last executing test programs: 2.163196697s ago: executing program 1 (id=168): socket$inet_udp(0x2, 0x2, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) socket$unix(0x1, 0x1, 0x0) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$can_bcm(0x1d, 0x2, 0x2) close_range(r3, r3, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) r5 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r5, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) socketpair$unix(0x1, 0x5, 0x0, 0x0) setsockopt$XDP_TX_RING(r5, 0x11b, 0x3, &(0x7f0000000200)=0x10010, 0x4) io_submit(r4, 0x1, &(0x7f0000000100)=[&(0x7f00000002c0)={0x400000, 0x0, 0x0, 0x0, 0x0, r3, &(0x7f0000000380)="05", 0x1, 0x0, 0x0, 0x2}]) sched_setaffinity(0x0, 0x0, 0x0) 1.244286429s ago: executing program 2 (id=198): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000580)={0x0, 0x0, 0x0}, 0x0) 1.19153539s ago: executing program 2 (id=199): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40000010}, 0x0) 1.191339061s ago: executing program 2 (id=200): write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x2, 0x248, 0x9b99}, 0x25, [0x9, 0x7, 0x5, 0x6, 0x8, 0x155f, 0x10000006, 0x4, 0x2dcd, 0x1, 0xb4, 0xd, 0xa2b9, 0x6, 0x7, 0xe4, 0x6, 0xfc000004, 0x403, 0xbbf, 0x3, 0xfffffffd, 0x101c0, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0xc3, 0x7, 0x81, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x4, 0x4, 0x16, 0x8, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0x80000001, 0xff, 0x0, 0x2, 0x2, 0x2, 0x7, 0x489, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x6, 0x4], [0x9, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x8e, 0xd50, 0x7, 0x5, 0x2, 0x809, 0x4, 0xa7, 0x1000, 0x0, 0x200b398, 0x400080, 0x1, 0x4, 0x1c, 0x7, 0x1, 0x2, 0x3, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x4, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3ff, 0x1ff, 0x1, 0x7fff, 0x1, 0x1cb, 0x9, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0xc, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x5, 0x491, 0x9, 0x200026, 0x8, 0x400, 0x2, 0xffff0000, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0xc, 0x5, 0x9, 0x5, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x10000a, 0x2, 0x400, 0x9, 0x1, 0xd3, 0xa8d, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9d27, 0x10000, 0x1, 0x100, 0x2, 0x6, 0x7ffd, 0x5, 0x3, 0xd500, 0x8, 0x77, 0x9, 0x6, 0x10000, 0xfffffffd, 0x5, 0x1], [0xa772, 0x6, 0x5, 0x1afa, 0xbf8, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x1, 0x7, 0x21, 0x9, 0x81, 0x7, 0x9d87, 0x407, 0xfffffff7, 0x4, 0x140f1, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x100009, 0xc, 0x137, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0x100, 0x8, 0x26e, 0x6, 0xfffffff9, 0x4, 0xfffffff9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x5, 0x8, 0x13fff, 0x1, 0x9]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000ac0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20006854}, 0x800) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) openat$ptp0(0xffffffffffffff9c, &(0x7f00000001c0), 0x200, 0x0) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x6, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x4, 0x5, 0x9, 0x8], 0x25000, 0x304}) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={0x0}}, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = dup(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) 1.19046991s ago: executing program 1 (id=201): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fda000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, &(0x7f0000000040)="366526460f215366b8a8000f00d843a565f20fd011470f06670f07c4e2f9242500200000470f017180650fc77b00650fc132", 0x32}], 0x1, 0x10, 0x0, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fd6000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x4, 0x0, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) 978.270086ms ago: executing program 0 (id=205): fchownat(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x400) r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x4, @tid=r0}, &(0x7f0000000000)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syslog(0x2, &(0x7f00000010c0)=""/4096, 0x1000) 911.697977ms ago: executing program 1 (id=206): mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt\x00', 0x1ff) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f0000000100)='ext4\x00', 0x8410, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x40086607, 0x0) 911.534347ms ago: executing program 1 (id=207): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) ioctl$F2FS_IOC_SET_PIN_FILE(r0, 0x4004f50d, 0x0) 910.681427ms ago: executing program 1 (id=208): r0 = creat(&(0x7f0000000080)='./file0\x00', 0x6a) close(r0) r1 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000140)={0x42, 0x2, 0x1}, 0x10) mount$9p_fd(0x0, &(0x7f0000000300)='./file0\x00', &(0x7f00000002c0), 0x0, &(0x7f00000005c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}}) 643.940964ms ago: executing program 0 (id=210): r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0xc0802, 0x0) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f00000000c0)) pwritev(r0, &(0x7f0000000580)=[{&(0x7f0000000140)="67dc83e391", 0x5}, {&(0x7f0000000400)="f2", 0x1}], 0x2, 0x2, 0x7fffffff) 547.641486ms ago: executing program 0 (id=213): ioctl$KVM_SET_CPUID2(0xffffffffffffffff, 0x4008ae90, &(0x7f0000000000)={0x1, 0x0, [{0x40000001, 0x4, 0x2, 0x31237648, 0x6, 0x2, 0x80}]}) mount(0x0, 0x0, &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat$kvm(0xffffff9c, &(0x7f0000000180), 0x1a9502, 0x0) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)={0xfffff34, 0x0, [{0xf88e470f, 0xed}]}) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000200)={[0x2, 0x9, 0xfffffffffffffffd, 0x71, 0x2, 0x2, 0x2d7, 0x8000000000000000, 0x8000000000000000, 0x5, 0x0, 0x4, 0x401, 0x2, 0x5, 0x8d], 0xeeee8000, 0x284e17}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x4a282, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 500.439327ms ago: executing program 0 (id=217): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x100, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f000033d000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f00000001c0)="d8df7e23b3b9ce000000b807000000ba000000000f301b8154fea900b9b60a000080320000c4e28ddc8dcd000000c182fd3f0000c8b950020000b801000000b9a6080000b800000100ba000000000f300f300fc79d53bf0000c4b9e16dc301012202", 0xba}], 0x1, 0x10, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fdf000/0x18000)=nil, &(0x7f0000000240)=[@text16={0x10, 0x0}], 0x1, 0x13, 0x0, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) 396.42259ms ago: executing program 3 (id=220): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nfc(&(0x7f00000002c0), r1) r2 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000300), r1) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r0, &(0x7f0000002800)={0x0, 0x0, &(0x7f00000027c0)={&(0x7f0000002780)={0x14, r2, 0x1, 0x70bd2c, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x40}, 0x0) 364.692141ms ago: executing program 3 (id=221): mknodat$loop(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x1004, 0x1) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) syz_io_uring_setup(0x363, &(0x7f00000000c0)={0x0, 0xd057, 0x0, 0x3, 0x2b7, 0x0, r0}, &(0x7f0000000080), &(0x7f0000000180), &(0x7f0000000000)) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) write(r1, &(0x7f00000000c0), 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./config\x00', &(0x7f00000001c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/u/720p\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0x1ff) symlinkat(&(0x7f0000000380)='./config/usb_gadget/g1\x00', 0xffffffffffffff9c, &(0x7f00000003c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h/u\x00') symlinkat(0x0, 0xffffffffffffff9c, 0x0) symlinkat(&(0x7f0000000480)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f00000004c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/class/hs/h\x00') symlinkat(&(0x7f0000000500)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000540)='./config/usb_gadget/g1/functions/uvc.0/streaming/class/ss/h\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000580)='./config/usb_gadget/g1/functions/uvc.0/control/header/h\x00', 0x0) 363.605461ms ago: executing program 0 (id=229): openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x100, 0x0) r0 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x1) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r0, &(0x7f000033d000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f00000001c0)="d8df7e23b3b9ce000000b807000000ba000000000f301b8154fea900b9b60a000080320000c4e28ddc8dcd000000c182fd3f0000c8b950020000b801000000b9a6080000b800000100ba000000000f300f300fc79d53bf0000c4b9e16dc301012202", 0xba}], 0x1, 0x10, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r0, &(0x7f0000fdf000/0x18000)=nil, &(0x7f0000000240)=[@text16={0x10, 0x0}], 0x1, 0x13, 0x0, 0x0) ioctl$KVM_RUN(r0, 0xae80, 0x0) 317.015962ms ago: executing program 0 (id=222): r0 = gettid() timer_create(0x1, &(0x7f0000000800)={0x0, 0x21, 0x4, @tid=r0}, &(0x7f0000000000)) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x3ed4, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) timer_settime(0x0, 0x1, &(0x7f0000000040), 0x0) socketpair$unix(0x1, 0x1, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_clone(0x20000011, 0x0, 0xffffffffffffff99, 0x0, 0x0, 0x0) waitid(0x0, 0x0, 0x0, 0x4, 0x0) 315.821952ms ago: executing program 3 (id=223): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000240)={0x2, &(0x7f0000000140)=[{0x20, 0x0, 0x8, 0xfffff010}, {0x6, 0xba, 0x2, 0xefff}]}, 0x10) r1 = socket$inet6(0xa, 0x800000000000002, 0x0) setsockopt$inet6_udp_int(r1, 0x11, 0x67, &(0x7f0000000180)=0x7f, 0x4) connect$inet6(r1, &(0x7f00000001c0)={0xa, 0x4e23, 0x3, @mcast1, 0x2}, 0x1c) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @ipv4={'\x00', '\xff\xff', @multicast1}}, 0x1c) write(r1, &(0x7f0000000300)="89ba41c97928dec7cec15a160d3dba2553b519a795020072aed129d4b5247c983455b3d757e8b2333a64d9abf416fd83f942661c47bcdf71f7d07ba20d03474a4a4bce636ea8d2b882b2b49ef18e2a96e41f206d930eda2769c5ee6d5e3d541ce9a21c3ce5cb5fbdad9a45de000000000000000000", 0x75) 126.562767ms ago: executing program 2 (id=224): r0 = syz_open_dev$loop(&(0x7f0000000000), 0x55f2d9a4, 0x101000) ioctl$BLKSSZGET(r0, 0x1268, 0x0) 126.484516ms ago: executing program 3 (id=225): r0 = socket$packet(0x11, 0x3, 0x300) getsockopt$packet_buf(r0, 0x107, 0xd, 0x0, &(0x7f00000029c0)) 96.819957ms ago: executing program 2 (id=226): mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt\x00', 0x1ff) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f0000000100)='ext4\x00', 0x8410, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x40086607, 0x0) 95.800807ms ago: executing program 3 (id=227): mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x16) mount$overlay(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000b80), 0x8, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) mount$incfs(&(0x7f0000000440)='./file0\x00', &(0x7f0000000140)='./file0\x00', &(0x7f0000000200), 0x80, 0x0) 57.427168ms ago: executing program 1 (id=228): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000380)={0x0}, 0x1, 0x0, 0x0, 0x40000010}, 0x0) 83.29µs ago: executing program 2 (id=230): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NFC_CMD_GET_TARGET(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x0, 0x4}, 0x14}}, 0x0) syz_genetlink_get_family_id$nfc(&(0x7f00000002c0), 0xffffffffffffffff) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000300), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r0, &(0x7f0000002800)={0x0, 0x0, &(0x7f00000027c0)={&(0x7f0000002780)={0x14, r1, 0x1, 0x70bd2c, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x40}, 0x0) 0s ago: executing program 3 (id=231): openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x100, 0x0) r0 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x1) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r0, &(0x7f000033d000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f00000001c0)="d8df7e23b3b9ce000000b807000000ba000000000f301b8154fea900b9b60a000080320000c4e28ddc8dcd000000c182fd3f0000c8b950020000b801000000b9a6080000b800000100ba000000000f300f300fc79d53bf0000c4b9e16dc301012202", 0xba}], 0x1, 0x10, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r0, &(0x7f0000fdf000/0x18000)=nil, &(0x7f0000000240)=[@text16={0x10, 0x0}], 0x1, 0x13, 0x0, 0x0) ioctl$KVM_RUN(r0, 0xae80, 0x0) kernel console output (not intermixed with test programs): cess permissive=1 [ 21.212588][ T36] audit: type=1400 audit(1788364008.839:63): avc: denied { siginh } for pid=274 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 Warning: Permanently added '10.128.0.79' (ED25519) to the list of known hosts. [ 28.232551][ T36] audit: type=1400 audit(1788364015.869:64): avc: denied { mounton } for pid=286 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 28.233732][ T286] cgroup: Unknown subsys name 'net' [ 28.256443][ T36] audit: type=1400 audit(1788364015.869:65): avc: denied { mount } for pid=286 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 28.286210][ T36] audit: type=1400 audit(1788364015.899:66): avc: denied { unmount } for pid=286 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 28.286425][ T286] cgroup: Unknown subsys name 'devices' [ 28.407407][ T286] cgroup: Unknown subsys name 'hugetlb' [ 28.413173][ T286] cgroup: Unknown subsys name 'rlimit' [ 28.506152][ T36] audit: type=1400 audit(1788364016.149:67): avc: denied { setattr } for pid=286 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 28.531046][ T36] audit: type=1400 audit(1788364016.149:68): avc: denied { mounton } for pid=286 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 28.545027][ T288] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 28.556478][ T36] audit: type=1400 audit(1788364016.149:69): avc: denied { mount } for pid=286 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 28.590035][ T36] audit: type=1400 audit(1788364016.209:70): avc: denied { relabelto } for pid=288 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 28.618014][ T36] audit: type=1400 audit(1788364016.209:71): avc: denied { write } for pid=288 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 28.634416][ T286] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 28.646247][ T36] audit: type=1400 audit(1788364016.269:72): avc: denied { read } for pid=286 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 28.686088][ T36] audit: type=1400 audit(1788364016.269:73): avc: denied { open } for pid=286 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 29.497655][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.505031][ T294] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.513283][ T294] bridge_slave_0: entered allmulticast mode [ 29.520302][ T294] bridge_slave_0: entered promiscuous mode [ 29.527441][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.534841][ T294] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.542237][ T294] bridge_slave_1: entered allmulticast mode [ 29.548490][ T294] bridge_slave_1: entered promiscuous mode [ 29.591543][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.599132][ T293] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.606886][ T293] bridge_slave_0: entered allmulticast mode [ 29.613369][ T293] bridge_slave_0: entered promiscuous mode [ 29.620186][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.627380][ T293] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.634572][ T293] bridge_slave_1: entered allmulticast mode [ 29.641329][ T293] bridge_slave_1: entered promiscuous mode [ 29.651891][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.659887][ T296] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.667608][ T296] bridge_slave_0: entered allmulticast mode [ 29.674422][ T296] bridge_slave_0: entered promiscuous mode [ 29.683745][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.690972][ T296] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.698383][ T296] bridge_slave_1: entered allmulticast mode [ 29.704762][ T296] bridge_slave_1: entered promiscuous mode [ 29.789288][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.796537][ T295] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.804324][ T295] bridge_slave_0: entered allmulticast mode [ 29.810748][ T295] bridge_slave_0: entered promiscuous mode [ 29.820526][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.827834][ T295] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.835070][ T295] bridge_slave_1: entered allmulticast mode [ 29.841533][ T295] bridge_slave_1: entered promiscuous mode [ 29.908478][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.915766][ T293] bridge0: port 2(bridge_slave_1) entered forwarding state [ 29.923258][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.930666][ T293] bridge0: port 1(bridge_slave_0) entered forwarding state [ 29.943798][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.950882][ T294] bridge0: port 2(bridge_slave_1) entered forwarding state [ 29.958363][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.965585][ T294] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.024733][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.032009][ T296] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.039732][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.047466][ T296] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.057509][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.065894][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.073732][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.081699][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.089199][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.097355][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.111909][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.119254][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.133883][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.141408][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.162336][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.169768][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.188994][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.196677][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.234785][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.242057][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.250398][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.257978][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.277360][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.284690][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.298320][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.305578][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.315880][ T294] veth0_vlan: entered promiscuous mode [ 30.327710][ T293] veth0_vlan: entered promiscuous mode [ 30.349160][ T293] veth1_macvtap: entered promiscuous mode [ 30.363568][ T294] veth1_macvtap: entered promiscuous mode [ 30.412932][ T293] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 30.430014][ T295] veth0_vlan: entered promiscuous mode [ 30.440738][ T296] veth0_vlan: entered promiscuous mode [ 30.454447][ T295] veth1_macvtap: entered promiscuous mode [ 30.473064][ T313] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 30.507473][ T296] veth1_macvtap: entered promiscuous mode [ 30.629105][ T336] FAULT_INJECTION: forcing a failure. [ 30.629105][ T336] name failslab, interval 1, probability 0, space 0, times 0 [ 30.644188][ T336] CPU: 0 UID: 0 PID: 336 Comm: syz.1.9 Not tainted syzkaller #0 4b6b95ab3aff47ee35cef28a0a3a23749bede870 [ 30.644224][ T336] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 30.644243][ T336] Call Trace: [ 30.644249][ T336] [ 30.644258][ T336] __dump_stack+0x21/0x30 [ 30.644297][ T336] dump_stack_lvl+0x140/0x1c0 [ 30.644323][ T336] ? __cfi_dump_stack_lvl+0x10/0x10 [ 30.644349][ T336] ? kasan_save_alloc_info+0x3a/0x50 [ 30.644368][ T336] dump_stack+0x19/0x20 [ 30.644391][ T336] should_fail_ex+0x3c2/0x510 [ 30.644413][ T336] should_failslab+0xac/0x100 [ 30.644436][ T336] __kmalloc_node_noprof+0x69/0x500 [ 30.644456][ T336] ? __vmalloc_node_range_noprof+0x529/0x1300 [ 30.644483][ T336] __vmalloc_node_range_noprof+0x529/0x1300 [ 30.644506][ T336] ? stack_trace_save+0xaa/0x100 [ 30.644525][ T336] ? stack_depot_save_flags+0x38/0x800 [ 30.644546][ T336] ? kasan_save_alloc_info+0x3a/0x50 [ 30.644560][ T336] ? __cfi___vmalloc_node_range_noprof+0x10/0x10 [ 30.644584][ T336] ? kvm_set_memory_region+0x2f/0x50 [ 30.644602][ T336] ? kvm_vm_ioctl+0xb01/0xc40 [ 30.644627][ T336] ? __se_sys_ioctl+0x123/0x1b0 [ 30.644647][ T336] ? __x64_sys_ioctl+0x7f/0xa0 [ 30.644658][ T336] ? x64_sys_call+0x1878/0x2ee0 [ 30.644667][ T336] ? do_syscall_64+0x57/0xf0 [ 30.644682][ T336] ? entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 30.644694][ T336] ? __vcalloc_noprof+0x3a/0x50 [ 30.644704][ T336] __vmalloc_noprof+0x104/0x1d0 [ 30.644718][ T336] ? __vcalloc_noprof+0x3a/0x50 [ 30.644728][ T336] ? __cfi___vmalloc_noprof+0x10/0x10 [ 30.644743][ T336] __vcalloc_noprof+0x3a/0x50 [ 30.644752][ T336] kvm_arch_prepare_memory_region+0x2be/0xf80 [ 30.644771][ T336] kvm_set_memslot+0x59a/0x13a0 [ 30.644788][ T336] ? __kmalloc_cache_noprof+0x23c/0x470 [ 30.644800][ T336] __kvm_set_memory_region+0x7f7/0xb40 [ 30.644817][ T336] kvm_set_memory_region+0x2f/0x50 [ 30.644826][ T336] kvm_vm_ioctl+0xb01/0xc40 [ 30.644843][ T336] ? __cfi_kvm_vm_ioctl+0x10/0x10 [ 30.644857][ T336] ? ioctl_has_perm+0x1bc/0x500 [ 30.644867][ T336] ? __asan_memcpy+0x5a/0x80 [ 30.644877][ T336] ? ioctl_has_perm+0x408/0x500 [ 30.644888][ T336] ? __cfi_futex_wait+0x10/0x10 [ 30.644898][ T336] ? selinux_file_ioctl+0x732/0x1480 [ 30.644908][ T336] ? vfs_write+0xbcf/0xfd0 [ 30.644919][ T336] ? __cfi_selinux_file_ioctl+0x10/0x10 [ 30.644929][ T336] ? do_futex+0x32a/0x510 [ 30.644942][ T336] ? __cfi_do_futex+0x10/0x10 [ 30.644955][ T336] ? mutex_unlock+0x90/0x240 [ 30.644966][ T336] ? __fget_files+0x2bc/0x330 [ 30.644979][ T336] ? bpf_lsm_file_ioctl+0xd/0x20 [ 30.644992][ T336] ? security_file_ioctl+0x3e/0x110 [ 30.645001][ T336] ? __cfi_kvm_vm_ioctl+0x10/0x10 [ 30.645014][ T336] __se_sys_ioctl+0x123/0x1b0 [ 30.645026][ T336] __x64_sys_ioctl+0x7f/0xa0 [ 30.645038][ T336] x64_sys_call+0x1878/0x2ee0 [ 30.645047][ T336] do_syscall_64+0x57/0xf0 [ 30.645061][ T336] ? clear_bhb_loop+0x50/0xa0 [ 30.645072][ T336] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 30.645083][ T336] RIP: 0033:0x7f6a9fd9e159 [ 30.645100][ T336] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 30.645109][ T336] RSP: 002b:00007f6aa0bce028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 30.645128][ T336] RAX: ffffffffffffffda RBX: 00007f6aa0025fa0 RCX: 00007f6a9fd9e159 [ 30.645136][ T336] RDX: 0000200000000180 RSI: 000000004020ae46 RDI: 0000000000000005 [ 30.645144][ T336] RBP: 00007f6a9fe35024 R08: 0000000000000000 R09: 0000000000000000 [ 30.645151][ T336] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 30.645158][ T336] R13: 00007f6aa0026038 R14: 00007f6aa0025fa0 R15: 00007ffcb433de78 [ 30.645168][ T336] [ 31.042126][ T336] syz.1.9: vmalloc error: size 4096, failed to allocated page array size 8, mode:0x400dc2(GFP_KERNEL_ACCOUNT|__GFP_HIGHMEM|__GFP_ZERO), nodemask=(null),cpuset=syz1,mems_allowed=0 [ 31.063486][ T336] CPU: 1 UID: 0 PID: 336 Comm: syz.1.9 Not tainted syzkaller #0 4b6b95ab3aff47ee35cef28a0a3a23749bede870 [ 31.063520][ T336] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 31.063533][ T336] Call Trace: [ 31.063540][ T336] [ 31.063548][ T336] __dump_stack+0x21/0x30 [ 31.063581][ T336] dump_stack_lvl+0x140/0x1c0 [ 31.063607][ T336] ? __cfi_dump_stack_lvl+0x10/0x10 [ 31.063631][ T336] ? _raw_spin_unlock_irqrestore+0x4a/0x70 [ 31.063660][ T336] dump_stack+0x19/0x20 [ 31.063683][ T336] warn_alloc+0x1e7/0x2c0 [ 31.063708][ T336] ? __kasan_check_write+0x18/0x20 [ 31.063727][ T336] ? __cfi_warn_alloc+0x10/0x10 [ 31.063751][ T336] ? __kasan_kmalloc+0x28/0xb0 [ 31.063773][ T336] ? __kmalloc_node_noprof+0x252/0x500 [ 31.063793][ T336] ? __vmalloc_node_range_noprof+0x529/0x1300 [ 31.063821][ T336] __vmalloc_node_range_noprof+0x65f/0x1300 [ 31.063852][ T336] ? kasan_save_alloc_info+0x3a/0x50 [ 31.063869][ T336] ? __cfi___vmalloc_node_range_noprof+0x10/0x10 [ 31.063896][ T336] ? kvm_set_memory_region+0x2f/0x50 [ 31.063913][ T336] ? kvm_vm_ioctl+0xb01/0xc40 [ 31.063937][ T336] ? __se_sys_ioctl+0x123/0x1b0 [ 31.063959][ T336] ? __x64_sys_ioctl+0x7f/0xa0 [ 31.063980][ T336] ? x64_sys_call+0x1878/0x2ee0 [ 31.063997][ T336] ? do_syscall_64+0x57/0xf0 [ 31.064022][ T336] ? entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 31.064044][ T336] ? __vcalloc_noprof+0x3a/0x50 [ 31.064063][ T336] __vmalloc_noprof+0x104/0x1d0 [ 31.064089][ T336] ? __vcalloc_noprof+0x3a/0x50 [ 31.064107][ T336] ? __cfi___vmalloc_noprof+0x10/0x10 [ 31.064135][ T336] __vcalloc_noprof+0x3a/0x50 [ 31.064153][ T336] kvm_arch_prepare_memory_region+0x2be/0xf80 [ 31.064173][ T336] kvm_set_memslot+0x59a/0x13a0 [ 31.064199][ T336] ? __kmalloc_cache_noprof+0x23c/0x470 [ 31.064220][ T336] __kvm_set_memory_region+0x7f7/0xb40 [ 31.064257][ T336] kvm_set_memory_region+0x2f/0x50 [ 31.064274][ T336] kvm_vm_ioctl+0xb01/0xc40 [ 31.064300][ T336] ? __cfi_kvm_vm_ioctl+0x10/0x10 [ 31.064326][ T336] ? ioctl_has_perm+0x1bc/0x500 [ 31.064346][ T336] ? __asan_memcpy+0x5a/0x80 [ 31.064365][ T336] ? ioctl_has_perm+0x408/0x500 [ 31.064382][ T336] ? __cfi_futex_wait+0x10/0x10 [ 31.064402][ T336] ? selinux_file_ioctl+0x732/0x1480 [ 31.064421][ T336] ? vfs_write+0xbcf/0xfd0 [ 31.064442][ T336] ? __cfi_selinux_file_ioctl+0x10/0x10 [ 31.064461][ T336] ? do_futex+0x32a/0x510 [ 31.064485][ T336] ? __cfi_do_futex+0x10/0x10 [ 31.064507][ T336] ? mutex_unlock+0x90/0x240 [ 31.064529][ T336] ? __fget_files+0x2bc/0x330 [ 31.064551][ T336] ? bpf_lsm_file_ioctl+0xd/0x20 [ 31.064574][ T336] ? security_file_ioctl+0x3e/0x110 [ 31.064592][ T336] ? __cfi_kvm_vm_ioctl+0x10/0x10 [ 31.064616][ T336] __se_sys_ioctl+0x123/0x1b0 [ 31.064639][ T336] __x64_sys_ioctl+0x7f/0xa0 [ 31.064660][ T336] x64_sys_call+0x1878/0x2ee0 [ 31.064677][ T336] do_syscall_64+0x57/0xf0 [ 31.064702][ T336] ? clear_bhb_loop+0x50/0xa0 [ 31.064723][ T336] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 31.064743][ T336] RIP: 0033:0x7f6a9fd9e159 [ 31.064760][ T336] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 31.064776][ T336] RSP: 002b:00007f6aa0bce028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 31.064797][ T336] RAX: ffffffffffffffda RBX: 00007f6aa0025fa0 RCX: 00007f6a9fd9e159 [ 31.064813][ T336] RDX: 0000200000000180 RSI: 000000004020ae46 RDI: 0000000000000005 [ 31.064826][ T336] RBP: 00007f6a9fe35024 R08: 0000000000000000 R09: 0000000000000000 [ 31.064839][ T336] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 31.064851][ T336] R13: 00007f6aa0026038 R14: 00007f6aa0025fa0 R15: 00007ffcb433de78 [ 31.064868][ T336] [ 31.064889][ T336] Mem-Info: [ 31.175337][ T10] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 31.181513][ T336] active_anon:5350 inactive_anon:0 isolated_anon:0 [ 31.181513][ T336] active_file:5547 inactive_file:2285 isolated_file:0 [ 31.181513][ T336] unevictable:0 dirty:1450 writeback:0 [ 31.181513][ T336] slab_reclaimable:3769 slab_unreclaimable:70940 [ 31.181513][ T336] mapped:23844 shmem:163 pagetables:790 [ 31.181513][ T336] sec_pagetables:3 bounce:0 [ 31.181513][ T336] kernel_misc_reclaimable:0 [ 31.181513][ T336] free:1549049 free_pcp:1762 free_cma:0 [ 31.195246][ T310] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 31.199488][ T336] Node 0 active_anon:21400kB inactive_anon:0kB active_file:22188kB inactive_file:9140kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:95376kB dirty:5800kB writeback:0kB shmem:652kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:4192kB pagetables:3052kB sec_pagetables:12kB all_unreclaimable? no [ 31.336164][ T10] usb 4-1: Using ep0 maxpacket: 16 [ 31.340132][ T336] DMA32 free:2958164kB boost:0kB min:19080kB low:23848kB high:28616kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:3145324kB managed:2963384kB mlocked:0kB bounce:0kB free_pcp:5220kB local_pcp:0kB free_cma:0kB [ 31.353837][ T10] usb 4-1: config 0 interface 0 altsetting 16 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 31.358366][ T336] lowmem_reserve[]: [ 31.363529][ T10] usb 4-1: config 0 interface 0 altsetting 16 endpoint 0x81 has invalid wMaxPacketSize 0 [ 31.370007][ T336] 0 [ 31.374515][ T10] usb 4-1: config 0 interface 0 altsetting 16 has 1 endpoint descriptor, different from the interface descriptor's value: 28 [ 31.395110][ T336] 3921 [ 31.403705][ T10] usb 4-1: config 0 interface 0 has no altsetting 0 [ 31.413646][ T336] 3921 [ 31.425244][ T10] usb 4-1: New USB device found, idVendor=056a, idProduct=0331, bcdDevice= 0.00 [ 31.432147][ T336] [ 31.443321][ T10] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 31.447647][ T336] Normal free:3238020kB boost:0kB min:25972kB low:32464kB high:38956kB reserved_highatomic:0KB free_highatomic:0KB active_anon:21300kB inactive_anon:0kB active_file:22188kB inactive_file:9140kB unevictable:0kB writepending:5800kB present:5242880kB managed:4015864kB mlocked:0kB bounce:0kB free_pcp:2528kB local_pcp:2116kB free_cma:0kB [ 31.448080][ T310] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 31.451203][ T336] lowmem_reserve[]: [ 31.493269][ T10] usb 4-1: config 0 descriptor?? [ 31.505534][ T336] 0 [ 31.516977][ T310] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 1.00 [ 31.546590][ T336] 0 [ 31.552521][ T310] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 31.583148][ T336] 0 [ 31.601123][ T310] usb 3-1: Product: syz [ 31.608433][ T336] [ 31.612027][ T310] usb 3-1: Manufacturer: syz [ 31.625380][ T336] DMA32: [ 31.635371][ T310] usb 3-1: SerialNumber: syz [ 31.635722][ T336] 5*4kB [ 31.651134][ T310] cdc_wdm 3-1:1.0: cdc-wdm0: USB WDM device [ 31.659817][ T336] (M) [ 31.694789][ T310] cdc_wdm 3-1:1.0: Unknown control protocol [ 31.704993][ T336] 2*8kB (M) 3*16kB (M) 6*32kB (M) 3*64kB (M) 5*128kB (M) 5*256kB (M) 5*512kB (M) 4*1024kB (UM) 4*2048kB (M) 718*4096kB (M) = 2958164kB [ 31.791901][ T336] Normal: 2*4kB (UE) 1*8kB (U) 4*16kB (UME) 4*32kB (UE) 5*64kB (ME) 43*128kB (UME) 36*256kB (UME) 20*512kB (ME) 8*1024kB (ME) 3*2048kB (M) 780*4096kB (M) = 3234704kB [ 31.809884][ T336] 8134 total pagecache pages [ 31.814504][ T336] 0 pages in swap cache [ 31.819176][ T336] Free swap = 124996kB [ 31.823600][ T336] Total swap = 124996kB [ 31.827915][ T336] 2097051 pages RAM [ 31.831726][ T336] 0 pages HighMem/MovableOnly [ 31.836865][ T336] 352239 pages reserved [ 31.841109][ T336] 0 pages cma reserved [ 31.847344][ T336] Memory allocations: [ 31.851887][ T336] 0 B 0 init/main.c:1477 func:do_initcalls [ 31.859304][ T330] overlayfs: missing 'lowerdir' [ 31.859898][ T336] 0 B 0 init/do_mounts.c:186 func:mount_root_generic [ 31.873284][ T336] 0 B 0 init/do_mounts.c:158 func:do_mount_root [ 31.881131][ T336] 0 B 0 init/do_mounts.c:352 func:mount_nodev_root [ 31.890236][ T336] 0 B 0 init/do_mounts_rd.c:241 func:rd_load_image [ 31.898570][ T336] 0 B 0 init/do_mounts_rd.c:72 func:identify_ramdisk_image [ 31.908055][ T336] 0 B 0 init/initramfs.c:507 func:unpack_to_rootfs [ 31.916552][ T336] 0 B 0 init/initramfs.c:508 func:unpack_to_rootfs [ 31.920276][ T328] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 31.924812][ T336] 0 B 0 init/initramfs.c:509 func:unpack_to_rootfs [ 31.924837][ T336] 0 B 0 init/initramfs.c:101 func:find_link [ 31.934033][ T328] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 31.963572][ T10] hid (null): unknown global tag 0xe [ 31.969535][ T10] hid (null): global environment stack underflow [ 31.976486][ T10] hid (null): invalid report_count 1106939437 [ 31.982793][ T10] hid (null): unknown global tag 0xd [ 32.175649][ T31] usb 4-1: USB disconnect, device number 2 [ 32.246938][ T358] FAULT_INJECTION: forcing a failure. [ 32.246938][ T358] name failslab, interval 1, probability 0, space 0, times 0 [ 32.260992][ T358] CPU: 0 UID: 0 PID: 358 Comm: syz.1.17 Not tainted syzkaller #0 4b6b95ab3aff47ee35cef28a0a3a23749bede870 [ 32.261023][ T358] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 32.261034][ T358] Call Trace: [ 32.261040][ T358] [ 32.261047][ T358] __dump_stack+0x21/0x30 [ 32.261078][ T358] dump_stack_lvl+0x140/0x1c0 [ 32.261100][ T358] ? __cfi_dump_stack_lvl+0x10/0x10 [ 32.261123][ T358] dump_stack+0x19/0x20 [ 32.261143][ T358] should_fail_ex+0x3c2/0x510 [ 32.261163][ T358] ? kobject_get_path+0xc3/0x2d0 [ 32.261186][ T358] should_failslab+0xac/0x100 [ 32.261207][ T358] __kmalloc_noprof+0x69/0x510 [ 32.261224][ T358] ? kasan_save_alloc_info+0x3a/0x50 [ 32.261240][ T358] ? kobject_get_path+0xc3/0x2d0 [ 32.261261][ T358] ? __kasan_kmalloc+0x96/0xb0 [ 32.261281][ T358] kobject_get_path+0xc3/0x2d0 [ 32.261303][ T358] kobject_uevent_env+0x2bc/0x7e0 [ 32.261321][ T358] kobject_uevent+0x21/0x40 [ 32.261336][ T358] __kobject_del+0xd3/0x2c0 [ 32.261358][ T358] kobject_put+0x1ff/0x2a0 [ 32.261380][ T358] net_rx_queue_update_kobjects+0x535/0x5b0 [ 32.261405][ T358] netdev_unregister_kobject+0xf7/0x260 [ 32.261427][ T358] unregister_netdevice_many_notify+0x1678/0x1be0 [ 32.261445][ T358] ? avc_has_extended_perms+0x7fb/0xe60 [ 32.261467][ T358] ? __cfi_unregister_netdevice_many_notify+0x10/0x10 [ 32.261486][ T358] ? cred_has_capability+0x296/0x3a0 [ 32.261503][ T358] ? arch_stack_walk+0x10a/0x170 [ 32.261520][ T358] ? selinux_perf_event_alloc+0x110/0x110 [ 32.261538][ T358] ? __kasan_check_read+0x15/0x20 [ 32.261555][ T358] unregister_netdevice_queue+0x302/0x350 [ 32.261578][ T358] ? selinux_capable+0x38/0x50 [ 32.261598][ T358] ? __cfi_unregister_netdevice_queue+0x10/0x10 [ 32.261616][ T358] ? ns_capable+0x90/0xf0 [ 32.261631][ T358] ip6_tnl_siocdevprivate+0x47f/0xe70 [ 32.261653][ T358] ? __cfi_ip6_tnl_siocdevprivate+0x10/0x10 [ 32.261675][ T358] ? proc_fail_nth_write+0x184/0x220 [ 32.261700][ T358] ? full_name_hash+0xa1/0xf0 [ 32.261721][ T358] dev_ifsioc+0x94e/0xc10 [ 32.261740][ T358] dev_ioctl+0xa62/0x1000 [ 32.261759][ T358] sock_ioctl+0x74e/0x7e0 [ 32.261774][ T358] ? __cfi_sock_ioctl+0x10/0x10 [ 32.261798][ T358] ? __fget_files+0x2bc/0x330 [ 32.261819][ T358] ? bpf_lsm_file_ioctl+0xd/0x20 [ 32.261839][ T358] ? security_file_ioctl+0x3e/0x110 [ 32.261855][ T358] ? __cfi_sock_ioctl+0x10/0x10 [ 32.261877][ T358] __se_sys_ioctl+0x123/0x1b0 [ 32.261897][ T358] __x64_sys_ioctl+0x7f/0xa0 [ 32.261916][ T358] x64_sys_call+0x1878/0x2ee0 [ 32.261931][ T358] do_syscall_64+0x57/0xf0 [ 32.261954][ T358] ? clear_bhb_loop+0x50/0xa0 [ 32.261973][ T358] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 32.261991][ T358] RIP: 0033:0x7f6a9fd9e159 [ 32.262006][ T358] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 32.262019][ T358] RSP: 002b:00007f6aa0bce028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 32.262039][ T358] RAX: ffffffffffffffda RBX: 00007f6aa0025fa0 RCX: 00007f6a9fd9e159 [ 32.262052][ T358] RDX: 0000200000000880 RSI: 00000000000089f2 RDI: 0000000000000003 [ 32.262063][ T358] RBP: 00007f6aa0bce090 R08: 0000000000000000 R09: 0000000000000000 [ 32.262074][ T358] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 32.262085][ T358] R13: 00007f6aa0026038 R14: 00007f6aa0025fa0 R15: 00007ffcb433de78 [ 32.262099][ T358] [ 33.109350][ T377] netlink: 228 bytes leftover after parsing attributes in process `syz.1.25'. [ 33.267424][ T36] kauditd_printk_skb: 77 callbacks suppressed [ 33.267450][ T36] audit: type=1400 audit(1788364020.909:151): avc: denied { create } for pid=381 comm="syz.3.27" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 33.301111][ T36] audit: type=1400 audit(1788364020.939:152): avc: denied { bind } for pid=381 comm="syz.3.27" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 33.361247][ T36] audit: type=1400 audit(1788364020.999:153): avc: denied { write } for pid=383 comm="syz.3.28" name="event0" dev="devtmpfs" ino=192 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 33.395096][ T36] audit: type=1400 audit(1788364020.999:154): avc: denied { open } for pid=383 comm="syz.3.28" path="/dev/input/event0" dev="devtmpfs" ino=192 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 33.426622][ T36] audit: type=1400 audit(1788364021.029:155): avc: denied { ioctl } for pid=383 comm="syz.3.28" path="/dev/input/event0" dev="devtmpfs" ino=192 ioctlcmd=0x45a0 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 33.453971][ T36] audit: type=1400 audit(1788364021.049:156): avc: denied { ioctl } for pid=385 comm="syz.3.29" path="socket:[3978]" dev="sockfs" ino=3978 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 33.478395][ T390] incfs: Options parsing error. -22 [ 33.486107][ T390] incfs: mount failed -22 [ 33.797841][ T36] audit: type=1400 audit(1788364021.269:157): avc: denied { unmount } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 33.835992][ T36] audit: type=1400 audit(1788364021.479:158): avc: denied { read write } for pid=399 comm="syz.0.34" name="mtrr" dev="proc" ino=4026532004 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mtrr_device_t tclass=file permissive=1 [ 33.869615][ T36] audit: type=1400 audit(1788364021.479:159): avc: denied { open } for pid=399 comm="syz.0.34" path="/7/proc/mtrr" dev="proc" ino=4026532004 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mtrr_device_t tclass=file permissive=1 [ 33.902857][ T31] usb 3-1: USB disconnect, device number 2 [ 33.931598][ T36] audit: type=1400 audit(1788364021.569:160): avc: denied { write } for pid=410 comm="syz.1.40" name="idProduct" dev="configfs" ino=4485 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=file permissive=1 [ 34.030331][ T427] capability: warning: `syz.0.47' uses deprecated v2 capabilities in a way that may be insecure [ 34.229627][ T437] netlink: 45 bytes leftover after parsing attributes in process `syz.0.51'. [ 34.385294][ T395] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 34.566389][ T395] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x2 has an invalid bInterval 0, changing to 7 [ 34.578186][ T395] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 34.588355][ T395] usb 3-1: New USB device found, idVendor=046d, idProduct=c222, bcdDevice= 0.00 [ 34.588918][ T468] FAULT_INJECTION: forcing a failure. [ 34.588918][ T468] name failslab, interval 1, probability 0, space 0, times 0 [ 34.597905][ T395] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 34.611510][ T468] CPU: 0 UID: 0 PID: 468 Comm: syz.0.65 Not tainted syzkaller #0 4b6b95ab3aff47ee35cef28a0a3a23749bede870 [ 34.611542][ T468] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 34.611554][ T468] Call Trace: [ 34.611560][ T468] [ 34.611568][ T468] __dump_stack+0x21/0x30 [ 34.611602][ T468] dump_stack_lvl+0x140/0x1c0 [ 34.611628][ T468] ? __cfi_dump_stack_lvl+0x10/0x10 [ 34.611654][ T468] ? avc_has_perm+0x155/0x240 [ 34.611676][ T468] dump_stack+0x19/0x20 [ 34.611699][ T468] should_fail_ex+0x3c2/0x510 [ 34.611721][ T468] should_failslab+0xac/0x100 [ 34.611744][ T468] kmem_cache_alloc_lru_noprof+0x44/0x410 [ 34.611763][ T468] ? selinux_socket_create+0x188/0x290 [ 34.611785][ T468] ? sock_alloc_inode+0x48/0x150 [ 34.611805][ T468] sock_alloc_inode+0x48/0x150 [ 34.611821][ T468] ? __cfi_sock_alloc_inode+0x10/0x10 [ 34.611838][ T468] alloc_inode+0x7a/0x270 [ 34.611861][ T468] ? bpf_lsm_socket_create+0xd/0x20 [ 34.611881][ T468] new_inode_pseudo+0x19/0x40 [ 34.611903][ T468] __sock_create+0x130/0x810 [ 34.611923][ T468] __sys_socketpair+0x1aa/0x5c0 [ 34.611942][ T468] __x64_sys_socketpair+0x9f/0xc0 [ 34.611963][ T468] x64_sys_call+0x2081/0x2ee0 [ 34.611979][ T468] do_syscall_64+0x57/0xf0 [ 34.612004][ T468] ? clear_bhb_loop+0x50/0xa0 [ 34.612025][ T468] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 34.612044][ T468] RIP: 0033:0x7f42fa59e159 [ 34.612061][ T468] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 34.612075][ T468] RSP: 002b:00007f42f8ff7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000035 [ 34.612095][ T468] RAX: ffffffffffffffda RBX: 00007f42fa825fa0 RCX: 00007f42fa59e159 [ 34.612109][ T468] RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000001 [ 34.612121][ T468] RBP: 00007f42fa635024 R08: 0000000000000000 R09: 0000000000000000 [ 34.612133][ T468] R10: 0000200000000280 R11: 0000000000000246 R12: 0000000000000000 [ 34.612145][ T468] R13: 00007f42fa826038 R14: 00007f42fa825fa0 R15: 00007fff59064468 [ 34.612161][ T468] [ 34.612190][ T468] socket: no more sockets [ 35.045469][ T395] lg-g15 0003:046D:C222.0002: hidraw0: USB HID v1.11 Device [HID 046d:c222] on usb-dummy_hcd.2-1/input0 [ 35.125385][ T395] lg-g15 0003:046D:C222.0002: Error -90 disabling keyboard emulation for the G-keys, falling back to generic hid-input driver [ 35.248215][ T331] usb 3-1: USB disconnect, device number 3 [ 35.530853][ T507] netlink: 76 bytes leftover after parsing attributes in process `syz.1.81'. [ 35.540463][ T507] netlink: 32 bytes leftover after parsing attributes in process `syz.1.81'. [ 35.549779][ T507] tipc: Invalid UDP bearer configuration [ 35.549803][ T507] tipc: Enabling of bearer rejected, failed to enable media [ 35.806744][ T517] syz.1.85 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 35.932770][ T531] mmap: syz.3.91 (531) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 36.007875][ T536] input: syz1 as /devices/virtual/input/input5 [ 36.485259][ T331] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 36.525402][ T395] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 36.636443][ T331] usb 2-1: config 127 has an invalid interface number: 57 but max is 0 [ 36.645244][ T331] usb 2-1: config 127 has an invalid descriptor of length 0, skipping remainder of the config [ 36.656043][ T331] usb 2-1: config 127 has no interface number 0 [ 36.664523][ T331] usb 2-1: New USB device found, idVendor=0df6, idProduct=0056, bcdDevice=d2.4b [ 36.674546][ T331] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 36.684323][ T331] usb 2-1: Product: syz [ 36.685242][ T395] usb 4-1: Using ep0 maxpacket: 16 [ 36.689192][ T331] usb 2-1: Manufacturer: syz [ 36.696461][ T395] usb 4-1: config 0 interface 0 altsetting 16 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 36.699418][ T331] usb 2-1: SerialNumber: syz [ 36.711692][ T395] usb 4-1: config 0 interface 0 altsetting 16 endpoint 0x81 has invalid wMaxPacketSize 0 [ 36.718933][ T331] asix 2-1:127.57: probe with driver asix failed with error -22 [ 36.726771][ T395] usb 4-1: config 0 interface 0 altsetting 16 has 1 endpoint descriptor, different from the interface descriptor's value: 28 [ 36.748927][ T395] usb 4-1: config 0 interface 0 has no altsetting 0 [ 36.755851][ T395] usb 4-1: New USB device found, idVendor=056a, idProduct=0331, bcdDevice= 0.00 [ 36.766291][ T395] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 36.775416][ T395] usb 4-1: config 0 descriptor?? [ 36.928645][ T310] usb 2-1: USB disconnect, device number 3 [ 37.327265][ T616] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 37.327286][ T616] rust_binder: Read failure Err(EFAULT) in pid:56 [ 37.336009][ T395] rust_binder: 615: undelivered death notification, 0000000000000000 [ 37.389990][ T395] usb 4-1: USB disconnect, device number 3 [ 37.779187][ T651] kvm: kvm [650]: vcpu2, guest rIP: 0x9135 Unhandled WRMSR(0xc1) = 0xfffffc00 [ 37.789514][ T651] kvm: kvm [650]: vcpu2, guest rIP: 0x9135 Unhandled WRMSR(0xc2) = 0xfffffc00 [ 37.801670][ T651] kvm: kvm [650]: vcpu2, guest rIP: 0x9135 Unhandled WRMSR(0x11e) = 0xfffffc00 [ 37.814495][ T651] kvm: kvm [650]: vcpu2, guest rIP: 0x9135 Unhandled WRMSR(0x186) = 0xfffffc00 [ 37.824465][ T651] kvm: kvm [650]: vcpu2, guest rIP: 0x9135 Unhandled WRMSR(0x187) = 0xfffffc00 [ 38.054128][ T669] input: syz0 as /devices/virtual/input/input6 [ 38.301179][ T696] input: syz0 as /devices/virtual/input/input7 [ 38.335451][ T310] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 38.490564][ T36] kauditd_printk_skb: 58 callbacks suppressed [ 38.490581][ T36] audit: type=1400 audit(1788364026.129:219): avc: denied { read } for pid=706 comm="syz.1.168" path="socket:[5700]" dev="sockfs" ino=5700 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 38.541484][ T310] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 38.552993][ T310] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 9326, setting to 1024 [ 38.572959][ T310] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 38.587014][ T310] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 38.596383][ T310] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 38.605620][ T310] usb 4-1: config 0 descriptor?? [ 38.611487][ T671] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 38.620672][ T726] input: syz0 as /devices/virtual/input/input8 [ 38.786547][ T36] audit: type=1400 audit(1788364026.429:220): avc: denied { watch watch_reads } for pid=734 comm="syz.0.179" path="/52/file0" dev="tmpfs" ino=286 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 38.983612][ T749] input: syz0 as /devices/virtual/input/input9 [ 39.025067][ T310] plantronics 0003:047F:FFFF.0004: unknown main item tag 0x0 [ 39.033825][ T310] plantronics 0003:047F:FFFF.0004: unknown main item tag 0x0 [ 39.051075][ T310] plantronics 0003:047F:FFFF.0004: unknown main item tag 0x0 [ 39.058935][ T310] plantronics 0003:047F:FFFF.0004: unknown main item tag 0x0 [ 39.066897][ T310] plantronics 0003:047F:FFFF.0004: unknown main item tag 0x0 [ 39.078807][ T310] plantronics 0003:047F:FFFF.0004: unknown main item tag 0x0 [ 39.095267][ T310] plantronics 0003:047F:FFFF.0004: unknown main item tag 0x0 [ 39.104150][ T310] plantronics 0003:047F:FFFF.0004: unknown main item tag 0x0 [ 39.112786][ T310] plantronics 0003:047F:FFFF.0004: unknown main item tag 0x0 [ 39.120485][ T310] plantronics 0003:047F:FFFF.0004: No inputs registered, leaving [ 39.129955][ T310] plantronics 0003:047F:FFFF.0004: hiddev96,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.3-1/input0 [ 39.210334][ T36] audit: type=1400 audit(1788364026.849:221): avc: denied { mount } for pid=771 comm="syz.0.195" name="/" dev="configfs" ino=925 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=filesystem permissive=1 [ 39.237985][ T36] audit: type=1400 audit(1788364026.879:222): avc: denied { create } for pid=771 comm="syz.0.195" name="u" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:configfs_t tclass=lnk_file permissive=1 [ 39.272507][ T36] audit: type=1400 audit(1788364026.909:223): avc: denied { unmount } for pid=293 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=filesystem permissive=1 [ 39.314447][ T778] netlink: 'syz.0.197': attribute type 3 has an invalid length. [ 39.324111][ T36] audit: type=1400 audit(1788364026.959:224): avc: denied { read write } for pid=776 comm="syz.0.197" name="vhost-vsock" dev="devtmpfs" ino=200 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 39.356804][ T310] usb 4-1: USB disconnect, device number 4 [ 39.381913][ T36] audit: type=1400 audit(1788364026.959:225): avc: denied { open } for pid=776 comm="syz.0.197" path="/dev/vhost-vsock" dev="devtmpfs" ino=200 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 39.413951][ T36] audit: type=1400 audit(1788364026.959:226): avc: denied { ioctl } for pid=776 comm="syz.0.197" path="/dev/vhost-vsock" dev="devtmpfs" ino=200 ioctlcmd=0xaf01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 39.477964][ T36] audit: type=1400 audit(1788364027.119:227): avc: denied { read write } for pid=783 comm="syz.2.200" name="ptp0" dev="devtmpfs" ino=196 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 39.504874][ T36] audit: type=1400 audit(1788364027.119:228): avc: denied { open } for pid=783 comm="syz.2.200" path="/dev/ptp0" dev="devtmpfs" ino=196 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 39.887723][ T807] Zero length message leads to an empty skb [ 40.498412][ T296] ------------[ cut here ]------------ [ 40.504119][ T296] WARNING: CPU: 0 PID: 296 at fs/overlayfs/util.c:605 ovl_dir_modified+0x15a/0x190 [ 40.513697][ T296] Modules linked in: [ 40.517714][ T296] CPU: 0 UID: 0 PID: 296 Comm: syz-executor Not tainted syzkaller #0 4b6b95ab3aff47ee35cef28a0a3a23749bede870 [ 40.529428][ T296] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 40.539984][ T296] RIP: 0010:ovl_dir_modified+0x15a/0x190 [ 40.545854][ T296] Code: c1 e8 03 42 80 3c 28 00 74 08 4c 89 f7 e8 8e 70 97 ff 49 ff 06 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc e8 06 96 3e ff <0f> 0b e9 3e ff ff ff e8 fa 95 3e ff 0f 0b e9 6e ff ff ff 44 89 f9 [ 40.566054][ T296] RSP: 0018:ffffc9000b69fb88 EFLAGS: 00010293 [ 40.572419][ T296] RAX: ffffffff8248e13a RBX: 0000000000000000 RCX: ffff888125634c00 [ 40.580752][ T296] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 40.589258][ T296] RBP: ffffc9000b69fbb0 R08: ffff888110e047ff R09: 1ffff110221c08ff [ 40.597629][ T296] R10: dffffc0000000000 R11: ffffed10221c0900 R12: 0000000000000000 [ 40.605823][ T296] R13: dffffc0000000000 R14: ffff888110e04760 R15: ffff88811668f220 [ 40.613990][ T296] FS: 000055555bf85500(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 40.623184][ T296] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 40.629973][ T296] CR2: 000055555bfb0998 CR3: 0000000125614000 CR4: 00000000003526b0 [ 40.638858][ T296] Call Trace: [ 40.642505][ T296] [ 40.645769][ T296] ovl_do_remove+0x824/0xd10 [ 40.650845][ T296] ? ovl_set_redirect+0x780/0x780 [ 40.656205][ T296] ? __cfi_down_write+0x10/0x10 [ 40.661353][ T296] ovl_rmdir+0x1e/0x30 [ 40.665662][ T296] vfs_rmdir+0x3db/0x560 [ 40.670189][ T296] incfs_kill_sb+0x102/0x220 [ 40.675063][ T296] deactivate_locked_super+0xd2/0x270 [ 40.680594][ T296] deactivate_super+0xb8/0xe0 [ 40.685939][ T296] cleanup_mnt+0x438/0x4d0 [ 40.690649][ T296] __cleanup_mnt+0x1d/0x40 [ 40.696256][ T296] task_work_run+0x1e5/0x260 [ 40.701191][ T296] ? __cfi_task_work_run+0x10/0x10 [ 40.706565][ T296] ? __x64_sys_umount+0x12e/0x180 [ 40.711866][ T296] ? __cfi___x64_sys_umount+0x10/0x10 [ 40.717742][ T296] ? __kasan_check_read+0x15/0x20 [ 40.722959][ T296] resume_user_mode_work+0x35/0x50 [ 40.728242][ T296] syscall_exit_to_user_mode+0x63/0xb0 [ 40.733729][ T296] do_syscall_64+0x63/0xf0 [ 40.738297][ T296] ? clear_bhb_loop+0x50/0xa0 [ 40.743271][ T296] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 40.749611][ T296] RIP: 0033:0x7f91a1d9f397 [ 40.754509][ T296] Code: a2 c7 05 5c 43 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 40.774635][ T296] RSP: 002b:00007ffc432cbe78 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 40.783581][ T296] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f91a1d9f397 [ 40.792402][ T296] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffc432cbf30 [ 40.801118][ T296] RBP: 00007ffc432cbf30 R08: 00007ffc432ccf30 R09: 00000000ffffffff [ 40.809238][ T296] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffc432ccfc0 [ 40.817787][ T296] R13: 00007f91a1e34474 R14: 0000000000009e0c R15: 00007ffc432cd000 [ 40.826547][ T296] [ 40.829665][ T296] ---[ end trace 0000000000000000 ]--- [ 40.838829][ T296] ------------[ cut here ]------------ [ 40.844575][ T296] WARNING: CPU: 0 PID: 296 at fs/overlayfs/util.c:605 ovl_dir_modified+0x15a/0x190 [ 40.854172][ T296] Modules linked in: [ 40.858102][ T296] CPU: 0 UID: 0 PID: 296 Comm: syz-executor Tainted: G W syzkaller #0 4b6b95ab3aff47ee35cef28a0a3a23749bede870 [ 40.871616][ T296] Tainted: [W]=WARN [ 40.875715][ T296] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 40.886270][ T296] RIP: 0010:ovl_dir_modified+0x15a/0x190 [ 40.891922][ T296] Code: c1 e8 03 42 80 3c 28 00 74 08 4c 89 f7 e8 8e 70 97 ff 49 ff 06 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc e8 06 96 3e ff <0f> 0b e9 3e ff ff ff e8 fa 95 3e ff 0f 0b e9 6e ff ff ff 44 89 f9 [ 40.911950][ T296] RSP: 0018:ffffc9000b69fb88 EFLAGS: 00010293 [ 40.918233][ T296] RAX: ffffffff8248e13a RBX: 0000000000000000 RCX: ffff888125634c00 [ 40.926545][ T296] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 40.935227][ T296] RBP: ffffc9000b69fbb0 R08: ffff888110e047ff R09: 1ffff110221c08ff [ 40.944004][ T296] R10: dffffc0000000000 R11: ffffed10221c0900 R12: 0000000000000000 [ 40.952755][ T296] R13: dffffc0000000000 R14: ffff888110e04760 R15: ffff88811668f220 [ 40.961317][ T296] FS: 000055555bf85500(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 40.970660][ T296] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 40.977478][ T296] CR2: 000055555bfb0998 CR3: 0000000125614000 CR4: 00000000003526b0 [ 40.985888][ T296] Call Trace: [ 40.989450][ T296] [ 40.992398][ T296] ovl_do_remove+0x824/0xd10 [ 40.997062][ T296] ? ovl_set_redirect+0x780/0x780 [ 41.002213][ T296] ? __cfi_down_write+0x10/0x10 [ 41.007398][ T296] ovl_rmdir+0x1e/0x30 [ 41.011627][ T296] vfs_rmdir+0x3db/0x560 [ 41.016294][ T296] incfs_kill_sb+0x197/0x220 [ 41.021147][ T296] deactivate_locked_super+0xd2/0x270 [ 41.026856][ T296] deactivate_super+0xb8/0xe0 [ 41.031746][ T296] cleanup_mnt+0x438/0x4d0 [ 41.036483][ T296] __cleanup_mnt+0x1d/0x40 [ 41.041398][ T296] task_work_run+0x1e5/0x260 [ 41.046247][ T296] ? __cfi_task_work_run+0x10/0x10 [ 41.051669][ T296] ? __x64_sys_umount+0x12e/0x180 [ 41.057058][ T296] ? __cfi___x64_sys_umount+0x10/0x10 [ 41.062720][ T296] ? __kasan_check_read+0x15/0x20 [ 41.067828][ T296] resume_user_mode_work+0x35/0x50 [ 41.073083][ T296] syscall_exit_to_user_mode+0x63/0xb0 [ 41.078730][ T296] do_syscall_64+0x63/0xf0 [ 41.083269][ T296] ? clear_bhb_loop+0x50/0xa0 [ 41.088422][ T296] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 41.094533][ T296] RIP: 0033:0x7f91a1d9f397 [ 41.099256][ T296] Code: a2 c7 05 5c 43 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 41.119901][ T296] RSP: 002b:00007ffc432cbe78 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 41.128561][ T296] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f91a1d9f397 [ 41.137031][ T296] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffc432cbf30 [ 41.145237][ T296] RBP: 00007ffc432cbf30 R08: 00007ffc432ccf30 R09: 00000000ffffffff [ 41.153395][ T296] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffc432ccfc0 [ 41.162118][ T296] R13: 00007f91a1e34474 R14: 0000000000009e0c R15: 00007ffc432cd000 [ 41.170653][ T296] [ 41.173691][ T296] ---[ end trace 0000000000000000 ]---