last executing test programs: 13.13105209s ago: executing program 2 (id=73): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x4c, &(0x7f000002eff0)={0x1, &(0x7f0000000040)=[{0x200}]}, 0x10) recvmmsg(r1, &(0x7f0000007340)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)=""/61, 0x3d}}], 0x1, 0x0, 0x0) sendmmsg$unix(r0, &(0x7f0000002880)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8050}}], 0x1, 0x4000000) 13.014279183s ago: executing program 2 (id=85): r0 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000400)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581", @ANYRES8], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000b00)={0x2c, &(0x7f0000000040)=ANY=[@ANYBLOB="00000f00000009003d140f3c369197d09647190890"], 0x0, 0x0, 0x0, 0x0}, 0x0) r1 = syz_open_dev$hiddev(&(0x7f0000000080), 0x0, 0x0) ioctl$HIDIOCGUSAGE(r1, 0xd01c4813, &(0x7f0000000100)={0x2, 0x100, 0xffffffff, 0x4, 0x0, 0x42}) 11.313230318s ago: executing program 2 (id=102): r0 = openat$kvm(0x0, &(0x7f0000000400), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_TSC_KHZ_vm(r1, 0xaea2, 0x200082) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f0000000000)={0x1, 0x0, @pic={0xd3, 0x2, 0x80, 0xde, 0x4, 0x0, 0x1, 0x8, 0x0, 0x1, 0x0, 0x62, 0xea, 0x5}}) 11.019736575s ago: executing program 2 (id=111): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x2a) mount$bind(&(0x7f0000000280)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) chroot(&(0x7f0000000580)='./file0/../file0\x00') mount$bind(&(0x7f0000000040)='.\x00', &(0x7f00000008c0)='./file0\x00', 0x0, 0x2a05004, 0x0) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000080)='./file0/../file0\x00') 11.005370725s ago: executing program 2 (id=104): r0 = socket$inet(0x2, 0x802, 0x1) connect$inet(r0, &(0x7f0000000040)={0x2, 0x0, @local}, 0x10) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000000)=0x1f7, 0x4) write(r0, &(0x7f0000000080)="08008edf773c8000", 0xfd) recvmmsg(r0, &(0x7f0000000340)=[{{0x0, 0x25, 0x0}}], 0x3f, 0x0, 0x0) 10.910815748s ago: executing program 2 (id=105): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000180)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x9, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000540), 0x3c) setsockopt$inet6_tcp_int(r0, 0x11a, 0x1, &(0x7f0000000100)=0x304, 0x4) 10.841908739s ago: executing program 32 (id=105): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000180)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x9, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000540), 0x3c) setsockopt$inet6_tcp_int(r0, 0x11a, 0x1, &(0x7f0000000100)=0x304, 0x4) 3.599003057s ago: executing program 0 (id=264): socket$inet(0x2, 0x4000000000000001, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff}) pipe2$9p(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000004500), 0x0, &(0x7f0000000100)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@version_9p2000}]}}) write$P9_RVERSION(r2, &(0x7f0000000080)=ANY=[@ANYBLOB="150000006bffff", @ANYRES16=r1, @ANYRESHEX=r2], 0x15) 3.49744351s ago: executing program 0 (id=266): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000001c0)=[@text32={0x20, 0x0}], 0x1, 0x4, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, &(0x7f0000000200)="f7790066baa000f3470f0966ef66ba420066b8e20066ef0f29902cbb0000c4e2b1ba8c88d9000000666666440f38826b410f7842281705b8010000000f01d9c4033921820f47a753fd", 0x49}], 0x1, 0x43, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 3.337289234s ago: executing program 0 (id=272): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x2}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', @multicast}) write$tun(r0, &(0x7f0000000080)={@val={0x0, 0x8914}, @void, @eth={@random="09d5fac0344f", @random, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x2, 0x12, 0x24, 0x66, 0x0, 0x2, 0x11, 0x0, @loopback, @multicast1}, {0x4e22, 0x4e22, 0x10, 0x0, @gue={{0x2, 0x1, 0x0, 0x4, 0x0, @val=0x80}}}}}}}}, 0x36) 3.178427878s ago: executing program 0 (id=278): r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) write$UHID_CREATE2(r0, &(0x7f00000007c0)=ANY=[@ANYBLOB="0b00000073797a31000000dfff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a30000037b35f0a000089b4c45a10000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a3100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001"], 0x119) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x8031, r0, 0x1000) r1 = syz_open_dev$hidraw(&(0x7f00000004c0), 0x0, 0xbb42) r2 = dup3(r1, r0, 0x80000) ioctl$HIDIOCGRDESC(r2, 0x90044802, 0x0) 3.026898792s ago: executing program 0 (id=282): mkdir(&(0x7f0000000300)='./bus\x00', 0x63) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./file1\x00', 0x143542, 0x160) write$P9_RREADLINK(r0, &(0x7f00000000c0)={0x1c, 0x17, 0x2, {0x13, './file0/file2/file0'}}, 0x1c) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1d0) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x8, &(0x7f0000000440)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@nfs_export_on}]}) linkat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0/file1\x00', 0xffffffffffffff9c, &(0x7f00000003c0)='./file0/file2\x00', 0x1000) 3.010837332s ago: executing program 0 (id=283): r0 = syz_usb_connect(0x5, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000751c0110e60f00989ad1010203010902240001000000000904290202b48cbb0009050402100000fa000905820240"], 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f00000017c0)={0x34, &(0x7f00000005c0)={0x40, 0x15, 0x6, "04c7d7c442e4"}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(r0, &(0x7f00000001c0)={0x14, 0x0, 0x0}, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) 738.244661ms ago: executing program 3 (id=324): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x6, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0x7, 0x4, 0x5, 0x4, 0x8], 0xffffffff, 0x304}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 671.163113ms ago: executing program 3 (id=325): mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f00000004c0)='./bus\x00', 0x0) mkdir(&(0x7f0000000440)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) chdir(&(0x7f0000000000)='./bus\x00') mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0xffffc000, 0x0) 659.540743ms ago: executing program 3 (id=326): r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000240)=0x9, 0x4) setsockopt$sock_int(r0, 0x1, 0x31, &(0x7f0000001600), 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0xe22, 0x0, @empty, 0x80002}, 0x1c) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) close_range(r1, 0xffffffffffffffff, 0x0) 642.615074ms ago: executing program 3 (id=328): sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000100)={0x44, 0x2, 0x6, 0x801, 0x0, 0x0, {0x0, 0x0, 0x40}, [@IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:ip,mark\x00'}]}, 0x44}}, 0x0) r0 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r0) readv(0xffffffffffffffff, &(0x7f0000000200)=[{&(0x7f0000000100)=""/35, 0x23}], 0x1) ptrace$setregs(0xd, r0, 0x2, &(0x7f0000000180)) ptrace$cont(0x21, r0, 0x5, 0x4) 600.138055ms ago: executing program 3 (id=329): r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000140), 0x452c00, 0x0) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, 0x0) syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) syz_io_uring_setup(0x48a9, &(0x7f0000000100)={0x0, 0xf40, 0x20, 0xffffffff, 0xab}, 0x0, 0x0, 0x0) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f00005f5000)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="020300091b0000000000000000000000040003000000000000000000000000000000000000000000000000000000000005000600000000000a00000000000000fe8000000000000000000000000000bb00000000000000000400040000000000000000000000000000000000000000000000000000000000020001000000000000000000000000ff05000500000000000a00000000000000fe8896380000000000000001000000010000000000000000030007000000000002004e24ac14141f0000000000000000020013"], 0xd8}}, 0x0) 242.121464ms ago: executing program 1 (id=339): symlink(&(0x7f0000000040)='.\x00', &(0x7f0000000100)='./file0\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdir(&(0x7f00000004c0)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000140)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@index_on}]}) chdir(&(0x7f0000000000)='./bus\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) 221.224025ms ago: executing program 1 (id=340): mkdir(&(0x7f0000000000)='my_tracefs\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='my_tracefs\x00', &(0x7f0000000300)='tracefs\x00', 0x0, 0x0) lchown(&(0x7f0000000040)='my_tracefs/events/task/task_rename/filter\x00', 0x0, 0x0) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) read$FUSE(r0, 0x0, 0x0) 207.152365ms ago: executing program 1 (id=341): r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0x1b) ioctl$KVM_IOEVENTFD(0xffffffffffffffff, 0x4040ae79, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x2, 0x7fff7ffc}]}) close_range(r1, 0xffffffffffffffff, 0x200000000000000) 191.538635ms ago: executing program 1 (id=342): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_CAP_HYPERV_SYNIC2(r2, 0x4068aea3, &(0x7f0000000040)) ioctl$KVM_SET_GSI_ROUTING(r1, 0x4008ae6a, &(0x7f0000000100)={0x1, 0x0, [{0x10, 0x4, 0x0, 0x0, @sint}]}) 169.715196ms ago: executing program 4 (id=343): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r1, 0x0) connect$inet6(r0, &(0x7f0000000140)={0xa, 0x4e22, 0x23, @loopback, 0x23}, 0x1c) accept4(r1, &(0x7f0000000380)=@generic, 0x0, 0x80000) 150.798096ms ago: executing program 4 (id=344): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = syz_open_dev$usbfs(&(0x7f0000000140), 0x77, 0x3501) ioctl$USBDEVFS_SUBMITURB(r0, 0x8038550a, &(0x7f0000000000)=@urb_type_control={0x2, {}, 0x0, 0x24, &(0x7f00000004c0)={0x0, 0x3, 0x4, 0x3}, 0x8, 0x0, 0x8, 0x0, 0x0, 0x20, 0x0}) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) ioctl$USBDEVFS_REAPURB(r0, 0x4004550d, 0x0) 138.053707ms ago: executing program 4 (id=345): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0xfc, "2af01c3d0040fbffffffffffffff00"}) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSTI(r1, 0x5412, &(0x7f0000000180)=0x13) ioctl$TCSETS(r1, 0x5402, &(0x7f0000000240)={0xfffffffa, 0x0, 0x8f, 0x8000, 0x4, "db000000000000039752b768e08ee2df361089"}) ioctl$TIOCSTI(r1, 0x5412, &(0x7f0000000200)=0xa) 124.062697ms ago: executing program 1 (id=346): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x181403, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_SET_GUEST_DEBUG_x86(r2, 0x4048ae9b, &(0x7f0000000300)={0x9f634221288b0807, 0x0, {[0x473a, 0x3, 0x7effdfff, 0x800000000005, 0x100200020, 0x9, 0xfffffffffffffffe, 0x3]}}) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe5000/0x18000)=nil, &(0x7f0000000380)=[@text16={0x10, &(0x7f0000000280)="0f01f666b8810000000f23c80f21f86635040040000f23f80f35c4c3c544715ef966b9800000c00f326635000100000f30f30f20a70f23d60f22630f20e06635040000000f22e00f35", 0x49}], 0x1, 0x40, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 116.109387ms ago: executing program 4 (id=347): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000006ffc)=0x4000000000000200, 0xe50fb6c50bc849c9) socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000040)=0x14) bind$packet(r0, &(0x7f0000000000)={0x11, 0x0, r2, 0x1, 0x0, 0x6, @link_local}, 0x14) sendto$inet6(r0, &(0x7f0000000580)="02043c0001000000010e0200c52cf7c20675e005b02f0800eb2b2ff0dadb897c6b112002faffffff3066090cb600c5471d130aaf14c85443b705ca7952ad90e59066321a54e7", 0x46, 0x40001, 0x0, 0x0) 88.110078ms ago: executing program 4 (id=348): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f000014f000/0x18000)=nil, &(0x7f0000000080)=[@text16={0x10, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_SET_NESTED_STATE(r2, 0x4080aebf, 0x0) ioctl$KVM_GET_NESTED_STATE(r2, 0xc080aebe, 0x0) 40.340139ms ago: executing program 4 (id=349): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) write$tun(r0, &(0x7f0000000200)={@val={0x0, 0x88a8}, @void, @eth={@multicast, @remote, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x3, 0x2f, 0x28, 0x65, 0x0, 0x1b, 0x6, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @remote}, {{0x4e21, 0x4e21, 0x41424344, 0x41424344, 0x1, 0x0, 0x5, 0x40, 0x2, 0x0, 0x2}}}}}}}, 0x3a) 26.297409ms ago: executing program 3 (id=350): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000280)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) ioctl$TUNSETLINK(r1, 0x400454cd, 0x20) r2 = dup(r0) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) 0s ago: executing program 1 (id=351): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x902, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000bfe000/0x400000)=nil) r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f0000000280)={0x0, &(0x7f0000000040)=[@cpuid={0x64, 0x18, {0x40000000, 0x801}}], 0x18}) ioctl$KVM_SET_CPUID2(r3, 0x4008ae90, &(0x7f00000001c0)={0x2, 0x0, [{0xb, 0x1, 0x1, 0x6, 0x8, 0x2006}, {0x0, 0xffff0002, 0x4, 0xb, 0x800007, 0x5, 0x80}]}) ioctl$KVM_RUN(r3, 0xae80, 0x0) kernel console output (not intermixed with test programs): syzkaller syzkaller login: [ 13.802781][ T36] kauditd_printk_skb: 25 callbacks suppressed [ 13.802801][ T36] audit: type=1400 audit(1785954472.190:59): avc: denied { transition } for pid=231 comm="sshd-session" path="/bin/sh" dev="sda1" ino=90 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 13.807514][ T36] audit: type=1400 audit(1785954472.190:60): avc: denied { noatsecure } for pid=231 comm="sshd-session" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 13.811001][ T36] audit: type=1400 audit(1785954472.190:61): avc: denied { write } for pid=231 comm="sh" path="pipe:[2672]" dev="pipefs" ino=2672 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 13.814821][ T36] audit: type=1400 audit(1785954472.190:62): avc: denied { rlimitinh } for pid=231 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 13.818155][ T36] audit: type=1400 audit(1785954472.190:63): avc: denied { siginh } for pid=231 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 Warning: Permanently added '10.128.0.123' (ED25519) to the list of known hosts. [ 21.457622][ T36] audit: type=1400 audit(1785954479.840:64): avc: denied { mounton } for pid=286 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 21.458884][ T286] cgroup: Unknown subsys name 'net' [ 21.481707][ T36] audit: type=1400 audit(1785954479.840:65): avc: denied { mount } for pid=286 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 21.509670][ T36] audit: type=1400 audit(1785954479.870:66): avc: denied { unmount } for pid=286 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 21.509876][ T286] cgroup: Unknown subsys name 'devices' [ 21.643032][ T286] cgroup: Unknown subsys name 'hugetlb' [ 21.648712][ T286] cgroup: Unknown subsys name 'rlimit' [ 21.752820][ T36] audit: type=1400 audit(1785954480.140:67): avc: denied { setattr } for pid=286 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 21.777027][ T36] audit: type=1400 audit(1785954480.140:68): avc: denied { mounton } for pid=286 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 21.802494][ T36] audit: type=1400 audit(1785954480.140:69): avc: denied { mount } for pid=286 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 21.833279][ T288] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 21.842637][ T36] audit: type=1400 audit(1785954480.230:70): avc: denied { relabelto } for pid=288 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.869217][ T36] audit: type=1400 audit(1785954480.230:71): avc: denied { write } for pid=288 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.901470][ T36] audit: type=1400 audit(1785954480.290:72): avc: denied { read } for pid=286 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.902008][ T286] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 21.927469][ T36] audit: type=1400 audit(1785954480.290:73): avc: denied { open } for pid=286 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.741190][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.748269][ T293] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.755605][ T293] bridge_slave_0: entered allmulticast mode [ 22.761960][ T293] bridge_slave_0: entered promiscuous mode [ 22.768759][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.776007][ T293] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.783247][ T293] bridge_slave_1: entered allmulticast mode [ 22.789487][ T293] bridge_slave_1: entered promiscuous mode [ 22.846582][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.853776][ T294] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.860973][ T294] bridge_slave_0: entered allmulticast mode [ 22.867213][ T294] bridge_slave_0: entered promiscuous mode [ 22.876587][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.883945][ T294] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.891042][ T294] bridge_slave_1: entered allmulticast mode [ 22.897226][ T294] bridge_slave_1: entered promiscuous mode [ 22.961553][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.968805][ T295] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.976032][ T295] bridge_slave_0: entered allmulticast mode [ 22.982534][ T295] bridge_slave_0: entered promiscuous mode [ 22.992173][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.999322][ T295] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.006434][ T295] bridge_slave_1: entered allmulticast mode [ 23.012774][ T295] bridge_slave_1: entered promiscuous mode [ 23.018861][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.026054][ T296] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.033192][ T296] bridge_slave_0: entered allmulticast mode [ 23.039381][ T296] bridge_slave_0: entered promiscuous mode [ 23.046258][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.053382][ T296] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.060454][ T296] bridge_slave_1: entered allmulticast mode [ 23.067207][ T296] bridge_slave_1: entered promiscuous mode [ 23.202030][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.209377][ T294] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.216963][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.224675][ T294] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.245370][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.252726][ T296] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.260329][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.267672][ T296] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.279086][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.286328][ T293] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.293706][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.300754][ T293] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.315126][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.322247][ T295] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.330969][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.338373][ T295] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.388270][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.395739][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.403984][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.411445][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.419081][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.426963][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.434545][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.442218][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.466167][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.473252][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.481196][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.488237][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.496332][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.503423][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.511088][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.518137][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.541992][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.549086][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.556948][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.564021][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.572812][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.580564][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.612808][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.620039][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.637416][ T294] veth0_vlan: entered promiscuous mode [ 23.643817][ T295] veth0_vlan: entered promiscuous mode [ 23.677435][ T295] veth1_macvtap: entered promiscuous mode [ 23.684875][ T296] veth0_vlan: entered promiscuous mode [ 23.692065][ T294] veth1_macvtap: entered promiscuous mode [ 23.708970][ T293] veth0_vlan: entered promiscuous mode [ 23.727161][ T293] veth1_macvtap: entered promiscuous mode [ 23.740223][ T296] veth1_macvtap: entered promiscuous mode [ 23.767581][ T295] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 23.848237][ T318] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 23.861446][ T321] netlink: 'syz.3.4': attribute type 8 has an invalid length. [ 23.896586][ T321] netlink: 'syz.3.4': attribute type 32 has an invalid length. [ 24.301932][ T361] process 'syz.3.15' launched './file1' with NULL argv: empty string added [ 24.608642][ T379] input: syz1 as /devices/virtual/input/input4 [ 24.639919][ T381] netlink: 12 bytes leftover after parsing attributes in process `syz.2.23'. [ 24.665347][ T383] loop3: detected capacity change from 0 to 7 [ 24.672091][ C0] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 24.681549][ C0] Buffer I/O error on dev loop3, logical block 0, async page read [ 24.689909][ C0] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 24.699083][ C0] Buffer I/O error on dev loop3, logical block 0, async page read [ 24.707298][ T383] loop3: unable to read partition table [ 24.720748][ T383] loop_reread_partitions: partition scan of loop3 (Wý* %4FLQk݊5) failed (rc=-5) [ 24.730732][ C1] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 24.742089][ C1] Buffer I/O error on dev loop3, logical block 0, async page read [ 24.751274][ C1] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 24.760508][ C1] Buffer I/O error on dev loop3, logical block 0, async page read [ 24.770603][ C1] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 24.779840][ C1] Buffer I/O error on dev loop3, logical block 0, async page read [ 24.788439][ C1] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 24.797617][ C1] Buffer I/O error on dev loop3, logical block 0, async page read [ 24.806030][ C0] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 24.815268][ C0] Buffer I/O error on dev loop3, logical block 0, async page read [ 24.850513][ T385] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=385 comm=syz.1.25 [ 24.890674][ T10] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 25.045751][ T10] usb 1-1: New USB device found, idVendor=04e8, idProduct=6889, bcdDevice= 1.00 [ 25.058470][ T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 25.081837][ T10] usb 1-1: Product: syz [ 25.086163][ T10] usb 1-1: Manufacturer: syz [ 25.091055][ T10] usb 1-1: SerialNumber: syz [ 25.829185][ T309] Bluetooth: hci0: Frame reassembly failed (-84) [ 25.848777][ T433] netlink: 'syz.1.44': attribute type 2 has an invalid length. [ 25.856820][ T433] netlink: 8 bytes leftover after parsing attributes in process `syz.1.44'. [ 26.012576][ T442] kvm: vcpu 2: requested lapic timer restore with starting count register 0x390=3835797286 (7671594572 ns) > initial count (4918772610 ns). Using initial count to start timer. [ 26.031147][ T442] kvm: vcpu 2: requested lapic timer restore with starting count register 0x390=2527804186 (323558935808 ns) > initial count (117850194176 ns). Using initial count to start timer. [ 26.350704][ T45] usb 2-1: new full-speed USB device number 2 using dummy_hcd [ 26.512360][ T45] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 26.523624][ T45] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 26.534028][ T45] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a5, bcdDevice= 0.40 [ 26.543205][ T45] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 26.551608][ T45] usb 2-1: SerialNumber: syz [ 26.558734][ T45] usb 2-1: bad CDC descriptors [ 26.563959][ T45] usb-storage 2-1:1.0: USB Mass Storage device detected [ 26.572252][ T45] usb-storage 2-1:1.0: Quirks match for vid 0525 pid a4a5: 10000 [ 26.581003][ T45] scsi host1: usb-storage 2-1:1.0 [ 26.620744][ T31] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 26.770671][ T31] usb 4-1: Using ep0 maxpacket: 32 [ 26.777188][ T31] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 26.787859][ T31] usb 4-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 26.796952][ T31] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 26.805518][ T31] usb 4-1: config 0 descriptor?? [ 26.812129][ T31] hub 4-1:0.0: bad descriptor, ignoring hub [ 26.818158][ T31] hub 4-1:0.0: probe with driver hub failed with error -5 [ 27.545303][ T36] kauditd_printk_skb: 83 callbacks suppressed [ 27.545322][ T36] audit: type=1400 audit(1785954485.930:157): avc: denied { read } for pid=461 comm="syz.3.54" name="binder0" dev="binder" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 27.548759][ T462] rust_binder: 461:462 no such ref 0 [ 27.551839][ T36] audit: type=1400 audit(1785954485.930:158): avc: denied { open } for pid=461 comm="syz.3.54" path="/dev/binderfs/binder0" dev="binder" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 27.583340][ T31] rust_binder: 461: undelivered transaction 1, process died [ 27.603867][ T36] audit: type=1400 audit(1785954485.930:159): avc: denied { ioctl } for pid=461 comm="syz.3.54" path="/dev/binderfs/binder0" dev="binder" ino=13 ioctlcmd=0x620d scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 27.619406][ T45] usb 1-1: USB disconnect, device number 2 [ 27.636717][ T36] audit: type=1400 audit(1785954485.930:160): avc: denied { set_context_mgr } for pid=461 comm="syz.3.54" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 27.644970][ T453] rust_binder: 461: undelivered TRANSACTION_COMPLETE [ 27.687779][ T36] audit: type=1400 audit(1785954485.930:161): avc: denied { map } for pid=461 comm="syz.3.54" path="/dev/binderfs/binder0" dev="binder" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 27.741282][ T36] audit: type=1400 audit(1785954485.930:162): avc: denied { write } for pid=461 comm="syz.3.54" name="binder0" dev="binder" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 27.766463][ T36] audit: type=1400 audit(1785954485.930:163): avc: denied { call } for pid=461 comm="syz.3.54" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 27.788228][ T36] audit: type=1400 audit(1785954485.930:164): avc: denied { transfer } for pid=461 comm="syz.3.54" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 27.900968][ T431] Bluetooth: hci0: command 0x1003 tx timeout [ 27.901867][ T54] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 27.983272][ T36] audit: type=1400 audit(1785954486.370:165): avc: denied { create } for pid=492 comm="syz.0.64" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 28.020677][ T36] audit: type=1400 audit(1785954486.390:166): avc: denied { setopt } for pid=492 comm="syz.0.64" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 28.463524][ T531] netlink: 12 bytes leftover after parsing attributes in process `syz.1.88'. [ 28.480749][ T45] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 28.520701][ T470] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 28.652106][ T45] usb 1-1: unable to get BOS descriptor or descriptor too short [ 28.665544][ T45] usb 1-1: config 1 has an invalid descriptor of length 1, skipping remainder of the config [ 28.684438][ T45] usb 1-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 28.697914][ T470] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 28.710144][ T10] usb 2-1: USB disconnect, device number 2 [ 28.710282][ T45] usb 1-1: too many endpoints for config 1 interface 1 altsetting 1: 48, using maximum allowed: 30 [ 28.727187][ T470] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 28.737677][ T470] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 28.750891][ T45] usb 1-1: config 1 interface 1 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 48 [ 28.764002][ T470] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 28.773148][ T470] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 28.782801][ T470] usb 3-1: config 0 descriptor?? [ 28.788702][ T45] usb 1-1: New USB device found, idVendor=1235, idProduct=800c, bcdDevice= 0.40 [ 28.798803][ T45] usb 1-1: New USB device strings: Mfr=1, Product=21, SerialNumber=3 [ 28.807008][ T45] usb 1-1: Product: syz [ 28.811328][ T45] usb 1-1: Manufacturer: syz [ 28.816063][ T45] usb 1-1: SerialNumber: syz [ 29.028487][ T45] snd-usb-audio 1-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 29.039333][ T45] usb 1-1: USB disconnect, device number 3 [ 29.050777][ T315] udevd[315]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 29.192455][ T470] plantronics 0003:047F:FFFF.0001: unknown main item tag 0xd [ 29.201215][ T470] plantronics 0003:047F:FFFF.0001: No inputs registered, leaving [ 29.213929][ T470] plantronics 0003:047F:FFFF.0001: hiddev96,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.2-1/input0 [ 29.462101][ T10] usb 3-1: USB disconnect, device number 2 [ 29.750287][ T577] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 29.758863][ T577] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 29.810706][ T9] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 29.840777][ T311] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 29.961950][ T9] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 29.973186][ T9] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 29.990829][ T9] usb 1-1: New USB device found, idVendor=054c, idProduct=0df2, bcdDevice=d6.af [ 30.000058][ T9] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 30.011542][ T311] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 30.022794][ T9] usb 1-1: config 0 descriptor?? [ 30.027821][ T311] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 30.038516][ T311] usb 2-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 30.047646][ T311] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 30.056730][ T311] usb 2-1: config 0 descriptor?? [ 30.380528][ T346] bridge_slave_1: left allmulticast mode [ 30.386316][ T346] bridge_slave_1: left promiscuous mode [ 30.392762][ T346] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.401328][ T346] bridge_slave_0: left allmulticast mode [ 30.416856][ T346] bridge_slave_0: left promiscuous mode [ 30.430767][ T346] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.447526][ T9] playstation 0003:054C:0DF2.0002: unknown main item tag 0x0 [ 30.457042][ T9] playstation 0003:054C:0DF2.0002: unknown main item tag 0x0 [ 30.471515][ T311] keytouch 0003:0926:3333.0003: fixing up Keytouch IEC report descriptor [ 30.492934][ T9] playstation 0003:054C:0DF2.0002: unknown main item tag 0x0 [ 30.500462][ T9] playstation 0003:054C:0DF2.0002: unknown main item tag 0x0 [ 30.509637][ T311] input: HID 0926:3333 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/0003:0926:3333.0003/input/input6 [ 30.540702][ T9] playstation 0003:054C:0DF2.0002: unknown main item tag 0x0 [ 30.560823][ T9] playstation 0003:054C:0DF2.0002: hidraw0: USB HID v1.01 Device [HID 054c:0df2] on usb-dummy_hcd.0-1/input0 [ 30.592877][ T346] veth1_macvtap: left promiscuous mode [ 30.598478][ T346] veth0_vlan: left promiscuous mode [ 30.617368][ T311] keytouch 0003:0926:3333.0003: input,hidraw1: USB HID v0.00 Keyboard [HID 0926:3333] on usb-dummy_hcd.1-1/input0 [ 30.682463][ T311] usb 2-1: USB disconnect, device number 3 [ 30.829625][ T594] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.836895][ T594] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.844386][ T594] bridge_slave_0: entered allmulticast mode [ 30.851485][ T9] playstation 0003:054C:0DF2.0002: Failed to retrieve feature with reportID 32: -71 [ 30.854036][ T594] bridge_slave_0: entered promiscuous mode [ 30.861295][ T9] playstation 0003:054C:0DF2.0002: Failed to retrieve DualSense firmware info: -71 [ 30.876527][ T9] playstation 0003:054C:0DF2.0002: Failed to get firmware info from DualSense [ 30.877781][ T594] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.885501][ T9] playstation 0003:054C:0DF2.0002: Failed to create dualsense. [ 30.910731][ T594] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.911147][ T9] playstation 0003:054C:0DF2.0002: probe with driver playstation failed with error -71 [ 30.927928][ T594] bridge_slave_1: entered allmulticast mode [ 30.933764][ T9] usb 1-1: USB disconnect, device number 4 [ 30.941170][ T594] bridge_slave_1: entered promiscuous mode [ 31.032823][ T594] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.040087][ T594] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.047451][ T594] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.054625][ T594] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.080926][ T309] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.088453][ T309] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.098966][ T309] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.106153][ T309] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.123830][ T309] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.130926][ T309] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.156342][ T594] veth0_vlan: entered promiscuous mode [ 31.171713][ T594] veth1_macvtap: entered promiscuous mode [ 31.517781][ T638] batadv_slave_0: entered promiscuous mode [ 31.524916][ T637] batadv_slave_0: left promiscuous mode [ 31.652894][ T654] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 31.662194][ T654] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 31.860674][ T63] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 31.883379][ T669] syzkaller1: entered promiscuous mode [ 31.889125][ T669] syzkaller1: entered allmulticast mode [ 32.020724][ T63] usb 2-1: Using ep0 maxpacket: 32 [ 32.027705][ T63] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 32.038859][ T63] usb 2-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 32.048092][ T63] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 32.056821][ T63] usb 2-1: config 0 descriptor?? [ 32.062970][ T63] hub 2-1:0.0: USB hub found [ 32.266179][ T63] hub 2-1:0.0: 1 port detected [ 32.577354][ T36] kauditd_printk_skb: 50 callbacks suppressed [ 32.577375][ T36] audit: type=1400 audit(1785954490.960:217): avc: denied { append } for pid=693 comm="syz.4.154" name="kvm" dev="devtmpfs" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 32.948785][ T36] audit: type=1400 audit(1785954491.330:218): avc: denied { setopt } for pid=704 comm="syz.4.158" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 33.073348][ T31] usb 2-1: USB disconnect, device number 4 [ 33.079301][ T63] hub 2-1:0.0: hub_ext_port_status failed (err = -71) [ 33.168219][ T717] netlink: 'syz.3.163': attribute type 12 has an invalid length. [ 33.329215][ T36] audit: type=1400 audit(1785954491.710:219): avc: denied { mounton } for pid=725 comm="syz.3.166" path="/58/file0" dev="fuse" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=file permissive=1 [ 33.382084][ T36] audit: type=1400 audit(1785954491.760:220): avc: denied { name_bind } for pid=731 comm="syz.0.168" src=20000 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=tcp_socket permissive=1 [ 33.412469][ T36] audit: type=1400 audit(1785954491.760:221): avc: denied { node_bind } for pid=731 comm="syz.0.168" saddr=224.0.0.2 src=20000 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 33.465709][ T36] audit: type=1400 audit(1785954491.850:222): avc: denied { read } for pid=735 comm="syz.4.171" name="vga_arbiter" dev="devtmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1 [ 33.490396][ T36] audit: type=1400 audit(1785954491.850:223): avc: denied { open } for pid=735 comm="syz.4.171" path="/dev/vga_arbiter" dev="devtmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1 [ 33.550391][ T36] audit: type=1400 audit(1785954491.930:224): avc: denied { create } for pid=741 comm="syz.0.183" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 33.579024][ T36] audit: type=1400 audit(1785954491.930:225): avc: denied { ioctl } for pid=741 comm="syz.0.183" path="socket:[6733]" dev="sockfs" ino=6733 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 33.628324][ T36] audit: type=1326 audit(1785954492.000:226): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=745 comm="syz.4.175" exe="/root/ci2-android-6-12-rust/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f488f19e019 code=0x0 [ 33.887727][ T766] rust_binder: 765:766 failed to claim space for a BINDER_TYPE_PTR (offset: 112, limit: 128, size: 123) [ 33.899116][ T766] rust_binder: 765:766 error while translating object: EINVAL [ 33.907141][ T766] rust_binder: Failure in copy_transaction_data: EINVAL [ 33.907162][ T766] rust_binder: 765:766 transaction call to 765:0 failed EINVAL, code 0 size 88-24 [ 33.926485][ T31] rust_binder: 765: undelivered TRANSACTION_ERROR: 29201 [ 34.385622][ T789] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 34.394263][ T789] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 34.997082][ T820] netlink: 16 bytes leftover after parsing attributes in process `syz.3.208'. [ 35.017971][ T824] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 35.026749][ T824] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 35.074945][ T826] syzkaller1: entered promiscuous mode [ 35.080457][ T826] syzkaller1: entered allmulticast mode [ 35.240673][ T10] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 35.391925][ T10] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 35.403227][ T10] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 35.413108][ T10] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 35.426360][ T10] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 35.435460][ T10] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 35.444375][ T10] usb 1-1: config 0 descriptor?? [ 35.647003][ T851] netlink: 1347 bytes leftover after parsing attributes in process `syz.1.221'. [ 35.838849][ T869] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 35.863827][ T10] plantronics 0003:047F:FFFF.0004: unknown main item tag 0x0 [ 35.871443][ T10] plantronics 0003:047F:FFFF.0004: unknown main item tag 0x0 [ 35.879491][ T10] plantronics 0003:047F:FFFF.0004: unknown main item tag 0x0 [ 35.889071][ T10] plantronics 0003:047F:FFFF.0004: unknown main item tag 0x0 [ 35.896683][ T10] plantronics 0003:047F:FFFF.0004: unknown main item tag 0x0 [ 35.901761][ T873] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 35.904264][ T10] plantronics 0003:047F:FFFF.0004: unknown main item tag 0x0 [ 35.913316][ T31] usb 2-1: new full-speed USB device number 5 using dummy_hcd [ 35.920170][ T10] plantronics 0003:047F:FFFF.0004: unknown main item tag 0x0 [ 35.928162][ T873] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 35.935256][ T10] plantronics 0003:047F:FFFF.0004: unknown main item tag 0x0 [ 35.950414][ T10] plantronics 0003:047F:FFFF.0004: unknown main item tag 0x0 [ 35.958079][ T10] plantronics 0003:047F:FFFF.0004: No inputs registered, leaving [ 35.969385][ T10] plantronics 0003:047F:FFFF.0004: hiddev96,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.0-1/input0 [ 36.091901][ T31] usb 2-1: config 0 has an invalid interface number: 251 but max is 0 [ 36.100360][ T31] usb 2-1: config 0 has no interface number 0 [ 36.108150][ T31] usb 2-1: New USB device found, idVendor=0b95, idProduct=172a, bcdDevice=f7.f4 [ 36.117341][ T31] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 36.125380][ T31] usb 2-1: Product: syz [ 36.129629][ T31] usb 2-1: Manufacturer: syz [ 36.134249][ T31] usb 2-1: SerialNumber: syz [ 36.139443][ T31] usb 2-1: config 0 descriptor?? [ 36.147640][ T10] usb 1-1: USB disconnect, device number 5 [ 36.502209][ T883] netlink: 12 bytes leftover after parsing attributes in process `syz.3.235'. [ 36.513720][ T883] netlink: 20 bytes leftover after parsing attributes in process `syz.3.235'. [ 36.555354][ T31] asix 2-1:0.251 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 36.576290][ T31] asix 2-1:0.251 (unnamed net_device) (uninitialized): Failed to read MAC address: -71 [ 36.592452][ T31] asix 2-1:0.251: probe with driver asix failed with error -5 [ 36.608646][ T31] usb 2-1: USB disconnect, device number 5 [ 36.800307][ T31] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 36.822137][ T31] hid-generic 0000:0000:0000.0005: hidraw0: HID v0.00 Device [syz1] on syz0 [ 36.939647][ T900] kvm: kvm [897]: vcpu6, guest rIP: 0x9139 Unhandled WRMSR(0xc1) = 0xe50000000000 [ 36.949761][ T900] kvm: kvm [897]: vcpu6, guest rIP: 0x9139 Unhandled WRMSR(0xc2) = 0xe50000000000 [ 36.962864][ T900] kvm: kvm [897]: vcpu6, guest rIP: 0x9139 Unhandled WRMSR(0x11e) = 0xe500be702111 [ 36.978835][ T900] kvm: kvm [897]: vcpu6, guest rIP: 0x9139 Unhandled WRMSR(0x186) = 0xe50000000000 [ 36.988686][ T900] kvm: kvm [897]: vcpu6, guest rIP: 0x9139 Unhandled WRMSR(0x187) = 0xe50000000000 [ 37.609885][ T36] kauditd_printk_skb: 27 callbacks suppressed [ 37.609905][ T36] audit: type=1400 audit(1785954495.990:254): avc: denied { create } for pid=945 comm="syz.0.261" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 37.635843][ T36] audit: type=1400 audit(1785954496.000:255): avc: denied { setopt } for pid=945 comm="syz.0.261" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 37.673809][ T346] Bluetooth: hci0: Frame reassembly failed (-84) [ 37.782558][ T954] 9pnet: p9_errstr2errno: server reported unknown error 0x0000 [ 37.853456][ T959] SELinux: failed to load policy [ 37.853552][ T36] audit: type=1400 audit(1785954496.240:256): avc: denied { load_policy } for pid=958 comm="syz.4.267" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=security permissive=1 [ 37.924002][ T36] audit: type=1400 audit(1785954496.310:257): avc: denied { connect } for pid=965 comm="syz.4.270" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 37.943890][ T309] tipc: Subscription rejected, illegal request [ 37.995238][ T972] syzkaller1: entered promiscuous mode [ 38.001867][ T972] syzkaller1: entered allmulticast mode [ 38.023908][ T975] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=198462431 (396924862 ns) > initial count (148514 ns). Using initial count to start timer. [ 38.041638][ T977] tipc: Started in network mode [ 38.046546][ T977] tipc: Node identity ac14140f, cluster identity 4711 [ 38.053957][ T977] tipc: New replicast peer: 255.255.255.255 [ 38.061996][ T977] tipc: Enabled bearer , priority 10 [ 38.083409][ T36] audit: type=1400 audit(1785954496.470:258): avc: denied { view } for pid=979 comm="syz.4.276" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=key permissive=1 [ 38.134996][ T9] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 38.159294][ T9] hid-generic 0000:0000:0000.0006: hidraw0: HID v0.00 Device [syz1] on syz0 [ 38.530685][ T63] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 38.680648][ T63] usb 1-1: Using ep0 maxpacket: 16 [ 38.687226][ T63] usb 1-1: config 0 has an invalid interface number: 41 but max is 0 [ 38.695575][ T63] usb 1-1: config 0 has no interface number 0 [ 38.701991][ T63] usb 1-1: config 0 interface 41 altsetting 2 bulk endpoint 0x4 has invalid maxpacket 16 [ 38.711883][ T63] usb 1-1: config 0 interface 41 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 64 [ 38.721931][ T63] usb 1-1: config 0 interface 41 has no altsetting 0 [ 38.730011][ T63] usb 1-1: New USB device found, idVendor=0fe6, idProduct=9800, bcdDevice=d1.9a [ 38.739220][ T63] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 38.747391][ T63] usb 1-1: Product: syz [ 38.751632][ T63] usb 1-1: Manufacturer: syz [ 38.756305][ T63] usb 1-1: SerialNumber: syz [ 38.761902][ T63] usb 1-1: config 0 descriptor?? [ 38.767175][ T998] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 38.774373][ T998] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 38.984881][ T998] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 38.992913][ T998] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 39.126108][ T1010] netlink: 679 bytes leftover after parsing attributes in process `syz.1.289'. [ 39.148207][ T36] audit: type=1400 audit(1785954497.530:259): avc: denied { mount } for pid=1011 comm="syz.1.290" name="/" dev="ramfs" ino=8499 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ramfs_t tclass=filesystem permissive=1 [ 39.180721][ T31] tipc: Node number set to 2886997007 [ 39.212651][ T1018] netlink: 4 bytes leftover after parsing attributes in process `syz.4.293'. [ 39.245898][ T36] audit: type=1400 audit(1785954497.630:260): avc: denied { create } for pid=1019 comm="syz.4.294" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 39.266529][ T36] audit: type=1400 audit(1785954497.650:261): avc: denied { write } for pid=1019 comm="syz.4.294" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 39.283400][ T1020] dummy_hcd dummy_hcd.0: remove, state 1 [ 39.293645][ T1020] usb usb1: USB disconnect, device number 1 [ 39.402552][ T63] CoreChips 1-1:0.41 (unnamed net_device) (uninitialized): sr_get_phy_addr : Error reading PHYID register:ffffffed [ 39.416172][ T63] usb 1-1: USB disconnect, device number 6 [ 39.433623][ T1020] dummy_hcd dummy_hcd.0: stopped [ 39.440640][ T1020] dummy_hcd dummy_hcd.0: USB bus 1 deregistered [ 39.479121][ T36] audit: type=1400 audit(1785954497.860:262): avc: denied { setattr } for pid=1023 comm="syz.4.296" name="UDPLITEv6" dev="sockfs" ino=8525 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 39.740645][ T54] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 39.746827][ T431] Bluetooth: hci0: command 0x1003 tx timeout [ 39.772026][ T1033] capability: warning: `syz.3.300' uses 32-bit capabilities (legacy support in use) [ 40.084793][ T1056] Source file dentry negative [ 40.112278][ T1058] syzkaller1: entered promiscuous mode [ 40.121150][ T1058] syzkaller1: entered allmulticast mode [ 40.196918][ T36] audit: type=1400 audit(1785954498.580:263): avc: denied { read } for pid=1059 comm="syz.1.312" name="c_mute_present" dev="configfs" ino=8686 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=file permissive=1 [ 40.374428][ T1072] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. [ 40.463696][ T1078] netlink: 4 bytes leftover after parsing attributes in process `syz.3.320'. [ 40.529599][ T1084] option changes via remount are deprecated (pid=1083 comm=syz.3.323) [ 40.537873][ T1084] cgroup: option or name mismatch, new: 0x2 "noprefix", old: 0x0 "" [ 41.302889][ T998] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN PTI [ 41.315643][ T998] KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] [ 41.324325][ T998] CPU: 0 UID: 0 PID: 998 Comm: syz.0.283 Not tainted syzkaller #0 24d49bbd58fde8b05052ac524e35fadc70590708 [ 41.335721][ T998] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 41.345797][ T998] RIP: 0010:set_link_state+0x2a/0x1240 [ 41.351326][ T998] Code: 55 48 89 e5 41 57 41 56 41 55 41 54 53 48 83 ec 60 49 89 fd 48 bb 00 00 00 00 00 fc ff df e8 5d fe cd fd 4c 89 e8 48 c1 e8 03 <80> 3c 18 00 74 08 4c 89 ef e8 b8 c2 26 fe 4d 8b 75 00 49 8d 95 93 [ 41.370958][ T998] RSP: 0018:ffffc900011ff718 EFLAGS: 00010046 [ 41.377042][ T998] RAX: 0000000000000000 RBX: dffffc0000000000 RCX: ffff88811835a600 [ 41.385016][ T998] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 41.392993][ T998] RBP: ffffc900011ff7a0 R08: 0000000000000003 R09: 0000000000000004 [ 41.400962][ T998] R10: dffffc0000000000 R11: fffff5200023fee0 R12: 0000000000000000 [ 41.409069][ T998] R13: 0000000000000000 R14: 0000000000000000 R15: ffff888107ec8000 [ 41.417211][ T998] FS: 0000000000000000(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 41.426313][ T998] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 41.432900][ T998] CR2: 00007f3426958060 CR3: 000000010e76e000 CR4: 00000000003526b0 [ 41.440887][ T998] DR0: 000000000000473a DR1: 0000000000000003 DR2: 000000007effdfff [ 41.448883][ T998] DR3: 0000800000000005 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 41.456949][ T998] Call Trace: [ 41.460403][ T998] [ 41.463513][ T998] ? __kasan_check_write+0x18/0x20 [ 41.468635][ T998] dummy_pullup+0xd1/0x130 [ 41.473081][ T998] ? __cfi_dummy_pullup+0x10/0x10 [ 41.478153][ T998] usb_gadget_disconnect_locked+0x151/0x400 [ 41.484169][ T998] gadget_unbind_driver+0xaf/0x3f0 [ 41.489291][ T998] ? __cfi_gadget_unbind_driver+0x10/0x10 [ 41.495030][ T998] device_release_driver_internal+0x4ad/0x830 [ 41.501112][ T998] driver_detach+0x1f5/0x2d0 [ 41.505887][ T998] bus_remove_driver+0x254/0x2b0 [ 41.511109][ T998] driver_unregister+0x79/0xb0 [ 41.515977][ T998] usb_gadget_unregister_driver+0x52/0x80 [ 41.521721][ T998] raw_release+0xdb/0x280 [ 41.526191][ T998] ? __cfi_raw_release+0x10/0x10 [ 41.531331][ T998] __fput+0x208/0xa30 [ 41.535348][ T998] ____fput+0x20/0x30 [ 41.539403][ T998] task_work_run+0x1e8/0x260 [ 41.545507][ T998] ? __cfi_task_work_run+0x10/0x10 [ 41.550804][ T998] ? __kasan_check_write+0x18/0x20 [ 41.556006][ T998] do_exit+0xa46/0x2850 [ 41.560281][ T998] ? __cfi_do_exit+0x10/0x10 [ 41.565326][ T998] ? __kasan_check_write+0x18/0x20 [ 41.571036][ T998] ? _raw_spin_lock_irq+0x93/0x120 [ 41.576168][ T998] do_group_exit+0x21f/0x2f0 [ 41.580874][ T998] ? __kasan_check_write+0x18/0x20 [ 41.586112][ T998] ? recalc_sigpending+0x184/0x1d0 [ 41.592033][ T998] get_signal+0x134c/0x1490 [ 41.596745][ T998] arch_do_signal_or_restart+0xbc/0x700 [ 41.602966][ T998] ? __cfi_arch_do_signal_or_restart+0x10/0x10 [ 41.609325][ T998] ? __se_sys_ioctl+0x198/0x1b0 [ 41.614447][ T998] syscall_exit_to_user_mode+0x57/0xb0 [ 41.619924][ T998] do_syscall_64+0x63/0xf0 [ 41.624903][ T998] ? clear_bhb_loop+0x50/0xa0 [ 41.629622][ T998] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 41.635529][ T998] RIP: 0033:0x7f832af9dcab [ 41.640034][ T998] Code: Unable to access opcode bytes at 0x7f832af9dc81. [ 41.647428][ T998] RSP: 002b:00007f832be1af50 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 41.655954][ T998] RAX: fffffffffffffffc RBX: 0000000000000003 RCX: 00007f832af9dcab [ 41.663937][ T998] RDX: 00007f832be1bfe0 RSI: 0000000080085502 RDI: 0000000000000003 [ 41.672105][ T998] RBP: 00007f832b03500c R08: 0000000000000000 R09: 0000000000000000 [ 41.680193][ T998] R10: 0000000000000003 R11: 0000000000000246 R12: 0000000000000000 [ 41.688229][ T998] R13: 00002000000001c0 R14: 00007f832b225fa0 R15: 00007ffe09a19a58 [ 41.696219][ T998] [ 41.699245][ T998] Modules linked in: [ 41.703149][ T998] ---[ end trace 0000000000000000 ]--- [ 41.708604][ T998] RIP: 0010:set_link_state+0x2a/0x1240 [ 41.714100][ T998] Code: 55 48 89 e5 41 57 41 56 41 55 41 54 53 48 83 ec 60 49 89 fd 48 bb 00 00 00 00 00 fc ff df e8 5d fe cd fd 4c 89 e8 48 c1 e8 03 <80> 3c 18 00 74 08 4c 89 ef e8 b8 c2 26 fe 4d 8b 75 00 49 8d 95 93 [ 41.734424][ T998] RSP: 0018:ffffc900011ff718 EFLAGS: 00010046 [ 41.740614][ T998] RAX: 0000000000000000 RBX: dffffc0000000000 RCX: ffff88811835a600 [ 41.748606][ T998] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 41.756580][ T998] RBP: ffffc900011ff7a0 R08: 0000000000000003 R09: 0000000000000004 [ 41.764827][ T998] R10: dffffc0000000000 R11: fffff5200023fee0 R12: 0000000000000000 [ 41.772813][ T998] R13: 0000000000000000 R14: 0000000000000000 R15: ffff888107ec8000 [ 41.780963][ T998] FS: 0000000000000000(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 41.789893][ T998] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 41.796477][ T998] CR2: 00007f3426958060 CR3: 000000010e76e000 CR4: 00000000003526b0 [ 41.804453][ T998] DR0: 000000000000473a DR1: 0000000000000003 DR2: 000000007effdfff [ 41.812877][ T998] DR3: 0000800000000005 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 41.820855][ T998] Kernel panic - not syncing: Fatal exception [ 41.827136][ T998] Kernel Offset: disabled [ 41.831667][ T998] Rebooting in 86400 seconds..