last executing test programs: 1.802417421s ago: executing program 1 (id=2): openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) syz_usb_connect$uac1(0x0, 0xa4, &(0x7f00000001c0)=ANY=[@ANYBLOB="2a01000020000040b708000000000000430109029200030172e5000904000000010100000a24010000000201020c0d240700000500006e626805000c240000e9fffff5ffffffff092403f3ff000005024524", @ANYRES8=r1, @ANYBLOB="05", @ANYRES16=r0, @ANYRES16=r1], 0x0) 1.722730937s ago: executing program 0 (id=1): r0 = syz_open_dev$usbmon(&(0x7f0000000480), 0x20000000003, 0x668d01) dup3(r0, 0xffffffffffffffff, 0x0) io_setup(0x6, &(0x7f0000000540)=0x0) r2 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd/3\x00') io_submit(r1, 0x1, &(0x7f0000000880)=[&(0x7f00000000c0)={0x0, 0x300, 0x0, 0x5, 0x0, r2, 0x0}]) 1.718980347s ago: executing program 2 (id=3): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) creat(&(0x7f00000002c0)='./file0\x00', 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000080)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) stat(&(0x7f0000000900)='./file0\x00', &(0x7f0000000940)) 1.619635445s ago: executing program 2 (id=8): r0 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000000)={[{0x4, 0x200, 0xc2, 0x4f, 0x19, 0x7, 0xc0, 0x9, 0xff, 0x6, 0xc, 0x0, 0x9}, {0x8, 0xa6f2, 0x6, 0xf5, 0x9, 0xff, 0x8, 0x3, 0x4, 0xc, 0x1, 0x6, 0x10005}, {0x1fb, 0x7, 0xd, 0x10, 0x25, 0x9, 0x0, 0xfb, 0x4, 0x15, 0x1, 0x3, 0xf0c}], 0x9}) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0, 0x0) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000200)={[0xfffffffffffffffe, 0x6, 0xfffffffffffffffd, 0x0, 0x10003, 0xfffffffffffffffd, 0x4002004c4, 0x1000, 0x0, 0xfff, 0x10, 0x0, 0x0, 0x0, 0x8, 0x3], 0xeeee8000, 0x2011c0}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 1.540283531s ago: executing program 0 (id=12): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x2179, 0x77, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x3, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x7}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000040)={0x18, &(0x7f0000000100)={0x0, 0x0, 0x8, {0x8, 0x9, "392cdaab4a73"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) 1.471757476s ago: executing program 2 (id=14): bind$tipc(0xffffffffffffffff, 0x0, 0x0) setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0xc, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000280)='gid_map\x00') pread64(r3, &(0x7f0000000080)=""/110, 0x98, 0x5) 596.451744ms ago: executing program 2 (id=17): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) r1 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r1, 0x0, 0x23, &(0x7f0000000740)={@multicast2, @loopback}, 0xc) r2 = socket$netlink(0x10, 0x3, 0x0) writev(r2, &(0x7f00000003c0)=[{&(0x7f0000000380)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fdd411efc40800040000000000000000", 0x39}], 0x1) writev(r2, &(0x7f00000001c0)=[{&(0x7f0000000400)="390000001300034700bb5be1c3e4feff06000000010000004500000025000000190004000400ad000200000000000006040000000000f93132", 0x39}], 0x1) r3 = socket$netlink(0x10, 0x3, 0x0) writev(r3, &(0x7f00000003c0)=[{&(0x7f0000000180)="200000001300034700bb65e1c3e4ffff01000000010000005600000025000000", 0x20}], 0x1) close_range(r0, 0xffffffffffffffff, 0x0) 558.025807ms ago: executing program 2 (id=18): r0 = syz_open_dev$usbfs(&(0x7f0000000100), 0x77, 0x101301) ioctl$USBDEVFS_CONTROL(r0, 0xc0105500, &(0x7f0000000000)={0x80, 0x6, 0x301, 0x0, 0x0, 0x1101, 0x0}) 499.989811ms ago: executing program 2 (id=19): prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x8000000000002) r1 = openat$zero(0xffffffffffffff9c, 0x0, 0x4, 0x0) clock_gettime(0x0, 0x0) write$input_event(r1, 0x0, 0x0) sched_setscheduler(r0, 0x2, &(0x7f0000000240)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000780)='devpts\x00', 0x0, 0x0) mount$binder(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x28, &(0x7f0000000240)={[{}]}) 195.988495ms ago: executing program 3 (id=21): r0 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r0, &(0x7f0000000340)=@nameseq={0x1e, 0x1, 0x3, {0x43, 0x4, 0x4}}, 0x10) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000100)={0x43, 0x0, 0x3, 0x3}, 0x10) sendmsg$tipc(r0, &(0x7f0000000280)={&(0x7f0000000040), 0x10, 0x0}, 0x0) 160.943267ms ago: executing program 1 (id=22): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x1002, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x64, 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 160.633717ms ago: executing program 3 (id=23): r0 = syz_open_dev$loop(&(0x7f0000000440), 0x81, 0x2b82) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000400)='cpuset.effective_cpus\x00', 0x275a, 0x0) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f0000000800)={r1, 0x800, {0x2a00, 0x80010000, 0x0, 0x1, 0x6, 0x0, 0x1, 0x1f, 0x1c, "fee8a2ab78fc179fd1f8a0e91ddaaca7bd6447a4b4e00d9683dda1af1ea09de2b7fb0a0100000000000000000300", "2809e8dbe108598904004ad54afac11d875397bdb22d0000b420a1a93c5240f45f819e01177d3d458dac00000000000000000000002000", "9012000000000000e8ffffff000000000000000000001a00", [0x4, 0x40000000000000]}}) ioctl$LOOP_SET_STATUS64(r0, 0x4c04, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x7, 0x1199, 0x0, 0xa, 0xe, 0x5, "d7472144ecc8c6950a91c1fb3924bc7f053db86b3c99dbf2516fad22dc027ba9cf62f516f0fbb9e2c2042757f2b1bf36e97f0f717ebabff89e48afe21de62d8b", "b567cb1805ece9c61f225d91a88b1d4949ace4d10d44903945f0ad009bac29d1590bef87d5019bcbb927f7156bcf066a958355ac80e89067bb74293bbd9c8701", "b819e584e242be14062fd5f17e486196301dd99277cdf5b41a8cd6cb4b2e04fc", [0x7f, 0x3]}) 115.999191ms ago: executing program 3 (id=24): r0 = getpid() recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f00000001c0)='tasks\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f00000000c0)=r0, 0x12) 115.792841ms ago: executing program 3 (id=25): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x10, 0x0, &(0x7f00000001c0)=[@request_death], 0x4, 0x200000000000000, &(0x7f0000000400)='krK+'}) 115.674781ms ago: executing program 3 (id=26): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_encap(r1, 0x11, 0x64, &(0x7f0000000100)=0x2, 0x4) connect$pppl2tp(r0, &(0x7f0000000300)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x5, 0x0, {0xa, 0x0, 0xf9d, @private2}}}, 0x32) 113.244841ms ago: executing program 3 (id=27): r0 = syz_usb_connect(0x5, 0x59, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000ec1bb2106c04e01401000102030109028f11010000000009046900000e010000182402010202f25d16"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) 93.130723ms ago: executing program 1 (id=28): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x42, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f0000000200)={0x1, 0x0, [{0x80000008, 0x5, 0x3, 0x3, 0x6}]}) 53.579346ms ago: executing program 1 (id=29): r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=ANY=[@ANYBLOB="020b000102"], 0x10}}, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f00000001c0)={0x40000000, 0x0, &(0x7f0000000040)={0x0, 0x70}}, 0x0) capset(0x0, &(0x7f0000000040)={0x0, 0x5, 0xfffffffd}) sendmmsg(r0, &(0x7f0000000180), 0x3ef, 0x0) 0s ago: executing program 1 (id=30): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x3) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000080)=[@text64={0x40, &(0x7f0000000000)="2ef36644f7e62e3e672e450f078f29d095abaa960000b890a4f084ef66bafc0c6d8f297812cf66ba410066ef48b800100000000000000f23d00f21f835100000080f23f866baf80cb88ef01480ef66bafc0c66b80c0066efc7442402d8650000c7442406000000000f011c2466ba4200ec2e64f30f5a8e6c000000", 0x7b}], 0x1, 0x52, &(0x7f0000000200)=[@vmwrite={0x8, 0x0, 0x1, 0x0, 0x0, 0x0, 0x2, 0x0, 0x85200000c}], 0x1) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000240)={[0x3, 0xec, 0x401, 0x3, 0x7, 0x4, 0x8000000000000001, 0x80000001, 0x1, 0x200, 0x4, 0x6, 0x9, 0x10000000003a, 0x9, 0x9], 0x0, 0x2a80}) ioctl$KVM_RUN(r2, 0xae80, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000140)=[@text32={0x20, 0x0}], 0x1, 0x65, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.190' (ED25519) to the list of known hosts. [ 20.263758][ T36] audit: type=1400 audit(1754885504.620:64): avc: denied { mounton } for pid=283 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2022 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 20.264924][ T283] cgroup: Unknown subsys name 'net' [ 20.267037][ T36] audit: type=1400 audit(1754885504.620:65): avc: denied { mount } for pid=283 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 20.270906][ T36] audit: type=1400 audit(1754885504.620:66): avc: denied { unmount } for pid=283 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 20.271036][ T283] cgroup: Unknown subsys name 'devices' [ 20.454480][ T283] cgroup: Unknown subsys name 'hugetlb' [ 20.460087][ T283] cgroup: Unknown subsys name 'rlimit' [ 20.551740][ T36] audit: type=1400 audit(1754885504.900:67): avc: denied { setattr } for pid=283 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 20.574990][ T36] audit: type=1400 audit(1754885504.900:68): avc: denied { mounton } for pid=283 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 20.583039][ T285] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 20.599947][ T36] audit: type=1400 audit(1754885504.900:69): avc: denied { mount } for pid=283 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 20.631711][ T36] audit: type=1400 audit(1754885504.970:70): avc: denied { relabelto } for pid=285 comm="mkswap" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 20.657323][ T36] audit: type=1400 audit(1754885504.970:71): avc: denied { write } for pid=285 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 20.665294][ T283] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 20.683041][ T36] audit: type=1400 audit(1754885505.020:72): avc: denied { read } for pid=283 comm="syz-executor" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 20.717026][ T36] audit: type=1400 audit(1754885505.020:73): avc: denied { open } for pid=283 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.988885][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.995960][ T290] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.003299][ T290] bridge_slave_0: entered allmulticast mode [ 22.009521][ T290] bridge_slave_0: entered promiscuous mode [ 22.017151][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.024293][ T290] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.031355][ T290] bridge_slave_1: entered allmulticast mode [ 22.037692][ T290] bridge_slave_1: entered promiscuous mode [ 22.075067][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.082116][ T293] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.089233][ T293] bridge_slave_0: entered allmulticast mode [ 22.095431][ T293] bridge_slave_0: entered promiscuous mode [ 22.106321][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.113379][ T293] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.120434][ T293] bridge_slave_1: entered allmulticast mode [ 22.126742][ T293] bridge_slave_1: entered promiscuous mode [ 22.151682][ T291] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.158919][ T291] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.166122][ T291] bridge_slave_0: entered allmulticast mode [ 22.172286][ T291] bridge_slave_0: entered promiscuous mode [ 22.180676][ T291] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.187748][ T291] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.194836][ T291] bridge_slave_1: entered allmulticast mode [ 22.201085][ T291] bridge_slave_1: entered promiscuous mode [ 22.235394][ T292] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.242459][ T292] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.249511][ T292] bridge_slave_0: entered allmulticast mode [ 22.255826][ T292] bridge_slave_0: entered promiscuous mode [ 22.263078][ T292] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.270109][ T292] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.277235][ T292] bridge_slave_1: entered allmulticast mode [ 22.283420][ T292] bridge_slave_1: entered promiscuous mode [ 22.384910][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.392070][ T290] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.399400][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.406537][ T290] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.432200][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.439379][ T293] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.446665][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.453702][ T293] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.481031][ T292] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.488095][ T292] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.495575][ T292] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.502612][ T292] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.512217][ T291] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.519304][ T291] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.526600][ T291] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.533639][ T291] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.569291][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.576627][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.583977][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.591351][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.599399][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.606899][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.631609][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.638720][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.646719][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.653803][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.677364][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.684463][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.698582][ T293] veth0_vlan: entered promiscuous mode [ 22.705795][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.712863][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.721249][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.728301][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.746615][ T290] veth0_vlan: entered promiscuous mode [ 22.755774][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.762854][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.779127][ T293] veth1_macvtap: entered promiscuous mode [ 22.807503][ T290] veth1_macvtap: entered promiscuous mode [ 22.826358][ T292] veth0_vlan: entered promiscuous mode [ 22.842881][ T291] veth0_vlan: entered promiscuous mode [ 22.852011][ T293] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 22.872204][ T292] veth1_macvtap: entered promiscuous mode [ 22.893058][ T291] veth1_macvtap: entered promiscuous mode [ 23.071498][ T354] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 23.152823][ T10] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 23.382899][ T73] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 23.546432][ T10] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 23.556900][ T10] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 23.566590][ T10] usb 2-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 23.573531][ T73] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 23.575683][ T10] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=67 [ 23.595441][ T10] usb 2-1: SerialNumber: syz [ 23.599115][ T73] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 23.610154][ T73] usb 1-1: New USB device found, idVendor=2179, idProduct=0077, bcdDevice= 0.00 [ 23.619517][ T73] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 23.628474][ T73] usb 1-1: config 0 descriptor?? [ 23.811911][ T10] usb 2-1: 0:2 : does not exist [ 23.824727][ T10] usb 2-1: USB disconnect, device number 2 [ 23.849661][ T335] udevd[335]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 24.045494][ T73] uclogic 0003:2179:0077.0001: interface is invalid, ignoring [ 24.096567][ T377] netlink: 'syz.2.17': attribute type 4 has an invalid length. [ 24.106701][ T377] netlink: 'syz.2.17': attribute type 4 has an invalid length. [ 24.271797][ T73] usb 1-1: USB disconnect, device number 2 [ 24.508182][ T392] support for the xor transformation has been removed. [ 24.541027][ T397] rust_binder: BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 24.656229][ T407] ------------[ cut here ]------------ [ 24.661744][ T407] WARNING: CPU: 1 PID: 407 at arch/x86/kvm/x86.c:11569 kvm_arch_vcpu_ioctl_run+0x12af/0x1aa0 [ 24.672068][ T407] Modules linked in: [ 24.676185][ T407] CPU: 1 UID: 0 PID: 407 Comm: syz.1.30 Not tainted 6.12.38-syzkaller-gc46482c03ae9 #0 80b02ff89b1607ee1d115e0157270f38c0251e02 [ 24.689452][ T407] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 24.699573][ T407] RIP: 0010:kvm_arch_vcpu_ioctl_run+0x12af/0x1aa0 [ 24.706119][ T407] Code: 7e 3b e8 34 05 6a 00 49 bd 00 00 00 00 00 fc ff df 4c 8b 7c 24 20 4c 8b 64 24 40 48 8b 5c 24 28 e9 26 fd ff ff e8 11 05 6a 00 <0f> 0b e9 e4 fc ff ff e8 05 05 6a 00 0f 0b e9 0e fd ff ff e8 f9 04 [ 24.725794][ T407] RSP: 0018:ffffc9000caff9c0 EFLAGS: 00010283 [ 24.731890][ T407] RAX: ffffffff811bd81f RBX: ffff888114eaa180 RCX: 0000000000080000 [ 24.739908][ T407] RDX: ffffc90001a52000 RSI: 0000000000000045 RDI: 0000000000000046 [ 24.748002][ T407] RBP: ffffc9000caffc70 R08: ffff888114a7cc07 R09: 1ffff1102294f980 [ 24.756027][ T407] R10: dffffc0000000000 R11: ffffed102294f981 R12: ffff8881138f5000 [ 24.764031][ T407] R13: dffffc0000000000 R14: 0000000000000001 R15: ffff888114eaa1f8 [ 24.772017][ T407] FS: 00007f5f27be36c0(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 24.780997][ T407] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 24.787643][ T407] CR2: 000000005200000c CR3: 0000000113050000 CR4: 00000000003526b0 [ 24.795687][ T407] Call Trace: [ 24.798976][ T407] [ 24.801918][ T407] ? __cfi___futex_queue+0x10/0x10 [ 24.807074][ T407] ? futex_wait_setup+0x1bc/0x260 [ 24.812133][ T407] ? __cfi_kvm_arch_vcpu_ioctl_run+0x10/0x10 [ 24.818157][ T407] ? futex_unqueue+0x136/0x160 [ 24.822946][ T407] ? __futex_wait+0x218/0x2a0 [ 24.827664][ T407] ? ioctl_has_perm+0x1aa/0x4d0 [ 24.832569][ T407] ? __asan_memcpy+0x5a/0x80 [ 24.837169][ T407] ? ioctl_has_perm+0x3e0/0x4d0 [ 24.842006][ T407] ? has_cap_mac_admin+0xd0/0xd0 [ 24.847062][ T407] ? __kasan_check_write+0x18/0x20 [ 24.852201][ T407] ? mutex_lock_killable+0x92/0x1c0 [ 24.857456][ T407] ? __cfi_mutex_lock_killable+0x10/0x10 [ 24.863172][ T407] ? futex_wait+0x29a/0x7a0 [ 24.867671][ T407] ? __cfi_futex_wait+0x10/0x10 [ 24.872566][ T407] kvm_vcpu_ioctl+0x96f/0xee0 [ 24.877256][ T407] ? __cfi_kvm_vcpu_ioctl+0x10/0x10 [ 24.882482][ T407] ? do_futex+0x309/0x500 [ 24.886831][ T407] ? __cfi_do_futex+0x10/0x10 [ 24.891555][ T407] ? __fget_files+0x2c5/0x340 [ 24.896290][ T407] ? bpf_lsm_file_ioctl+0xd/0x20 [ 24.901246][ T407] ? security_file_ioctl+0x34/0xd0 [ 24.906449][ T407] ? __cfi_kvm_vcpu_ioctl+0x10/0x10 [ 24.911696][ T407] __se_sys_ioctl+0x132/0x1b0 [ 24.916422][ T407] __x64_sys_ioctl+0x7f/0xa0 [ 24.921022][ T407] x64_sys_call+0x1878/0x2ee0 [ 24.925748][ T407] do_syscall_64+0x58/0xf0 [ 24.930172][ T407] ? clear_bhb_loop+0x50/0xa0 [ 24.934895][ T407] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 24.940887][ T407] RIP: 0033:0x7f5f2918ebe9 [ 24.945418][ T407] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 24.965119][ T407] RSP: 002b:00007f5f27be3038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 24.973577][ T407] RAX: ffffffffffffffda RBX: 00007f5f293b5fa0 RCX: 00007f5f2918ebe9 [ 24.981551][ T407] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005 [ 24.989561][ T407] RBP: 00007f5f29211e19 R08: 0000000000000000 R09: 0000000000000000 [ 24.997583][ T407] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 25.005589][ T407] R13: 00007f5f293b6038 R14: 00007f5f293b5fa0 R15: 00007ffec4de9008 [ 25.013601][ T407] [ 25.016617][ T407] ---[ end trace 0000000000000000 ]--- [ 25.172522][ T375] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 25.322515][ T375] usb 4-1: Using ep0 maxpacket: 16 [ 25.328793][ T375] usb 4-1: config index 0 descriptor too short (expected 4495, got 71) [ 25.337098][ T375] usb 4-1: config 0 has an invalid interface number: 105 but max is 0 [ 25.345291][ T375] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 25.355414][ T375] usb 4-1: config 0 has no interface number 0 [ 25.363056][ T375] usb 4-1: New USB device found, idVendor=046c, idProduct=14e0, bcdDevice= 0.01 [ 25.372187][ T375] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 25.380212][ T375] usb 4-1: Product: syz [ 25.384433][ T375] usb 4-1: Manufacturer: syz [ 25.389008][ T375] usb 4-1: SerialNumber: syz [ 25.394840][ T375] usb 4-1: config 0 descriptor?? [ 27.582168][ T375] usb 4-1: USB disconnect, device number 2