last executing test programs: 5.689212642s ago: executing program 1 (id=2): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_LAPIC(r2, 0x4400ae8f, &(0x7f0000000300)={"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000100"}) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000100)={0x1, 0x0, [{0x80b}]}) 5.523832186s ago: executing program 1 (id=6): r0 = openat$kvm(0x0, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f0000000040)={0x0, &(0x7f0000000080)=[@code={0xa, 0x13, {"ebfe"}}], 0x13}) ioctl$KVM_RUN(r3, 0xae80, 0x0) (async) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) ioctl$KVM_SET_CLOCK(r1, 0x4030ae7b, &(0x7f0000000100)) ioctl$KVM_SET_CLOCK(r1, 0x4030ae7b, &(0x7f0000000100)) 5.316925661s ago: executing program 3 (id=4): r0 = syz_usb_connect(0x2, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ff000040861a23750000010203010902270001010080320904000003ff010200070582022000000705020220000007058103080001"], &(0x7f0000000800)) nanosleep(&(0x7f0000000400)={0x0, 0x2faf080}, 0x0) syz_usb_control_io(r0, &(0x7f0000000300)={0x2c}, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x5f, 0x2, '0\x00'}}) syz_usb_control_io(r0, &(0x7f0000000300)={0x2c}, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x5f, 0x2, '0\x00'}}) syz_usb_control_io(r0, &(0x7f0000000300)={0x2c}, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x5f, 0x2, '0\x00'}}) syz_usb_control_io(r0, &(0x7f0000000300)={0x2c}, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x5f, 0x2, '0\x00'}}) syz_usb_control_io(r0, &(0x7f0000000300)={0x2c}, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x5f, 0x2, '0\x00'}}) syz_usb_control_io(r0, &(0x7f0000000300)={0x2c}, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x5f, 0x2, '0\x00'}}) syz_usb_control_io(r0, &(0x7f0000000300)={0x2c}, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x5f, 0x2, '0\x00'}}) syz_usb_control_io(r0, &(0x7f0000000300)={0x2c}, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x5f, 0x2, '0\x00'}}) 5.187918174s ago: executing program 0 (id=10): r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x40, 0xcf2, 0x6250, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x0, 0x80, 0xfa, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x8, 0x6, 0x50, 0x0, [], [{{0x9, 0x5, 0x1, 0x2, 0x200}}, {{0x9, 0x5, 0x82, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_ep_read(r0, 0x1, 0x1f, &(0x7f0000001000)) syz_usb_ep_write(r0, 0x82, 0x1, &(0x7f0000002000)="02") syz_usb_ep_write(r0, 0x82, 0xd, &(0x7f0000003000)='USBS\x00\x00\x00\x00\x00\x00\x00\x00\x00') syz_usb_ep_read(r0, 0x1, 0x1f, &(0x7f0000004000)) syz_usb_ep_write(r0, 0x82, 0x24, &(0x7f0000005000)='\x00'/36) syz_usb_ep_write(r0, 0x82, 0xd, &(0x7f0000006000)='USBS\x00\x00\x00\x00\x00\x00\x00\x00\x00') 4.623530408s ago: executing program 1 (id=11): syz_usb_connect(0x0, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x97, 0xff, 0x82, 0x8, 0x2058, 0x1005, 0xc19b, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x8f, 0x0, 0x0, 0xbf, 0x57, 0x5a}}]}}]}}, 0x0) syz_usb_disconnect(0x3) syz_usb_connect(0x3, 0x4e, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000401107500500010102030109023c0001010080320904000006ffffff0007058e0200020007050e02000200070501020002000705030200020007058d0200020007050d02000200"], 0x0) 3.947853844s ago: executing program 4 (id=14): r0 = syz_open_dev$usbfs(&(0x7f0000000000), 0x0, 0x0) r1 = syz_open_dev$usbfs(&(0x7f0000000000), 0x1, 0x0) r2 = syz_open_dev$usbfs(&(0x7f0000000000), 0x2, 0x0) r3 = syz_open_dev$usbfs(&(0x7f0000000000), 0x3, 0x0) ioctl$USBDEVFS_CLAIMINTERFACE(r0, 0x8004550f, &(0x7f0000000100)) ioctl$USBDEVFS_CLAIMINTERFACE(r1, 0x8004550f, &(0x7f0000000100)) ioctl$USBDEVFS_CLAIMINTERFACE(r2, 0x8004550f, &(0x7f0000000100)) ioctl$USBDEVFS_CLAIMINTERFACE(r3, 0x8004550f, &(0x7f0000000100)) ioctl$USBDEVFS_SUBMITURB(r0, 0x8038550a, &(0x7f0000000200)=@urb_type_bulk={0x3, {0x1}, 0x0, 0x0, &(0x7f0000000300)='\x00\x00\x00\x00', 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)='\x00'}) ioctl$USBDEVFS_SUBMITURB(r1, 0x8038550a, &(0x7f0000000200)=@urb_type_bulk={0x3, {0x1}, 0x0, 0x0, &(0x7f0000000300)='\x00\x00\x00\x00', 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)='\x00'}) ioctl$USBDEVFS_SUBMITURB(r2, 0x8038550a, &(0x7f0000000200)=@urb_type_bulk={0x3, {0x1}, 0x0, 0x0, &(0x7f0000000300)='\x00\x00\x00\x00', 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)='\x00'}) ioctl$USBDEVFS_SUBMITURB(r3, 0x8038550a, &(0x7f0000000200)=@urb_type_bulk={0x3, {0x1}, 0x0, 0x0, &(0x7f0000000300)='\x00\x00\x00\x00', 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)='\x00'}) ioctl$USBDEVFS_DISCARDURB(r0, 0x550b, &(0x7f0000000200)) ioctl$USBDEVFS_DISCARDURB(r1, 0x550b, &(0x7f0000000200)) ioctl$USBDEVFS_DISCARDURB(r2, 0x550b, &(0x7f0000000200)) ioctl$USBDEVFS_DISCARDURB(r3, 0x550b, &(0x7f0000000200)) 3.947720944s ago: executing program 4 (id=15): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={&(0x7f0000000100), 0x0, &(0x7f0000000040)={&(0x7f0000000000)={{0x14, 0xa00, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x301, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x40, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8, 0x0, 0x0, 0x0, 0x1}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x20, 0x4, 0x0, 0x1, [{0x1c, 0x1, 0x0, 0x1, @ct={{0x7, 0x0}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_CT_KEY={0x8}, @NFTA_CT_DREG={0x8, 0x1, 0x1, 0x0, 0x1}]}}}]}]}], {0x14, 0xa01, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0}}}}}, 0x0) 3.947630674s ago: executing program 4 (id=16): r0 = syz_usb_connect(0x2, 0x4b, &(0x7f0000000000)=ANY=[@ANYBLOB="12011001ff000040b90661400000010200010902390002010080fa0904000001ff000000070581031000010904010000ff0000000904010102ff0000000705870240000007050702400000"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x10, &(0x7f0000000400)='\x00'/16) nanosleep(&(0x7f0000000300)={0x1, 0x1dcd6500}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) 2.723505474s ago: executing program 2 (id=17): r0 = openat$kvm(0x0, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x1000, &(0x7f0000000000/0x1000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000161000/0x18000)=nil, &(0x7f0000000240)=[@text16={0x20, &(0x7f0000000140)="a100001000", 0x5}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 2.652849846s ago: executing program 2 (id=18): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_GUEST_MEMFD(r1, 0xc040aed4, &(0x7f0000000100)={0x2000}) fallocate(r2, 0x3, 0x0, 0x1000) 2.564102688s ago: executing program 2 (id=19): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CAP_SPLIT_IRQCHIP(r1, 0x4068aea3, &(0x7f0000000100)={0x79, 0x0, 0x1}) ioctl$KVM_CAP_X2APIC_API(r1, 0x4068aea3, &(0x7f0000000200)={0x81, 0x0, 0x3}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GSI_ROUTING(r1, 0x4008aea6, &(0x7f0000000300)={0x1, 0x0, [{0x0, 0x1, 0x0, 0x0, @msi={0xfee00000, 0x0, 0x20}}]}) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000400)=[@text64={0x40, &(0x7f0000000040)="0f30", 0x2}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_SIGNAL_MSI(r1, 0x4020aea5, &(0x7f0000000500)={0xfee00000, 0x0, 0x20}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 2.551820398s ago: executing program 2 (id=20): r0 = syz_usb_connect(0x2, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040e305020700010102030109022000010100c0320904000002080650000705810200020007050202000200"], 0x0) nanosleep(&(0x7f0000000100)={0x0, 0x1dcd6500}, 0x0) syz_usb_disconnect(r0) nanosleep(&(0x7f0000000100)={0x0, 0x1dcd6500}, 0x0) 2.425749021s ago: executing program 1 (id=21): syz_usb_connect(0x0, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x97, 0xff, 0x82, 0x8, 0x2058, 0x1005, 0xc19b, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x8f, 0x0, 0x0, 0xbf, 0x57, 0x5a}}]}}]}}, 0x0) syz_usb_connect(0x3, 0x3f, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ffff00404b0c000100010102030109022d0001010080320904000003ffff0000090501020002000000090582020002000000090583034000010000"], 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) 2.256033336s ago: executing program 3 (id=22): r0 = syz_usb_connect$cdc_ecm(0x3, 0x56, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x2, 0x0, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x0, 0x0, 0xffffffffffff8001, 0x1, [{{0x9, 0x2, 0x44, 0x1, 0x1, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x3, 0x2, 0x6, 0x0, 0x0, {{0x5}, {0x5}, {0xd}}, {[{{0x9, 0x5, 0x81, 0x3, 0x10, 0x9}}], {{0x9, 0x5, 0x82, 0x2, 0x200}}, {{0x9, 0x5, 0x3, 0x2, 0x200}}}}}]}}]}}, &(0x7f0000001400)={0x0, 0x0, 0x0, 0x0, 0x2, [{0x4, &(0x7f0000001500)=@lang_id={0x4, 0x3, 0x409}}, {0x1a, &(0x7f0000001600)=@string={0x1a, 0x3, '4\x002\x004\x002\x004\x002\x004\x002\x004\x002\x004\x002\x00'}}]}) nanosleep(&(0x7f0000000300)={0x0, 0x2faf080}, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000100)={'syzkaller0\x00', 0x1}) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', 0x1}) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000180)={'veth0\x00', 0x1}) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000001c0)={'veth1\x00', 0x1}) syz_usb_ep_write(r0, 0x81, 0x8, &(0x7f0000000200)="a100010000000000") (async) syz_usb_ep_write(r0, 0x81, 0x10, &(0x7f0000000240)="a12a00000000080000100e0000100e00") (async) 2.198360477s ago: executing program 0 (id=23): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/fail_page_alloc/ignore-gfp-reclaim\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='N\x00', 0x2) 2.165060127s ago: executing program 0 (id=24): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(&(0x7f0000000080)=@filename='none\x00', &(0x7f00000000c0)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/platform/drivers/vivid/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000180)='vivid.0\x00', 0x7) (async) r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./sys/module/vivid/parameters/node_types\x00', 0x1, 0x0) write(r1, &(0x7f0000000200)='0x20000\x00', 0x8) r2 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/bus/platform/devices/pcspkr/driver_override\x00', 0x1, 0x0) write(r2, &(0x7f0000000280)='vivid\x00', 0x5) r3 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./sys/bus/platform/drivers/vivid/bind\x00', 0x1, 0x0) write(r3, &(0x7f0000000300)='pcspkr\x00', 0x6) (async) 2.084102539s ago: executing program 0 (id=25): syz_btf_id_by_name$bpf_lsm(&(0x7f0000000000)='bpf_lsm_inode_alloc_security\x00') 2.07705438s ago: executing program 0 (id=26): r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000100)={{0xfffffffffffffffe, 0x1000}, 0x1}) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_GET_REGS(r3, 0x8090ae81, 0xfffffffffffffffe) 2.013566622s ago: executing program 0 (id=27): syz_usb_connect(0x1, 0x80, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040cd0621010001010100010902200001010080500904000002ff0000000705810240000007050202400000"], 0x0) 959.998877ms ago: executing program 1 (id=28): r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000480)={{0x12, 0x1, 0x0, 0x2, 0x0, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x0, 0x0, 0x0, "", {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5}, {0xd}, {0x6}}, {{0x9, 0x5, 0x81, 0x3, 0x200}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200}}, {{0x9, 0x5, 0x3, 0x2, 0x200}}}}}}}]}}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000340)={0x44, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x20, 0x80, 0x1c, {0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10}}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, &(0x7f0000000080)={0x14, 0x0, &(0x7f0000000040)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) syz_usb_ep_write(r0, 0x82, 0x5, &(0x7f0000002340)='hello') syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x20, 0x80, 0x1c, {0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10}}, &(0x7f0000000220)={0x20, 0x86, 0x4, 0x800}, &(0x7f0000000240)={0x20, 0x84, 0x2}, &(0x7f0000000260)={0x20, 0x88, 0x2, 0x600}, &(0x7f0000000280)={0x20, 0x8a, 0x2}}) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x29b92700}, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/module/cdc_ncm/drivers/usb:cdc_ncm/5-1:1.0/net\x00', 0x0, 0x0) openat(r1, &(0x7f0000000500)='wwan0\x00', 0x0, 0x0) openat(r1, &(0x7f0000000600)='eth0\x00', 0x0, 0x0) openat(r1, &(0x7f0000000700)='eth1\x00', 0x0, 0x0) openat(r1, &(0x7f0000000800)='usb0\x00', 0x0, 0x0) 928.927348ms ago: executing program 4 (id=29): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f0000000080)) ioctl$KVM_SET_PIT2(r1, 0x4070aea0, &(0x7f0000000100)={[{0x1, 0x0, 0x2}]}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID2(r2, 0x4008ae90, &(0x7f0000000200)={0x1, 0x0, [{0x1, 0x0, 0x0, 0x0, 0x0, 0x200000}]}) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000300)={0x1, 0x0, [{0x1b, 0x0, 0xc00}]}) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000380)={0x1, 0x0, [{0x835, 0x0, 0x400}]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) nanosleep(&(0x7f0000000400)={0x1}, 0x0) 839.48379ms ago: executing program 2 (id=30): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x102}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=@newqdisc={0x0, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_mq={0x7}]}, 0x2c}}, 0x0) 736.035482ms ago: executing program 2 (id=31): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040030431c60001000000010902120001010080320904000000ff000000"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000001000)={0x84, &(0x7f0000001100)={0xc1, 0x1, 0x4, "ffffffff"}}) syz_usb_control_io(r0, 0x0, &(0x7f0000001000)={0x84, &(0x7f0000001100)={0x41, 0x2}}) nanosleep(&(0x7f0000000300)={0x2}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(&(0x7f0000000400)=@filename='none\x00', &(0x7f0000000500)='./sys\x00', &(0x7f0000000600)='sysfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/class/i2c-adapter/i2c-2/new_device\x00', 0x1, 0x0) 31.0406ms ago: executing program 4 (id=32): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/idVendor\x00', 0x1, 0x0) write(r0, &(0x7f0000000300)='0x1d6b\x00', 0x6) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/idProduct\x00', 0x1, 0x0) write(r1, &(0x7f0000000500)='0x0104\x00', 0x6) close(r1) mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g1/functions/acm.usb0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000700)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) symlinkat(&(0x7f0000000800)='./config/usb_gadget/g1/functions/acm.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000900)='./config/usb_gadget/g1/configs/c.1/acm.usb0\x00') r2 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r2, &(0x7f0000000b00)='cdns2-pci\x00', 0xa) close(r2) 0s ago: executing program 4 (id=33): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f00000000e0)='./config/usb_gadget/g1/max_speed\x00', 0x1, 0x0) write(r0, &(0x7f00000000f0)='high-speed\n\x00', 0xb) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1/idVendor\x00', 0x1, 0x0) write(r1, &(0x7f0000000140)='0x17b3\n\x00', 0x7) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/idProduct\x00', 0x1, 0x0) write(r2, &(0x7f00000001c0)='0x0004\n\x00', 0x7) close(r2) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff) r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/strings/0x409/manufacturer\x00', 0x1, 0x0) write(r3, &(0x7f0000000280)='ACME\n\x00', 0x5) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/strings/0x409/product\x00', 0x1, 0x0) write(r4, &(0x7f0000000300)='ACMESynth\n\x00', 0xa) close(r4) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/configs/c.1/strings/0x409\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/usb_gadget/g1/functions/midi.usb0\x00', 0x1ff) symlinkat(&(0x7f0000000580)='./config/usb_gadget/g1/functions/midi.usb0\x00', 0xffffffffffffff9c, &(0x7f00000005c0)='./config/usb_gadget/g1/configs/c.1/midi.usb0\x00') r5 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r5, &(0x7f0000000680)='dummy_udc.0\n\x00', 0xc) close(r5) nanosleep(&(0x7f0000000700)={0x0, 0x1dcd6500}, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r6, &(0x7f0000000b00)='\n\x00', 0x1) close(r6) nanosleep(&(0x7f0000000700)={0x0, 0x5f5e100}, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.139' (ED25519) to the list of known hosts. [ 22.309271][ T28] audit: type=1400 audit(1786955386.042:64): avc: denied { mounton } for pid=279 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 22.312001][ T279] cgroup: Unknown subsys name 'net' [ 22.331911][ T28] audit: type=1400 audit(1786955386.042:65): avc: denied { mount } for pid=279 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.359189][ T28] audit: type=1400 audit(1786955386.072:66): avc: denied { unmount } for pid=279 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.359483][ T279] cgroup: Unknown subsys name 'devices' [ 22.504307][ T279] cgroup: Unknown subsys name 'hugetlb' [ 22.509899][ T279] cgroup: Unknown subsys name 'rlimit' [ 22.613244][ T28] audit: type=1400 audit(1786955386.352:67): avc: denied { setattr } for pid=279 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=258 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 22.636419][ T28] audit: type=1400 audit(1786955386.352:68): avc: denied { mounton } for pid=279 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 22.661222][ T28] audit: type=1400 audit(1786955386.352:69): avc: denied { mount } for pid=279 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 22.690180][ T281] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 22.699012][ T28] audit: type=1400 audit(1786955386.432:70): avc: denied { relabelto } for pid=281 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.724921][ T28] audit: type=1400 audit(1786955386.432:71): avc: denied { write } for pid=281 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" Setting up swapspace version 1, size = 127995904 bytes [ 22.797185][ T28] audit: type=1400 audit(1786955386.532:72): avc: denied { read } for pid=279 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.822745][ T28] audit: type=1400 audit(1786955386.532:73): avc: denied { open } for pid=279 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.822777][ T279] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 23.691801][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.698888][ T290] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.706311][ T290] device bridge_slave_0 entered promiscuous mode [ 23.732835][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.739877][ T288] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.747405][ T288] device bridge_slave_0 entered promiscuous mode [ 23.754378][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.761408][ T290] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.768816][ T290] device bridge_slave_1 entered promiscuous mode [ 23.785315][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.792343][ T288] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.799717][ T288] device bridge_slave_1 entered promiscuous mode [ 23.827062][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.834106][ T289] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.841476][ T289] device bridge_slave_0 entered promiscuous mode [ 23.851307][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.858366][ T289] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.865822][ T289] device bridge_slave_1 entered promiscuous mode [ 23.891436][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.898515][ T287] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.905918][ T287] device bridge_slave_0 entered promiscuous mode [ 23.914223][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.921256][ T287] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.928647][ T287] device bridge_slave_1 entered promiscuous mode [ 23.990185][ T291] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.997309][ T291] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.004797][ T291] device bridge_slave_0 entered promiscuous mode [ 24.022875][ T291] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.029909][ T291] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.037280][ T291] device bridge_slave_1 entered promiscuous mode [ 24.131071][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.138130][ T288] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.145433][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.152452][ T288] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.174989][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.182118][ T290] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.189400][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.196446][ T290] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.217584][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.224635][ T287] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.231906][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.238945][ T287] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.257172][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.264232][ T289] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.271488][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.278535][ T289] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.305944][ T221] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.313840][ T221] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.320953][ T221] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.328691][ T221] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.336990][ T221] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.344197][ T221] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.351366][ T221] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.358694][ T221] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.365886][ T221] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.392457][ T221] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.400030][ T221] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.408473][ T221] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.415554][ T221] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.423623][ T221] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.431727][ T221] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.438774][ T221] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.447779][ T221] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 24.455476][ T221] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.477890][ T221] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.486048][ T221] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.493086][ T221] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.500392][ T221] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.509192][ T221] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.520479][ T221] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.531169][ T221] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.544176][ T221] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.552248][ T221] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.560533][ T221] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.567579][ T221] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.591845][ T221] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.600089][ T221] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.608851][ T221] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.615898][ T221] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.623797][ T221] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.631876][ T221] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.638919][ T221] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.646365][ T221] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.654516][ T221] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.661525][ T221] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.668892][ T221] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.676856][ T221] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.685129][ T221] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.692138][ T221] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.699515][ T221] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.707786][ T221] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.714831][ T221] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.722691][ T221] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 24.732684][ T221] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 24.740832][ T221] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.758696][ T287] device veth0_vlan entered promiscuous mode [ 24.766103][ T221] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 24.774329][ T221] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.782242][ T221] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.790694][ T221] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.799355][ T221] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 24.807435][ T221] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.815560][ T221] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.823519][ T221] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.831479][ T221] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.839124][ T221] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.851911][ T221] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.860703][ T221] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.869104][ T221] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.877022][ T221] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.888561][ T287] device veth1_macvtap entered promiscuous mode [ 24.896382][ T288] device veth0_vlan entered promiscuous mode [ 24.909087][ T221] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.916576][ T221] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.924171][ T221] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 24.932242][ T221] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.940589][ T221] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 24.948606][ T221] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 24.956648][ T221] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.964874][ T221] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 24.973070][ T221] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.987558][ T290] device veth0_vlan entered promiscuous mode [ 25.000038][ T221] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 25.008709][ T221] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.017200][ T221] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 25.025297][ T221] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.033408][ T221] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.041555][ T221] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.050217][ T221] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.058486][ T221] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.066839][ T221] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.075048][ T221] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.083269][ T221] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.090686][ T221] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.101238][ T288] device veth1_macvtap entered promiscuous mode [ 25.111623][ T221] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 25.119302][ T221] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 25.127747][ T221] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.146829][ T289] device veth0_vlan entered promiscuous mode [ 25.153560][ T287] request_module fs-gadgetfs succeeded, but still no fs? [ 25.161167][ T291] device veth0_vlan entered promiscuous mode [ 25.170763][ T221] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 25.179675][ T221] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.188211][ T221] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.201238][ T310] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 25.203774][ T221] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.225977][ T221] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 25.234570][ T221] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.243631][ T221] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.251942][ T221] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.260575][ T221] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 25.268709][ T221] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.276829][ T221] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.285432][ T221] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.293009][ T221] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.300564][ T221] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.309977][ T290] device veth1_macvtap entered promiscuous mode [ 25.321474][ T291] device veth1_macvtap entered promiscuous mode [ 25.329805][ T221] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.338139][ T221] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.347457][ T221] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 25.357863][ T221] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.366394][ T221] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.374764][ T221] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 25.385614][ T289] device veth1_macvtap entered promiscuous mode [ 25.402235][ T221] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.410696][ T221] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.427216][ T221] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 25.435908][ T221] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.444308][ T221] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.453066][ T221] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.461390][ T221] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.470115][ T221] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.478919][ T221] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.487468][ T221] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.496053][ T221] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.517529][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.528651][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.537050][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.545686][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.862644][ T24] usb 4-1: new full-speed USB device number 2 using dummy_hcd [ 25.872598][ T19] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 25.942637][ T321] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 25.962641][ T40] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 26.012631][ T24] usb 4-1: device descriptor read/64, error -71 [ 26.072601][ T19] usb 5-1: Using ep0 maxpacket: 8 [ 26.078779][ T19] usb 5-1: config 0 has an invalid interface number: 143 but max is 0 [ 26.087213][ T19] usb 5-1: config 0 has no interface number 0 [ 26.093493][ T19] usb 5-1: New USB device found, idVendor=2058, idProduct=1005, bcdDevice=c1.9b [ 26.102711][ T19] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 26.113892][ T19] usb 5-1: config 0 descriptor?? [ 26.132684][ T321] usb 3-1: Using ep0 maxpacket: 8 [ 26.139080][ T321] usb 3-1: config 0 has an invalid interface number: 143 but max is 0 [ 26.147449][ T321] usb 3-1: config 0 has no interface number 0 [ 26.153817][ T321] usb 3-1: New USB device found, idVendor=2058, idProduct=1005, bcdDevice=c1.9b [ 26.163126][ T321] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 26.171934][ T321] usb 3-1: config 0 descriptor?? [ 26.179005][ T40] usb 1-1: New USB device found, idVendor=0cf2, idProduct=6250, bcdDevice= 0.00 [ 26.188934][ T40] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 26.197062][ T40] usb 1-1: Product: syz [ 26.201279][ T40] usb 1-1: Manufacturer: syz [ 26.206026][ T40] usb 1-1: SerialNumber: syz [ 26.217250][ T40] usb-storage 1-1:1.0: USB Mass Storage device detected [ 26.225346][ T40] scsi host1: usb-storage 1-1:1.0 [ 26.282634][ T24] usb 4-1: device descriptor read/64, error -71 [ 26.321947][ T19] usb 5-1: USB disconnect, device number 2 [ 26.380509][ T334] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 26.389030][ T334] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 26.532664][ T40] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 26.552624][ T24] usb 4-1: new full-speed USB device number 3 using dummy_hcd [ 26.702706][ T24] usb 4-1: device descriptor read/64, error -71 [ 26.712620][ T40] usb 2-1: Using ep0 maxpacket: 8 [ 26.718693][ T40] usb 2-1: config 0 has an invalid interface number: 143 but max is 0 [ 26.726958][ T40] usb 2-1: config 0 has no interface number 0 [ 26.733081][ T40] usb 2-1: New USB device found, idVendor=2058, idProduct=1005, bcdDevice=c1.9b [ 26.742112][ T40] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 26.752302][ T40] usb 2-1: config 0 descriptor?? [ 26.916696][ T354] Zero length message leads to an empty skb [ 26.959298][ T338] usb 2-1: USB disconnect, device number 2 [ 26.972615][ T24] usb 4-1: device descriptor read/64, error -71 [ 27.092744][ T24] usb usb4-port1: attempt power cycle [ 27.192649][ T40] usb 5-1: new full-speed USB device number 3 using dummy_hcd [ 27.374516][ T40] usb 5-1: New USB device found, idVendor=06b9, idProduct=4061, bcdDevice= 0.00 [ 27.383668][ T40] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 27.391669][ T40] usb 5-1: Product: syz [ 27.395894][ T40] usb 5-1: Manufacturer: syz [ 27.502637][ T24] usb 4-1: new full-speed USB device number 4 using dummy_hcd [ 27.512596][ T338] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 27.533663][ T24] usb 4-1: device descriptor read/8, error -71 [ 27.649273][ T19] usb 3-1: USB disconnect, device number 2 [ 27.683719][ T24] usb 4-1: device descriptor read/8, error -71 [ 27.693725][ T338] usb 2-1: config index 0 descriptor too short (expected 60, got 18) [ 27.701933][ T338] usb 2-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 6 [ 27.716102][ T338] usb 2-1: New USB device found, idVendor=0711, idProduct=0550, bcdDevice= 1.00 [ 27.725176][ T338] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 27.733233][ T338] usb 2-1: Product: syz [ 27.737402][ T338] usb 2-1: Manufacturer: syz [ 27.741991][ T338] usb 2-1: SerialNumber: syz [ 27.949420][ T19] usb 2-1: USB disconnect, device number 3 [ 27.952689][ T24] usb 4-1: new full-speed USB device number 5 using dummy_hcd [ 27.993675][ T24] usb 4-1: device descriptor read/8, error -71 [ 28.143821][ T24] usb 4-1: device descriptor read/8, error -71 [ 28.263026][ T24] usb usb4-port1: unable to enumerate USB device [ 28.602647][ T19] usb 3-1: new full-speed USB device number 3 using dummy_hcd [ 28.675863][ T338] usb 1-1: USB disconnect, device number 2 [ 28.687952][ T28] kauditd_printk_skb: 44 callbacks suppressed [ 28.687965][ T28] audit: type=1400 audit(1786955392.422:118): avc: denied { mount } for pid=377 comm="syz.0.23" name="/" dev="sysfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 28.716009][ T28] audit: type=1400 audit(1786955392.452:119): avc: denied { unmount } for pid=289 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 28.742746][ T295] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 28.942625][ T295] usb 2-1: Using ep0 maxpacket: 8 [ 28.948646][ T295] usb 2-1: config 0 has an invalid interface number: 143 but max is 0 [ 28.956870][ T295] usb 2-1: config 0 has no interface number 0 [ 28.962997][ T295] usb 2-1: New USB device found, idVendor=2058, idProduct=1005, bcdDevice=c1.9b [ 28.972015][ T295] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 28.980628][ T295] usb 2-1: config 0 descriptor?? [ 29.062593][ T40] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 29.187697][ T373] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 29.196225][ T373] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 29.242591][ T338] usb 1-1: new low-speed USB device number 3 using dummy_hcd [ 29.251866][ T40] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 29.261239][ T40] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 29.269289][ T40] usb 4-1: SerialNumber: 424242424242 [ 29.368279][ T292] usb 2-1: USB disconnect, device number 4 [ 29.422589][ T338] usb 1-1: Invalid ep0 maxpacket: 64 [ 29.536981][ T19] usb 3-1: unable to read config index 0 descriptor/start: -71 [ 29.544702][ T19] usb 3-1: can't read configurations, error -71 [ 29.572852][ T338] usb 1-1: new low-speed USB device number 4 using dummy_hcd [ 29.752616][ T338] usb 1-1: Invalid ep0 maxpacket: 64 [ 29.758018][ T338] usb usb1-port1: attempt power cycle [ 29.945917][ T24] usb 5-1: USB disconnect, device number 3 [ 30.152590][ T295] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 30.172603][ T338] usb 1-1: new low-speed USB device number 5 using dummy_hcd [ 30.202944][ T338] usb 1-1: Invalid ep0 maxpacket: 64 [ 30.333864][ T295] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 30.346263][ T295] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 30.352699][ T338] usb 1-1: new low-speed USB device number 6 using dummy_hcd [ 30.355849][ T295] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 30.370784][ T295] usb 2-1: Product: syz [ 30.375067][ T295] usb 2-1: Manufacturer: syz [ 30.379669][ T295] usb 2-1: SerialNumber: syz [ 30.392965][ T338] usb 1-1: Invalid ep0 maxpacket: 64 [ 30.398366][ T338] usb usb1-port1: unable to enumerate USB device [ 30.442626][ T19] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 30.623669][ T19] usb 3-1: New USB device found, idVendor=0403, idProduct=c631, bcdDevice= 1.00 [ 30.632764][ T19] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 30.859682][ T28] audit: type=1400 audit(1786955394.592:120): avc: denied { create } for pid=405 comm="syz.4.32" name="acm.usb0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:configfs_t tclass=lnk_file permissive=1 [ 30.891409][ T408] ================================================================== [ 30.899494][ T408] BUG: KASAN: use-after-free in kobject_get+0x113/0x120 [ 30.906458][ T408] Read of size 1 at addr ffff8881133f683c by task syz.4.33/408 [ 30.914000][ T408] [ 30.916357][ T408] CPU: 0 PID: 408 Comm: syz.4.33 Not tainted syzkaller #0 [ 30.923499][ T408] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 30.933573][ T408] Call Trace: [ 30.936859][ T408] [ 30.939794][ T408] __dump_stack+0x21/0x24 [ 30.944182][ T408] dump_stack_lvl+0x110/0x170 [ 30.946313][ T409] UDC core: g1: couldn't find an available UDC or it's busy [ 30.948873][ T408] ? __cfi_dump_stack_lvl+0x8/0x8 [ 30.948902][ T408] ? __cfi__printk+0x8/0x8 [ 30.965648][ T408] ? kobject_get+0x113/0x120 [ 30.970260][ T408] print_address_description+0x71/0x200 [ 30.975813][ T408] print_report+0x4a/0x60 [ 30.980165][ T408] kasan_report+0x122/0x150 [ 30.984680][ T408] ? kobject_get+0x113/0x120 [ 30.989269][ T408] ? kasan_save_alloc_info+0x1f/0x30 [ 30.994564][ T408] __asan_report_load1_noabort+0x14/0x20 [ 31.000209][ T408] kobject_get+0x113/0x120 [ 31.004631][ T408] device_add+0x2f0/0xec0 [ 31.008985][ T408] device_create+0x26c/0x300 [ 31.013585][ T408] ? __cfi_device_create+0x10/0x10 [ 31.018710][ T408] create_function_device+0x60/0x70 [ 31.023941][ T408] f_midi_alloc_inst+0x1a8/0x380 [ 31.028892][ T408] usb_get_function_instance+0xf3/0x310 [ 31.034451][ T408] function_make+0x118/0x360 [ 31.039058][ T408] ? __cfi_function_make+0x10/0x10 [ 31.044183][ T408] ? __cfi_mutex_lock+0x10/0x10 [ 31.049054][ T408] ? __kasan_kmalloc+0x95/0xb0 [ 31.053828][ T408] ? configfs_mkdir+0x444/0x9e0 [ 31.058695][ T408] ? __kmalloc+0xb4/0x1e0 [ 31.063027][ T408] ? __kasan_check_write+0x14/0x20 [ 31.068158][ T408] configfs_mkdir+0x518/0x9e0 [ 31.072863][ T408] vfs_mkdir+0x39c/0x580 [ 31.077121][ T408] do_mkdirat+0x174/0x4d0 [ 31.081468][ T408] __x64_sys_mkdirat+0x89/0xa0 [ 31.086243][ T408] x64_sys_call+0x73d/0x9a0 [ 31.090771][ T408] do_syscall_64+0x4c/0xa0 [ 31.095201][ T408] ? clear_bhb_loop+0x30/0x80 [ 31.099876][ T408] ? clear_bhb_loop+0x30/0x80 [ 31.104564][ T408] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 31.110491][ T408] RIP: 0033:0x7f3ea7f9e0d9 [ 31.114923][ T408] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 31.134536][ T408] RSP: 002b:00007f3ea8e91028 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 [ 31.142971][ T408] RAX: ffffffffffffffda RBX: 00007f3ea8225fa0 RCX: 00007f3ea7f9e0d9 [ 31.150960][ T408] RDX: 00000000000001ff RSI: 00002000000003c0 RDI: ffffffffffffff9c [ 31.158941][ T408] RBP: 00007f3ea8035024 R08: 0000000000000000 R09: 0000000000000000 [ 31.166919][ T408] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 31.174893][ T408] R13: 00007f3ea8226038 R14: 00007f3ea8225fa0 R15: 00007ffe63ecc688 [ 31.182892][ T408] [ 31.185910][ T408] [ 31.188230][ T408] Allocated by task 328: [ 31.192477][ T408] kasan_set_track+0x4b/0x70 [ 31.197078][ T408] kasan_save_alloc_info+0x1f/0x30 [ 31.202177][ T408] __kasan_kmalloc+0x95/0xb0 [ 31.206778][ T408] kmalloc_trace+0x40/0xb0 [ 31.211198][ T408] device_create+0x13a/0x300 [ 31.215802][ T408] gadgets_make+0x84a/0xad0 [ 31.220301][ T408] configfs_mkdir+0x518/0x9e0 [ 31.224982][ T408] vfs_mkdir+0x39c/0x580 [ 31.229238][ T408] do_mkdirat+0x174/0x4d0 [ 31.233579][ T408] __x64_sys_mkdirat+0x89/0xa0 [ 31.238348][ T408] x64_sys_call+0x73d/0x9a0 [ 31.242873][ T408] do_syscall_64+0x4c/0xa0 [ 31.247314][ T408] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 31.253228][ T408] [ 31.255551][ T408] Freed by task 328: [ 31.259470][ T408] kasan_set_track+0x4b/0x70 [ 31.264073][ T408] kasan_save_free_info+0x2b/0x40 [ 31.269101][ T408] ____kasan_slab_free+0x132/0x180 [ 31.274220][ T408] __kasan_slab_free+0x11/0x20 [ 31.278983][ T408] slab_free_freelist_hook+0xc2/0x190 [ 31.284348][ T408] __kmem_cache_free+0xb7/0x1b0 [ 31.289205][ T408] kfree+0x6f/0xf0 [ 31.292921][ T408] device_create_release+0x15/0x20 [ 31.298044][ T408] device_release+0xa4/0x1d0 [ 31.302644][ T408] kobject_put+0x19d/0x280 [ 31.307074][ T408] device_destroy+0xb4/0xf0 [ 31.311580][ T408] gadgets_drop+0xa0/0xd0 [ 31.315900][ T408] configfs_rmdir+0x89b/0x980 [ 31.320575][ T408] vfs_rmdir+0x381/0x4f0 [ 31.324823][ T408] do_rmdir+0x261/0x6b0 [ 31.328981][ T408] __x64_sys_rmdir+0x49/0x50 [ 31.333578][ T408] x64_sys_call+0x68e/0x9a0 [ 31.338094][ T408] do_syscall_64+0x4c/0xa0 [ 31.342517][ T408] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 31.348417][ T408] [ 31.350736][ T408] The buggy address belongs to the object at ffff8881133f6800 [ 31.350736][ T408] which belongs to the cache kmalloc-1k of size 1024 [ 31.364790][ T408] The buggy address is located 60 bytes inside of [ 31.364790][ T408] 1024-byte region [ffff8881133f6800, ffff8881133f6c00) [ 31.378074][ T408] [ 31.380421][ T408] The buggy address belongs to the physical page: [ 31.386843][ T408] page:ffffea00044cfc00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1133f0 [ 31.397088][ T408] head:ffffea00044cfc00 order:3 compound_mapcount:0 compound_pincount:0 [ 31.405411][ T408] flags: 0x4000000000010200(slab|head|zone=1) [ 31.411492][ T408] raw: 4000000000010200 dead000000000100 dead000000000122 ffff888100043080 [ 31.420089][ T408] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 31.428689][ T408] page dumped because: kasan: bad access detected [ 31.435091][ T408] page_owner tracks the page as allocated [ 31.440811][ T408] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 102, tgid 102 (udevd), ts 5060977171, free_ts 0 [ 31.460436][ T408] post_alloc_hook+0x1f5/0x210 [ 31.465216][ T408] prep_new_page+0x1c/0x110 [ 31.469720][ T408] get_page_from_freelist+0x2ca9/0x2d20 [ 31.475301][ T408] __alloc_pages+0x1fa/0x610 [ 31.479894][ T408] alloc_slab_page+0x6e/0xf0 [ 31.484478][ T408] new_slab+0x98/0x3e0 [ 31.488538][ T408] ___slab_alloc+0x70f/0xb70 [ 31.493133][ T408] __slab_alloc+0x5e/0xa0 [ 31.497465][ T408] __kmem_cache_alloc_node+0x204/0x2d0 [ 31.502937][ T408] __kmalloc_node_track_caller+0xa1/0x1e0 [ 31.508658][ T408] __alloc_skb+0x226/0x4a0 [ 31.513070][ T408] netlink_sendmsg+0x635/0xbd0 [ 31.517833][ T408] ____sys_sendmsg+0x5fb/0x9c0 [ 31.522594][ T408] ___sys_sendmsg+0x2a2/0x360 [ 31.527279][ T408] __x64_sys_sendmsg+0x20d/0x2e0 [ 31.532217][ T408] x64_sys_call+0x171/0x9a0 [ 31.536721][ T408] page_owner free stack trace missing [ 31.542082][ T408] [ 31.544402][ T408] Memory state around the buggy address: [ 31.550024][ T408] ffff8881133f6700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 31.558089][ T408] ffff8881133f6780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 31.566155][ T408] >ffff8881133f6800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 31.574211][ T408] ^ [ 31.580101][ T408] ffff8881133f6880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 31.588185][ T408] ffff8881133f6900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 31.596239][ T408] ================================================================== [ 31.604957][ T408] Disabling lock debugging due to kernel taint [ 31.618667][ T408] ------------[ cut here ]------------ [ 31.622638][ T28] audit: type=1400 audit(1786955395.352:121): avc: denied { read } for pid=84 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 31.624285][ T408] refcount_t: addition on 0; use-after-free. [ 31.646047][ T40] cdc_ether: probe of 4-1:1.0 failed with error -71 [ 31.664055][ T28] audit: type=1400 audit(1786955395.352:122): avc: denied { search } for pid=84 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 31.669267][ T40] usb 4-1: USB disconnect, device number 6 [ 31.687747][ T28] audit: type=1400 audit(1786955395.352:123): avc: denied { write } for pid=84 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 31.694955][ T408] WARNING: CPU: 1 PID: 408 at lib/refcount.c:25 refcount_warn_saturate+0x104/0x1a0 [ 31.721802][ T408] Modules linked in: [ 31.723296][ T28] audit: type=1400 audit(1786955395.352:124): avc: denied { add_name } for pid=84 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 31.725721][ T408] CPU: 1 PID: 408 Comm: syz.4.33 Tainted: G B syzkaller #0 [ 31.746863][ T28] audit: type=1400 audit(1786955395.352:125): avc: denied { create } for pid=84 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 31.754781][ T408] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 31.754793][ T408] RIP: 0010:refcount_warn_saturate+0x104/0x1a0 [ 31.775834][ T28] audit: type=1400 audit(1786955395.392:126): avc: denied { append open } for pid=84 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 31.785470][ T408] Code: 05 01 48 c7 c7 40 0d ca 85 e8 d8 28 d9 fe 0f 0b eb df e8 2f 9a 08 ff c6 05 0f ca 26 05 01 48 c7 c7 80 0c ca 85 e8 bc 28 d9 fe <0f> 0b eb c3 e8 13 9a 08 ff c6 05 f4 c9 26 05 01 48 c7 c7 e0 0c ca [ 31.792096][ T28] audit: type=1400 audit(1786955395.392:127): avc: denied { getattr } for pid=84 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 31.814270][ T408] RSP: 0018:ffffc9001076fa18 EFLAGS: 00010246 [ 31.814291][ T408] RAX: ca8cb3d9846e9200 RBX: 0000000000000002 RCX: 0000000000080000 [ 31.814303][ T408] RDX: ffffc90003ae3000 RSI: 000000000007ffff RDI: 0000000000080000 [ 31.814315][ T408] RBP: ffffc9001076fa28 R08: 0000000000000003 R09: 0000000000000004 [ 31.814328][ T408] R10: dffffc0000000000 R11: fffff520020ede94 R12: 1ffff110230cc60e [ 31.863228][ T295] cdc_ncm 2-1:1.0: MAC-Address: 42:42:42:42:42:42 [ 31.870546][ T408] R13: dffffc0000000000 R14: 0000000000000002 R15: 0000000000000000 [ 31.870562][ T408] FS: 00007f3ea8e916c0(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 31.870579][ T408] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 31.879988][ T295] cdc_ncm 2-1:1.0: dwNtbInMaxSize=16 is too small. Using 2048 [ 31.886573][ T408] CR2: 00007f39e12edd69 CR3: 0000000114ce2000 CR4: 00000000003506a0 [ 31.886593][ T408] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 31.895288][ T295] cdc_ncm 2-1:1.0: setting rx_max = 2048 [ 31.900978][ T408] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 31.900995][ T408] Call Trace: [ 31.901001][ T408] [ 31.901010][ T408] kobject_get+0xfb/0x120 [ 31.972193][ T408] device_add+0x2f0/0xec0 [ 31.976585][ T408] device_create+0x26c/0x300 [ 31.981197][ T408] ? __cfi_device_create+0x10/0x10 [ 31.986354][ T408] create_function_device+0x60/0x70 [ 31.991571][ T408] f_midi_alloc_inst+0x1a8/0x380 [ 31.996537][ T408] usb_get_function_instance+0xf3/0x310 [ 32.002107][ T408] function_make+0x118/0x360 [ 32.006733][ T408] ? __cfi_function_make+0x10/0x10 [ 32.011858][ T408] ? __cfi_mutex_lock+0x10/0x10 [ 32.016753][ T408] ? __kasan_kmalloc+0x95/0xb0 [ 32.021536][ T408] ? configfs_mkdir+0x444/0x9e0 [ 32.026441][ T408] ? __kmalloc+0xb4/0x1e0 [ 32.030781][ T408] ? __kasan_check_write+0x14/0x20 [ 32.035934][ T408] configfs_mkdir+0x518/0x9e0 [ 32.040632][ T408] vfs_mkdir+0x39c/0x580 [ 32.044895][ T408] do_mkdirat+0x174/0x4d0 [ 32.049241][ T408] __x64_sys_mkdirat+0x89/0xa0 [ 32.054053][ T408] x64_sys_call+0x73d/0x9a0 [ 32.058601][ T408] do_syscall_64+0x4c/0xa0 [ 32.063056][ T408] ? clear_bhb_loop+0x30/0x80 [ 32.067771][ T408] ? clear_bhb_loop+0x30/0x80 [ 32.072453][ T408] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 32.078384][ T408] RIP: 0033:0x7f3ea7f9e0d9 [ 32.082829][ T408] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 32.102497][ T408] RSP: 002b:00007f3ea8e91028 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 [ 32.110952][ T408] RAX: ffffffffffffffda RBX: 00007f3ea8225fa0 RCX: 00007f3ea7f9e0d9 [ 32.118960][ T408] RDX: 00000000000001ff RSI: 00002000000003c0 RDI: ffffffffffffff9c [ 32.126990][ T408] RBP: 00007f3ea8035024 R08: 0000000000000000 R09: 0000000000000000 [ 32.135007][ T408] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 32.143005][ T408] R13: 00007f3ea8226038 R14: 00007f3ea8225fa0 R15: 00007ffe63ecc688 [ 32.150995][ T408] [ 32.154049][ T408] ---[ end trace 0000000000000000 ]--- [ 32.159530][ T408] ------------[ cut here ]------------ [ 32.165089][ T408] refcount_t: saturated; leaking memory. [ 32.171162][ T408] WARNING: CPU: 0 PID: 408 at lib/refcount.c:22 refcount_warn_saturate+0x158/0x1a0 [ 32.180576][ T408] Modules linked in: [ 32.184527][ T408] CPU: 0 PID: 408 Comm: syz.4.33 Tainted: G B W syzkaller #0 [ 32.193153][ T408] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 32.203228][ T408] RIP: 0010:refcount_warn_saturate+0x158/0x1a0 [ 32.209390][ T408] Code: 05 01 48 c7 c7 20 0c ca 85 e8 84 28 d9 fe 0f 0b eb 8b e8 db 99 08 ff c6 05 ba c9 26 05 01 48 c7 c7 20 0c ca 85 e8 68 28 d9 fe <0f> 0b e9 6c ff ff ff e8 bc 99 08 ff c6 05 9f c9 26 05 01 48 c7 c7 [ 32.229031][ T408] RSP: 0018:ffffc9001076f8d8 EFLAGS: 00010246 [ 32.235149][ T408] RAX: ca8cb3d9846e9200 RBX: 0000000000000001 RCX: 0000000000080000 [ 32.243189][ T408] RDX: ffffc90003ae3000 RSI: 000000000007ffff RDI: 0000000000080000 [ 32.251180][ T408] RBP: ffffc9001076f8e8 R08: ffff8881f6e2759b R09: 1ffff1103edc4eb3 [ 32.259180][ T408] R10: dffffc0000000000 R11: ffffed103edc4eb4 R12: dffffc0000000000 [ 32.267205][ T408] R13: ffff888118663018 R14: 0000000000000001 R15: 00000000c0000000 [ 32.275204][ T408] FS: 00007f3ea8e916c0(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 32.284187][ T408] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 32.290816][ T408] CR2: 0000200000002341 CR3: 0000000114ce2000 CR4: 00000000003506b0 [ 32.298822][ T408] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 32.306812][ T408] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 32.314804][ T408] Call Trace: [ 32.318087][ T408] [ 32.321004][ T408] kobject_add_internal+0xa81/0xc20 [ 32.326261][ T408] kobject_add+0x165/0x230 [ 32.330705][ T408] ? __cfi_kobject_add+0x10/0x10 [ 32.335670][ T408] ? get_device_parent+0x12e/0x410 [ 32.340793][ T408] device_add+0x398/0xec0 [ 32.345153][ T408] device_create+0x26c/0x300 [ 32.349756][ T408] ? __cfi_device_create+0x10/0x10 [ 32.354894][ T408] create_function_device+0x60/0x70 [ 32.360122][ T408] f_midi_alloc_inst+0x1a8/0x380 [ 32.365106][ T408] usb_get_function_instance+0xf3/0x310 [ 32.370673][ T408] function_make+0x118/0x360 [ 32.375304][ T408] ? __cfi_function_make+0x10/0x10 [ 32.380437][ T408] ? __cfi_mutex_lock+0x10/0x10 [ 32.385329][ T408] ? __kasan_kmalloc+0x95/0xb0 [ 32.390105][ T408] ? configfs_mkdir+0x444/0x9e0 [ 32.394990][ T408] ? __kmalloc+0xb4/0x1e0 [ 32.399353][ T408] ? __kasan_check_write+0x14/0x20 [ 32.404526][ T408] configfs_mkdir+0x518/0x9e0 [ 32.409235][ T408] vfs_mkdir+0x39c/0x580 [ 32.413516][ T408] do_mkdirat+0x174/0x4d0 [ 32.417865][ T408] __x64_sys_mkdirat+0x89/0xa0 [ 32.422661][ T408] x64_sys_call+0x73d/0x9a0 [ 32.427182][ T408] do_syscall_64+0x4c/0xa0 [ 32.431590][ T408] ? clear_bhb_loop+0x30/0x80 [ 32.436285][ T408] ? clear_bhb_loop+0x30/0x80 [ 32.440968][ T408] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 32.446884][ T408] RIP: 0033:0x7f3ea7f9e0d9 [ 32.451321][ T408] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 32.470975][ T408] RSP: 002b:00007f3ea8e91028 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 [ 32.479416][ T408] RAX: ffffffffffffffda RBX: 00007f3ea8225fa0 RCX: 00007f3ea7f9e0d9 [ 32.487433][ T408] RDX: 00000000000001ff RSI: 00002000000003c0 RDI: ffffffffffffff9c [ 32.495423][ T408] RBP: 00007f3ea8035024 R08: 0000000000000000 R09: 0000000000000000 [ 32.503446][ T408] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 32.511418][ T408] R13: 00007f3ea8226038 R14: 00007f3ea8225fa0 R15: 00007ffe63ecc688 [ 32.519418][ T408] [ 32.522439][ T408] ---[ end trace 0000000000000000 ]--- [ 32.527988][ T408] ------------[ cut here ]------------ [ 32.527992][ T295] cdc_ncm 2-1:1.0: setting tx_max = 88 [ 32.533543][ T408] refcount_t: underflow; use-after-free. [ 32.533714][ T408] WARNING: CPU: 1 PID: 408 at lib/refcount.c:28 refcount_warn_saturate+0x120/0x1a0 [ 32.533751][ T408] Modules linked in: [ 32.533761][ T408] CPU: 1 PID: 408 Comm: syz.4.33 Tainted: G B W syzkaller #0 [ 32.533780][ T408] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 32.533789][ T408] RIP: 0010:refcount_warn_saturate+0x120/0x1a0 [ 32.533816][ T408] Code: 05 01 48 c7 c7 80 0c ca 85 e8 bc 28 d9 fe 0f 0b eb c3 e8 13 9a 08 ff c6 05 f4 c9 26 05 01 48 c7 c7 e0 0c ca 85 e8 a0 28 d9 fe <0f> 0b eb a7 e8 f7 99 08 ff c6 05 d5 c9 26 05 01 48 c7 c7 20 0c ca [ 32.533830][ T408] RSP: 0018:ffffc9001076f8a0 EFLAGS: 00010246 [ 32.533845][ T408] RAX: ca8cb3d9846e9200 RBX: 0000000000000003 RCX: 0000000000080000 [ 32.533857][ T408] RDX: ffffc90003ae3000 RSI: 000000000007ffff RDI: 0000000000080000 [ 32.533869][ T408] RBP: ffffc9001076f8b0 R08: ffff8881f6f2759b R09: 1ffff1103ede4eb3 [ 32.533883][ T408] R10: dffffc0000000000 R11: ffffed103ede4eb4 R12: 00000000c0000000 [ 32.533896][ T408] R13: ffff8881133f683c R14: 0000000000000003 R15: ffff8881133f6838 [ 32.533908][ T408] FS: 00007f3ea8e916c0(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 32.533924][ T408] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 32.533937][ T408] CR2: 00007f39e12edd69 CR3: 0000000114ce2000 CR4: 00000000003506a0 [ 32.533953][ T408] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 32.533964][ T408] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 32.533975][ T408] Call Trace: [ 32.533980][ T408] [ 32.533986][ T408] kobject_put+0x244/0x280 [ 32.534012][ T408] kobject_add_internal+0x9a2/0xc20 [ 32.534038][ T408] kobject_add+0x165/0x230 [ 32.534063][ T408] ? __cfi_kobject_add+0x10/0x10 [ 32.534087][ T408] ? get_device_parent+0x12e/0x410 [ 32.544963][ T295] cdc_ncm 2-1:1.0 usb0: register 'cdc_ncm' at usb-dummy_hcd.1-1, CDC NCM (NO ZLP), 42:42:42:42:42:42 [ 32.545326][ T408] device_add+0x398/0xec0 [ 32.734230][ T408] device_create+0x26c/0x300 [ 32.738849][ T408] ? __cfi_device_create+0x10/0x10 [ 32.744021][ T408] create_function_device+0x60/0x70 [ 32.749257][ T408] f_midi_alloc_inst+0x1a8/0x380 [ 32.754255][ T408] usb_get_function_instance+0xf3/0x310 [ 32.759832][ T408] function_make+0x118/0x360 [ 32.764454][ T408] ? __cfi_function_make+0x10/0x10 [ 32.769599][ T408] ? __cfi_mutex_lock+0x10/0x10 [ 32.774517][ T408] ? __kasan_kmalloc+0x95/0xb0 [ 32.779314][ T408] ? configfs_mkdir+0x444/0x9e0 [ 32.784210][ T408] ? __kmalloc+0xb4/0x1e0 [ 32.788572][ T408] ? __kasan_check_write+0x14/0x20 [ 32.793735][ T408] configfs_mkdir+0x518/0x9e0 [ 32.798430][ T408] vfs_mkdir+0x39c/0x580 [ 32.802724][ T408] do_mkdirat+0x174/0x4d0 [ 32.807071][ T408] __x64_sys_mkdirat+0x89/0xa0 [ 32.811860][ T408] x64_sys_call+0x73d/0x9a0 [ 32.816403][ T408] do_syscall_64+0x4c/0xa0 [ 32.820837][ T408] ? clear_bhb_loop+0x30/0x80 [ 32.825545][ T408] ? clear_bhb_loop+0x30/0x80 [ 32.830239][ T408] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 32.836178][ T408] RIP: 0033:0x7f3ea7f9e0d9 [ 32.840620][ T408] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 32.860268][ T408] RSP: 002b:00007f3ea8e91028 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 [ 32.868753][ T408] RAX: ffffffffffffffda RBX: 00007f3ea8225fa0 RCX: 00007f3ea7f9e0d9 [ 32.876758][ T408] RDX: 00000000000001ff RSI: 00002000000003c0 RDI: ffffffffffffff9c [ 32.884787][ T408] RBP: 00007f3ea8035024 R08: 0000000000000000 R09: 0000000000000000 [ 32.892804][ T408] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 32.900786][ T408] R13: 00007f3ea8226038 R14: 00007f3ea8225fa0 R15: 00007ffe63ecc688 [ 32.908806][ T408] [ 32.911833][ T408] ---[ end trace 0000000000000000 ]--- [ 32.917483][ T408] kobject_add_internal failed for f_midi (error: -2 parent: ) [ 33.110802][ T295] usb 3-1: USB disconnect, device number 4 [ 33.193924][ T40] usb 2-1: USB disconnect, device number 5 [ 33.200020][ T40] cdc_ncm 2-1:1.0 usb0: unregister 'cdc_ncm' usb-dummy_hcd.1-1, CDC NCM (NO ZLP)