: type=1400 audit(1786952824.049:148): avc: denied { ioctl } for pid=450 comm="syz.5.27" path="socket:[17238]" dev="sockfs" ino=17238 ioctlcmd=0x48c9 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 83.127987][ T381] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 83.160031][ T381] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 83.168030][ T381] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 83.176026][ T381] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 83.184093][ T381] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 83.192433][ T381] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 83.200070][ T381] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 83.210153][ T437] device veth0_vlan entered promiscuous mode [ 83.218922][ T381] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 83.226829][ T381] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 83.235100][ T381] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 83.242566][ T381] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 83.258061][ T381] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 83.266204][ T381] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 83.274355][ T381] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 83.282882][ T381] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 83.291281][ T381] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 83.305163][ T436] device veth1_macvtap entered promiscuous mode [ 83.313693][ T435] device veth1_macvtap entered promiscuous mode [ 83.331828][ T381] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 83.340238][ T381] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 83.349126][ T381] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 83.357770][ T381] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 83.366057][ T381] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 83.380708][ T437] device veth1_macvtap entered promiscuous mode [ 83.391648][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 83.400232][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 83.409442][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 83.418770][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 83.427148][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 83.446638][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 83.456129][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 83.464554][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 83.473713][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 83.492283][ T460] using random self ethernet address [ 83.499079][ T460] using random host ethernet address [ 83.507420][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 83.516563][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 83.530791][ T460] usb0: HOST MAC de:02:10:ff:0a:de [ 83.536681][ T28] audit: type=1400 audit(1786952824.499:149): avc: denied { read } for pid=142 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=1 [ 83.544854][ T460] usb0: MAC 9a:f0:e3:fd:99:d7 [ 83.571976][ T28] audit: type=1400 audit(1786952824.499:150): avc: denied { read } for pid=142 comm="dhcpcd" name="n15" dev="tmpfs" ino=721 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 83.594615][ T28] audit: type=1400 audit(1786952824.499:151): avc: denied { open } for pid=142 comm="dhcpcd" path="/run/udev/data/n15" dev="tmpfs" ino=721 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 83.619416][ T28] audit: type=1400 audit(1786952824.499:152): avc: denied { getattr } for pid=142 comm="dhcpcd" path="/run/udev/data/n15" dev="tmpfs" ino=721 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 83.624788][ T40] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 83.698016][ T28] audit: type=1400 audit(1786952824.659:153): avc: denied { create } for pid=470 comm="dhcpcd-run-hook" name="resolv.conf.usb0.link" scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 83.721110][ T28] audit: type=1400 audit(1786952824.659:154): avc: denied { write } for pid=470 comm="dhcpcd-run-hook" path="/run/dhcpcd/hook-state/resolv.conf.usb0.link" dev="tmpfs" ino=740 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 83.747134][ T28] audit: type=1400 audit(1786952824.659:155): avc: denied { append } for pid=470 comm="dhcpcd-run-hook" name="resolv.conf.usb0.link" dev="tmpfs" ino=740 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 83.824783][ T40] usb 7-1: Using ep0 maxpacket: 8 [ 83.830873][ T40] usb 7-1: config 0 has an invalid interface number: 143 but max is 0 [ 83.839235][ T40] usb 7-1: config 0 has no interface number 0 [ 83.845411][ T40] usb 7-1: New USB device found, idVendor=2058, idProduct=1005, bcdDevice=c1.9b [ 83.854514][ T40] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 83.862671][ T316] usb 8-1: new high-speed USB device number 2 using dummy_hcd [ 83.871108][ T40] usb 7-1: config 0 descriptor?? [ 83.874754][ T407] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 83.883577][ T308] usb 10-1: new high-speed USB device number 2 using dummy_hcd [ 83.891690][ T422] android_work: sent uevent USB_STATE=CONNECTED [ 84.036859][ T60] usb 6-1: USB disconnect, device number 2 [ 84.054748][ T316] usb 8-1: Using ep0 maxpacket: 8 [ 84.061167][ T316] usb 8-1: config 0 has an invalid interface number: 143 but max is 0 [ 84.069420][ T316] usb 8-1: config 0 has no interface number 0 [ 84.075589][ T316] usb 8-1: New USB device found, idVendor=1234, idProduct=5678, bcdDevice=c1.9b [ 84.085164][ T308] usb 10-1: Using ep0 maxpacket: 8 [ 84.091342][ T316] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 84.091365][ T43] device bridge_slave_1 left promiscuous mode [ 84.105950][ T308] usb 10-1: config 0 has an invalid interface number: 143 but max is 0 [ 84.107101][ T316] usb 8-1: config 0 descriptor?? [ 84.114336][ T407] usb 1-1: Dual-Role OTG device on HNP port [ 84.125268][ T308] usb 10-1: config 0 has no interface number 0 [ 84.125510][ T40] usb 7-1: USB disconnect, device number 2 [ 84.131503][ T407] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0104, bcdDevice= 6.01 [ 84.146716][ T308] usb 10-1: New USB device found, idVendor=2058, idProduct=1005, bcdDevice=c1.9b [ 84.155920][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 84.158057][ T407] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 84.171036][ T308] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 84.171169][ T43] device bridge_slave_0 left promiscuous mode [ 84.182392][ T308] usb 10-1: config 0 descriptor?? [ 84.185544][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 84.190532][ T407] usb 1-1: Product: Product [ 84.202186][ T407] usb 1-1: Manufacturer: Manufacturer [ 84.208089][ T43] device bridge_slave_1 left promiscuous mode [ 84.212050][ T407] usb 1-1: SerialNumber: 1234567890 [ 84.214271][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 84.226647][ T422] android_work: sent uevent USB_STATE=CONFIGURED [ 84.234378][ T407] usb-storage 1-1:1.0: USB Mass Storage device detected [ 84.237886][ T43] device bridge_slave_0 left promiscuous mode [ 84.242906][ T407] scsi host1: usb-storage 1-1:1.0 [ 84.248088][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 84.261284][ T43] device veth1_macvtap left promiscuous mode [ 84.267357][ T43] device veth0_vlan left promiscuous mode [ 84.273211][ T43] device veth1_macvtap left promiscuous mode [ 84.279405][ T43] device veth0_vlan left promiscuous mode [ 84.397771][ T422] usb 8-1: USB disconnect, device number 2 [ 84.406063][ T469] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 84.423268][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): usb0: link becomes ready [ 84.431446][ T469] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 84.432683][ T407] cdc_ether 1-1:1.1 usb1: register 'cdc_ether' at usb-dummy_hcd.0-1, CDC Ethernet Device, de:02:10:ff:0a:de [ 84.440140][ T316] usb 10-1: USB disconnect, device number 2 [ 84.622600][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): usb1: link becomes ready [ 84.834791][ T40] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 84.894762][ T421] usb 7-1: new high-speed USB device number 3 using dummy_hcd [ 84.944773][ T316] usb 9-1: new high-speed USB device number 2 using dummy_hcd [ 85.014767][ T40] usb 6-1: Using ep0 maxpacket: 8 [ 85.020880][ T40] usb 6-1: config 0 has an invalid interface number: 143 but max is 0 [ 85.029202][ T40] usb 6-1: config 0 has no interface number 0 [ 85.035399][ T40] usb 6-1: New USB device found, idVendor=2058, idProduct=1005, bcdDevice=c1.9b [ 85.044443][ T40] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 85.053195][ T40] usb 6-1: config 0 descriptor?? [ 85.076947][ T421] usb 7-1: New USB device found, idVendor=0525, idProduct=a4a5, bcdDevice= 1.00 [ 85.086140][ T421] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 85.094126][ T421] usb 7-1: Product: syz [ 85.098400][ T421] usb 7-1: Manufacturer: syz [ 85.103058][ T421] usb 7-1: SerialNumber: syz [ 85.110103][ T421] usb-storage 7-1:1.0: USB Mass Storage device detected [ 85.118046][ T421] usb-storage 7-1:1.0: Quirks match for vid 0525 pid a4a5: 10000 [ 85.126223][ T421] scsi host2: usb-storage 7-1:1.0 [ 85.135413][ T316] usb 9-1: New USB device found, idVendor=0fc5, idProduct=1227, bcdDevice= 1.00 [ 85.144494][ T316] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 85.153023][ T316] usb 9-1: Product: syz [ 85.157252][ T316] usb 9-1: Manufacturer: syz [ 85.161855][ T316] usb 9-1: SerialNumber: syz [ 85.244799][ T308] usb 10-1: new high-speed USB device number 3 using dummy_hcd [ 85.264229][ T407] usb 6-1: USB disconnect, device number 3 [ 85.325800][ T422] scsi 1:0:0:0: Direct-Access Linux File-Stor Gadget 0601 PQ: 0 ANSI: 2 [ 85.336902][ T486] sd 1:0:0:0: Power-on or device reset occurred [ 85.344433][ T43] sd 1:0:0:0: [sdb] 2048 512-byte logical blocks: (1.05 MB/1.00 MiB) [ 85.353271][ T43] sd 1:0:0:0: [sdb] Write Protect is off [ 85.359569][ T43] sd 1:0:0:0: [sdb] Write cache: enabled, read cache: enabled, doesn't support DPO or FUA [ 85.377868][ T43] sd 1:0:0:0: [sdb] Attached SCSI removable disk [ 85.434761][ T308] usb 10-1: Using ep0 maxpacket: 8 [ 85.440978][ T308] usb 10-1: config 0 has an invalid interface number: 143 but max is 0 [ 85.450059][ T308] usb 10-1: config 0 has no interface number 0 [ 85.456794][ T308] usb 10-1: New USB device found, idVendor=2058, idProduct=1005, bcdDevice=c1.9b [ 85.466154][ T308] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 85.475130][ T308] usb 10-1: config 0 descriptor?? [ 85.688849][ T308] usb 10-1: USB disconnect, device number 3 [ 85.978543][ T316] usb 9-1: USB disconnect, device number 2 [ 86.124900][ T407] usb 8-1: new high-speed USB device number 3 using dummy_hcd [ 86.217350][ T535] ================================================================== [ 86.225433][ T535] BUG: KASAN: use-after-free in kobject_get+0x113/0x120 [ 86.232377][ T535] Read of size 1 at addr ffff88811395a03c by task syz.9.49/535 [ 86.239923][ T535] [ 86.242244][ T535] CPU: 1 PID: 535 Comm: syz.9.49 Not tainted syzkaller #0 [ 86.249345][ T535] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 86.259379][ T535] Call Trace: [ 86.262648][ T535] SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 86.265574][ T535] __dump_stack+0x21/0x24 [ 86.269901][ T535] dump_stack_lvl+0x110/0x170 [ 86.274587][ T535] ? __cfi_dump_stack_lvl+0x8/0x8 [ 86.279624][ T535] ? __cfi__printk+0x8/0x8 [ 86.284045][ T535] ? kobject_get+0x113/0x120 [ 86.288645][ T535] print_address_description+0x71/0x200 [ 86.294202][ T535] print_report+0x4a/0x60 [ 86.298533][ T535] kasan_report+0x122/0x150 [ 86.303051][ T535] ? kobject_get+0x113/0x120 [ 86.307660][ T535] ? kasan_save_alloc_info+0x1f/0x30 [ 86.312957][ T535] __asan_report_load1_noabort+0x14/0x20 [ 86.318606][ T535] kobject_get+0x113/0x120 [ 86.323037][ T535] device_add+0x2f0/0xec0 [ 86.327382][ T535] device_create+0x26c/0x300 [ 86.331981][ T535] ? __cfi_device_create+0x10/0x10 [ 86.337104][ T535] create_function_device+0x60/0x70 [ 86.342316][ T535] f_midi_alloc_inst+0x1a8/0x380 [ 86.347266][ T535] usb_get_function_instance+0xf3/0x310 [ 86.352828][ T535] function_make+0x118/0x360 [ 86.357427][ T535] ? __cfi_function_make+0x10/0x10 [ 86.362543][ T535] ? __cfi_mutex_lock+0x10/0x10 [ 86.367398][ T535] ? __kasan_kmalloc+0x95/0xb0 [ 86.372151][ T535] ? configfs_mkdir+0x444/0x9e0 [ 86.377022][ T535] ? __kmalloc+0xb4/0x1e0 [ 86.381392][ T535] ? __kasan_check_write+0x14/0x20 [ 86.386495][ T535] configfs_mkdir+0x518/0x9e0 [ 86.391154][ T535] vfs_mkdir+0x39c/0x580 [ 86.395397][ T535] do_mkdirat+0x174/0x4d0 [ 86.399725][ T535] __x64_sys_mkdirat+0x89/0xa0 [ 86.404489][ T535] x64_sys_call+0x73d/0x9a0 [ 86.408999][ T535] do_syscall_64+0x4c/0xa0 [ 86.413407][ T535] ? clear_bhb_loop+0x30/0x80 [ 86.418087][ T535] ? clear_bhb_loop+0x30/0x80 [ 86.422756][ T535] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 86.428633][ T535] RIP: 0033:0x7f7cb539e0d9 [ 86.433031][ T535] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 86.452627][ T535] RSP: 002b:00007f7cb62db028 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 [ 86.461033][ T535] RAX: ffffffffffffffda RBX: 00007f7cb5625fa0 RCX: 00007f7cb539e0d9 [ 86.469003][ T535] RDX: 00000000000001ff RSI: 0000200000000400 RDI: ffffffffffffff9c [ 86.476974][ T535] RBP: 00007f7cb5435024 R08: 0000000000000000 R09: 0000000000000000 [ 86.484932][ T535] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 86.492886][ T535] R13: 00007f7cb5626038 R14: 00007f7cb5625fa0 R15: 00007ffda00d6eb8 [ 86.500844][ T535] [ 86.503851][ T535] [ 86.506163][ T535] Allocated by task 323: [ 86.510394][ T535] kasan_set_track+0x4b/0x70 [ 86.514971][ T535] kasan_save_alloc_info+0x1f/0x30 [ 86.520073][ T535] __kasan_kmalloc+0x95/0xb0 [ 86.524648][ T535] kmalloc_trace+0x40/0xb0 [ 86.529054][ T535] device_create+0x13a/0x300 [ 86.533627][ T535] gadgets_make+0x84a/0xad0 [ 86.538122][ T535] configfs_mkdir+0x518/0x9e0 [ 86.542782][ T535] vfs_mkdir+0x39c/0x580 [ 86.547004][ T535] do_mkdirat+0x174/0x4d0 [ 86.551314][ T535] __x64_sys_mkdirat+0x89/0xa0 [ 86.556082][ T535] x64_sys_call+0x73d/0x9a0 [ 86.560567][ T535] do_syscall_64+0x4c/0xa0 [ 86.564967][ T535] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 86.570864][ T535] [ 86.573180][ T535] Freed by task 488: [ 86.577050][ T535] kasan_set_track+0x4b/0x70 [ 86.581636][ T535] kasan_save_free_info+0x2b/0x40 [ 86.586656][ T535] ____kasan_slab_free+0x132/0x180 [ 86.591760][ T535] __kasan_slab_free+0x11/0x20 [ 86.596515][ T535] slab_free_freelist_hook+0xc2/0x190 [ 86.601864][ T535] __kmem_cache_free+0xb7/0x1b0 [ 86.606702][ T535] kfree+0x6f/0xf0 [ 86.610408][ T535] device_create_release+0x15/0x20 [ 86.615517][ T535] device_release+0xa4/0x1d0 [ 86.620109][ T535] kobject_put+0x19d/0x280 [ 86.624530][ T535] device_destroy+0xb4/0xf0 [ 86.629010][ T535] gadgets_drop+0xa0/0xd0 [ 86.633330][ T535] configfs_rmdir+0x89b/0x980 [ 86.638005][ T535] vfs_rmdir+0x381/0x4f0 [ 86.642229][ T535] do_rmdir+0x261/0x6b0 [ 86.646371][ T535] __x64_sys_rmdir+0x49/0x50 [ 86.650942][ T535] x64_sys_call+0x68e/0x9a0 [ 86.655439][ T535] do_syscall_64+0x4c/0xa0 [ 86.659859][ T535] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 86.665755][ T535] [ 86.668070][ T535] The buggy address belongs to the object at ffff88811395a000 [ 86.668070][ T535] which belongs to the cache kmalloc-1k of size 1024 [ 86.682113][ T535] The buggy address is located 60 bytes inside of [ 86.682113][ T535] 1024-byte region [ffff88811395a000, ffff88811395a400) [ 86.695367][ T535] [ 86.697672][ T535] The buggy address belongs to the physical page: [ 86.704062][ T535] page:ffffea00044e5600 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x113958 [ 86.714291][ T535] head:ffffea00044e5600 order:3 compound_mapcount:0 compound_pincount:0 [ 86.722620][ T535] flags: 0x4000000000010200(slab|head|zone=1) [ 86.728692][ T535] raw: 4000000000010200 dead000000000100 dead000000000122 ffff888100043080 [ 86.737260][ T535] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 86.745820][ T535] page dumped because: kasan: bad access detected [ 86.752228][ T535] page_owner tracks the page as allocated [ 86.757919][ T535] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 103, tgid 103 (udevd), ts 4246978214, free_ts 0 [ 86.777539][ T535] post_alloc_hook+0x1f5/0x210 [ 86.782299][ T535] prep_new_page+0x1c/0x110 [ 86.786794][ T535] get_page_from_freelist+0x2ca9/0x2d20 [ 86.792331][ T535] __alloc_pages+0x1fa/0x610 [ 86.796912][ T535] alloc_slab_page+0x6e/0xf0 [ 86.801492][ T535] new_slab+0x98/0x3e0 [ 86.805557][ T535] ___slab_alloc+0x70f/0xb70 [ 86.810155][ T535] __slab_alloc+0x5e/0xa0 [ 86.814483][ T535] __kmem_cache_alloc_node+0x204/0x2d0 [ 86.819942][ T535] __kmalloc_node_track_caller+0xa1/0x1e0 [ 86.825643][ T535] __alloc_skb+0x226/0x4a0 [ 86.830056][ T535] netlink_sendmsg+0x635/0xbd0 [ 86.834798][ T535] ____sys_sendmsg+0x5fb/0x9c0 [ 86.839546][ T535] ___sys_sendmsg+0x2a2/0x360 [ 86.844205][ T535] __x64_sys_sendmsg+0x20d/0x2e0 [ 86.849123][ T535] x64_sys_call+0x171/0x9a0 [ 86.853615][ T535] page_owner free stack trace missing [ 86.858984][ T535] [ 86.861301][ T535] Memory state around the buggy address: [ 86.866922][ T535] ffff888113959f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 86.874964][ T535] ffff888113959f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 86.883017][ T535] >ffff88811395a000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 86.891061][ T535] ^ [ 86.896934][ T535] ffff88811395a080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 86.904982][ T535] ffff88811395a100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 86.913039][ T535] ================================================================== [ 86.922534][ T535] Disabling lock debugging due to kernel taint [ 86.928943][ T28] kauditd_printk_skb: 10 callbacks suppressed [ 86.928953][ T28] audit: type=1400 audit(1786952827.889:166): avc: denied { read } for pid=85 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 86.973039][ T535] ------------[ cut here ]------------ [ 86.978592][ T535] refcount_t: addition on 0; use-after-free. [ 86.994866][ T535] WARNING: CPU: 0 PID: 535 at lib/refcount.c:25 refcount_warn_saturate+0x104/0x1a0 [ 87.004204][ T535] Modules linked in: [ 87.008289][ T535] CPU: 0 PID: 535 Comm: syz.9.49 Tainted: G B syzkaller #0 [ 87.017083][ T535] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 87.027294][ T535] RIP: 0010:refcount_warn_saturate+0x104/0x1a0 [ 87.033628][ T535] Code: 05 01 48 c7 c7 40 0d ca 85 e8 d8 28 d9 fe 0f 0b eb df e8 2f 9a 08 ff c6 05 0f ca 26 05 01 48 c7 c7 80 0c ca 85 e8 bc 28 d9 fe <0f> 0b eb c3 e8 13 9a 08 ff c6 05 f4 c9 26 05 01 48 c7 c7 e0 0c ca [ 87.053362][ T535] RSP: 0018:ffffc90000d97a18 EFLAGS: 00010246 [ 87.059602][ T535] RAX: 22adc91b960ac400 RBX: 0000000000000002 RCX: 0000000000080000 [ 87.067671][ T535] RDX: ffffc90002a8f000 RSI: 000000000007ffff RDI: 0000000000080000 [ 87.074754][ T28] audit: type=1400 audit(1786952827.889:167): avc: denied { search } for pid=85 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 87.075723][ T535] RBP: ffffc90000d97a28 R08: ffffc90000d97607 R09: 1ffff920001b2ec0 [ 87.105084][ T535] R10: dffffc0000000000 R11: fffff520001b2ec1 R12: 1ffff1102410330e [ 87.113143][ T535] R13: dffffc0000000000 R14: 0000000000000002 R15: 0000000000000000 [ 87.121217][ T535] FS: 00007f7cb62db6c0(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 87.130239][ T535] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 87.136889][ T28] audit: type=1400 audit(1786952827.889:168): avc: denied { write } for pid=85 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 87.136915][ T28] audit: type=1400 audit(1786952827.889:169): avc: denied { add_name } for pid=85 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 87.136933][ T28] audit: type=1400 audit(1786952827.889:170): avc: denied { create } for pid=85 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 87.158181][ T535] CR2: 00005555a2a0caf8 CR3: 0000000120e0f000 CR4: 00000000003506b0 [ 87.207335][ T535] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 87.215367][ T535] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 87.223358][ T535] Call Trace: [ 87.226678][ T535] [ 87.229621][ T535] kobject_get+0xfb/0x120 [ 87.233969][ T535] device_add+0x2f0/0xec0 [ 87.238342][ T535] device_create+0x26c/0x300 [ 87.238556][ T28] audit: type=1400 audit(1786952827.889:171): avc: denied { append open } for pid=85 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 87.242942][ T535] ? __cfi_device_create+0x10/0x10 [ 87.271289][ T535] create_function_device+0x60/0x70 [ 87.274839][ T28] audit: type=1400 audit(1786952827.889:172): avc: denied { getattr } for pid=85 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 87.276549][ T535] f_midi_alloc_inst+0x1a8/0x380 [ 87.304009][ T535] usb_get_function_instance+0xf3/0x310 [ 87.309614][ T535] function_make+0x118/0x360 [ 87.314220][ T535] ? __cfi_function_make+0x10/0x10 [ 87.319376][ T535] ? __cfi_mutex_lock+0x10/0x10 [ 87.324261][ T535] ? __kasan_kmalloc+0x95/0xb0 [ 87.329354][ T535] ? configfs_mkdir+0x444/0x9e0 [ 87.334227][ T535] ? __kmalloc+0xb4/0x1e0 [ 87.338592][ T535] ? __kasan_check_write+0x14/0x20 [ 87.343720][ T535] configfs_mkdir+0x518/0x9e0 [ 87.348417][ T535] vfs_mkdir+0x39c/0x580 [ 87.352672][ T535] do_mkdirat+0x174/0x4d0 [ 87.357052][ T535] __x64_sys_mkdirat+0x89/0xa0 [ 87.361835][ T535] x64_sys_call+0x73d/0x9a0 [ 87.366368][ T535] do_syscall_64+0x4c/0xa0 [ 87.370794][ T535] ? clear_bhb_loop+0x30/0x80 [ 87.375498][ T535] ? clear_bhb_loop+0x30/0x80 [ 87.380197][ T535] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 87.386113][ T535] RIP: 0033:0x7f7cb539e0d9 [ 87.390534][ T535] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 87.410382][ T535] RSP: 002b:00007f7cb62db028 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 [ 87.418912][ T535] RAX: ffffffffffffffda RBX: 00007f7cb5625fa0 RCX: 00007f7cb539e0d9 [ 87.426919][ T535] RDX: 00000000000001ff RSI: 0000200000000400 RDI: ffffffffffffff9c [ 87.434928][ T535] RBP: 00007f7cb5435024 R08: 0000000000000000 R09: 0000000000000000 [ 87.442912][ T535] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 87.450924][ T535] R13: 00007f7cb5626038 R14: 00007f7cb5625fa0 R15: 00007ffda00d6eb8 [ 87.458924][ T535] [ 87.461955][ T535] ---[ end trace 0000000000000000 ]--- [ 87.467517][ T535] ------------[ cut here ]------------ [ 87.472994][ T535] refcount_t: saturated; leaking memory. [ 87.479661][ T535] WARNING: CPU: 1 PID: 535 at lib/refcount.c:22 refcount_warn_saturate+0x158/0x1a0 [ 87.489295][ T535] Modules linked in: [ 87.493296][ T535] CPU: 1 PID: 535 Comm: syz.9.49 Tainted: G B W syzkaller #0 [ 87.501946][ T535] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 87.512041][ T535] RIP: 0010:refcount_warn_saturate+0x158/0x1a0 [ 87.518247][ T535] Code: 05 01 48 c7 c7 20 0c ca 85 e8 84 28 d9 fe 0f 0b eb 8b e8 db 99 08 ff c6 05 ba c9 26 05 01 48 c7 c7 20 0c ca 85 e8 68 28 d9 fe <0f> 0b e9 6c ff ff ff e8 bc 99 08 ff c6 05 9f c9 26 05 01 48 c7 c7 [ 87.537888][ T535] RSP: 0018:ffffc90000d978d8 EFLAGS: 00010246 [ 87.543990][ T535] RAX: 22adc91b960ac400 RBX: 0000000000000001 RCX: 0000000000080000 [ 87.552001][ T535] RDX: ffffc90002a8f000 RSI: 000000000007ffff RDI: 0000000000080000 [ 87.560018][ T535] RBP: ffffc90000d978e8 R08: ffffc90000d975e7 R09: 1ffff920001b2ebc [ 87.568258][ T535] R10: dffffc0000000000 R11: fffff520001b2ebd R12: dffffc0000000000 [ 87.576456][ T535] R13: ffff888120819818 R14: 0000000000000001 R15: 00000000c0000000 [ 87.584455][ T535] FS: 00007f7cb62db6c0(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 87.593446][ T535] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 87.600072][ T535] CR2: 0000001b30420ff8 CR3: 0000000120e0f000 CR4: 00000000003506a0 [ 87.608081][ T535] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 87.616101][ T535] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 87.624104][ T535] Call Trace: [ 87.627427][ T535] [ 87.630369][ T535] kobject_add_internal+0xa81/0xc20 [ 87.635627][ T535] kobject_add+0x165/0x230 [ 87.640066][ T535] ? __cfi_kobject_add+0x10/0x10 [ 87.645139][ T535] ? get_device_parent+0x12e/0x410 [ 87.650323][ T535] device_add+0x398/0xec0 [ 87.654667][ T535] device_create+0x26c/0x300 [ 87.659307][ T535] ? __cfi_device_create+0x10/0x10 [ 87.664432][ T535] create_function_device+0x60/0x70 [ 87.669667][ T535] f_midi_alloc_inst+0x1a8/0x380 [ 87.674626][ T535] usb_get_function_instance+0xf3/0x310 [ 87.680214][ T535] function_make+0x118/0x360 [ 87.684845][ T535] ? __cfi_function_make+0x10/0x10 [ 87.689968][ T535] ? __cfi_mutex_lock+0x10/0x10 [ 87.694863][ T535] ? __kasan_kmalloc+0x95/0xb0 [ 87.699655][ T535] ? configfs_mkdir+0x444/0x9e0 [ 87.704511][ T535] ? __kmalloc+0xb4/0x1e0 [ 87.708877][ T535] ? __kasan_check_write+0x14/0x20 [ 87.714013][ T535] configfs_mkdir+0x518/0x9e0 [ 87.718745][ T535] vfs_mkdir+0x39c/0x580 [ 87.723015][ T535] do_mkdirat+0x174/0x4d0 [ 87.727545][ T535] __x64_sys_mkdirat+0x89/0xa0 [ 87.732432][ T535] x64_sys_call+0x73d/0x9a0 [ 87.736996][ T535] do_syscall_64+0x4c/0xa0 [ 87.741432][ T535] ? clear_bhb_loop+0x30/0x80 [ 87.746137][ T535] ? clear_bhb_loop+0x30/0x80 [ 87.750835][ T535] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 87.756780][ T535] RIP: 0033:0x7f7cb539e0d9 [ 87.761205][ T535] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 87.780860][ T535] RSP: 002b:00007f7cb62db028 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 [ 87.789297][ T535] RAX: ffffffffffffffda RBX: 00007f7cb5625fa0 RCX: 00007f7cb539e0d9 [ 87.797314][ T535] RDX: 00000000000001ff RSI: 0000200000000400 RDI: ffffffffffffff9c [ 87.805404][ T535] RBP: 00007f7cb5435024 R08: 0000000000000000 R09: 0000000000000000 [ 87.813474][ T535] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 87.821534][ T535] R13: 00007f7cb5626038 R14: 00007f7cb5625fa0 R15: 00007ffda00d6eb8 [ 87.829546][ T535] [ 87.832584][ T535] ---[ end trace 0000000000000000 ]--- [ 87.838638][ T535] ------------[ cut here ]------------ [ 87.844163][ T535] refcount_t: underflow; use-after-free. [ 87.850328][ T535] WARNING: CPU: 1 PID: 535 at lib/refcount.c:28 refcount_warn_saturate+0x120/0x1a0 [ 87.859771][ T535] Modules linked in: [ 87.863741][ T535] CPU: 1 PID: 535 Comm: syz.9.49 Tainted: G B W syzkaller #0 [ 87.872471][ T535] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 87.882640][ T535] RIP: 0010:refcount_warn_saturate+0x120/0x1a0 [ 87.889142][ T535] Code: 05 01 48 c7 c7 80 0c ca 85 e8 bc 28 d9 fe 0f 0b eb c3 e8 13 9a 08 ff c6 05 f4 c9 26 05 01 48 c7 c7 e0 0c ca 85 e8 a0 28 d9 fe <0f> 0b eb a7 e8 f7 99 08 ff c6 05 d5 c9 26 05 01 48 c7 c7 20 0c ca [ 87.909060][ T535] RSP: 0018:ffffc90000d978a0 EFLAGS: 00010246 [ 87.915210][ T535] RAX: 22adc91b960ac400 RBX: 0000000000000003 RCX: 0000000000080000 [ 87.923211][ T535] RDX: ffffc90002a8f000 RSI: 000000000007ffff RDI: 0000000000080000 [ 87.931255][ T535] RBP: ffffc90000d978b0 R08: ffffc90000d97487 R09: 1ffff920001b2e90 [ 87.939307][ T535] R10: dffffc0000000000 R11: fffff520001b2e91 R12: 00000000c0000000 [ 87.947349][ T535] R13: ffff88811395a03c R14: 0000000000000003 R15: ffff88811395a038 [ 87.955382][ T535] FS: 00007f7cb62db6c0(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 87.964348][ T535] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 87.971279][ T535] CR2: 0000001b30420ff8 CR3: 0000000120e0f000 CR4: 00000000003506a0 [ 87.979315][ T535] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 87.987328][ T535] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 87.995435][ T535] Call Trace: [ 87.998732][ T535] [ 88.001659][ T535] kobject_put+0x244/0x280 [ 88.006134][ T535] kobject_add_internal+0x9a2/0xc20 [ 88.011373][ T535] kobject_add+0x165/0x230 [ 88.015835][ T535] ? __cfi_kobject_add+0x10/0x10 [ 88.020804][ T535] ? get_device_parent+0x12e/0x410 [ 88.025961][ T535] device_add+0x398/0xec0 [ 88.030320][ T535] device_create+0x26c/0x300 [ 88.034958][ T535] ? __cfi_device_create+0x10/0x10 [ 88.040093][ T535] create_function_device+0x60/0x70 [ 88.045719][ T535] f_midi_alloc_inst+0x1a8/0x380 [ 88.050879][ T535] usb_get_function_instance+0xf3/0x310 [ 88.056495][ T535] function_make+0x118/0x360 [ 88.061114][ T535] ? __cfi_function_make+0x10/0x10 [ 88.066273][ T535] ? __cfi_mutex_lock+0x10/0x10 [ 88.071158][ T535] ? __kasan_kmalloc+0x95/0xb0 [ 88.075974][ T535] ? configfs_mkdir+0x444/0x9e0 [ 88.080857][ T535] ? __kmalloc+0xb4/0x1e0 [ 88.085243][ T535] ? __kasan_check_write+0x14/0x20 [ 88.090382][ T535] configfs_mkdir+0x518/0x9e0 [ 88.095183][ T535] vfs_mkdir+0x39c/0x580 [ 88.099447][ T535] do_mkdirat+0x174/0x4d0 [ 88.103775][ T535] __x64_sys_mkdirat+0x89/0xa0 [ 88.108588][ T535] x64_sys_call+0x73d/0x9a0 [ 88.113120][ T535] do_syscall_64+0x4c/0xa0 [ 88.117584][ T535] ? clear_bhb_loop+0x30/0x80 [ 88.122285][ T535] ? clear_bhb_loop+0x30/0x80 [ 88.127126][ T535] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 88.133121][ T535] RIP: 0033:0x7f7cb539e0d9 [ 88.137580][ T535] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 88.157243][ T535] RSP: 002b:00007f7cb62db028 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 [ 88.165699][ T535] RAX: ffffffffffffffda RBX: 00007f7cb5625fa0 RCX: 00007f7cb539e0d9 [ 88.173727][ T535] RDX: 00000000000001ff RSI: 0000200000000400 RDI: ffffffffffffff9c [ 88.181742][ T535] RBP: 00007f7cb5435024 R08: 0000000000000000 R09: 0000000000000000 [ 88.189856][ T535] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 88.197891][ T535] R13: 00007f7cb5626038 R14: 00007f7cb5625fa0 R15: 00007ffda00d6eb8 [ 88.206061][ T535] [ 88.209150][ T535] ---[ end trace 0000000000000000 ]--- [ 88.215867][ T535] kobject_add_internal failed for f_midi (error: -2 parent: ) [ 88.278215][ T407] usb 8-1: device descriptor read/all, error -71 [ 88.705161][ T43] device bridge_slave_1 left promiscuous mode [ 88.711293][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 88.718750][ T43] device bridge_slave_0 left promiscuous mode [ 88.724951][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 88.732839][ T43] device veth1_macvtap left promiscuous mode [ 88.738938][ T43] device veth0_vlan left promiscuous mode [ 89.135097][ T308] usb 7-1: USB disconnect, device number 3 [ 89.645534][ T43] device bridge_slave_1 left promiscuous mode [ 89.651714][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 89.659296][ T43] device bridge_slave_0 left promiscuous mode [ 89.665578][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 89.674852][ T43] device bridge_slave_1 left promiscuous mode [ 89.680966][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 89.688420][ T43] device bridge_slave_0 left promiscuous mode [ 89.694526][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 89.702548][ T43] device bridge_slave_1 left promiscuous mode [ 89.708673][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 89.716159][ T43] device bridge_slave_0 left promiscuous mode [ 89.722256][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 89.730178][ T43] device bridge_slave_1 left promiscuous mode [ 89.736409][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 89.743832][ T43] device bridge_slave_0 left promiscuous mode [ 89.750045][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 89.758452][ T43] device veth1_macvtap left promiscuous mode [ 89.764465][ T43] device veth0_vlan left promiscuous mode [ 89.770565][ T43] device veth1_macvtap left promiscuous mode [ 89.776634][ T43] device veth0_vlan left promiscuous mode [ 89.782759][ T43] device veth1_macvtap left promiscuous mode [ 89.788842][ T43] device veth0_vlan left promiscuous mode [ 89.795115][ T43] device veth1_macvtap left promiscuous mode [ 89.801136][ T43] device veth0_vlan left promiscuous mode [ 94.498331][ T28] audit: type=1400 audit(1786952835.459:173): avc: denied { search } for pid=539 comm="dhcpcd-run-hook" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 94.521077][ T28] audit: type=1400 audit(1786952835.479:174): avc: denied { read } for pid=540 comm="dhcpcd-run-hook" name="resolv.conf" dev="tmpfs" ino=494 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 94.544251][ T28] audit: type=1400 audit(1786952835.479:175): avc: denied { open } for pid=540 comm="dhcpcd-run-hook" path="/run/dhcpcd/hook-state/resolv.conf" dev="tmpfs" ino=494 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 94.569891][ T28] audit: type=1400 audit(1786952835.479:176): avc: denied { getattr } for pid=540 comm="dhcpcd-run-hook" path="/run/dhcpcd/hook-state/resolv.conf" dev="tmpfs" ino=494 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 94.595143][ T28] audit: type=1400 audit(1786952835.529:177): avc: denied { write } for pid=539 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=493 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 94.618115][ T28] audit: type=1400 audit(1786952835.529:178): avc: denied { add_name } for pid=539 comm="dhcpcd-run-hook" name="resolv.conf.usb0.ipv4ll" scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 94.640596][ T28] audit: type=1400 audit(1786952835.559:179): avc: denied { remove_name } for pid=550 comm="rm" name="resolv.conf.usb0.ipv4ll" dev="tmpfs" ino=873 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1