last executing test programs: 6.40520657s ago: executing program 2 (id=3): r0 = syz_usb_connect$hid(0x3, 0x36, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x20, 0x1e7d, 0x3232, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x50, 0x0, "", [{{0x9, 0x4, 0x0, 0x5, 0x3, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x9, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x200, 0x0, 0x15, 0x87}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="002218000000050c150825ff0904a1010901a1007508950109308102c0c0"], 0x0}, 0x0) 4.702715743s ago: executing program 2 (id=28): setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x2d, &(0x7f0000000180)=0x3, 0x4) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x1e9100, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = openat$ttynull(0xffffffffffffff9c, &(0x7f0000000040), 0x82084, 0x0) ioctl$TCSETSF2(r4, 0x402c542d, &(0x7f0000000100)={0x6, 0x2, 0x7, 0xb, 0x44, "8c00000000fffa00000000ffff00000400", 0x40fff, 0x4}) ioctl$TIOCSTI(r4, 0x5412, &(0x7f0000000140)=0xff) ioctl$TCFLSH(r4, 0x540b, 0x1) r5 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x2) syz_kvm_setup_cpu$x86(r3, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f00000000c0)=[@text64={0x40, 0x0}], 0x1, 0x54, 0x0, 0x0) r6 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) connect$802154_dgram(r6, &(0x7f0000000300)={0x24, @long={0x3, 0x3}}, 0x14) mkdirat(0xffffffffffffff9c, &(0x7f0000000780)='./proc\x00', 0x1ff) mount(0x0, &(0x7f00000007c0)='./proc\x00', &(0x7f0000000800)='nsfs\x00', 0x0, 0x0) setsockopt$WPAN_SECURITY(r6, 0x0, 0x1, &(0x7f00000002c0), 0x4) r7 = openat(0xffffffffffffff9c, &(0x7f0000000840)='./proc\x00', 0x0, 0x2a) write(r7, &(0x7f0000000880)='3', 0x1) bind$inet6(r1, &(0x7f0000000280)={0xa, 0x4e23, 0x5c, @dev={0xfe, 0x80, '\x00', 0x2e}, 0x9}, 0x1c) getsockname$unix(r7, &(0x7f00000001c0)=@abs, &(0x7f0000000240)=0x6e) 4.627405175s ago: executing program 2 (id=29): r0 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000840)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffe) add_key(&(0x7f00000003c0)='dns_resolver\x00', &(0x7f0000000400)={'syz', 0x3}, &(0x7f0000000080)="00030102", 0xfffff, r0) 4.565128876s ago: executing program 2 (id=30): r0 = syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000000000200304306000000000000109022400010000000009040000010300000009210000000122020009058103"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000340)={0x24, 0x0, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB='\x00\"\v'], 0x0}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f00000003c0)={0x84, &(0x7f0000000480)=ANY=[@ANYBLOB="00140d"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f00000004c0)={0x84, &(0x7f0000000580)=ANY=[@ANYBLOB='\x00\x00M'], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) 3.914085702s ago: executing program 3 (id=31): r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCL_SETSEL(0xffffffffffffffff, 0x541c, &(0x7f0000000040)={0x2, {0x2, 0x103, 0xfe, 0x6, 0x1f0}}) ioctl$TIOCL_SETSEL(r0, 0x541c, &(0x7f00000001c0)={0x2, {0x2, 0x107, 0x500, 0x100, 0x1, 0x4000}}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'bridge0\x00'}) setsockopt$IP_VS_SO_SET_ADD(0xffffffffffffffff, 0x0, 0x482, &(0x7f0000000080)={0x84, @rand_addr=0x64010100, 0x4e21, 0x3, 'wrr\x00', 0x1, 0xa8a, 0x30}, 0x2c) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000280)={0xa, 0x4e22, 0x9, @loopback, 0x6}, 0x1c) connect$inet6(r1, &(0x7f0000000140)={0xa, 0x4e22, 0x56202329, @empty, 0x4000005}, 0x1c) setsockopt$inet6_IPV6_DSTOPTS(r1, 0x29, 0x3b, &(0x7f0000000080)=ANY=[], 0x8) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=@newsa={0x158, 0x10, 0x5, 0x1, 0x0, {{@in6=@loopback, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0xa, 0x80, 0x80, 0x0, 0x0, 0x80}, {@in6=@loopback, 0x1234, 0x33}, @in6=@loopback, {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}, {}, {}, 0x0, 0x0, 0xa, 0x0, 0x0, 0x80}, [@algo_auth={0x48, 0x1, {{'hmac(sha1)\x00'}}}, @replay_esn_val={0x20, 0x17, {0x1, 0x0, 0x0, 0x0, 0x0, 0x20, [0x0]}}]}, 0x158}}, 0x0) sendmsg$nl_xfrm(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000500)=@newpolicy={0xfc, 0x13, 0x5, 0x1, 0x0, {{@in6=@loopback, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0xa, 0x80, 0x80}, {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}, {}, 0x0, 0x0, 0x1}, [@tmpl={0x44, 0x5, [{{@in6=@loopback, 0x1234, 0x33}, 0xa, @in6=@loopback}]}]}, 0xfc}}, 0x0) sendmmsg$inet6(r1, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000680)='A', 0x1}], 0x1}}], 0x1, 0x4000801) 3.841365644s ago: executing program 3 (id=32): mkdirat(0xffffffffffffff9c, &(0x7f0000000640)='./file0\x00', 0x1f7) mount(&(0x7f0000000680)=@filename='mtd0\x00', &(0x7f00000006c0)='./file0\x00', &(0x7f0000000700)='jffs2\x00', 0x800000, 0x0) chdir(&(0x7f0000000740)='./file0\x00') setresuid(0xee00, 0xee00, 0x0) fchmodat(0xffffffffffffff9c, &(0x7f0000000780)='.\x00', 0xfffffffb) 3.789167295s ago: executing program 3 (id=33): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000002780), 0x8000, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000027c0)=0xf) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$TCFLSH(r1, 0x400455c8, 0x0) ioctl$TIOCSTI(r1, 0x5412, &(0x7f0000002800)=0x2) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) ioctl$TIOCSTI(r1, 0x5412, &(0x7f0000002840)=0xd) ioctl$TIOCSTI(r1, 0x5412, &(0x7f0000002880)=0x3) ioctl$TIOCSTI(r1, 0x5412, &(0x7f00000028c0)=0x7) ioctl$TIOCSTI(r1, 0x5412, &(0x7f0000002900)=0x1e) 1.786106386s ago: executing program 3 (id=42): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/class/rnbd-client/ctl/map_device\x00', 0x1, 0x0) write(r0, &(0x7f0000000100)='sessname=s. device_path=/dev/ram0 path=ip:127.0.0.1', 0x33) 1.725083317s ago: executing program 3 (id=43): mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000001c0)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) syz_ublk_setup_io_uring(0x467c, &(0x7f0000000140)={0x0, 0xcfab, 0x8000, 0x0, 0x118}, 0x0, &(0x7f00000002c0), &(0x7f00000003c0)) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) syz_ublk_setup_queues(r2, r0, &(0x7f00000004c0)={0x0, 0x42cc, 0x10, 0x1, 0x80}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe706, 0x1000, 0x3, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3b00, 0x2, 0x4, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x93e9, 0x200, 0x4003bfff, 0x2b8}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5, 0x800, 0x1, 0x230}}], 0x1, 0x0, 0x0) 1.724723457s ago: executing program 3 (id=44): r0 = syz_usb_connect$hid(0x5, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000000000206d044fc200000000000109022400010000000409040008020301030009210000000122180009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000540)={0x24, 0x0, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="0022180000000501150091a60906a101200182008c0508"], 0x0}, 0x0) syz_usb_control_io(r0, &(0x7f0000000280)={0x2c, &(0x7f0000000000)={0x40, 0x8, 0xaa, {0xaa, 0xd, "c592dc416329178204ebded070fd09ff60f258d64d113c40d599309c819afc3e339c5827f0064f3f3fee258a0723078686fbd9424dd8f0a9e22df1431e5b086655261700f40a596c21acb5fc22d93a2304263cb9299dedacb564872bb9f615d849ff781399839c91f0b678de623f2d245cd3aea824e88c15cf74e5608595c2073206ad23a8a94c61bb380f0db21133531ed503af6543b8e00a5852b29091a1e5e1f33c323fce6389"}}, &(0x7f0000000100)={0x0, 0x3, 0x7c, @string={0x7c, 0x3, "755fd8574ff86dcda9eb5911b06fc03411fc504702f0d65214bbcec03547e31b63ff49bb67e32992dfbfb5ee052f50f10792fbc51685339bf99df3c2fd4e1dc091c72916412ca44c23fc9fe228361488b35e5cc84434b503bee2181834f5fdd2129dec561b915676fddc716b44e73e0a0bd302158ef329229600"}}, &(0x7f00000001c0)={0x0, 0xf, 0x35, {0x5, 0xf, 0x35, 0x2, [@ss_container_id={0x14, 0x10, 0x4, 0x4, "80049045286cecf0f09849477173d2bc"}, @ssp_cap={0x1c, 0x10, 0xa, 0xff, 0x4, 0x2, 0xf00f, 0xffff, [0xc000, 0xf, 0x3f00, 0xff3fcf]}]}}, &(0x7f0000000200)={0x20, 0x29, 0xf, {0xf, 0x29, 0x4, 0x10, 0x2, 0x1, "ff0efcfa", "27141afe"}}, &(0x7f0000000240)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x5, 0x1, 0xb, 0x1, 0x5, 0x1ff, 0x9}}}, &(0x7f0000000740)={0x84, &(0x7f00000002c0)=ANY=[@ANYBLOB="01308062c2f11a69153c3ef1673e5a82720d7d232b"], &(0x7f0000000300)={0x0, 0xa, 0x1, 0x6}, &(0x7f0000000340)={0x0, 0x8, 0x1, 0xc}, &(0x7f0000000380)={0x20, 0x0, 0x4, {0x2, 0x7df5faeec0abf08}}, &(0x7f00000003c0)={0x20, 0x0, 0x4, {0x1000, 0x4}}, &(0x7f0000000400)={0x40, 0x7, 0x2, 0xdd}, &(0x7f0000000440)={0x40, 0x9, 0x1}, &(0x7f0000000480)={0x40, 0xb, 0x2, "86c6"}, &(0x7f00000004c0)={0x40, 0xf, 0x2, 0x3}, &(0x7f0000000500)={0x40, 0x13, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}, &(0x7f00000005c0)={0x40, 0x17, 0x6}, &(0x7f0000000600)={0x40, 0x19, 0x2, 'XI'}, &(0x7f0000000640)={0x40, 0x1a, 0x2, 0x1}, &(0x7f0000000680)={0x40, 0x1c, 0x1, 0x7}, &(0x7f00000006c0)={0x40, 0x1e, 0x1, 0x1}, &(0x7f0000000700)={0x40, 0x21, 0x1, 0xd0}}) 1.58252494s ago: executing program 2 (id=45): execveat(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1000) syz_io_uring_setup(0x1fc7, &(0x7f0000000140)={0x0, 0x79b2, 0x3180, 0x1, 0x3b1}, 0x0, 0x0, 0x0) r0 = syz_usb_connect$printer(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000402505a8a4410001020b0109021b00010100c000090400000207010100090501020002"], 0x0) mkdirat(0xffffffffffffffff, &(0x7f00000001c0)='./tracing\x00', 0x29) mount(0x0, &(0x7f0000000200)='./tracing\x00', &(0x7f0000000240)='tracefs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./tracing/trace_clock\x00', 0x1, 0x0) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000000100)={0x34, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000001180)={0x20, 0x0, 0x1}}) r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) pwritev2(r2, &(0x7f00000015c0)=[{&(0x7f0000000080)="ec", 0x1}], 0x1, 0xfffff, 0x0, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0xb, 0x6, 0xff}, 0x40, [0x7ffd, 0xc95a, 0xf, 0x8, 0x80, 0x2, 0x3, 0x10007f, 0x20000006, 0x4d, 0x6, 0x3, 0x9, 0x2, 0xffff2d34, 0xffffff01, 0x6, 0x3, 0xfffffffc, 0x5, 0x4, 0x2, 0x7, 0x3c5b, 0x80000001, 0x24, 0xd, 0x1, 0x0, 0x2, 0xe661, 0x4, 0x7, 0xdf, 0x8, 0x4c74, 0x80000000, 0x0, 0x3, 0xe, 0x8, 0x8000806e, 0x7, 0x200, 0x1, 0x7, 0x200, 0x3e, 0x2, 0x6, 0x6, 0xc, 0x5, 0x4, 0x8, 0x400, 0x83, 0x1, 0x5, 0x6, 0x8, 0x4, 0x3, 0x40], [0x10000009, 0x5, 0x8000012f, 0x8004, 0x1, 0xfffffff3, 0x129432e6, 0x88, 0xf9, 0xe, 0x8, 0x6c7, 0x9, 0xfffffffc, 0x8, 0x0, 0x0, 0x5, 0x2f, 0xe, 0xc, 0x78, 0xea4, 0x0, 0x4, 0x7, 0x7fff, 0x6, 0x400, 0x6, 0x6, 0x1, 0xff, 0x5, 0x1000005, 0x5f34, 0xd, 0x100004e0, 0x2, 0x4, 0xb, 0x8001, 0x9, 0x8, 0x9, 0x3b, 0x47, 0xf469, 0x1, 0xfe000000, 0xffff, 0x2, 0x4, 0x9, 0x3, 0x3, 0x9, 0x1, 0x3, 0xffffffff, 0xbc45, 0x48c93690, 0x43, 0xff], [0x7, 0xa, 0x4, 0x5, 0x7f, 0x100, 0x8d2, 0x9, 0x5, 0x7fff, 0x0, 0x5, 0x9, 0x4, 0x6, 0x5, 0x0, 0x6, 0x8, 0x1, 0x86, 0x3, 0x303c, 0xbe7, 0xb, 0x5, 0x2, 0x2, 0x3, 0x20000008, 0x2, 0x6d03, 0x6, 0x38, 0x800003, 0x200, 0x0, 0x3, 0x4, 0x2950bfaf, 0x1000, 0xa2, 0x9, 0x6, 0x5, 0x6, 0xac8, 0xc2, 0x2, 0x3, 0x7ff, 0x8b, 0xfffffff9, 0x1, 0x1000000a, 0x0, 0x5, 0x1f, 0x120000, 0x3, 0x2006, 0x80a2ed, 0x4, 0x25], [0x80009, 0xbb33, 0x80000000, 0xb, 0xfffffff3, 0x93a, 0x6, 0x1000006, 0xfffffffe, 0xb9, 0xce7, 0x1ff, 0x2, 0x57, 0x4, 0x3, 0x101, 0x10000, 0x4, 0x7fff, 0x10000, 0x7ff, 0x2, 0x5, 0x1, 0x2, 0x14d, 0x60a7, 0x16, 0x96, 0xfffffffe, 0x80000000, 0x5, 0x4, 0xc8, 0x1, 0xfffff000, 0x10080, 0x3, 0x7e, 0x100, 0xcab, 0x7, 0xaf, 0x8, 0x6, 0x226, 0x5, 0x5, 0xf, 0x30b1d693, 0xa1f, 0xf40, 0x7, 0x1, 0x6c1b, 0x2844, 0x4, 0x5, 0xb1e, 0xd7, 0x200, 0xffff3441, 0x1]}, 0x45c) close_range(r1, 0xffffffffffffffff, 0x0) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) 1.042229544s ago: executing program 0 (id=46): socket$pppl2tp(0x18, 0x1, 0x1) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='cmdline\x00') pipe2$9p(&(0x7f00000000c0), 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r2 = openat$kvm(0x0, &(0x7f0000000300), 0x0, 0x0) ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) socket(0x10, 0x803, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r3, &(0x7f0000000500)={0x0, 0x0, 0x0}, 0x4040000) 1.011614125s ago: executing program 1 (id=47): socket$inet_udp(0x2, 0x2, 0x0) ioctl$BLKRRPART(0xffffffffffffffff, 0x125f, 0x0) r0 = openat$kvm(0x0, &(0x7f0000000480), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil) syz_kvm_add_vcpu$x86(r2, &(0x7f00000004c0)={0x0, &(0x7f0000000500)=[@enable_nested={0x12c, 0x18}, @nested_intel_vmwrite_mask={0x154, 0x38, {0xfffffffffffffffd, @control64=0x2012, 0x30002}}], 0x50}) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f00000005c0), 0x1, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r4, 0xae60) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_GET_SUPPORTED_HV_CPUID_cpu(r5, 0xc008aec1, &(0x7f0000000600)={0x26}) 951.408236ms ago: executing program 0 (id=48): mmap$IORING_OFF_SQ_RING(0x0, 0x7, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000400)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000480)=@new_dev={0x4, 0xf39, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x100}}}, &(0x7f00000004c0)) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetlb.1GB.usage_in_bytes\x00', 0x275a, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) recvmmsg$unix(0xffffffffffffffff, &(0x7f0000000240)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4001, 0x0) close_range(r0, 0xffffffffffffffff, 0x4) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x4000, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r1, &(0x7f0000000180)='27', 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) ioctl$RTC_SET_TIME(r2, 0x4024700a, &(0x7f0000000280)={0x2e, 0x1e, 0x4, 0x2, 0x3, 0xa9, 0x5, 0x2, 0x1}) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.net/syz0\x00', 0x1ff) socket$inet6_tcp(0xa, 0x1, 0x0) 539.309527ms ago: executing program 1 (id=49): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) write(0xffffffffffffffff, &(0x7f0000000000)='27', 0x2) mount(0x0, &(0x7f0000000200)='./proc\x00', &(0x7f0000000040)='proc\x00', 0x8000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x44) write(r0, &(0x7f0000000000)='3', 0x4e) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000280)=0x1, 0x4) r2 = fsopen(&(0x7f00000003c0)='proc\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) getsockopt$IP_VS_SO_GET_SERVICES(r0, 0x0, 0x482, &(0x7f00000000c0)=""/33, &(0x7f0000000100)=0x21) 539.164917ms ago: executing program 0 (id=50): setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x2d, &(0x7f0000000180)=0x3, 0x4) socket$inet6_udp(0xa, 0x2, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x1e9100, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = openat$ttynull(0xffffffffffffff9c, &(0x7f0000000040), 0x82084, 0x0) ioctl$TCSETSF2(r3, 0x402c542d, &(0x7f0000000100)={0x6, 0x2, 0x7, 0xb, 0x44, "8c00000000fffa00000000ffff00000400", 0x40fff, 0x4}) ioctl$TIOCSTI(r3, 0x5412, &(0x7f0000000140)=0xff) ioctl$TCFLSH(r3, 0x540b, 0x1) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2) syz_kvm_setup_cpu$x86(r2, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f00000000c0)=[@text64={0x40, 0x0}], 0x1, 0x54, 0x0, 0x0) r5 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) connect$802154_dgram(r5, &(0x7f0000000300)={0x24, @long={0x3, 0x3}}, 0x14) mkdirat(0xffffffffffffff9c, &(0x7f0000000780)='./proc\x00', 0x1ff) mount(0x0, &(0x7f00000007c0)='./proc\x00', &(0x7f0000000800)='nsfs\x00', 0x0, 0x0) setsockopt$WPAN_SECURITY(r5, 0x0, 0x1, &(0x7f00000002c0), 0x4) 538.232987ms ago: executing program 1 (id=51): socket(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$inet(0x2, 0x2, 0x1) r0 = mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = getpid() r3 = syz_pidfd_open(r2, 0x0) setns(r3, 0x24020000) r4 = syz_clone(0xb2b60000, 0x0, 0xfffffffffffffcd1, 0x0, 0x0, 0x0) r5 = syz_pidfd_open(r4, 0x0) setns(r5, 0x24020000) mount$bind(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x887c68, 0x0) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) r6 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r7 = syz_pidfd_open(r6, 0x0) setns(r7, 0x24020000) r8 = syz_clone(0xb21e0000, 0x0, 0x0, 0x0, 0x0, 0x0) r9 = syz_pidfd_open(r8, 0x0) setns(r9, 0x24020000) r10 = fsopen(&(0x7f0000000080)='cgroup2\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r10, 0x6, 0x0, 0x0, 0x0) fsmount(r10, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) syz_io_uring_setup(0x41f4, &(0x7f0000000140)={0x0, 0xf46f, 0x4000, 0x3, 0x3c3}, &(0x7f00000002c0)=0x0, &(0x7f0000000340), &(0x7f0000000380)) syz_ublk_add_dev(0xffffffffffffffff, r11, r0, 0x0, &(0x7f0000000200)={0x2e, 0x22, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000001c0)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r13 = socket$inet6_tcp(0xa, 0x1, 0x0) r14 = dup(r13) syz_ublk_setup_queues(r14, r12, &(0x7f00000004c0)={0x0, 0xbd, 0x10, 0x1, 0x7f}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1a52, 0x42, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3b00, 0x2, 0x1, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x93ea, 0x2000, 0x4013bfff, 0x2b9}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5, 0x800, 0x1, 0x26d}}], 0x1, 0x0, 0x0) 407.89728ms ago: executing program 0 (id=52): socket(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$inet(0x2, 0x2, 0x1) r0 = mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = getpid() r4 = syz_pidfd_open(r3, 0x0) setns(r4, 0x24020000) r5 = syz_clone(0xb2b60000, 0x0, 0xfffffffffffffcd1, 0x0, 0x0, 0x0) r6 = syz_pidfd_open(r5, 0x0) setns(r6, 0x24020000) mount$bind(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x887c68, 0x0) sendmsg$inet(r2, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) r7 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r8 = syz_pidfd_open(r7, 0x0) setns(r8, 0x24020000) r9 = syz_clone(0xb21e0000, 0x0, 0x0, 0x0, 0x0, 0x0) r10 = syz_pidfd_open(r9, 0x0) setns(r10, 0x24020000) r11 = fsopen(&(0x7f0000000080)='cgroup2\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r11, 0x6, 0x0, 0x0, 0x0) fsmount(r11, 0x0, 0x0) recvmsg$unix(r1, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[@cred={{0x1c}}, @rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x48}, 0x80) syz_io_uring_setup(0x41f4, &(0x7f0000000140)={0x0, 0xf46f, 0x4000, 0x3, 0x3c3, 0x0, r13}, &(0x7f00000002c0)=0x0, &(0x7f0000000340), &(0x7f0000000380)) syz_ublk_add_dev(0xffffffffffffffff, r15, r0, 0x0, &(0x7f0000000200)={0x2e, 0x22, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000001c0)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r17 = socket$inet6_tcp(0xa, 0x1, 0x0) r18 = dup(r17) syz_ublk_setup_queues(r18, r16, &(0x7f00000004c0)={0x0, 0xbd, 0x10, 0x1, 0x7f}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1a52, 0x42, 0x1000002, 0x91, 0x0, r12}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3b00, 0x2, 0x1, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x93ea, 0x2000, 0x4013bfff, 0x2b9, 0x0, r14}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5, 0x800, 0x1, 0x26d}}], 0x1, 0x0, 0x0) 406.913989ms ago: executing program 1 (id=53): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$wireguard(&(0x7f00000002c0), 0xffffffffffffffff) sendmsg$WG_CMD_SET_DEVICE(r0, &(0x7f0000000300)={0x0, 0x20, &(0x7f0000000340)={&(0x7f0000000400)=ANY=[@ANYBLOB="ec000000", @ANYRES16=r1, @ANYBLOB="0100000000000000000001000000060006004e23004124000300b08073e8d44e91e3da922c22438244bb885c69e269c8e9d835b114293a4ddc6e1400020077673000000000000000000000000000980008809400008008000a000100000006000500010000001400040002004e20e0000001000000000000000024000100dbffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff480009801c000080060001000200000008000200ffffffff050003"], 0xec}, 0x1, 0x0, 0x0, 0x20004844}, 0x40000) 337.280982ms ago: executing program 1 (id=54): socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000580)={0xffffffffffffffff}) sendmmsg$inet(r0, &(0x7f00000005c0)=[{{0x0, 0xfffffffffffffda1, 0x0}}], 0x40001b6, 0xf5) r1 = socket$nl_sock_diag(0x10, 0x3, 0x4) write(r1, &(0x7f0000000600)="580000001400010300000000000000001e000000ffffffff0000000000000000000000000000000000000000000000000500"/88, 0x58) 337.109472ms ago: executing program 1 (id=55): syz_usb_connect(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100003afe0620e6040b00000101020301090224000100001000090414000239261a5509050602ff03000001000000000000bbd93ff5c5a018941d9792435f90b15a1909224fec296d486dd42a8249400e240499604af52a93579943055a7579f7c417650f6d4ccaf176248af6ed0a2083d5b7f870f2d4f8aaf9767f80fcc37755f11eca00400e7b5eaa0d502715833422359841d16ecb9364707b0e7af4fbc54948196a71f7b8abbde8f8f646627a1037533b43ffe18991b8ca302d1b1f0ba25b31c95bfdf93d149469e2434cdd5288139cdfef43427ff848e0b326b6c4168d647a47d09223baa5095ddf2d98ebc972e5b68185add440d07121f870d448b48c4606ea5b38da3144cad25593b718c3930391ee3a570d63f4941aea8c6ec4638bb19775d1d7bb03c191aba41940dd7edd"], 0x0) 182.489225ms ago: executing program 0 (id=56): socket$pppl2tp(0x18, 0x1, 0x1) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='cmdline\x00') pipe2$9p(&(0x7f00000000c0), 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r2 = openat$kvm(0x0, &(0x7f0000000300), 0x0, 0x0) ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) socket(0x10, 0x803, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r3, &(0x7f0000000500)={0x0, 0x0, 0x0}, 0x4040000) 65.768948ms ago: executing program 2 (id=57): ioctl$BLKRRPART(0xffffffffffffffff, 0x125f, 0x0) r0 = openat$kvm(0x0, &(0x7f0000000480), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil) syz_kvm_add_vcpu$x86(r2, &(0x7f00000004c0)={0x0, &(0x7f0000000500)=[@enable_nested={0x12c, 0x18}, @nested_intel_vmwrite_mask={0x154, 0x38, {0xfffffffffffffffd, @control64=0x2012, 0x30002}}], 0x50}) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f00000005c0), 0x1, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r4, 0xae60) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_GET_SUPPORTED_HV_CPUID_cpu(r5, 0xc008aec1, &(0x7f0000000600)={0x26}) 0s ago: executing program 0 (id=58): mmap$IORING_OFF_SQ_RING(0x0, 0x7, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, &(0x7f00000004c0)) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetlb.1GB.usage_in_bytes\x00', 0x275a, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) recvmmsg$unix(0xffffffffffffffff, &(0x7f0000000240)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4001, 0x0) close_range(r0, 0xffffffffffffffff, 0x4) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x4000, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r1, &(0x7f0000000180)='27', 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) ioctl$RTC_SET_TIME(r2, 0x4024700a, &(0x7f0000000280)={0x2e, 0x1e, 0x4, 0x2, 0x3, 0xa9, 0x5, 0x2, 0x1}) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.net/syz0\x00', 0x1ff) socket$inet6_tcp(0xa, 0x1, 0x0) kernel console output (not intermixed with test programs): syzkaller syzkaller login: [ 15.426979][ T36] kauditd_printk_skb: 31 callbacks suppressed [ 15.426997][ T36] audit: type=1400 audit(1792506107.480:59): avc: denied { transition } for pid=233 comm="sshd-session" path="/bin/sh" dev="sda1" ino=90 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 15.431487][ T36] audit: type=1400 audit(1792506107.480:60): avc: denied { noatsecure } for pid=233 comm="sshd-session" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 15.435797][ T36] audit: type=1400 audit(1792506107.480:61): avc: denied { write } for pid=233 comm="sh" path="pipe:[1513]" dev="pipefs" ino=1513 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 15.439443][ T36] audit: type=1400 audit(1792506107.490:62): avc: denied { rlimitinh } for pid=233 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 15.442501][ T36] audit: type=1400 audit(1792506107.490:63): avc: denied { siginh } for pid=233 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 Warning: Permanently added '10.128.1.14' (ED25519) to the list of known hosts. [ 23.223652][ T36] audit: type=1400 audit(1792506115.270:64): avc: denied { mounton } for pid=287 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 23.227171][ T287] cgroup: Unknown subsys name 'net' [ 23.246431][ T36] audit: type=1400 audit(1792506115.270:65): avc: denied { mount } for pid=287 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 23.273645][ T36] audit: type=1400 audit(1792506115.300:66): avc: denied { unmount } for pid=287 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 23.274180][ T287] cgroup: Unknown subsys name 'devices' [ 23.408100][ T287] cgroup: Unknown subsys name 'hugetlb' [ 23.413751][ T287] cgroup: Unknown subsys name 'rlimit' [ 23.529446][ T36] audit: type=1400 audit(1792506115.580:67): avc: denied { setattr } for pid=287 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 23.552648][ T36] audit: type=1400 audit(1792506115.580:68): avc: denied { mounton } for pid=287 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 23.577463][ T36] audit: type=1400 audit(1792506115.580:69): avc: denied { mount } for pid=287 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 23.605210][ T289] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 23.614271][ T36] audit: type=1400 audit(1792506115.660:70): avc: denied { relabelto } for pid=289 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.638064][ T287] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 23.639828][ T36] audit: type=1400 audit(1792506115.660:71): avc: denied { write } for pid=289 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.674173][ T36] audit: type=1400 audit(1792506115.680:72): avc: denied { read } for pid=287 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.699734][ T36] audit: type=1400 audit(1792506115.680:73): avc: denied { open } for pid=287 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 24.516205][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.523341][ T294] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.545995][ T294] bridge_slave_0: entered allmulticast mode [ 24.552943][ T294] bridge_slave_0: entered promiscuous mode [ 24.577520][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.584610][ T294] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.591787][ T294] bridge_slave_1: entered allmulticast mode [ 24.598264][ T294] bridge_slave_1: entered promiscuous mode [ 24.701406][ T298] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.708568][ T298] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.715662][ T298] bridge_slave_0: entered allmulticast mode [ 24.722166][ T298] bridge_slave_0: entered promiscuous mode [ 24.728738][ T298] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.735858][ T298] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.742955][ T298] bridge_slave_1: entered allmulticast mode [ 24.749353][ T298] bridge_slave_1: entered promiscuous mode [ 24.816234][ T299] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.823319][ T299] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.830651][ T299] bridge_slave_0: entered allmulticast mode [ 24.837299][ T299] bridge_slave_0: entered promiscuous mode [ 24.848621][ T299] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.855691][ T299] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.862977][ T299] bridge_slave_1: entered allmulticast mode [ 24.869287][ T299] bridge_slave_1: entered promiscuous mode [ 24.907230][ T300] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.914308][ T300] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.921619][ T300] bridge_slave_0: entered allmulticast mode [ 24.927917][ T300] bridge_slave_0: entered promiscuous mode [ 24.934462][ T300] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.941704][ T300] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.948850][ T300] bridge_slave_1: entered allmulticast mode [ 24.955089][ T300] bridge_slave_1: entered promiscuous mode [ 24.961558][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.968665][ T294] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.976074][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.983113][ T294] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.094587][ T298] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.102049][ T298] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.109404][ T298] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.116671][ T298] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.133001][ T299] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.140110][ T299] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.147449][ T299] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.154501][ T299] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.164587][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.171979][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.179792][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.187123][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.194409][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.202250][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.215100][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.222571][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.236741][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.243865][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.287825][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.294918][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.308449][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.315505][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.349124][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.356206][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.364038][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.371133][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.390032][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.397116][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.404939][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.412098][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.425492][ T294] veth0_vlan: entered promiscuous mode [ 25.450615][ T298] veth0_vlan: entered promiscuous mode [ 25.467745][ T298] veth1_macvtap: entered promiscuous mode [ 25.490047][ T294] veth1_macvtap: entered promiscuous mode [ 25.496668][ T300] veth0_vlan: entered promiscuous mode [ 25.534371][ T300] veth1_macvtap: entered promiscuous mode [ 25.541542][ T299] veth0_vlan: entered promiscuous mode [ 25.552174][ T298] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 25.584809][ T299] veth1_macvtap: entered promiscuous mode [ 25.591108][ T315] FAULT_INJECTION: forcing a failure. [ 25.591108][ T315] name failslab, interval 1, probability 0, space 0, times 1 [ 25.606537][ T315] CPU: 1 UID: 0 PID: 315 Comm: syz.0.1 Not tainted syzkaller #0 f4dc25654f8255e5780388d900d0b326847aed68 [ 25.606573][ T315] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 25.606603][ T315] Call Trace: [ 25.606611][ T315] [ 25.606619][ T315] __dump_stack+0x21/0x30 [ 25.606661][ T315] dump_stack_lvl+0x140/0x1c0 [ 25.606695][ T315] ? __cfi_dump_stack_lvl+0x10/0x10 [ 25.606732][ T315] dump_stack+0x19/0x20 [ 25.606765][ T315] should_fail_ex+0x3c2/0x510 [ 25.606789][ T315] should_failslab+0xac/0x100 [ 25.606813][ T315] kmem_cache_alloc_lru_noprof+0x44/0x410 [ 25.606847][ T315] ? proc_alloc_inode+0x48/0x150 [ 25.606880][ T315] proc_alloc_inode+0x48/0x150 [ 25.606910][ T315] ? __cfi_proc_alloc_inode+0x10/0x10 [ 25.606942][ T315] alloc_inode+0x7a/0x270 [ 25.606964][ T315] ? __cfi_d_alloc_name+0x10/0x10 [ 25.606996][ T315] new_inode+0x25/0x1e0 [ 25.607018][ T315] ? __d_instantiate+0x43f/0x790 [ 25.607052][ T315] proc_setup_self+0xe0/0x280 [ 25.607078][ T315] proc_fill_super+0x539/0x850 [ 25.607114][ T315] get_tree_nodev+0xce/0x170 [ 25.607141][ T315] ? __cfi_proc_fill_super+0x10/0x10 [ 25.607175][ T315] proc_get_tree+0x20/0x30 [ 25.607208][ T315] vfs_get_tree+0xa1/0x290 [ 25.607241][ T315] vfs_cmd_create+0xb0/0x220 [ 25.607270][ T315] ? vfs_fsconfig_locked+0x6c/0x350 [ 25.607302][ T315] vfs_fsconfig_locked+0x76/0x350 [ 25.607331][ T315] __se_sys_fsconfig+0x72d/0x870 [ 25.607373][ T315] ? __x64_sys_fsconfig+0xf0/0xf0 [ 25.607404][ T315] ? asm_sysvec_reschedule_ipi+0x1f/0x30 [ 25.607437][ T315] __x64_sys_fsconfig+0xc3/0xf0 [ 25.607467][ T315] x64_sys_call+0x11bb/0x2ee0 [ 25.607492][ T315] do_syscall_64+0x57/0xf0 [ 25.607515][ T315] ? clear_bhb_loop+0x50/0xa0 [ 25.607544][ T315] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 25.607572][ T315] RIP: 0033:0x7fb68439f559 [ 25.607602][ T315] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 25.607622][ T315] RSP: 002b:00007fb68530b028 EFLAGS: 00000246 ORIG_RAX: 00000000000001af [ 25.607657][ T315] RAX: ffffffffffffffda RBX: 00007fb684625fa0 RCX: 00007fb68439f559 [ 25.607675][ T315] RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000005 [ 25.607689][ T315] RBP: 00007fb684436b20 R08: 0000000000000000 R09: 0000000000000000 [ 25.607704][ T315] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 25.607717][ T315] R13: 00007fb684626038 R14: 00007fb684625fa0 R15: 00007fffce816858 [ 25.607737][ T315] [ 25.609002][ T315] proc_fill_super: can't allocate /proc/self [ 25.640373][ T317] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 25.947868][ T326] rust_binder: 326 RLIMIT_NICE not set [ 26.060144][ T45] rust_binder: 325: undelivered TRANSACTION_COMPLETE [ 26.175866][ T66] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 26.191879][ T338] kvm: pic: non byte write [ 26.326254][ T66] usb 3-1: Using ep0 maxpacket: 32 [ 26.338099][ T66] usb 3-1: config 0 interface 0 altsetting 5 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 26.355767][ T66] usb 3-1: config 0 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 26.371737][ T344] kvm: kvm [343]: vcpu2, guest rIP: 0x9135 Unhandled WRMSR(0xc1) = 0xfffffc00 [ 26.380735][ T66] usb 3-1: config 0 interface 0 has no altsetting 0 [ 26.380774][ T66] usb 3-1: New USB device found, idVendor=1e7d, idProduct=3232, bcdDevice= 0.00 [ 26.388580][ T344] kvm: kvm [343]: vcpu2, guest rIP: 0x9135 Unhandled WRMSR(0xc2) = 0xfffffc00 [ 26.410216][ T344] kvm: kvm [343]: vcpu2, guest rIP: 0x9135 Unhandled WRMSR(0x11e) = 0xfffffc00 [ 26.415857][ T66] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 26.433149][ T344] kvm: kvm [343]: vcpu2, guest rIP: 0x9135 Unhandled WRMSR(0x186) = 0xfffffc00 [ 26.439671][ T66] usb 3-1: config 0 descriptor?? [ 26.442883][ T344] kvm: kvm [343]: vcpu2, guest rIP: 0x9135 Unhandled WRMSR(0x187) = 0xfffffc00 [ 26.868049][ T66] input: HID 1e7d:3232 as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/0003:1E7D:3232.0001/input/input4 [ 26.884324][ T66] ryos 0003:1E7D:3232.0001: input,hiddev96,hidraw0: USB HID v0.00 Device [HID 1e7d:3232] on usb-dummy_hcd.2-1/input0 [ 27.098714][ T45] usb 3-1: USB disconnect, device number 2 [ 27.276525][ T66] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 27.335867][ T312] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 27.425818][ T66] usb 2-1: Using ep0 maxpacket: 32 [ 27.432205][ T66] usb 2-1: config 0 has an invalid interface number: 184 but max is 0 [ 27.440620][ T66] usb 2-1: config 0 has no interface number 0 [ 27.447039][ T66] usb 2-1: config 0 interface 184 has no altsetting 0 [ 27.456965][ T66] usb 2-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 27.466155][ T66] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 27.475381][ T66] usb 2-1: Product: syz [ 27.479893][ T66] usb 2-1: Manufacturer: syz [ 27.485175][ T66] usb 2-1: SerialNumber: syz [ 27.489851][ T312] usb 1-1: Using ep0 maxpacket: 32 [ 27.497646][ T66] usb 2-1: config 0 descriptor?? [ 27.504112][ T312] usb 1-1: config 0 interface 0 altsetting 5 endpoint 0x81 has an invalid bInterval 128, changing to 11 [ 27.515484][ T66] smsc75xx v1.0.0 [ 27.519786][ T312] usb 1-1: config 0 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 27.532855][ T312] usb 1-1: config 0 interface 0 has no altsetting 0 [ 27.539598][ T312] usb 1-1: New USB device found, idVendor=1e7d, idProduct=2db4, bcdDevice= 0.00 [ 27.548947][ T312] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 27.557994][ T312] usb 1-1: config 0 descriptor?? [ 27.946095][ T45] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 27.967229][ T312] konepure 0003:1E7D:2DB4.0002: unknown main item tag 0x0 [ 27.974440][ T312] konepure 0003:1E7D:2DB4.0002: unknown main item tag 0x0 [ 27.981676][ T312] konepure 0003:1E7D:2DB4.0002: unknown main item tag 0x0 [ 27.988850][ T312] konepure 0003:1E7D:2DB4.0002: unknown main item tag 0x0 [ 27.996026][ T312] konepure 0003:1E7D:2DB4.0002: unknown main item tag 0x0 [ 28.003303][ T312] konepure 0003:1E7D:2DB4.0002: unknown main item tag 0x0 [ 28.010496][ T312] konepure 0003:1E7D:2DB4.0002: unknown main item tag 0x0 [ 28.017793][ T312] konepure 0003:1E7D:2DB4.0002: unknown main item tag 0x0 [ 28.024946][ T312] konepure 0003:1E7D:2DB4.0002: unknown main item tag 0x0 [ 28.032710][ T312] konepure 0003:1E7D:2DB4.0002: unknown main item tag 0x0 [ 28.039914][ T312] konepure 0003:1E7D:2DB4.0002: unknown main item tag 0x0 [ 28.047109][ T312] konepure 0003:1E7D:2DB4.0002: unknown main item tag 0x0 [ 28.054257][ T312] konepure 0003:1E7D:2DB4.0002: unknown main item tag 0x0 [ 28.061534][ T312] konepure 0003:1E7D:2DB4.0002: unknown main item tag 0x0 [ 28.068717][ T312] konepure 0003:1E7D:2DB4.0002: unknown main item tag 0x0 [ 28.075900][ T312] konepure 0003:1E7D:2DB4.0002: unknown main item tag 0x0 [ 28.083119][ T312] konepure 0003:1E7D:2DB4.0002: unknown main item tag 0x0 [ 28.090399][ T312] konepure 0003:1E7D:2DB4.0002: unknown main item tag 0x0 [ 28.097761][ T312] konepure 0003:1E7D:2DB4.0002: unknown main item tag 0x0 [ 28.104918][ T312] konepure 0003:1E7D:2DB4.0002: unbalanced collection at end of report description [ 28.114486][ T66] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000040: -32 [ 28.125318][ T45] usb 3-1: Using ep0 maxpacket: 32 [ 28.130638][ T312] konepure 0003:1E7D:2DB4.0002: parse failed [ 28.136764][ T66] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 28.146038][ T312] konepure 0003:1E7D:2DB4.0002: probe with driver konepure failed with error -22 [ 28.157208][ T45] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 28.168254][ T45] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 28.178097][ T45] usb 3-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 28.187246][ T45] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 28.196174][ T45] usb 3-1: config 0 descriptor?? [ 28.204109][ T313] usb 1-1: USB disconnect, device number 2 [ 28.406166][ T36] kauditd_printk_skb: 66 callbacks suppressed [ 28.406184][ T36] audit: type=1400 audit(1792506120.460:138): avc: denied { create } for pid=398 comm="syz.3.31" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 28.432933][ T36] audit: type=1400 audit(1792506120.470:139): avc: denied { write } for pid=398 comm="syz.3.31" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 28.452989][ T36] audit: type=1400 audit(1792506120.470:140): avc: denied { nlmsg_write } for pid=398 comm="syz.3.31" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 28.492377][ T53] Bluetooth: hci0: Frame reassembly failed (-84) [ 28.605868][ T45] hid-generic 0003:0403:6030.0003: unknown main item tag 0x0 [ 28.613387][ T45] hid-generic 0003:0403:6030.0003: unknown main item tag 0x0 [ 28.621649][ T45] hid-generic 0003:0403:6030.0003: hidraw0: USB HID v0.00 Device [HID 0403:6030] on usb-dummy_hcd.2-1/input0 [ 28.734032][ T36] audit: type=1400 audit(1792506120.780:141): avc: denied { create } for pid=408 comm="syz.0.34" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 28.754274][ T36] audit: type=1400 audit(1792506120.780:142): avc: denied { create } for pid=408 comm="syz.0.34" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 28.774067][ T36] audit: type=1400 audit(1792506120.780:143): avc: denied { create } for pid=408 comm="syz.0.34" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 28.794665][ T36] audit: type=1400 audit(1792506120.780:144): avc: denied { create } for pid=408 comm="syz.0.34" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 28.814015][ T36] audit: type=1400 audit(1792506120.780:145): avc: denied { create } for pid=408 comm="syz.0.34" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 28.833781][ T36] audit: type=1400 audit(1792506120.780:146): avc: denied { create } for pid=408 comm="syz.0.34" anonclass=[io_uring] scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 28.855362][ T36] audit: type=1400 audit(1792506120.780:147): avc: denied { map } for pid=408 comm="syz.0.34" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=4064 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 28.961870][ T417] process 'syz.0.37' launched '/dev/fd/5' with NULL argv: empty string added [ 29.011638][ T423] loop0: detected capacity change from 0 to 3904 [ 29.036653][ T423] loop0: [ 29.295798][ T313] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 29.445785][ T313] usb 1-1: Using ep0 maxpacket: 32 [ 29.452122][ T313] usb 1-1: config 0 has an invalid interface number: 67 but max is 0 [ 29.460282][ T313] usb 1-1: config 0 has no interface number 0 [ 29.468606][ T313] usb 1-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 29.477725][ T313] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 29.485809][ T313] usb 1-1: Product: syz [ 29.489987][ T313] usb 1-1: Manufacturer: syz [ 29.494613][ T313] usb 1-1: SerialNumber: syz [ 29.500162][ T313] usb 1-1: config 0 descriptor?? [ 29.506224][ T313] smsc95xx v2.0.0 [ 29.909125][ T313] smsc95xx 1-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -32 [ 29.920079][ T313] smsc95xx 1-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 30.505822][ T55] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 30.506211][ T406] Bluetooth: hci0: command 0x1003 tx timeout [ 30.737567][ T313] smsc95xx 1-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -71 [ 30.741275][ T311] usb 3-1: USB disconnect, device number 3 [ 30.760796][ T313] smsc95xx 1-1:0.67: probe with driver smsc95xx failed with error -71 [ 30.774554][ T313] usb 1-1: USB disconnect, device number 3 [ 30.781760][ T66] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000010: -71 [ 30.793253][ T66] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): Failed to read HW_CFG: -71 [ 30.802904][ T66] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -71 [ 30.812456][ T66] smsc75xx 2-1:0.184: probe with driver smsc75xx failed with error -71 [ 30.821760][ T66] usb 2-1: USB disconnect, device number 2 [ 30.828428][ T45] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 30.986405][ T45] usb 4-1: Using ep0 maxpacket: 32 [ 30.992826][ T45] usb 4-1: config 0 interface 0 altsetting 8 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 31.003995][ T45] usb 4-1: config 0 interface 0 altsetting 8 endpoint 0x81 has invalid wMaxPacketSize 0 [ 31.014079][ T45] usb 4-1: config 0 interface 0 altsetting 8 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 31.026955][ T45] usb 4-1: config 0 interface 0 has no altsetting 0 [ 31.033598][ T45] usb 4-1: New USB device found, idVendor=046d, idProduct=c24f, bcdDevice= 0.00 [ 31.042701][ T45] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 31.051339][ T45] usb 4-1: config 0 descriptor?? [ 31.056398][ T311] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 31.206914][ T311] usb 3-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 31.221209][ T311] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 31.230845][ T311] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 31.239010][ T311] usb 3-1: Product: syz [ 31.243202][ T311] usb 3-1: Manufacturer: syz [ 31.247898][ T311] usb 3-1: SerialNumber: syz [ 31.287103][ T441] Zero length message leads to an empty skb [ 31.371210][ T445] FAULT_INJECTION: forcing a failure. [ 31.371210][ T445] name failslab, interval 1, probability 0, space 0, times 0 [ 31.383921][ T445] CPU: 0 UID: 0 PID: 445 Comm: syz.0.48 Not tainted syzkaller #0 f4dc25654f8255e5780388d900d0b326847aed68 [ 31.383957][ T445] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 31.383973][ T445] Call Trace: [ 31.383981][ T445] [ 31.383989][ T445] __dump_stack+0x21/0x30 [ 31.384031][ T445] dump_stack_lvl+0x140/0x1c0 [ 31.384067][ T445] ? __cfi_dump_stack_lvl+0x10/0x10 [ 31.384103][ T445] ? __kasan_kmalloc+0x96/0xb0 [ 31.384125][ T445] ? __kmalloc_cache_noprof+0x23c/0x470 [ 31.384165][ T445] dump_stack+0x19/0x20 [ 31.384203][ T445] should_fail_ex+0x3c2/0x510 [ 31.384228][ T445] should_failslab+0xac/0x100 [ 31.384251][ T445] kmem_cache_alloc_noprof+0x42/0x410 [ 31.384286][ T445] ? __kernfs_new_node+0xf1/0x740 [ 31.384305][ T445] __kernfs_new_node+0xf1/0x740 [ 31.384321][ T445] ? mutex_unlock+0x90/0x240 [ 31.384353][ T445] ? kernfs_new_node+0x280/0x280 [ 31.384379][ T445] ? pcpu_alloc_noprof+0xd93/0x1440 [ 31.384417][ T445] kernfs_new_node+0x154/0x280 [ 31.384441][ T445] kernfs_create_dir_ns+0x4b/0x130 [ 31.384460][ T445] cgroup_mkdir+0x396/0x1600 [ 31.384475][ T445] ? __kasan_check_write+0x18/0x20 [ 31.384516][ T445] ? __cfi_cgroup_mkdir+0x10/0x10 [ 31.384536][ T445] kernfs_iop_mkdir+0x1be/0x2d0 [ 31.384562][ T445] vfs_mkdir+0x591/0x810 [ 31.384589][ T445] do_mkdirat+0x240/0x530 [ 31.384608][ T445] ? __cfi_do_mkdirat+0x10/0x10 [ 31.384626][ T445] ? __kasan_check_write+0x18/0x20 [ 31.384666][ T445] ? getname_flags+0x203/0x6b0 [ 31.384700][ T445] ? __kasan_check_write+0x18/0x20 [ 31.384735][ T445] __x64_sys_mkdirat+0x8b/0xa0 [ 31.384754][ T445] x64_sys_call+0x2ba8/0x2ee0 [ 31.384771][ T445] do_syscall_64+0x57/0xf0 [ 31.384786][ T445] ? clear_bhb_loop+0x50/0xa0 [ 31.384827][ T445] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 31.384855][ T445] RIP: 0033:0x7fb68439f559 [ 31.384878][ T445] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 31.384891][ T445] RSP: 002b:00007fb68530b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 [ 31.384909][ T445] RAX: ffffffffffffffda RBX: 00007fb684625fa0 RCX: 00007fb68439f559 [ 31.384922][ T445] RDX: 00000000000001ff RSI: 00002000000001c0 RDI: ffffffffffffff9c [ 31.384933][ T445] RBP: 00007fb684436b20 R08: 0000000000000000 R09: 0000000000000000 [ 31.384959][ T445] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 31.384974][ T445] R13: 00007fb684626038 R14: 00007fb684625fa0 R15: 00007fffce816858 [ 31.384994][ T445] [ 31.460286][ T311] usblp 3-1:1.0: usblp0: USB Unidirectional printer dev 4 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 31.652523][ T45] logitech 0003:046D:C24F.0004: unknown main item tag 0x2 [ 31.659767][ T45] logitech 0003:046D:C24F.0004: unknown main item tag 0x0 [ 31.667005][ T45] logitech 0003:046D:C24F.0004: unknown main item tag 0x0 [ 31.674182][ T45] logitech 0003:046D:C24F.0004: unknown main item tag 0x0 [ 31.681383][ T45] logitech 0003:046D:C24F.0004: unknown main item tag 0x0 [ 31.688562][ T45] logitech 0003:046D:C24F.0004: unknown main item tag 0x0 [ 31.695802][ T45] logitech 0003:046D:C24F.0004: unknown main item tag 0x0 [ 31.702984][ T45] logitech 0003:046D:C24F.0004: unknown main item tag 0x0 [ 31.710497][ T45] logitech 0003:046D:C24F.0004: unknown main item tag 0x0 [ 31.717717][ T45] logitech 0003:046D:C24F.0004: unknown main item tag 0x0 [ 31.724885][ T45] logitech 0003:046D:C24F.0004: unbalanced collection at end of report description [ 31.734477][ T45] logitech 0003:046D:C24F.0004: parse failed [ 31.740577][ T45] logitech 0003:046D:C24F.0004: probe with driver logitech failed with error -22 [ 31.752710][ T311] usb 3-1: USB disconnect, device number 4 [ 31.762020][ T311] usblp0: removed [ 31.793751][ T451] ======================================================= [ 31.793751][ T451] WARNING: The mand mount option has been deprecated and [ 31.793751][ T451] and is ignored by this kernel. Remove the mand [ 31.793751][ T451] option from the mount to silence this warning. [ 31.793751][ T451] ======================================================= [ 32.215817][ T311] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 32.301349][ T469] FAULT_INJECTION: forcing a failure. [ 32.301349][ T469] name failslab, interval 1, probability 0, space 0, times 0 [ 32.330406][ T469] CPU: 0 UID: 0 PID: 469 Comm: syz.0.58 Not tainted syzkaller #0 f4dc25654f8255e5780388d900d0b326847aed68 [ 32.330446][ T469] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 32.330463][ T469] Call Trace: [ 32.330471][ T469] [ 32.330480][ T469] __dump_stack+0x21/0x30 [ 32.330524][ T469] dump_stack_lvl+0x140/0x1c0 [ 32.330561][ T469] ? __cfi_dump_stack_lvl+0x10/0x10 [ 32.330599][ T469] ? __kasan_check_write+0x18/0x20 [ 32.330633][ T469] ? down_write+0xee/0x2b0 [ 32.330666][ T469] dump_stack+0x19/0x20 [ 32.330701][ T469] should_fail_ex+0x3c2/0x510 [ 32.330726][ T469] should_failslab+0xac/0x100 [ 32.330750][ T469] __kmalloc_cache_noprof+0x41/0x470 [ 32.330786][ T469] ? cgroup_mkdir+0xbe2/0x1600 [ 32.330810][ T469] cgroup_mkdir+0xbe2/0x1600 [ 32.330834][ T469] ? __cfi_cgroup_mkdir+0x10/0x10 [ 32.330856][ T469] kernfs_iop_mkdir+0x1be/0x2d0 [ 32.330884][ T469] vfs_mkdir+0x591/0x810 [ 32.330913][ T469] do_mkdirat+0x240/0x530 [ 32.330941][ T469] ? __cfi_do_mkdirat+0x10/0x10 [ 32.330969][ T469] ? __kasan_check_write+0x18/0x20 [ 32.331002][ T469] ? getname_flags+0x203/0x6b0 [ 32.331046][ T469] ? __kasan_check_write+0x18/0x20 [ 32.331080][ T469] __x64_sys_mkdirat+0x8b/0xa0 [ 32.331109][ T469] x64_sys_call+0x2ba8/0x2ee0 [ 32.331135][ T469] do_syscall_64+0x57/0xf0 [ 32.331157][ T469] ? clear_bhb_loop+0x50/0xa0 [ 32.331188][ T469] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 32.331218][ T469] RIP: 0033:0x7fb68439f559 [ 32.331239][ T469] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 32.331259][ T469] RSP: 002b:00007fb68530b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 [ 32.331286][ T469] RAX: ffffffffffffffda RBX: 00007fb684625fa0 RCX: 00007fb68439f559 [ 32.331305][ T469] RDX: 00000000000001ff RSI: 00002000000001c0 RDI: ffffffffffffff9c [ 32.331323][ T469] RBP: 00007fb684436b20 R08: 0000000000000000 R09: 0000000000000000 [ 32.331339][ T469] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 32.331353][ T469] R13: 00007fb684626038 R14: 00007fb684625fa0 R15: 00007fffce816858 [ 32.331374][ T469] [ 32.332617][ T469] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000021: 0000 [#1] PREEMPT SMP KASAN PTI [ 32.376078][ T311] usb 2-1: Using ep0 maxpacket: 32 [ 32.379622][ T469] KASAN: null-ptr-deref in range [0x0000000000000108-0x000000000000010f] [ 32.379645][ T469] CPU: 0 UID: 0 PID: 469 Comm: syz.0.58 Not tainted syzkaller #0 f4dc25654f8255e5780388d900d0b326847aed68 [ 32.385953][ T311] usb 2-1: config 0 has an invalid interface number: 20 but max is 0 [ 32.388243][ T469] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 32.392936][ T311] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 32.397608][ T469] RIP: 0010:cgroup_mkdir+0x122a/0x1600 [ 32.397639][ T469] Code: eb 05 e8 79 4d 08 00 48 89 df e8 11 9e 00 00 48 81 fb 01 f0 ff ff 0f 83 9a fb ff ff 4c 8d b3 08 01 00 00 4d 89 f4 49 c1 ec 03 <43> 80 3c 2c 00 74 08 4c 89 f7 e8 e7 c7 61 00 48 8b bb 08 01 00 00 [ 32.397659][ T469] RSP: 0018:ffffc9000e82fc88 EFLAGS: 00010206 [ 32.419536][ T311] usb 2-1: config 0 has no interface number 0 [ 32.422245][ T469] RAX: 49ee65d01018ec00 RBX: 0000000000000000 RCX: ffff8881f6c3adc0 [ 32.422266][ T469] RDX: ffff8881143d5d80 RSI: ffff888113576000 RDI: ffff888100042000 [ 32.436008][ T311] usb 2-1: config 0 interface 20 altsetting 0 bulk endpoint 0x6 has invalid maxpacket 1023 [ 32.440822][ T469] RBP: ffffc9000e82fd38 R08: 0000000004506387 R09: 00000000fbd73b33 [ 32.440847][ T469] R10: 000000000000000c R11: ffffffff81777ac0 R12: 0000000000000021 [ 32.440864][ T469] R13: dffffc0000000000 R14: 0000000000000108 R15: ffff888113576010 [ 32.456086][ T311] usb 2-1: config 0 interface 20 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 32.460225][ T469] FS: 00007fb68530b6c0(0000) GS:ffff8881f6c00000(0000) knlGS:0000000000000000 [ 32.460251][ T469] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 32.466953][ T311] usb 2-1: New USB device found, idVendor=04e6, idProduct=000b, bcdDevice= 1.00 [ 32.469342][ T469] CR2: 00002000000004c0 CR3: 00000001333a4000 CR4: 00000000003526b0 [ 32.485606][ T311] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 32.499301][ T469] Call Trace: [ 32.499314][ T469] [ 32.499326][ T469] ? __cfi_cgroup_mkdir+0x10/0x10 [ 32.527083][ T311] usb 2-1: Product: syz [ 32.531725][ T469] kernfs_iop_mkdir+0x1be/0x2d0 [ 32.553790][ T311] usb 2-1: Manufacturer: syz [ 32.563338][ T469] vfs_mkdir+0x591/0x810 [ 32.563377][ T469] do_mkdirat+0x240/0x530 [ 32.583569][ T311] usb 2-1: SerialNumber: syz [ 32.588561][ T469] ? __cfi_do_mkdirat+0x10/0x10 [ 32.588596][ T469] ? __kasan_check_write+0x18/0x20 [ 32.615159][ T311] usb 2-1: config 0 descriptor?? [ 32.616826][ T469] ? getname_flags+0x203/0x6b0 [ 32.616870][ T469] ? __kasan_check_write+0x18/0x20 [ 32.632436][ T463] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 32.641948][ T469] __x64_sys_mkdirat+0x8b/0xa0 [ 32.832406][ T469] x64_sys_call+0x2ba8/0x2ee0 [ 32.837133][ T469] do_syscall_64+0x57/0xf0 [ 32.841598][ T469] ? clear_bhb_loop+0x50/0xa0 [ 32.846321][ T469] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 32.852257][ T469] RIP: 0033:0x7fb68439f559 [ 32.856707][ T469] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 32.876351][ T469] RSP: 002b:00007fb68530b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 [ 32.884830][ T469] RAX: ffffffffffffffda RBX: 00007fb684625fa0 RCX: 00007fb68439f559 [ 32.892846][ T469] RDX: 00000000000001ff RSI: 00002000000001c0 RDI: ffffffffffffff9c [ 32.900864][ T469] RBP: 00007fb684436b20 R08: 0000000000000000 R09: 0000000000000000 [ 32.908872][ T469] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 32.916881][ T469] R13: 00007fb684626038 R14: 00007fb684625fa0 R15: 00007fffce816858 [ 32.924672][ T311] usb-storage 2-1:0.20: USB Mass Storage device detected [ 32.924888][ T469] [ 32.934945][ T469] Modules linked in: [ 32.939197][ T469] ---[ end trace 0000000000000000 ]--- [ 32.947392][ T469] RIP: 0010:cgroup_mkdir+0x122a/0x1600 [ 32.952970][ T469] Code: eb 05 e8 79 4d 08 00 48 89 df e8 11 9e 00 00 48 81 fb 01 f0 ff ff 0f 83 9a fb ff ff 4c 8d b3 08 01 00 00 4d 89 f4 49 c1 ec 03 <43> 80 3c 2c 00 74 08 4c 89 f7 e8 e7 c7 61 00 48 8b bb 08 01 00 00 [ 32.974490][ T469] RSP: 0018:ffffc9000e82fc88 EFLAGS: 00010206 [ 32.974576][ T311] usb-storage 2-1:0.20: Quirks match for vid 04e6 pid 000b: 4 [ 32.981080][ T469] RAX: 49ee65d01018ec00 RBX: 0000000000000000 RCX: ffff8881f6c3adc0 [ 32.997061][ T469] RDX: ffff8881143d5d80 RSI: ffff888113576000 RDI: ffff888100042000 [ 33.005087][ T469] RBP: ffffc9000e82fd38 R08: 0000000004506387 R09: 00000000fbd73b33 [ 33.013629][ T469] R10: 000000000000000c R11: ffffffff81777ac0 R12: 0000000000000021 [ 33.021893][ T469] R13: dffffc0000000000 R14: 0000000000000108 R15: ffff888113576010 [ 33.030154][ T469] FS: 00007fb68530b6c0(0000) GS:ffff8881f6c00000(0000) knlGS:0000000000000000 [ 33.039320][ T469] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 33.046150][ T469] CR2: 00007fb6852e9ff8 CR3: 00000001333a4000 CR4: 00000000003526b0 [ 33.054173][ T469] Kernel panic - not syncing: Fatal exception [ 33.060853][ T469] Kernel Offset: disabled [ 33.065200][ T469] Rebooting in 86400 seconds..