last executing test programs: 4.962348008s ago: executing program 0 (id=116): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) move_mount(0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffff9c, 0x0, 0x64) 4.401094582s ago: executing program 0 (id=118): r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f00000014c0)={0x2, 0x0, &(0x7f0000000140)={&(0x7f0000000400)={0x2, 0x18, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0x0, @multicast1}}, @sadb_address={0x3, 0x6, 0x0, 0x0, 0x0, @in={0x2, 0x0, @broadcast}}]}, 0x40}}, 0x22000800) 4.400936902s ago: executing program 0 (id=119): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$TUNSETSNDBUF(r0, 0x400454d4, &(0x7f0000000180)=0xffffffff) 4.217351956s ago: executing program 0 (id=120): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ed) mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget\x00', 0x1ed) mkdirat(0xffffffffffffff9c, 0x0, 0x1ed) close(0xffffffffffffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ed) r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) write(r0, &(0x7f0000000300)='0\x00', 0x1) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/functions/uac2.usb0/p_chmask\x00', 0x1, 0x0) write(r1, &(0x7f0000000380)='3', 0x1) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/usb_gadget/g1/functions/uac2.usb0/p_mute_present\x00', 0x1, 0x0) write(r2, &(0x7f0000000400)='1\x00', 0x1) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/functions/uac2.usb0/p_volume_present\x00', 0x1, 0x0) write(r3, 0x0, 0x0) close(r3) symlinkat(&(0x7f0000000500)='./config/usb_gadget/g1/functions/uac2.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000540)='./config/usb_gadget/g1/configs/c.1/uac2.usb0\x00') openat(0xffffffffffffff9c, &(0x7f0000000580)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) 4.217193496s ago: executing program 0 (id=121): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$devlink(&(0x7f0000000380), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_SB_PORT_POOL_SET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000500)={0x54, r1, 0x931, 0x70bd27, 0x25dfdbfd, {}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x1}}, {0x8, 0xb, 0x2}, {0x6, 0x11, 0xa7}, {0x8}}]}, 0x54}, 0x1, 0x0, 0x0, 0x4000000}, 0x4800) 4.217130736s ago: executing program 0 (id=122): syz_usb_connect(0x5, 0x4e, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040cd06350100010000000109023c0001010080320904"], 0x0) mkdir(&(0x7f0000000100)='mnt\x00', 0x1ff) mount(0x0, &(0x7f0000000300)='mnt\x00', &(0x7f0000000400)='devtmpfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000040)='mnt/ttyUSB0\x00', 0x24c03, 0x208) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$BATADV_CMD_TP_METER(r0, &(0x7f00000006c0)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x10000000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x40080) socket$nl_route(0x10, 0x3, 0x0) ioctl$XFS_IOC_FD_TO_HANDLE(0xffffffffffffffff, 0xc038586a, 0x0) 3.289295799s ago: executing program 2 (id=129): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./tracing\x00', &(0x7f0000000080)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./tracing/per_cpu/cpu0/trace_pipe_raw\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f0000000840)={0x2020}, 0x2020) 3.106014414s ago: executing program 3 (id=133): r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040d118af1e0000010203010902270001010080fa0904000003ffffff000705810200020007058202000200070503"], 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000700)={0x1c, &(0x7f0000000a40)=ANY=[@ANYBLOB="2a0a0205000000f3f4f7"], 0x0, 0x0}) socket$nl_route(0x10, 0x3, 0x0) 2.514788108s ago: executing program 1 (id=139): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x1c1842, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x4801}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x42, 0x0) close(r1) socket$inet(0x2, 0x3, 0x1) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000000)={'syzkaller0\x00', @broadcast}) write$cgroup_devices(r0, &(0x7f0000000200)=ANY=[@ANYBLOB="1b23000d"], 0xffdd) 2.44457128s ago: executing program 2 (id=140): r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_rx_ring(r0, 0x107, 0x5, &(0x7f0000000040)=@req3={0x1000, 0x3a, 0x9, 0x3a, 0x0, 0xe9, 0x1}, 0x1c) 2.378911941s ago: executing program 1 (id=141): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xe, 0x8031, 0xffffffffffffffff, 0x3000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) open(&(0x7f0000000200)='./file1\x00', 0x84a07e, 0x48) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file2\x00', 0x207) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f00000000c0)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file2'}}], [], 0x2c}) setxattr$security_capability(&(0x7f0000000140)='./file0/file1\x00', &(0x7f0000000040), 0x0, 0x0, 0x2) 2.378734521s ago: executing program 2 (id=142): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x10) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r2, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r1, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[@rights={{0x10}}, @rights={{0x10}}, @rights={{0x10}}, @rights={{0x10}}], 0x40}, 0x80) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) socketpair$unix(0x1, 0x0, 0x0, 0x0) socket$inet(0x2, 0x2, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) r8 = dup(r7) syz_ublk_setup_queues(r8, r6, &(0x7f0000000880)={0x0, 0xfffffffe, 0x0, 0x4, 0x1f4}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x800, 0x1000002, 0x6}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c87, 0x8000, 0x3, 0xbaa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x8684, 0x2, 0x40040001, 0x334, 0x0, r0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xec4b, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) 1.556899722s ago: executing program 1 (id=143): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x400, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_SET_GSI_ROUTING(r1, 0x4008ae6a, &(0x7f0000000100)={0x0, 0x1f}) 1.554582012s ago: executing program 2 (id=144): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)) pipe(0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008e}, 0x0) getpgrp(0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x6) r0 = syz_clone(0x200c8100, 0x0, 0x0, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r0, 0x1, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) socket$vsock_stream(0x28, 0x1, 0x0) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) close_range(r2, 0xffffffffffffffff, 0x0) 1.403454985s ago: executing program 2 (id=145): socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) getpid() prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) recvmsg(r0, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x1) 894.625478ms ago: executing program 2 (id=146): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921000000012201000905810308"], 0x0) syz_usb_disconnect(r0) r1 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120110010000004058040350"], 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_connect$cdc_ncm(0x2, 0x6e, &(0x7f0000000040)={{0x12, 0x1, 0x250, 0x2, 0x0, 0x0, 0x0, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x6, 0x50, 0x40, "", {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5, 0x24, 0x0, 0x7}, {0xd, 0x24, 0xf, 0x1, 0xc9, 0x7151, 0x5, 0x8}, {0x6, 0x24, 0x1a, 0x1, 0x24}}, {{0x9, 0x5, 0x81, 0x3, 0x40, 0x8, 0x87, 0xf3}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x20, 0x6, 0xc, 0x7}}, {{0x9, 0x5, 0x3, 0x2, 0x200, 0x0, 0x6, 0x3}}}}}}}]}}, &(0x7f00000009c0)={0x0, 0x0, 0x5, &(0x7f0000000400)={0x5, 0xf, 0x5}, 0x4, [{0x4, &(0x7f0000000200)=@lang_id={0x4, 0x3, 0x401}}, {0x0, 0x0}, {0x4, &(0x7f0000000280)=@lang_id={0x4, 0x3, 0x201d}}, {0x5, &(0x7f00000003c0)=@string={0x5, 0x3, "dfa734"}}]}) syz_usb_ep_write(r0, 0x81, 0xffffffffffffff6d, &(0x7f0000000100)="019a18370cfb661ba08c228ce6ca19b6a99a071ca34c72c891f8a260fa00000080977dae8d64a30e92cd51117c4a71e26518e804c00058e6c7c0c363027251668bb650d90000000000") 866.595709ms ago: executing program 1 (id=147): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_X86_SET_MSR_FILTER(r1, 0x4188aec6, &(0x7f0000000bc0)={0x1, [{0x0, 0x0, 0x2, 0x0}, {0x1, 0x8, 0x1, &(0x7f0000000440)="ef"}, {0x3, 0x0, 0x8001, 0x0}, {0x2, 0x10, 0x0, &(0x7f0000000000)="c33d"}, {0x3, 0x0, 0xec3, 0x0}, {0x3, 0x0, 0xc18476c, 0x0}, {0x2, 0x0, 0x9, 0x0}, {0x1, 0x0, 0x5, 0x0}, {0x3, 0x0, 0x1, 0x0}, {0x3, 0xfffffffffffffcae, 0x0, 0x0}, {0x2, 0x0, 0x5, 0x0}, {0x1, 0x0, 0x1, 0x0}, {0x3, 0x0, 0x0, 0x0}, {0x2, 0x0, 0x5, 0x0}, {0x2, 0x0, 0x7ffe, 0x0}, {0x1, 0x0, 0x804, 0x0}]}) 774.184081ms ago: executing program 1 (id=148): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x4000000) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWRULE={0x60, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x34, 0x4, 0x0, 0x1, [{0x30, 0x1, 0x0, 0x1, @dynset={{0xb}, @val={0x20, 0x2, 0x0, 0x1, [@NFTA_DYNSET_SREG_KEY={0x8, 0x4, 0x1, 0x0, 0xf}, @NFTA_DYNSET_OP={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_DYNSET_SET_NAME={0x9, 0x1, 'syz1\x00'}]}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x88}, 0x1, 0x0, 0x0, 0x4000850}, 0x20040040) 774.029031ms ago: executing program 1 (id=149): syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12011001000000401e09030001000102000109022700010100c0320904"], 0x0) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) 122.612017ms ago: executing program 3 (id=150): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), r0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000002900)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_BSS(r0, &(0x7f0000002a00)={0x0, 0x0, &(0x7f00000029c0)={&(0x7f0000002940)={0x24, r1, 0xbb34a96d50fa80b5, 0x70bd26, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_BSS_SHORT_SLOT_TIME={0x5, 0x1e, 0xff}]}, 0x24}, 0x1, 0x0, 0x0, 0x40041}, 0x40004) 75.051308ms ago: executing program 3 (id=151): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ed) mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget\x00', 0x1ed) mkdirat(0xffffffffffffff9c, 0x0, 0x1ed) close(0xffffffffffffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ed) r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) write(r0, &(0x7f0000000300)='0\x00', 0x1) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/functions/uac2.usb0/p_chmask\x00', 0x1, 0x0) write(r1, &(0x7f0000000380)='3', 0x1) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/usb_gadget/g1/functions/uac2.usb0/p_mute_present\x00', 0x1, 0x0) write(r2, &(0x7f0000000400)='1\x00', 0x1) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/functions/uac2.usb0/p_volume_present\x00', 0x1, 0x0) write(r3, 0x0, 0x0) close(r3) symlinkat(&(0x7f0000000500)='./config/usb_gadget/g1/functions/uac2.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000540)='./config/usb_gadget/g1/configs/c.1/uac2.usb0\x00') openat(0xffffffffffffff9c, &(0x7f0000000580)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) 61.160619ms ago: executing program 3 (id=152): r0 = userfaultfd(0x80001) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) ioctl$UFFDIO_REGISTER(r0, 0xc020aa04, &(0x7f0000000000)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x3, 0x2}) 164.37µs ago: executing program 3 (id=153): r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x10) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = dup(r2) syz_ublk_setup_queues(r3, r1, &(0x7f0000000880)={0x0, 0xfffffffe, 0x0, 0x4, 0x1f4}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x800, 0x1000002, 0x6}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c87, 0x8000, 0x3, 0xbaa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x8684, 0x2, 0x40040001, 0x334, 0x0, r0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xec4b, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) 0s ago: executing program 3 (id=154): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x1c1842, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x4801}) select(0x40, &(0x7f0000000080)={0x8, 0x62dc, 0x5, 0x0, 0x800, 0x8000000000000000, 0x6, 0x1ff}, 0x0, 0x0, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x42, 0x0) close(r1) socket$inet(0x2, 0x3, 0x1) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000000)={'syzkaller0\x00', @broadcast}) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.118' (ED25519) to the list of known hosts. [ 29.558794][ T36] audit: type=1400 audit(1787033826.750:64): avc: denied { mounton } for pid=288 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 29.562228][ T288] cgroup: Unknown subsys name 'net' [ 29.581488][ T36] audit: type=1400 audit(1787033826.750:65): avc: denied { mount } for pid=288 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 29.608870][ T36] audit: type=1400 audit(1787033826.780:66): avc: denied { unmount } for pid=288 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 29.609318][ T288] cgroup: Unknown subsys name 'devices' [ 29.718169][ T288] cgroup: Unknown subsys name 'hugetlb' [ 29.723819][ T288] cgroup: Unknown subsys name 'rlimit' [ 29.819561][ T36] audit: type=1400 audit(1787033827.010:67): avc: denied { setattr } for pid=288 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 29.842822][ T36] audit: type=1400 audit(1787033827.010:68): avc: denied { mounton } for pid=288 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 29.867602][ T36] audit: type=1400 audit(1787033827.010:69): avc: denied { mount } for pid=288 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 29.934667][ T290] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 29.943613][ T36] audit: type=1400 audit(1787033827.130:70): avc: denied { relabelto } for pid=290 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" Setting up swapspace version 1, size = 127995904 bytes [ 29.969158][ T36] audit: type=1400 audit(1787033827.130:71): avc: denied { write } for pid=290 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 30.009824][ T36] audit: type=1400 audit(1787033827.200:72): avc: denied { read } for pid=288 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 30.035461][ T36] audit: type=1400 audit(1787033827.200:73): avc: denied { open } for pid=288 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 30.036227][ T288] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 30.898787][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.905978][ T295] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.913192][ T295] bridge_slave_0: entered allmulticast mode [ 30.920308][ T295] bridge_slave_0: entered promiscuous mode [ 30.927199][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.934251][ T295] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.942324][ T295] bridge_slave_1: entered allmulticast mode [ 30.949306][ T295] bridge_slave_1: entered promiscuous mode [ 31.086027][ T299] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.093128][ T299] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.100432][ T299] bridge_slave_0: entered allmulticast mode [ 31.106771][ T299] bridge_slave_0: entered promiscuous mode [ 31.127371][ T301] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.134444][ T301] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.141575][ T301] bridge_slave_0: entered allmulticast mode [ 31.147944][ T301] bridge_slave_0: entered promiscuous mode [ 31.154158][ T299] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.161523][ T299] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.168686][ T299] bridge_slave_1: entered allmulticast mode [ 31.175150][ T299] bridge_slave_1: entered promiscuous mode [ 31.183080][ T301] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.190410][ T301] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.197630][ T301] bridge_slave_1: entered allmulticast mode [ 31.203896][ T301] bridge_slave_1: entered promiscuous mode [ 31.247140][ T300] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.254317][ T300] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.261438][ T300] bridge_slave_0: entered allmulticast mode [ 31.267764][ T300] bridge_slave_0: entered promiscuous mode [ 31.274342][ T300] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.281436][ T300] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.288547][ T300] bridge_slave_1: entered allmulticast mode [ 31.294856][ T300] bridge_slave_1: entered promiscuous mode [ 31.335668][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.342832][ T295] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.350226][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.357283][ T295] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.449240][ T301] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.456428][ T301] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.463753][ T301] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.470853][ T301] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.485866][ T300] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.492954][ T300] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.500284][ T300] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.507396][ T300] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.531106][ T129] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.538520][ T129] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.546933][ T129] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.554184][ T129] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.561538][ T129] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.569646][ T129] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.589999][ T129] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.597075][ T129] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.604691][ T129] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.611771][ T129] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.644124][ T129] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.651218][ T129] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.664420][ T129] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.671520][ T129] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.685285][ T129] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.692355][ T129] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.708941][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.716053][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.727552][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.734612][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.750454][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.757569][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.798821][ T295] veth0_vlan: entered promiscuous mode [ 31.804983][ T300] veth0_vlan: entered promiscuous mode [ 31.836370][ T295] veth1_macvtap: entered promiscuous mode [ 31.844558][ T300] veth1_macvtap: entered promiscuous mode [ 31.852297][ T299] veth0_vlan: entered promiscuous mode [ 31.867757][ T301] veth0_vlan: entered promiscuous mode [ 31.880214][ T299] veth1_macvtap: entered promiscuous mode [ 31.896740][ T301] veth1_macvtap: entered promiscuous mode [ 31.940840][ T300] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 31.993901][ T316] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 32.035360][ T320] synth uevent: /bus/acpi: unknown uevent action string [ 32.152857][ T327] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 32.386260][ T348] synth uevent: /bus/acpi: unknown uevent action string [ 32.535428][ T45] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 32.615347][ T65] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 32.695319][ T45] usb 1-1: Using ep0 maxpacket: 16 [ 32.701980][ T45] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 32.713478][ T45] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 32.724549][ T45] usb 1-1: New USB device found, idVendor=041e, idProduct=3100, bcdDevice= 0.00 [ 32.734270][ T45] usb 1-1: New USB device strings: Mfr=34, Product=0, SerialNumber=0 [ 32.742656][ T45] usb 1-1: Manufacturer: syz [ 32.749522][ T45] usb 1-1: config 0 descriptor?? [ 32.765751][ T65] usb 3-1: Using ep0 maxpacket: 16 [ 32.772091][ T65] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 32.796857][ T65] usb 3-1: New USB device found, idVendor=0b95, idProduct=772a, bcdDevice=82.73 [ 32.815313][ T65] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 32.823375][ T65] usb 3-1: Product: syz [ 32.835307][ T65] usb 3-1: Manufacturer: syz [ 32.839996][ T65] usb 3-1: SerialNumber: syz [ 32.855576][ T65] usb 3-1: config 0 descriptor?? [ 32.865969][ T65] asix 3-1:0.0: probe with driver asix failed with error -22 [ 33.064454][ T312] usb 3-1: USB disconnect, device number 2 [ 33.167683][ T45] hid-generic 0003:041E:3100.0001: hidraw0: USB HID v0.00 Device [syz] on usb-dummy_hcd.0-1/input0 [ 33.250680][ T359] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 33.366730][ T65] usb 1-1: USB disconnect, device number 2 [ 33.614683][ T364] netlink: 'syz.2.18': attribute type 12 has an invalid length. [ 34.472719][ T394] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 34.472831][ T394] rust_binder: Read failure Err(EFAULT) in pid:15 [ 34.712110][ T394] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 34.725300][ T394] rust_binder: Read failure Err(EFAULT) in pid:15 [ 34.734487][ T394] rust_binder: 393:394 error while translating object: EBADF [ 34.748516][ T36] kauditd_printk_skb: 65 callbacks suppressed [ 34.748535][ T36] audit: type=1400 audit(1787033831.920:139): avc: denied { call } for pid=393 comm="syz.0.31" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 34.795505][ T394] rust_binder: Failure in copy_transaction_data: EBADF [ 34.795564][ T394] rust_binder: 393:394 transaction call to 393:0 failed EBADF, code 0 size 112-24 [ 34.836833][ T9] rust_binder: 393: undelivered TRANSACTION_ERROR: 29201 [ 34.927012][ T36] audit: type=1400 audit(2000000000.120:140): avc: denied { create } for pid=406 comm="syz.2.37" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 35.363193][ T36] audit: type=1400 audit(2000000000.550:141): avc: denied { create } for pid=416 comm="syz.0.40" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 35.384117][ T36] audit: type=1400 audit(2000000000.570:142): avc: denied { write } for pid=416 comm="syz.0.40" name="event2" dev="devtmpfs" ino=208 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 35.407340][ T36] audit: type=1400 audit(2000000000.570:143): avc: denied { open } for pid=416 comm="syz.0.40" path="/dev/input/event2" dev="devtmpfs" ino=208 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 35.485722][ T36] audit: type=1400 audit(2000000000.680:144): avc: denied { ioctl } for pid=420 comm="syz.0.42" path="socket:[4480]" dev="sockfs" ino=4480 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 35.527711][ T36] audit: type=1400 audit(2000000000.720:145): avc: denied { create } for pid=422 comm="syz.0.43" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 35.548939][ T36] audit: type=1400 audit(2000000000.740:146): avc: denied { getopt } for pid=422 comm="syz.0.43" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 35.768775][ T36] audit: type=1400 audit(2000000000.960:147): avc: denied { write } for pid=433 comm="syz.3.49" name="c_mute_present" dev="configfs" ino=4050 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=file permissive=1 [ 35.804556][ T36] audit: type=1400 audit(2000000000.960:148): avc: denied { open } for pid=433 comm="syz.3.49" path="/13/config/usb_gadget/g1/functions/uac2.usb0/c_mute_present" dev="configfs" ino=4050 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=file permissive=1 [ 36.425213][ T31] usb 4-1: new low-speed USB device number 2 using dummy_hcd [ 36.697129][ T31] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 36.715348][ T31] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 36.730694][ T31] usb 4-1: New USB device found, idVendor=0c70, idProduct=f0b6, bcdDevice= 0.00 [ 36.740380][ T31] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 36.754404][ T31] usb 4-1: config 0 descriptor?? [ 37.249455][ T31] hid-generic 0003:0C70:F0B6.0002: unknown main item tag 0x0 [ 37.257139][ T31] hid-generic 0003:0C70:F0B6.0002: unknown main item tag 0x0 [ 37.264604][ T31] hid-generic 0003:0C70:F0B6.0002: unknown main item tag 0x1 [ 37.272543][ T31] hid-generic 0003:0C70:F0B6.0002: unknown main item tag 0x0 [ 37.280162][ T31] hid-generic 0003:0C70:F0B6.0002: unknown main item tag 0x0 [ 37.288158][ T31] hid-generic 0003:0C70:F0B6.0002: item fetching failed at offset 6/7 [ 37.892327][ T484] overlayfs: upper fs does not support RENAME_WHITEOUT. [ 37.900285][ T484] overlayfs: failed to set xattr on upper [ 37.906265][ T484] overlayfs: ...falling back to redirect_dir=nofollow. [ 37.913458][ T484] overlayfs: ...falling back to uuid=null. [ 38.027299][ T31] hid-generic 0003:0C70:F0B6.0002: probe with driver hid-generic failed with error -22 [ 38.038524][ T31] usb 4-1: USB disconnect, device number 2 [ 38.045347][ T9] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 38.505081][ T9] usb 3-1: Using ep0 maxpacket: 16 [ 38.516187][ T9] usb 3-1: unable to get BOS descriptor or descriptor too short [ 38.524766][ T9] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 38.539813][ T9] usb 3-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 38.550825][ T9] usb 3-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 38.563299][ T9] usb 3-1: New USB device found, idVendor=103d, idProduct=0100, bcdDevice= 0.40 [ 38.575062][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 38.583084][ T9] usb 3-1: Product: syz [ 38.595403][ T9] usb 3-1: Manufacturer: syz [ 38.600058][ T9] usb 3-1: SerialNumber: syz [ 38.808714][ T9] usb 3-1: Audio class v2/v3 interfaces need an interface association [ 38.825160][ T9] snd-usb-audio 3-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 39.166431][ T519] netlink: 4 bytes leftover after parsing attributes in process `syz.1.83'. [ 39.216987][ T9] usb 3-1: USB disconnect, device number 3 [ 39.250598][ T324] udevd[324]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.1/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 39.775149][ T312] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 39.815056][ T31] usb 4-1: new full-speed USB device number 3 using dummy_hcd [ 39.830584][ T544] file system registered [ 39.926333][ T36] kauditd_printk_skb: 33 callbacks suppressed [ 39.926426][ T36] audit: type=1400 audit(2000000005.120:182): avc: denied { create } for pid=545 comm="syz.2.95" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 39.965088][ T312] usb 2-1: Using ep0 maxpacket: 16 [ 39.971572][ T36] audit: type=1400 audit(2000000005.150:183): avc: denied { setopt } for pid=545 comm="syz.2.95" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 39.991078][ T312] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 40.014933][ T31] usb 4-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 40.027685][ T312] usb 2-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 40.040417][ T31] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 40.054332][ T312] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 40.065914][ T31] usb 4-1: config 0 descriptor?? [ 40.082243][ T312] usb 2-1: config 0 descriptor?? [ 40.093911][ T36] audit: type=1400 audit(2000000005.280:184): avc: denied { mount } for pid=547 comm="syz.2.96" name="/" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=filesystem permissive=1 [ 40.181453][ T36] audit: type=1400 audit(2000000005.370:185): avc: denied { unmount } for pid=300 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=filesystem permissive=1 [ 40.538788][ T312] hid-generic 0003:04D8:00DD.0003: hidraw0: USB HID v0.05 Device [HID 04d8:00dd] on usb-dummy_hcd.1-1/input0 [ 40.584629][ T36] audit: type=1400 audit(2000000005.770:186): avc: denied { bind } for pid=562 comm="syz.0.102" lport=4 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 40.604763][ T36] audit: type=1400 audit(2000000005.770:187): avc: denied { name_bind } for pid=562 comm="syz.0.102" src=3618 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=rawip_socket permissive=1 [ 40.637478][ T36] audit: type=1400 audit(2000000005.770:188): avc: denied { node_bind } for pid=562 comm="syz.0.102" src=3618 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=rawip_socket permissive=1 [ 40.940827][ T9] usb 2-1: USB disconnect, device number 2 [ 41.929328][ T573] Zero length message leads to an empty skb [ 42.128024][ T36] audit: type=1400 audit(2000000007.120:189): avc: denied { create } for pid=569 comm="syz.2.105" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 42.148207][ T36] audit: type=1400 audit(2000000007.120:190): avc: denied { write } for pid=569 comm="syz.2.105" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 42.169408][ T36] audit: type=1400 audit(2000000007.120:191): avc: denied { nlmsg_write } for pid=569 comm="syz.2.105" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 42.561963][ T578] configfs-gadget.g1 gadget.0: uvc: uvc_function_bind() [ 42.623387][ T578] configfs-gadget.g1 gadget.0: uvc: Unable to allocate streaming EP [ 42.691058][ T578] udc dummy_udc.0: failed to start g1: -22 [ 42.709479][ T65] usb 4-1: USB disconnect, device number 3 [ 42.758650][ T578] configfs-gadget.g1 gadget.0: probe with driver configfs-gadget.g1 failed with error -22 [ 42.851259][ T578] UDC core: g1: couldn't find an available UDC or it's busy [ 43.944874][ T312] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 44.316171][ T312] usb 3-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 44.331641][ T312] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 44.344445][ T312] usb 3-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 44.353762][ T312] usb 3-1: config 1 has no interface number 1 [ 44.360066][ T312] usb 3-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 44.374230][ T312] usb 3-1: config 1 interface 2 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 44.389059][ T312] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 44.398399][ T312] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 44.414751][ T312] usb 3-1: Product: syz [ 44.423132][ T312] usb 3-1: Manufacturer: syz [ 44.432962][ T312] usb 3-1: SerialNumber: syz [ 44.493532][ T65] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 44.644751][ T65] usb 4-1: Using ep0 maxpacket: 16 [ 44.651166][ T65] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 44.655111][ T312] usb 3-1: MIDIStreaming interface descriptor not found [ 44.663025][ T65] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 44.678713][ T312] usb 3-1: USB disconnect, device number 4 [ 44.688038][ T65] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 44.698731][ T65] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 44.706928][ T65] usb 4-1: Product: syz [ 44.711196][ T65] usb 4-1: Manufacturer: syz [ 44.716132][ T65] usb 4-1: SerialNumber: syz [ 44.926938][ T65] usb 4-1: 0:2 : does not exist [ 44.931922][ T65] usb 4-1: unit 9 not found! [ 44.939838][ T65] usb 4-1: USB disconnect, device number 4 [ 45.124769][ T312] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 45.167954][ T36] kauditd_printk_skb: 8 callbacks suppressed [ 45.167972][ T36] audit: type=1400 audit(2000000010.360:200): avc: denied { write } for pid=621 comm="syz.2.124" name="001" dev="devtmpfs" ino=92 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 45.197414][ T622] dummy_hcd dummy_hcd.0: remove, state 1 [ 45.203096][ T622] usb usb1: USB disconnect, device number 1 [ 45.210847][ T622] dummy_hcd dummy_hcd.0: stopped [ 45.215861][ T622] dummy_hcd dummy_hcd.0: USB bus 1 deregistered [ 45.224441][ T36] audit: type=1400 audit(2000000010.410:201): avc: denied { read } for pid=621 comm="syz.2.124" name="vga_arbiter" dev="devtmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1 [ 45.263869][ T36] audit: type=1400 audit(2000000010.450:202): avc: denied { unmount } for pid=300 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 45.274886][ T312] usb 2-1: Using ep0 maxpacket: 32 [ 45.289999][ T312] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 45.300213][ T312] usb 2-1: config 1 interface 0 altsetting 8 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 45.308154][ T36] audit: type=1400 audit(2000000010.500:203): avc: denied { mount } for pid=625 comm="syz.2.126" name="/" dev="devtmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 45.313168][ T312] usb 2-1: config 1 interface 0 has no altsetting 0 [ 45.344431][ T312] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 45.351824][ T36] audit: type=1400 audit(2000000010.530:204): avc: denied { unmount } for pid=300 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 45.354000][ T312] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 45.381422][ T312] usb 2-1: Product: syz [ 45.385646][ T312] usb 2-1: Manufacturer: syz [ 45.390279][ T312] usb 2-1: SerialNumber: syz [ 45.426377][ T36] audit: type=1400 audit(2000000010.620:205): avc: denied { mount } for pid=631 comm="syz.2.129" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 45.448453][ T36] audit: type=1400 audit(2000000010.620:206): avc: denied { search } for pid=631 comm="syz.2.129" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 45.470501][ T36] audit: type=1400 audit(2000000010.620:207): avc: denied { read } for pid=631 comm="syz.2.129" name="trace_pipe_raw" dev="tracefs" ino=55 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=file permissive=1 [ 45.493474][ T36] audit: type=1400 audit(2000000010.620:208): avc: denied { open } for pid=631 comm="syz.2.129" path="/33/tracing/per_cpu/cpu0/trace_pipe_raw" dev="tracefs" ino=55 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=file permissive=1 [ 45.518465][ T36] audit: type=1400 audit(2000000010.670:209): avc: denied { getopt } for pid=633 comm="syz.3.130" lport=58 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 45.602154][ T312] cdc_ether 2-1:1.0: probe with driver cdc_ether failed with error -22 [ 45.612431][ T312] usb 2-1: USB disconnect, device number 3 [ 45.804727][ T349] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 45.955887][ T349] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 45.967127][ T349] usb 4-1: New USB device found, idVendor=18d1, idProduct=1eaf, bcdDevice= 0.00 [ 45.976249][ T349] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 45.984266][ T349] usb 4-1: Product: syz [ 45.988478][ T349] usb 4-1: Manufacturer: syz [ 45.993117][ T349] usb 4-1: SerialNumber: syz [ 46.119204][ T642] tmpfs: Unknown parameter 'quota' [ 46.154120][ T646] 9pnet_fd: p9_fd_create_tcp (646): problem binding to privport [ 46.203369][ T652] syzkaller0: entered promiscuous mode [ 46.209022][ T652] syzkaller0: entered allmulticast mode [ 46.215689][ T652] PF_CAN: dropped non conform CAN FD skbuff: dev type 65534, len 65487 [ 48.154574][ T349] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 48.184589][ T312] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 48.305746][ T349] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 48.317142][ T349] usb 2-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice= 0.01 [ 48.326292][ T349] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 48.334313][ T349] usb 2-1: Product: syz [ 48.338603][ T349] usb 2-1: Manufacturer: syz [ 48.344215][ T312] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 48.355517][ T312] usb 3-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 48.364702][ T312] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 48.375065][ T312] usb 3-1: config 0 descriptor?? [ 48.575916][ T31] usb 2-1: USB disconnect, device number 4 [ 48.591213][ T312] usbhid 3-1:0.0: can't add hid device: -71 [ 48.599021][ T312] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 48.610813][ T312] usb 3-1: USB disconnect, device number 5 [ 48.628271][ T9] usb 4-1: USB disconnect, device number 5 [ 48.728680][ T691] syzkaller0: entered promiscuous mode [ 48.734283][ T691] syzkaller0: entered allmulticast mode [ 48.742961][ T672] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN PTI [ 48.755581][ T672] KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] [ 48.764032][ T672] CPU: 0 UID: 0 PID: 672 Comm: syz.0.122 Not tainted syzkaller #0 e678fb639bf2314ecbc0d819b692701f82417ebd [ 48.775427][ T672] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 48.785512][ T672] RIP: 0010:dummy_udc_stop+0x82/0x330 [ 48.790946][ T672] Code: 4d 8d bc c7 d0 04 00 00 4c 89 f8 48 c1 e8 03 80 3c 18 00 49 89 de 74 08 4c 89 ff e8 88 aa 26 fe 49 8b 1f 48 89 d8 48 c1 e8 03 <42> 80 3c 30 00 74 08 48 89 df e8 6f aa 26 fe 48 8b 1b 48 89 df e8 [ 48.810580][ T672] RSP: 0018:ffffc9000d46f7c0 EFLAGS: 00010246 [ 48.816669][ T672] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ 48.824642][ T672] RDX: ffff88811d169300 RSI: 0000000000000003 RDI: 0000000000000005 [ 48.832661][ T672] RBP: ffffc9000d46f818 R08: ffffc9000d46f7a7 R09: 1ffff92001a8def4 [ 48.840664][ T672] R10: 0000000000000000 R11: ffffffff83b98b30 R12: ffff888103ff8c90 [ 48.848662][ T672] R13: 1ffff110209e8f01 R14: dffffc0000000000 R15: ffff888103ff9160 [ 48.856672][ T672] FS: 0000000000000000(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 48.865615][ T672] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 48.872205][ T672] CR2: 00007fc548073d58 CR3: 000000012c65e000 CR4: 00000000003526b0 [ 48.880208][ T672] Call Trace: [ 48.883523][ T672] [ 48.886461][ T672] gadget_unbind_driver+0x29b/0x3f0 [ 48.891688][ T672] ? __cfi_gadget_unbind_driver+0x10/0x10 [ 48.897411][ T672] device_release_driver_internal+0x4ad/0x830 [ 48.903512][ T672] driver_detach+0x1f5/0x2d0 [ 48.908133][ T672] bus_remove_driver+0x254/0x2b0 [ 48.913076][ T672] driver_unregister+0x79/0xb0 [ 48.917844][ T672] usb_gadget_unregister_driver+0x52/0x80 [ 48.923572][ T672] raw_release+0xdb/0x280 [ 48.927912][ T672] ? __cfi_raw_release+0x10/0x10 [ 48.932887][ T672] __fput+0x208/0xa30 [ 48.936896][ T672] ____fput+0x20/0x30 [ 48.940910][ T672] task_work_run+0x1e8/0x260 [ 48.945514][ T672] ? __cfi_task_work_run+0x10/0x10 [ 48.950634][ T672] ? __kasan_check_write+0x18/0x20 [ 48.955773][ T672] do_exit+0xa46/0x2850 [ 48.959975][ T672] ? futex_wake+0x666/0x950 [ 48.964489][ T672] ? futex_setup_timer+0xb4/0xd0 [ 48.969447][ T672] ? __cfi_do_exit+0x10/0x10 [ 48.974044][ T672] ? futex_wait+0x2b8/0x7c0 [ 48.978560][ T672] ? __cfi_futex_wait+0x10/0x10 [ 48.983439][ T672] ? __kasan_check_write+0x18/0x20 [ 48.988572][ T672] ? _raw_spin_lock_irq+0x93/0x120 [ 48.993697][ T672] do_group_exit+0x21f/0x2f0 [ 48.998300][ T672] ? __kasan_check_write+0x18/0x20 [ 49.003440][ T672] ? recalc_sigpending+0x184/0x1d0 [ 49.008818][ T672] get_signal+0x134c/0x1490 [ 49.013337][ T672] arch_do_signal_or_restart+0xbc/0x700 [ 49.018889][ T672] ? __cfi_arch_do_signal_or_restart+0x10/0x10 [ 49.025061][ T672] ? __kasan_check_write+0x18/0x20 [ 49.030195][ T672] syscall_exit_to_user_mode+0x57/0xb0 [ 49.035681][ T672] do_syscall_64+0x63/0xf0 [ 49.040154][ T672] ? clear_bhb_loop+0x50/0xa0 [ 49.044858][ T672] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 49.050783][ T672] RIP: 0033:0x7f383839e0d9 [ 49.055215][ T672] Code: Unable to access opcode bytes at 0x7f383839e0af. [ 49.062232][ T672] RSP: 002b:00007f383917f0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 49.070653][ T672] RAX: fffffffffffffe00 RBX: 00007f3838626098 RCX: 00007f383839e0d9 [ 49.078658][ T672] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f3838626098 [ 49.086638][ T672] RBP: 00007f3838626090 R08: 0000000000000000 R09: 0000000000000000 [ 49.094636][ T672] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 49.102641][ T672] R13: 00007f3838626128 R14: 00007ffeb68b6c90 R15: 00007ffeb68b6d78 [ 49.110669][ T672] [ 49.113719][ T672] Modules linked in: [ 49.117754][ T672] ---[ end trace 0000000000000000 ]--- [ 49.127531][ T672] RIP: 0010:dummy_udc_stop+0x82/0x330 [ 49.132974][ T672] Code: 4d 8d bc c7 d0 04 00 00 4c 89 f8 48 c1 e8 03 80 3c 18 00 49 89 de 74 08 4c 89 ff e8 88 aa 26 fe 49 8b 1f 48 89 d8 48 c1 e8 03 <42> 80 3c 30 00 74 08 48 89 df e8 6f aa 26 fe 48 8b 1b 48 89 df e8 [ 49.152843][ T672] RSP: 0018:ffffc9000d46f7c0 EFLAGS: 00010246 [ 49.159129][ T672] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ 49.167561][ T672] RDX: ffff88811d169300 RSI: 0000000000000003 RDI: 0000000000000005 [ 49.174616][ T312] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 49.176136][ T672] RBP: ffffc9000d46f818 R08: ffffc9000d46f7a7 R09: 1ffff92001a8def4 [ 49.191229][ T672] R10: 0000000000000000 R11: ffffffff83b98b30 R12: ffff888103ff8c90 [ 49.199304][ T672] R13: 1ffff110209e8f01 R14: dffffc0000000000 R15: ffff888103ff9160 [ 49.207391][ T672] FS: 0000000000000000(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 49.216370][ T672] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 49.222983][ T672] CR2: 00007fb0d7a27dac CR3: 000000010c78e000 CR4: 00000000003526b0 [ 49.231051][ T672] Kernel panic - not syncing: Fatal exception [ 49.237711][ T672] Kernel Offset: disabled [ 49.242059][ T672] Rebooting in 86400 seconds..